Geospatial Analysis of Dynamic Terrorist Networks more

Geospatial Analysis of Dynamic Terrorist Networks Richard Medina and George Hepner The emergence of global terrorism has given a new relevance to the study of social networks within global geographic space. Terrorists and their organizations, as nonstate actors, are a great threat to the existing order, structures and people. However, as organizations, terrorist networks share an evolving correspondence to other organizational entities both in terms of their social network relationships, and the manifestation of these relationships across geographic space. This evolving correspondence is a fertile ground for description and investigation. While our knowledge of structure and operations of terrorist networks is presently limited, gaining this knowledge is a matter of global security and peace. Generally, a network is visualized as a collection of vertices or nodes and the connections between them termed edges or links. In the study of terrorist networks in social space, nodes, or actors in the network can be individual terrorists, terrorist cells, or clusters, where the links are the relationships between those nodes. Various types of nodes and links can coexist. For example, nodes can represent different sex, nationality, location, etc., while links can vary by strength of relationships, geographic or social class proximity, etc. Nodes and links in a network can also be represented with varying degrees of importance or influence by different weights.1 For example, if the nodes in question are individual people, Osama bin-Laden of al Qaeda will be a larger influence on the network than an actor of lesser status. Nodes within a network typically vary in their connectivity. They can be classified based on their relative connectivity as hubs or non-hubs. Network hubs dominate connectivity, and are responsible for connecting nodes with fewer connections. An ideal example of a hub in a network is the wheel that contains a node at the center, and nodes at the outside end of each spoke. The hub in the center has optimal connectivity, as it is connected to each of the nodes through the spokes, while the outer nodes have the minimal connections; they connect only to the hub. It is easy R. Medina University of Utah e-mail: richard.medina@geog.utah.edu 1 M. E. J. Newman, “The Structure and Function of Complex Networks,” Society for Industrial and Applied Mathematics 45, 2 (2003), pp. 167–256. I.A. Karawan et al. (eds.), Values and Violence, C Springer Science+Business Media B.V. 2008 151 152 R. Medina, G. Hepner to see that the hub is responsible for the total connectivity of the wheel network described above. Since hubs play such an important role in network connectivity, it follows that the removal of hubs from a network will cause various levels of fragmentation. Hub and non-hub connectivity will be discussed in this paper as it applies to counterterrorism. Network Models There are two main network models that generally describe the organizational and authoritative structure of every real network: hierarchical and decentralized. In hierarchical network organization, a leader delegates tasks to lower levels and manages organizational activities. The delegation of authority is structured from top, down through the ranks, typically in a pyramidal shape. Hierarchical network organization can be seen throughout the business world in which corporations operate authoritatively from the top down, or from the CEO or Board of Directors down to the lower levels of the organization. An example of a hierarchically structured former terrorist organization is the Provisional Irish Republican Army, in which its authority flows from the Army Counsel at the top of the pyramid to the Active Service Units at the bottom.2 In decentralized networks, there is no true organizational hierarchy. An extreme structural example of this is an all-channel or fully connected network in which each node is connected to all other nodes in the network.3 Tasks and orders are not directed top to bottom in a pyramidal flow; rather nodes in the network determine their own path, albeit many times with a general direction. Examples of decentralized networks are the World Wide Web and the Internet. In both examples it is apparent that there are many connections from node to node (i.e., webpage to webpage or computer to computer, respectively), and both are lacking a pyramidal structure. Examples of decentralized terrorist organizations are al Qaeda and Hamas. Both groups, although they have a central authoritative core, also have cells that act autonomously for the good of the movement, or what seems in their eyes to be a beneficial step toward particular goal. Aside from the hierarchical and decentralized network structures of terrorist or criminal activities, a completely decentralized structure exists, known as Leaderless Resistance. This structure, or lack of, can be described as a group of perpetrators acting out the wishes of an “inspirational leader.” This leader offers no direction, support, funding, etc., only an overall goal. An example of this occurred in California when the White Aryan Nation (WAR) sought retribution after the 2 J. Horgan and M. Taylor, “The Provisional Irish Republican Army: Command and Functional Structure,” Terrorism and Political Violence 9, 3 (1997), pp. 1–32. 