In space there is no definite location, only in relation to everyone else in the space — you are located by who you are connected to.
September 11, 2001 event – Uncloaking Terrorist Networks
Source: Valdis Krebs (http://orgnet.com)
Data Gathering – Within one week of the attack, information from the investigation started to become public. We soon knew there were 19 hijackers, which planes they were on, and which nation’s passports they had used to get into America. As more information about the hijackers’ past was uncovered the investigators decided to map links of three strengths (and corresponding thickness). The tie strength would largely be governed by the amount of time together by a pair of terrorists. Those living together or attending the same school or the same classes/training would have the strongest ties.
Those traveling together and participating in meetings together would have ties of moderate strength and medium thickness. Finally, those who were recorded as having a single transaction together, or an occasional meeting, and no other ties, they classified as weak ties that were shown with the thinnest links in the network.
The investigators started their mapping project upon seeing several summaries of data about the hijackers in major newspapers (Sydney Morning Herald, 2001; Washington Post, 2001). These data collections contained information about the nodes/hijackers and their links/relationships.
From two to six weeks after the event, it appeared that a new relationship or node was added to the network on a daily basis. Several false stories appeared about a cell in Detroit. These stories, originally reported with great fanfare, were proven false within one week. This made the investigators very cautious about adding a link or a node to the network.
The network was created iteratively as data became available. Everyday the investigators checked the major news sources for updated information. Figure “1” shows their computer screen during this process. The browser window shows the news story, the other window shows the network mapping and measuring software. They would add nodes and links to the map as they read the news accounts. Figure “1” shows a link being added between one of the hijackers and an accomplice.
By the middle of October enough data was available to start seeing patterns in the hijacker network. Initially, the investigators examined the prior trusted contacts – those ties formed long ago through living and learning together. The network self-organized (via a network layout algorithm) into the shape of a serpent – how appropriate, they thought.
The investigators were amazed at how sparse the network was and how distant many of the hijackers on the same team were from each other. Many pairs of team members were beyond the horizon of observability from each other – many on the same flight were more than two steps away from each other. A strategy for keeping cell members distant from each other, and from other cells, minimizes damage to the network if a cell member is captured or otherwise compromised. Usama bin Laden even described this plan in his infamous videotape, which was found in Afghanistan. In the transcript (U.S. Department of Defense, 2001) Usama bin Laden mentions: “Those who were trained to fly didn’t know the others. One group of people did not know the other group.”
The network metrics for the network in Figure “2” are found in Table “1”. For a small network of less than 20 nodes, we see a long average path length of 4.75 steps. Several of the hijackers are separated by more than 6 steps. From this metric and bin Laden’s comments above we see that covert networks trade efficiency for secrecy.
Table 1: Small-World Network Metrics
|Clustering Coefficient||Average Path Length|
|Contacts + Shortcuts||0.42||2.79|
Yet, work has to be done, plans have to be executed. How does a covert network accomplish its goals? Through the judicious use of transitory shortcuts in the network. Meetings were held that connected distant parts of the network to coordinate tasks and report progress. After coordination was accomplished, the cross-ties went dormant. One well documented meeting of the hijacker network took place in Las Vegas. The ties from this and other meetings are shown in gold in Figure “3”.
Six (6) shortcuts were added to the network temporarily in order to collaborate and coordinate. These shortcuts reduced the average path length in the network by over 40% thus improving the information flow in the network – see Table “1”. When the network is brought closer together by these shortcuts, all of the pilots ended up in a small clique – the perfect structure to efficiently coordinate tasks and activities. There is a constant dynamic between keeping the network hidden and actively using it to accomplish objectives.
The 19 hijackers did not work alone. They had other accomplices that did not get on the planes. These co-conspirators were conduits for money and also provided needed skills and knowledge. Figure “4” shows the hijackers and their network neighborhood – their direct and indirect associates.
After one month of investigation it was ‘common knowledge’ that Mohamed Atta was the ring leader of this conspiracy. Again, bin Laden verified Atta’s leadership role in the video tape (U.S. Department of Defense, 2001). Looking at the diagram he has the most connections. In Table “2” we see that Atta scores the highest on all network centrality metrics – Degrees, Closeness, and Betweenness.
The network metric Degrees reveals Atta’s activity in the network. Closeness measures his ability to access others in the network and monitor what is happening. Betweenness shows his control over the flow in the network – he plays the role of a broker in the network. These metrics support his leader status.
