Estimating the Shape of Covert Networks

Social network analysis has been used to understand groups of individuals and how they operate. Most of the literature in social networks has dealt with overt organizations with an easily discernable network structure. This paper examines the possibilities of using the inherent structures observed in social networks to make predictions of networks using limited and missing information. The model is based on empirical network data exhibiting the structural properties of triad closure and adjacency. Triad closure indicates that if person i has a dyad with person j and person j has a dyad with person k, then there is a higher than chance likelihood that person i and person k have a dyad. Adjacency is a corollary of triad closure stating that if person i has a dyad with person j, it is more than likely that person i has a dyad with person k. The model exploits these properties using an inference model to update adjacent dyads given information on a reference dyad. The model is tested against several networks to understand and discern its behavior. The paper illustrates that if the model is built with careful consideration towards the network being predicted, it may assist in making better decisions regarding uncertain organizational phenomenon. However, the model performs relatively poorly if there is a disproportionate amount of information either supporting or not supporting a dyad and/or if dyadic priors are well informed. The method is applied in a covert network example, and has been extended for epidemiological networks and improving performance in organizations operating under stress. The paper opens up new avenues in the development of models designed to make network predictions and use those predictions to make better decisions. Support: This research has been supported in part by the National Science Foundation IGERT in CASOS, the office of Naval Research ONR 1681-1-1001944 and the center for Computational Analysis of Social and Organizational Systems. The views and results expressed herein are solely the responsibility of the authors and do not represent the official views of the Office of Naval Research or the National Science Foundation. Unknown Network Structures TRADOC PAM 525-5 (1994) hypothesizes that Command and Control will face new and unconventional threats in the post Cold War environment. These threats, largely a result of increased global instability and the rise of regional conflicts, require a change in the tactics and techniques of Command and Control. Arquilla and Ronfeldt (2002) indicate that future conflicts will take place against asymmetric threats consisting of networked forms of organization. These networked forms of organization would have the ability to cloak their activities from detection using dispersed organizational forms and swarming tactics. The events of September 11, 2001, the USS Cole bombing, and embassy bombings in Africa by terrorist cellular units illustrate the effectiveness of networked forms of organization and swarming tactics in the post Cold War era. Such threats require sophisticated tools and technologies to coordinate information and construct an accurate picture of threats and the particular risks they pose for the United States and its Allies. Such techniques must recognize the multifarious nature of such threats, both in the organizational structure of such terrorist threats, and the particular skills, tasks, and resources characteristic of individuals in these groups (Krackhardt and Carley, 1998). Dombroski, M. , P. Fischbeck, and K. Carley, June 2003, “Estimating the Shape of Covert Networks,” Proceedings of the 8 International Command and Control Research and Technology Symposium, Washington, DC. ________________________________________________________________________________________________________ 3 Social network analysis has been used to understand organizational dynamics in a variety of application areas (e.g., epidemiology, technological diffusion, and management consulting). A group’s behavior, values, and/or performance can be articulated by understanding the relationships that exist within the group. Most applications to date have been on open groups or societies in controlled experiments. Currently there have been very few network applications to covert or “hidden” networks of interest. Sparrow (1991) discusses the prospects for using social network analysis as investigative tools for intelligence and law enforcement. Sparrow discusses the prospects of using traditional social network centralization measures to identify key individuals in a covert organization and inferring their activities through their connections. Erickson (1981) and Baker and Faulkner (1993) discuss the structure of covert organizations and their distinguishing structural characteristics. Baker and Faulkner conclude that the requirement for secrecy distinguishes the covert organization from the overt organization, which permeates every aspect of the organization including its structure and productivity. Covert organizations with high task loads that require coordination are generally more hierarchical than organizations with lower task loads and less coordination, although all covert organizations studied exhibited flatter and more dispersed forms of organization than comparatively sized overt organizations. PCI (2002) has developed software and tools to assist law enforcement professionals to coordinate information gathering techniques on illicit organizations and their structure through the use of Anacapa charts and link analysis to build social networks. The FBI’s Big Floyd is a template matching system designed to link archived criminal tactics and organized criminal groups with current criminal investigations (Bayse and Morris, 1987). Although the tools and techniques described up to this point would be useful to Command and Control for detecting and understanding the activities of networked criminal and terrorist organizations, a tool that can infer the structure of these covert organizations using known social network properties and limited observational data does not currently exist. Such a tool would not only be beneficial in building a more complete picture of covert networks using limited data, but could also allow policy makers to make better-informed decisions. This paper presents an empirically based probabilistic model, grounded on observational social networks, to infer network structure using limited and incomplete information. First, relative similarity information is used to build a prior probability assessment of who communicates with whom. As direct information on dyadic likelihood is received, these priors are updated. Adjacent dyads are updated through an empirically based inference model. This continues until the likelihood of every dyad in the probabilistic network is inferred and updated. The resulting network provides an estimate of the actual network and may be used to guide policy analysis. Network Properties Researchers have uncovered inherent structural properties in social networks (Skvoretz, 1990). These properties arise from the structure of the network itself and not from the behavior of the individuals in the network. They include reciprocity, triad-closure, and triad-closure reciprocity. A corollary of the triad properties is an adjacency property. Simply stated, if persons i and j are talkative with each other, then they are likely to be talkative with others. Formally, if A and B are adjacent dyads, then if n n E n n A B > > ) ( , and if n n E n n A B < < ) ( , Dombroski, M., P. Fischbeck, and K. Carley, June 2003, “Estimating the Shape of Covert Networks,” Proceedings of the 8 International Command and Control Research and Technology Symposium, Washington, DC. ________________________________________________________________________________________________________ 4 where nB is the number of interactions recorded on dyad B, E(nA) is the expected number of interactions on dyad A, and n-bar is the mean number of interactions for the whole network. In other words, if B has above average activity then the expected value of the distribution of interactions for all of its adjacent dyads will also exceed the mean number of interactions. The degree to which these properties exist varies from network to network (Krackhardt, 1987). Constructing the Model The problem domain will determine the relationship of interest (ROI). In most real-world situations, only samples of interactions between individuals can be observed. Depending on the type of interaction, knowing that i and j interacted will inform our belief about the likelihood of a ROI existing between the individuals. But, what, if any, inference can be made about these individuals’ relationships with others in the network? For illustrative purposes and to facilitate model development, we focus on one social network dataset, Bernard and Killworth’s 1979 observed interactions between 58 fraternity brothers at a West Virginia university. Because of the size of this data set, it was not possible to develop a robust inference model based on the triad-closure property. Instead, the model is based on adjacency properties found in the data. Figure 1 shows this relationship between interactions on a reference dyad and the expected number of interactions on an adjacent dyad. As the number of communications for the reference dyad increases, so does the expected number for the adjacent dyads. Adjacency Property-A plot of Conversation Counts