3 J. Arquilla and D. Ronfeldt, “The Advent of Netwar (Revisited),” in J. Arquilla and D. Ronfeldt (eds.), Networks and Netwars: The Future of Terror, Crime, and Militancy: Rand Report MR-1382 (Santa Monica: Rand Corporation, 2001), pp. 1–25. Geospatial Analysis of Dynamic Terrorist Networks 153 barring of Proposition 187, which was written to end U.S. government services to immigrants. The WAR urged violent attacks from their followers.4 Terrorist organizational structure can be a hybrid of these three structures. For example, the network may include a central authoritative core, while the large majority of the organization is decentralized or in the process of decentralizing. An example of this occurs when organizations are the shifting from one structure to another, most likely when decentralization is required for security. Terrorist networks are increasingly complex systems of people, finances, and technology, while at the same time striving for nodal (cell) isolation and a lack of interdependency that offers resiliency and tactical security benefits. Understanding this paradox is foundational to comprehending these networks and trying to anticipate activities. Deployed al Qaeda cells are required to be monetarily self sufficient. This ensures that if members of a cell are captured, information about organizational funding is not exposed. It also ensures that cells are not dependent on organizational funding. Financial self sufficiency is part of the operational doctrine of al Qaeda and is taught in the military training manual, Declaration of Jihad against the Country’s Tyrants. To remain self sufficient, cells are to split finances for operations and investments, such that financial returns are generated. For security purposes funds are at times left with non-members of the cells so that those funds and their sources are not exposed if cell members are captured. Training for financial gain includes some illegal activities including credit card fraud and document forgery. Much of the financial planning in an al Qaeda cell is the responsibility of the cell commander.5 Decentralization Terrorist organizations have been moving toward a network structure goal of increased security through social and geographic decentralization. One of the major strengths of decentralized networks is resilience. Decentralized structures cannot be destroyed by leadership decapitation as with hierarchical structures. Random attacks on a decentralized network will most likely not cause network failure. A directed attack on a relatively large number of the network’s hubs is necessary for complete network failure.6 This may be the greatest benefit of the decentralized network.7 Another benefit of utilizing a network structure is the ability to quickly reconfigure when necessary, especially when given advance warning of threat to the 4 C. Dishman, “The Leaderless Nexus: When Crime and Terror Converge,” Studies in Conflict and Terrorism 28 (2005), pp. 237–252. 5 M. Basile, “Going to the Source: Why Al Qaeda’s Financial Network Is Likely to Withstand the Current War on Terrorist Financing,” Studies in Conflict & Terrorism 27 (2004), pp. 169–185. 6 M. Sageman, Understanding Terror Networks (Philadelphia: University of Pennsylvania Press, 2004). 7 See Sageman, Understanding Terror Networks; P. Williams, “Transnational Criminal Networks,” in J. Arquilla and D. Ronfeldt (eds.), Networks and Netwars: The Future of Terror, Crime, and Militancy: Rand Report MR-1382 (Santa Monica: Rand Corporation, 2001), pp. 61–97; R. Albert, 154 R. Medina, G. Hepner organization. Since decentralized networks often have little concrete infrastructure and monetary investment in any specific place they can migrate within the geography of their socio-cultural activity space to avoid threats. Transcending national boundaries is becoming easier for decentralized organizations with the continuing shift toward globalization. Terrorist organizations can operate transnational to take advantage of more lenient laws and regulations, government tolerance of illicit activity, and the assistance of resident allies in one nation verses another.8 Border regions have become places of meeting, planning, and support for terrorist and other criminal organizations. Islamic terrorist organizations such as Al-Gama’a al-Islamiyya, al Qaeda, Hizballah, and Hamas have utilized the sanctuary of the socio-cultural mix in the tri-border region of Paraguay, Brazil, and Argentina in South America.9 The process of network decentralization is furthered by the use of advancing information technologies. The ease of communication access along with electronic financial systems are fostering increased decentralization. There are three major ways in which information technologies are assisting terrorist network decentralization: (1) the reduction of transmission time, (2) the reduction of communication costs, and (3) an increase in the complexity of transmittable information.10 With transmission times reduced and technologies such as cell phones and global positioning systems (GPS), terrorist attacks can take