Table 2: Hijackers Network Neighborhood
* possible false ID
|0.361||Mohamed Atta||0.588||Mohamed Atta||0.587||Mohamed Atta|
|0.295||Marwan Al-Shehhi||0.252||Essid Sami Ben Khemais||0.466||Marwan Al-Shehhi|
|0.213||Hani Hanjour||0.232||Zacarias Moussaoui||0.445||Hani Hanjour|
|0.180||Essid Sami Ben Khemais||0.154||Nawaf Alhazmi||0.442||Nawaf Alhazmi|
|0.180||Nawaf Alhazmi||0.126||Hani Hanjour||0.436||Ramzi Bin al-Shibh|
|0.164||Ramzi Bin al-Shibh||0.105||Djamal Beghal||0.436||Zacarias Moussaoui|
|0.164||Ziad Jarrah||0.088||Marwan Al-Shehhi||0.433||Essid Sami Ben Khemais|
|0.148||Abdul Aziz Al-Omari*||0.050||Satam Suqami||0.424||Abdul Aziz Al-Omari*|
|0.131||Djamal Beghal||0.048||Ramzi Bin al-Shibh||0.424||Ziad Jarrah|
|0.131||Fayez Ahmed||0.043||Abu Qatada||0.409||Imad Eddin Barakat Yarkas|
|0.131||Salem Alhazmi*||0.034||Tarek Maaroufi||0.409||Satam Suqami|
|0.131||Satam Suqami||0.033||Mamoun Darkazanli||0.407||Fayez Ahmed|
|0.131||Zacarias Moussaoui||0.029||Imad Eddin Barakat Yarkas||0.404||Lotfi Raissi|
|0.115||Hamza Alghamdi||0.026||Fayez Ahmed||0.401||Wail Alshehri|
|0.115||Said Bahaji||0.023||Abdul Aziz Al-Omari*||0.399||Ahmed Al Haznawi|
|0.098||Khalid Al-Mihdhar||0.022||Hamza Alghamdi||0.399||Said Bahaji|
|0.098||Saeed Alghamdi*||0.017||Ziad Jarrah||0.391||Agus Budiman|
|0.098||Tarek Maaroufi||0.015||Ahmed Al Haznawi||0.391||Zakariya Essabar|
|0.098||Wail Alshehri||0.013||Salem Alhazmi*||0.389||Mamoun Darkazanli|
|0.098||Wail Alshehri||0.013||Salem Alhazmi*||0.389||Mamoun Darkazanli|
|0.098||Waleed Alshehri||0.012||Lotfi Raissi||0.389||Mounir El Motassadeq|
|0.082||Abu Qatada||0.012||Saeed Alghamdi*||0.389||Mustafa Ahmed al-Hisawi|
|0.082||Agus Budiman||0.011||Agus Budiman||0.372||Abdelghani Mzoudi|
|0.082||Ahmed Alghamdi||0.007||Ahmed Alghamdi||0.372||Ahmed Khalil Al-Ani|
|0.082||Lotfi Raissi||0.007||Ahmed Ressam||0.365||Salem Alhazmi*|
|0.082||Zakariya Essabar||0.007||Haydar Abu Doha||0.361||Hamza Alghamdi|
|0.066||Ahmed Al Haznawi||0.006||Kamel Daoudi||0.343||Abu Qatada|
|0.066||Imad Eddin Barakat Yarkas||0.006||Khalid Al-Mihdhar||0.343||Tarek Maaroufi|
|0.066||Jerome Courtaillier||0.004||Mohamed Bensakhria||0.339||Ahmed Alghamdi|
|0.066||Kamel Daoudi||0.003||Nabil al-Marabh||0.335||Waleed Alshehri|
|0.066||Majed Moqed||0.002||Jerome Courtaillier||0.332||Djamal Beghal|
|0.066||Mamoun Darkazanli||0.002||Mustafa Ahmed al-Hisawi||0.332||Khalid Al-Mihdhar|
|0.066||Mohamed Bensakhria||0.002||Said Bahaji||0.332||Saeed Alghamdi*|
|0.066||Mounir El Motassadeq||0.002||Wail Alshehri||0.328||Majed Moqed|
|0.066||Mustafa Ahmed al-Hisawi||0.001||Abu Walid||0.324||Ahmed Ressam|
|0.066||Nabil al-Marabh||0.001||Mehdi Khammoun||0.323||Ahmed Alnami|
|0.066||Rayed Mohammed Abdullah||0.001||Mohand Alshehri*||0.323||Nabil al-Marabh|
|0.049||Abdussattar Shaikh||0.001||Raed Hijazi||0.321||Haydar Abu Doha|
|0.049||Abu Walid||0.001||Rayed Mohammed Abdullah||0.319||Mohamed Bensakhria|
|0.049||Ahmed Alnami||0.001||Waleed Alshehri||0.316||Essoussi Laaroussi|
|0.049||Haydar Abu Doha||0.000||Abdelghani Mzoudi||0.316||Jerome Courtaillier|
|0.049||Mehdi Khammoun||0.000||Abdussattar Shaikh||0.316||Kamel Daoudi|
|0.049||Osama Awadallah||0.000||Abu Zubeida||0.316||Seifallah ben Hassine|
|0.049||Raed Hijazi||0.000||Ahmed Alnami||0.314||Rayed Mohammed Abdullah|
|0.033||Ahmed Ressam||0.000||Ahmed Khalil Al-Ani||0.313||Raed Hijazi|
|0.033||Bandar Alhazmi||0.000||Bandar Alhazmi||0.311||Abdussattar Shaikh|
|0.033||David Courtaillier||0.000||David Courtaillier||0.311||Bandar Alhazmi|
|0.033||Essoussi Laaroussi||0.000||Essoussi Laaroussi||0.311||Faisal Al Salmi|
|0.033||Faisal Al Salmi||0.000||Faisal Al Salmi||0.311||Mohand Alshehri*|