place with the assistance of information in real time, and real location. These technologies assist in the assessment of target locations and temporal efficiency, as well as with early warnings, escape routes, and other logistical tactics. The reduction of communication costs will increase decentralization simply because it is relatively cheaper to decentralize as technology increases in the future. In the past, organizations centralized to reduce communication and coordination costs, while they are now free to spread out. While terrorists are able to transmit increasingly complex information, the complexity of their operations can also increase. This complex information may include air photo and satellite images, detailed maps, and weapons information transmitted in real time. It should also be noted that the quality and effectiveness of commercial encryption software is continually increasing, and already allows for information to be sent and received without the threat of interception. These new encryption technologies will soon be integrated into programs and servers, offering terrorists the ability to send encrypted, unbreakable communications without extra effort.11 H. Jeong, and A.-L. Barabasi, “Error and Attack Tolerance of Complex Networks,” Nature 406 (2000), pp. 378–382. 8 Williams, “Transnational Networks.” 9 R. Hudson, “Terrorist and Organized Crime Groups in the Tri-Border Area (TBA) of South America,” The Library of Congress – Federal Research Division (2003). 10 M. Zanini and S. J. A. Edwards, “The Networking of Terror in the Information Age,” in J. Arquilla and D. Ronfeldt (eds.), Networks and Netwars: The Future of Terror, Crime, and Militancy: Rand Report MR-1382 (Santa Monica: Rand Corporation, 2001). 11 D. E. Denning and W. E. Baugh, “Encryption and Evolving Technologies as Tools of Organized Crime and Terrorism,” The National Strategy Information Center’s US Working Group on Organized Crime (WGOC), (1997). Geospatial Analysis of Dynamic Terrorist Networks 155 Fig. 1 Advanced terrorist network structure Terrorist networks are social networks with specific and evolving structures and decentralized connectivity. An advanced terrorist network structure is displayed below in Fig. 1. The network core contains the hierarchical core leadership, operative cells, and individual operatives, while the periphery contains peripheral assistance, and beyond the periphery are leaderless cells and individual operatives. It is assumed that the leaderless cells and operatives are not connected in the typical sense of connectivity between nodes in a network, but are connected by ideological/religious beliefs and/or purpose. Dotted lines are used to denote weak ties within the network, such as connections between terrorists in the network to those who offer assistance, but are not close ties. Weak ties in a social network typically refer to the connection between acquaintances.12 These ties can connect nodes in the network to nodes in the periphery, such that they are not operational actors in the network, but are functional in the sense that they offer recruitment assistance, shelter and safe havens, monetary support, as well as other types of assistance. Core/Periphery connections can, and in many cases do refer to strong ties in a social network, however, here they are shown here as weak ties to emphasize the importance of making a distinction between strong and weak ties. Acquaintances in a social network can provide benefits by 12 M. S. Granovetter, “The Strength of Weak Ties,” The American Journal of Sociology 78, 6 (1973), pp. 1360–1380. 156 R. Medina, G. Hepner introducing nodes to new experiences and opportunities.13 Weak ties in a terrorist network can assist nodes with funding, recruitment, shelter, etc. Figure 1 illustrates a generalized version of the structure of a present day evolved terrorist organization. Depending on the organization, cells and operatives are more or less decentralized, and leaderless cells and operatives may or may not exist. There may also be less reliance on cells with dependence on branches of the hierarchical core. An example of this is seen with Hamas, which has four operational wings: “internal security (Jihad Amman), ‘popular uprising’ (stage violent protests, stone throwing, etc.), suicide bomber group (Al-Majahadoun Al-Falestinioun), [and the] professional killer group (The Izz al-Din al-Qassam Squads).”14 Hamas uses operational cells which depend on the hierarchical structure of the organization (i.e., they take orders from and answer to a higher authority), whereas al Qaeda cells can operate self sufficiently and don’t necessarily have to take orders from a higher authority.15 Cells acting independently will have different connectivity patterns than cells that are operationally connected. Networks in Social Space Terrorist networks operate and, therefore, can be analyzed in social and geographical spaces. In social space, the two main social network components are connectedness and structure. Connectedness refers to the social links between nodes or actors in the network, while network structure refers to the shape of the network. Both social network components can be mapped in geographic space and visualized using various mapping techniques. Connectivity and structure can be analyzed using traditional social network analysis, small-world, and scale-free approaches. Traditional social network analysis (SNA) tends to focus on relationships within networks while non-traditional SNA, including small-world and scale-free analyses, focuses on the identification of network classes.16 The fundamental concepts of traditional SNA focus on actors (nodes), and the social ties (linkages) that delineate relationships in subgroups, groups, and entire social networks. The term subgroup is used to define any subset of a network including nodes and links. Groups are actors and ties that make up an assumed bounded system. Traditional SNA uses graph theory and matrix operations to analyze social networks. The benefits of the use of graphs for SNA are (1) a vocabulary that is applicable in the description of social structure and connectivity properties, (2) quantitative methods that are used to analyze social networks, and (3) through the use of vocabulary and quantitative methods graph theory can Granovetter, “The Strength of Weak Ties,” pp. 1360–1380. K. M. Carley, “Estimating Vulnerabilities in Large Covert Networks Using Multi-Level Data,” in Proceedings of the 2004 International Symposium on Command and Control Research and Technology (2004), p. 1. 15 Carley, “Estimating Vulnerabilities.” 16 F. Liljeros, C. R. Edling, and L. A. N. Amaral, “Sexual Networks: Implications for the Transmission of Sexually Transmitted Infections,” Microbes and Infection 5 (2003), pp. 189–196. 14 13 Geospatial Analysis of Dynamic Terrorist Networks 157 be used to prove graphical theorems and make inferences about the social systems they represent. Graph theory uses metrics such as degree (number of connections per node), density (proportion of links present to links possible), geodesic distance (shortest path between two nodes), node eccentricity (largest geodesic distance between a given node and any other node in a graph), graph diameter (largest geodesic distance in a graph), and general connectivity.17 Small-World Networks The small-world approach suggests that each of the nodes in a terrorist network is connected to any other node within a relatively small number of degrees. The growth of various terrorist networks can be attributed to the process of “preferential attachment,” in which the probability of a node to gain connections to new nodes is determined by the number of connections that node has presently, simply meaning that the more connected a node becomes, the easier is will be for new nodes to find that node.18 Networks that grow through this process eventually evolve into a small-world structure. This is the case with regard to two of the main network clusters involved in the present global jihad: the cluster of terrorists from the Core Arab states (Saudi Arabia, Egypt, Yemen, Kuwait), and the cluster of terrorists from the Maghreb (Morocco, Algeria, Tunisia).19 Although it has been stated that all social networks contain properties of clustering and the small-world effect,20 there still remains question as to whether terrorist networks are small-worlds. Terrorist networks are social networks, but in these networks does there exist conscious effort to inhibit connectivity within the network for security purposes? And if the connectivity is purposefully inhibited, is it possible to stray from a small-world structure? The benefit would be the removal of links to more important nodes in the network by decreased connectivity. Even if terrorist networks are small-worlds, strong ties in the networks can appear as weak ties, which will inhibit the detection of the small-world structure.21 Even with the highest level of security precautions, where cell members do not know each other until time of an operation, small-world connectivity may be unavoidable. An example of the use of small-world connectivity is given in Krebs, where the September 11th terrorists are described as using shortcuts in the network for planning efficiency. Additional analyses of real terrorist network data that reflect the decentralized nature of present day terrorist networks are required to understand the small-world issue more fully. S. Wasserman and K. Faust, Social Network Analysis: Methods and Applications (New York: Cambridge University Press, 1994). 18 Sageman, Understanding Terror Networks. 19 Sageman, Understanding Terror Networks. 20 D. H. Zanette, “Models of Social Processes on Small-World Networks,” Paper read at American Institute of Physics, at Bariloche, Argentina, 2–15 June 2002. 21 V. E. Krebs, “Mapping Networks of Terrorist Cells,” Connections 24, 3 (2002), pp. 43–52. 