|0.033||Lased Ben Heni||0.000||Faisal Al Salmi||0.311||Osama Awadallah|
|0.033||Mohammed Belfas||0.000||Jean-Marc Grandvisir||0.308||Mehdi Khammoun|
|0.033||Mohand Alshehri*||0.000||Lased Ben Heni||0.308||Mohamed Abdi|
|0.033||Seifallah ben Hassine||0.000||Madjid Sahoune||0.307||David Courtaillier|
|0.016||Abdelghani Mzoudi||0.000||Majed Moqed||0.307||Mohammed Belfas|
|0.016||Abu Zubeida||0.000||Mamduh Mahmud Salim||0.305||Lased Ben Heni|
|0.016||Ahmed Khalil Al-Ani||0.000||Mohamed Abdi||0.303||Fahid al Shakri|
|0.016||Fahid al Shakri||0.000||Mohammed Belfas||0.303||Madjid Sahoune|
|0.016||Jean-Marc Grandvisir||0.000||Mounir El Motassadeq||0.303||Samir Kishk|
|0.016||Madjid Sahoune||0.000||Nizar Trabelsi||0.281||Mamduh Mahmud Salim|
|0.016||Mamduh Mahmud Salim||0.000||Osama Awadallah||0.264||Abu Walid|
|0.016||Mohamed Abdi||0.000||Samir Kishk||0.250||Abu Zubeida|
|0.016||Nizar Trabelsi||0.000||Seifallah ben Hassine||0.250||Jean-Marc Grandvisir|
|0.016||Samir Kishk||0.000||Zakariya Essabar||0.250||Nizar Trabelsi|
Yet, we are obviously missing nodes and ties in this network. Centrality measures are very sensitive to minor changes in network connectivity. A discovery of a new conspirator or two, or the uncovering of new ties amongst existing nodes can alter who comes out on top in the centrality measures. We must be wary of incomplete data.
To draw an accurate picture of a covert network, we need to identify task and trust ties between the conspirators. The same four relationships we often map in many business organizations would tell us much about illegal organizations. This data is occasionally difficult to unearth with cooperating clients. With covert criminals, the task is enormous, and may be impossible to complete. Table “3” below lists multiple project networks and possible data sources about covert collaborators.
Table 3: Networks to Map
|1. Trust||Prior contacts in family, neighborhood, school, military, club or organization. Public and court records. Data may only be available in suspect’s native country.|
|2. Task||Logs and records of phone calls, electronic mail, chat rooms, instant messages, Web site visits. Travel records. Human intelligence: observation of meetings and attendance at common events.|
|3. Money & Resources||Bank account and money transfer records. Pattern and location of credit card use. Prior court records. Human intelligence: observation of visits to alternate banking resources such as Hawala.|
|4. Strategy & Goals||Web sites. Videos and encrypted disks delivered by courier. Travel records. Human intelligence: observation of meetings and attendance at common events.|
Of course, the common network researcher will not have access to many of these sources. The researcher’s best sources may be public court proceedings, which contain much of this data (U.S. Department of Justice, 2001).
The best solution for network disruption may be to discover possible suspects and then, via snowball sampling, map their individual personal networks – see whom else they lead to, and where they overlap. To find these suspects it appears that the best method is for diverse intelligence agencies to aggregate their individual information into a larger emergent map. By sharing information and knowledge, a more complete picture of possible danger can be drawn. In our data search we came across many news accounts where one agency, or country, had data that another would have found very useful.
To win this fight against terrorism it appears that the good guys have to build a better information and knowledge sharing network than the bad guys.