17 158 R. Medina, G. Hepner If one assumes that terrorist networks are small-worlds, there are many implications for security and defense. For example, the spread of information, money, and commodities throughout a small-world network may be relatively quicker than diffusion through other types of networks. The spread of infectious diseases has been shown to diffuse relatively fast in small-world networks.22 Determining the speed and directions of covert network flows would be beneficial for counterterrorism. By viewing terrorist networks as small-worlds, the most connected nodes in the network may become more visible. In small-worlds, the most currently ‘popular’ nodes are not always the most connected. In the network of actors the most highly connected nodes are not simply the most recognizable. The “centers of the Hollywood universe” are determined by attributes, including length of time in the profession and types of movies made. The top five most highly connected (central) nodes based on appearances in movies are Rod Steiger (2.68), Christopher Lee (2.68), Dennis Hopper (2.70), Donald Sutherland (2.70), and Harvey Keitel (2.71).23 Each actor listed above is followed by his “Bacon Number.” The centrality of nodes in this network, which is the average number of hops to get from the “center” to any other actor, is determined by their Bacon Number. These five actors were found to have the lowest average number of hops to connect to any other node in the network.24 A greater understanding of centrality in terrorist networks will assist in counterterrorism. Removing the most highly connected nodes will work to fragment a network by greatly reducing connectivity, and can cause network failure. Small-world networks exhibit characteristics of rapid diffusion, such as with communicable diseases or information. One of the main characteristics of smallworld networks is that any node is connected to any other node by a relatively few number of hops through the network. It follows that disease will diffuse through the network quickly. In an ideal model of disease (i.e. infection rates by contact are one hundred percent), a disease will spread as far and as fast as the measured degree for each node at each step through the network. The spread will increase first through time steps, then exponentially, and only slowing down as the network becomes saturated.25 In countering terrorism, analysis of networks as small-worlds may assist in the redirection to the most central nodes for targeting, and also slow down the diffusion of necessary ideas, funding, and commodities through terrorist networks. 22 D. Watts and S. H. Strogatz, “Collective Dynamics of ‘Small-World’ Networks,” Nature 393 (1998), pp. 440–442. 23 University of Virginia, Department of Computer Science (2006), The Center of the Hollywood Universe [cited Oct. 22 2006]. Available from http://oracleofbacon.org/center list.html. 24 The Internet Movie Database (IMDb) was used to build this small-world example, and can be found at http://www.imdb.com/. 25 M. E. J. Newman, “Models of the Small-world: A Review,” Journal of Statistical Physics 101, 3–4, (2000), pp. 819–841. Geospatial Analysis of Dynamic Terrorist Networks 159 Scale-Free Networks The scale-free property of various networks was first introduced in 1999 by AlbertL´ szl´ Barab´ si and R´ ka Albert. Contrary to their hypothesis, they found that a o a e the distribution of nodal connectivity of the World Wide Web was not that of a typical random network, but instead was scale-free, where some nodes “defied explanation.” In the authors’ words, it was “almost as if (they) had stumbled on a significant number of people who were 100 feet tall.”26 Many real networks have shown through analysis to be free of scale. These include: food webs, the internet, the World Wide Web, the network of actors made popular by the “six degrees of separation from Kevin Bacon” game, and the social network of human sexual contacts, among others.27 Growth of a network in a self-organized process of preferential attachment between nodes results in a scale free structure. Preferential attachment refers to network growth where the probability of an existing node to attain new links is proportional to the number of links the given node already has.28 If a network grows by preferential attachment its primary nodes will have the most opportunity to attract new nodes, and therefore will eventually dominate the network because their probability to gain connections will increase with the growing number of connections.29 In scale-free networks nodes have a relative amount of “attractiveness.” Attractive nodes are generally highly connected while unattractive nodes are less connected. The concept of nodal attractiveness is explained in Mossa et al. where “new nodes want to connect to the existing nodes with the largest number of links – i.e., with the largest degree – because of the advantages offered by being linked to a well connected node.”30 Attractiveness in a network can be directed either from the less connected nodes to the hubs or from the hubs to the less connected nodes. Plotting frequency on the y axis (the number of nodes that have a specified connectivity), against connectivity on the x axis (nodal degree) will result in a downward sloping curve that contains all points as shown below in Fig. 2. The points on the left side of the graph are representative of nodes that have low connectivity. Each point represents one or more nodes with the same number of connections in the first degree. The frequencies of low connected nodes in a scale-free network are relatively much higher than the frequencies of high connected nodes. In this figure, the point in the far right, which is representative of a relatively small number of nodes with relatively many connections, dominates the connectivity of the A. L. Barab´ si and E. Bonabeau, “Scale-Free Networks,” Scientific American 288, 5 (2003). a D. Cohen, “All the World’s a Net,” New Scientist 174, 2338 (2002), pp. 24–29. 28 S. N. Dorogovtsev, J. F. F. Mendes, and A. N. Samukhin, “Structure of Growing Networks with Preferential Linking,” Physical Review Letters 85, 21 (2000), pp. 4633–4636. 29 A. L. Barab´ si, Linked: They New Science of Networks (Cambridge: Perseus Publishing, 2002). a 30 S. Mossa, M. Barth´ lemy, H. E. Stanley, and L. A. N. Amaral, “Truncation of Power Law e Behavior in “Scale-Free” Network Models due to Information Filtering,” Physical Review Letters 88, 13 (2002), pp. 138701–1. 27 26 160 R. Medina, G. Hepner Fig. 2 Plot of scale-free conditions hypothesized network. The few nodes represented by the graphical placement of this point have a very large number of connections. When the log of the frequency (y axis) is plotted against the log of the connectivity (x axis) in this hypothesized network, the power law distribution becomes apparent. One of the main characteristics of this distribution is the linear downward sloping trend as seen below in Fig. 3.31 The log-log plot is used to classify networks as being scale-free. Preferential attachment, as discussed previously with small-world networks, is a key concept in scale-free networks. Scale-free networks follow a power law distribution (see Fig. 3), which simply means that the majority of nodes in the network have relatively few connections, while few nodes have relatively many. The power law distribution is reflective of the “hub” characteristic within a network. Relatively few nodes in a scale-free network dominate its connectivity. The two main attributes that determine whether a network is scale-free: growth and preferential attachment are properties of many real world networks. The random graph and small-world network approaches do not take these attributes into consideration. The scale-free network attributes, which are inherent in many real world networks, make these networks resilient to random attacks, but vulnerable to attacks directed toward the hubs. Examples of these are the internet and the al Qaeda terrorist network. In a scale-free network, a random attack will most likely target a node that is poorly connected and less influential in that network, while the hubs will remain unharmed. 31 Barabasi, Linked, the New Science of Networks. Geospatial Analysis of Dynamic Terrorist Networks 161 Fig. 3 Log-log plot of scale-free conditions Real world networks display many examples of nodes that are connected by preferential attachment. In the case of the academic paper citation network, a new citation is more likely to be directed toward a previous paper with a relatively large number of citations. More citations imply that the author is a relatively well known peer in the academic community.32 In the case of food web networks, predator species are the nodes responsible for the attractiveness property, because they prey on large numbers of varying species. In the case of sexual networking, people that have relatively more partners may be more attractive to others than people with fewer partners.33 Fateh Kamel is an example of a node with preferential attachment in a terrorist network. He acted as a hub of the network that was responsible for much of the nodal connectivity applied in the September eleventh attacks of 2001. Kamel was what may be referred to as a “typical hub,” in that he was “a charming and handsome man with a knack for making friends and acquaintances.”34 His “attractiveness” then led to a process in which “the better known he became, the easier it was for newcomers to find him and the more people he met.”35 This is an example of the “rich-getricher” structure, which is a characteristic of scale-free networks. It can be assumed that hubs similar to Kamel exist within the al Qaeda network, as well as within other terrorist networks. The growth of terrorist organizations can be attributed at least in part to preferential attachment. If we assume that terrorist networks are scale-free, what implications does this have for countering these networks? First, and quite possibly the most important 32 A. L. Barab´ si and R. Albert, “Emergence of Scaling in Random Networks,” Science 286 a (October 1999), pp. 509–512. 33 Cohen, “All the World’s a Net.” 34 Sageman, Understanding Terror Networks, p. 139. 35 Sageman, Understanding Terror Networks. 162 R. Medina, G. Hepner characteristic is that scale-free networks are extremely resilient to random or “accidental” attacks. This is due to the existence of relatively many more, less connected nodes than hubs. A random attack will most likely damage or remove a node that is not essential to network flow. It is estimated that approximately eighty percent of nodes can be randomly removed from the Internet, and a connection between any two nodes in the network will still remain (internet defined here as the physical web of routers, servers, etc. that information travels through). While random attacks on a scale-free network will prove in most cases to be futile, a relatively few directed attacks on known hubs can successfully break up the network. It is estimated that the removal of as few as five to fifteen percent of all hubs within the network will dismantle it. The largest difficulty may lie in successfully identifying hubs within a terrorist network. It is more difficult to identify social network hubs than hubs of any other type of network.36 Diffusion of information and tactics throughout a scale-free network is quick to spread and very persistent.37 This is due to the diffusion through highly connected hubs. Since these hubs have a relatively large number of connections, it only takes one node linked to a hub to diffuse to a substantial number of other nodes within the network. Borrowing from contagious disease literature, hubs in a network have also been termed “superspreaders,” because of their ability to infect other nodes in the network (Barth´ lemy et al. 2004). With regard to terrorist networks, where e propaganda can be used as a tool to gain and further support, the diffusion of information through the network can be selective and very efficient. It takes only one node to begin diffusion through the network, but to stop the diffusion almost every node in the network must be considered as a carrier. In the case of measles infections, approximately ninety percent of people within the social network must be vaccinated in order to effectively stop diffusion. The large majority of the hubs, if not all, must be reached.38 Scale-free networks also have the ability to allow nodal variation. Many nodes within the network can “mutate,” change location, or leave the network without damaging it as a whole, as long as too many hubs aren’t removed. This property adds to the robustness of scale-free networks. The networks are able to constantly improve by evolving.39 By using the example of Fateh Kamel, one can see the ability of a node to change location. Kamel immigrated to Canada in 1997 from Algeria. In Canada, he assisted in the formation of a terrorist network for the Bosnian jihad. He then formed a logistical support network in Milan around the Islamic Cultural Institute.40 Kamel’s ability to attract other nodes proved to be beneficial for the Global Jihad. Because of his attractiveness, he had the ability to move from one region to Barabasi and Bonabeau, “Scale-Free Networks.” Barabasi and Bonabeau, “Scale-Free Networks.” 38 M. Barth´ lemy, A. Barrat, R. Pastor-Satorras, and A. Vespignani, “Velocity and Hierarchical e Spread of Epidemic Outbreaks in Scale-Free Networks,” Physical Review Letters 92, 17 (2004) pp. 178701–1–178701–4. 39 Cohen, “All the World’s A Net.” 40 Sageman, Understanding Terror Networks. 37 36 Geospatial Analysis of Dynamic Terrorist Networks 163 the next and form subgroups of networks along the way. Kamel had evolved from his training in the Afghan camp in the early 1990s, to an insurgent in Bosnia, then on to be a well-connected hub of the terrorist network.41 Networks in Geographic Space In spite of less reliance by terrorist groups for a controlled geographic territory for generating operational revenue and providing a safe haven, there is a necessary physical presence in specific socio-cultural support areas, logistical supply points, training sites, and safe houses. Regardless of the advancement of information technologies there is a high level of spatial interaction by actors in terrorist organizations for recruiting, financial flows, and tactical support at various geographic scales. Network dynamics include the spatial interaction of ideas, innovations, orders, and tasks, flows of goods such as money, weapons, etc., and movement of actors throughout the network. When geographic or geospatial information corresponds to the components of a social network, the network can be mapped to provide insights into the structure and dynamics of the network. The visual portrayal of information is used because humans “reason and learn more effectively in a visual setting than when using textual and numerical data,”42 and also because visualization can offer implicit information about spatial data as well as non-spatial data. Activity based mapping can include locations of multiple activities as well as temporal variables (e.g., minute, day, month, year, etc.).43 By using activity based mapping it is easier to discover spatial, temporal, and spatio-temporal patterns within data. Terrorists work in activity spaces which include necessities such as funding, targets, weapons, planning and education, etc., and their activities take place in time. An example of accessibility visualization is given by the spatio-social network of Aafia Siddiqui in Fig. 4b below. In this example, important geographic locations for strategic operations or interactions can be found when the social network data is mapped (Fig. 4a). In Boston, Aafia lived with other terrorists, while she was educated at MIT in Biology. The flow of funding begins to become apparent, as well as ties to Ibrahim Bah who was a gateway into funding through diamond trading in Africa and a leader of the Revolutionary United Front (RUF). Through the assumed case given by these data, Aafia Siddiqui is two degrees from Osama bin Laden through Khalid Shaikh Mohammed (KSM). It is possible that Aafia is directly linked to bin Laden but the relationship is not represented in these data. Sageman, Understanding Terror Networks. M. P. Kwan and J. Lee, “Geovisualization of Human Activity Patterns Using 3D GIS: A TimeGeographic Approach,” in M. F. Goodchild and D. G. Janelle (eds.), Spatially Integrated Social Science: Examples in Best Practice (Oxford: Oxford University Press, 2003), p. 3. 43 Kwan and Lee, “Geovisualization.” 42 41 164 (a) R. Medina, G. Hepner Fig. 4a Aafia Siddiqui social network as visualized at www.trackingthethreat.com In order to conceptualize terrorist network activities and accessibilities both physical and virtual spaces must be considered. The action of decentralization is supported by information technologies such that geographically dispersed terrorist networks require the use of virtual interaction to operate efficiently, while they operate in physical spaces. When people or organizations use both physical and virtual activity spaces they are acting in what has been referred to as “hybrid space.”44 Operational cells of terrorist networks can now substitute physical interaction with virtual interaction, although they may choose to use physical space for planning at times to remove any risk of leaving a digital trail. While virtual interaction can be 44 M. Batty and H. J. Miller, “Representing and Visualizing Physical, Virtual and Hybrid Information Spaces,” in D. G. Janelle and D. C. Hodge (eds.), Information, Place, and Cyberspace: Issues in Accessibility, (New York: Springer, 2000). Geospatial Analysis of Dynamic Terrorist Networks (b) 165 Fig. 4b Spatio-Social network of Aafia Siddiqui DOB – 3/2/1972 Birthplace – Pakistan Educated at MIT (Biology) Founded the Institute of Islamic Research and Teaching Linked to Ibrahim Bah (Diamonds) Provided funds to the Benevolence International Foundation (Chicago) and the Al-Kifah Refugee Center (Brooklyn) Member of al Qaeda Believed to be in Pakistan Data source: FMS www.trackingthethreat.com used in the planning states of and operation, the actual operation must take place in physical space, unless the actors are planning a cyber-terrorist attack. For example, cells must be strategically placed such that access to targets or other objectives is maximized and access to monetary opportunities is minimized if the cell is not funded by the organization. The location of terrorist bases, safe houses and support facilities, and cells involve several geographic factors. These facilities can only exist in areas of community support, and disorganized political authority. Proximity to international borders and favorable terrain for operations and security tend to be more suitable locations for facilities.45 45 A. D. Lohman, “Insurgencies and Counter-Insurgencies: A Geographical Perspective,” in E. J. Palka and F. A. Galgano (eds.), The Scope of Military Geography: Across the Spectrum from Peacetime to War (New York: McGraw-Hill, 2001), pp. 263–290. 166 R. Medina, G. Hepner Interaction can exist in virtual space using computers and cell phones, but the majority of operational goals require accessibility in physical space. Conceptualizing terrorist networks in hybrid space is required of any present day research on terrorism or counterterrorism, as the actions of terrorist organizations in both the physical world and the virtual world are equally important. Examples of the geographic mapping and visualization of terrorist network dynamics using geographic information systems (GIS) are shown in Figs. 5 and 6.46 In these figures, terrorist incidents in Iraq for 2004 are mapped. The vertical bars in Fig. 5 represent the number of incidents, with the cities receiving the most incidents labelled. In Fig. 6, the bars represent the number of fatalities per incident. It is apparent that the cities of Baghdad, Mosul, and Kirkut suffer the most incidents, but more people die per attack in Irbil, Mahhoudiya, and Anah. In this case the cities with high fatalities per incident had only one to two recorded attacks in 2004, but each of these attacks had a substantial number of fatalities. Incident, fatality, and fatality per incident data are provided below in Table 1. Fig. 5 Iraq – number of incidents by city (2004) 46 Data for these maps were collected online from the National Counter Terrorism Center’s Worldwide Incidents Tracking System (WITS) at http://wits.nctc.gov/Main.do. Geospatial Analysis of Dynamic Terrorist Networks 167 Fig. 6 Iraq – fatalities per incident by city (2004) Table 1 Incidents, fatalities, and fatalities per incident for mapped cities in Iraq (2004) City Basrah Anah Baghdad Ba’qubah Irbil Kirkuk Mandali Mosul Incidents 33 1 304 53 2 75 1 102 Fatalities 102 16 976 193 110 156 54 251 Fatalities per incident 3.090909 16.000000 3.210526 3.641509 55.000000 2.080000 54.000000 2.460784 Networked organizations act in social and geographic space. Terrorist groups, while unique in several ways, share characteristics of many other more benign social networks. Analysis of these universal characteristics, with recognition of the unique qualities of terrorist networks allows for scientific analysis of their structure and dynamics. This is a necessary undertaking to analyze and deal effectively with these groups in the future.