Mapping Networks of Terrorist Cells

Krebs, V.E. (2002).

Summary
Through this article, Krebs attempts to map the social networks of the 19 hijackers involved in the terrorist attacks of September 11, 2001. He uses the same approach as he does for mapping project teams within organizations; however, while overt networks can be fairly easy to map, covert networks are significantly more difficult.

Krebs cites Malcolm Sparrow (1991) in describing three major problems of analyzing criminal networks:

1. Incompleteness - the inevitability of missing nodes and links that the investigators will not uncover
2. Fuzzy boundaries - the difficulty in deciding who to include and who not to include
3. Dynamic - these networks are not static, they are always changing. Instead of looking for the presence or absence of a tie, Sparrow recommends looking at waxing or waning strength of ties based on the situation.

These terrorist networks are held together by deep, trusted ties that are usually not visible to outsiders. Ties are strengthened when terrorists spend time together, specifically in classes or training. 

Krebs' initial social network (Figure 1) was created using strong ties built between terrorists who lived and learned together. Interestingly, many of the individuals on the same flight were more than two steps away from each other (beyond the horizon of observability). This practice minimizes the damage to a network if an individual is captured or compromised. Interestingly enough, Osama bin Laden reiterated this strategy: "Those who were trained to fly didn't know the others. One group of people did not know the other group" (Department of Defense, 2001). 

Figure 1. Trusted Prior Contacts

This initial network poses the question how work gets completed if members are so unconnected? Essentially, meetings are held which develop short-cut ties to coordinate between distant nodes in the network (Figure 2). However, after these meetings are held, the short-cut ties fall dormant until the need for activity again. These shortcuts improve the overall information flow in a network.

Figure 2: Trusted Prior Contacts + Meeting (Short-cut) Ties

Mohamed Atta, the hijacker's ring leader, scored the highest on measures of degrees and closeness, and was second in betweenness centrality. These measures do not necessarily identify Atta as the leader, but there are likely a number of nodes and links absent from these maps. Figure 3 includes contacts and intermediaries who assisted the 19 hijackers and clearly shows Atta at the center of the 'Hamburg cell' (in the bottom left) and his importance to the overall network.

Figure 3: Hijacker's Network Neighborhood

Social network analysis is frequently used for prosecution; once the investigators have a suspect, they can map the criminal's network through financial transactions, phone records, messaging services, and other types of government records. Attempting to prevent illegal activities based on social network analysis is much more difficult. Covert networks limit their outside ties and keep their internal, strong ties dormant unless necessary. Reducing overall number and activity of ties reduces the visibility of the network and minimizes the possibility for a leak.

Interestingly, many of the strong ties in Figure 3 were concentrated around the hijackers trained as pilots. This concentration of both unique skills and connectivity within the same nodes makes a network very vulnerable to disruption. These key individuals can be targeted by law enforcement for capture or compromise and severely deteriorate the operational and logistical capabilities of the covert network. 

While this knowledge could be used to prevent illegal activities by covert networks, the challenge still lies in identifying members of the network before it is too late. In order to overcome this hurdle, Krebs recommends that the various intelligence agencies share and aggregate their information to build a larger, more complete network. There are significant difficulties in putting this recommendation into practice, but it would be an advantageous first step to discovering and disrupting covert networks.

Critique

The article presents a detailed view of how social network analysis can be used to assess and take action against covert networks. Krebs' analysis that the most connected members of this network were also those with the unique skills (the pilots) is something that can be applied to similar terrorist network structures in order to prevent their activities. One improvement that should be made, or a measure that can be considered in future research, is the use of Eigenvector centrality. Eigenvector centrality is used to determine the influence of nodes in a network through their connections to other high or low scoring nodes. This measure would have likely shown Mohamed Atta to be the leader of this particular social network.

Source:

Krebs, V.E. (2002). Mapping networks of terrorist cells. Connections, 24(3), 43-52.

Retrieved from: https://www.aclu.org/sites/default/files/field_document/ACLURM002810.pdf 

Morphological Analysis (Rating 3.5 out of 5 Stars as a Method; 4.25 out of 5 stars as a Modifier)

Note: This post represents the synthesis of the thoughts, procedures and experiences of others as represented in the  articles read in advance (see previous posts) and the discussion among the students and instructor during the Advanced Analytic Techniques class at Mercyhurst University in November 2015 regarding Morphological Analysis as an Analytic Technique specifically. This technique was evaluated based on its overall validity, simplicity, flexibility and its ability to effectively use unstructured data.

Description:

Morphological Analysis (MA) can be used as either a methodology or a modifier. According to Fritz Zwicky, the developer of Morphological Analysis, this is a method for structuring and investigating the relationships between components and dimensions of a complex problem. This methodology allows an analyst to eliminate potential relationships due to inconsistencies between components. A less-structured version of MA can be used as a modifier through idea generation, mental modelling, or brainstorming (Refer to Structured Analytic Techniques for Analysis by Heuer and Pherson).

Strengths:

• Helps identify low probability-high impact scenarios
• Can weigh and consider many variables and scenarios
• Identifies intelligence gaps and helps form the intelligence collection plan
• Leaves an audit trail about how judgments are reached
• Can be used for idea generation, mental modelling, or brainstorming
• Can generate scenarios either intuitively or through quantifiable software
• Highly flexible, can be used in a variety of fields
• Can be updated and adjusted with new information
• Reduces the chance events will play out in a way that the analysts has not previously imagined

Weaknesses:

• It has potential for personal bias to affect the matrix
• The structure could inhibit free thinking
• When used as a method, there is a high difficulty in determining a definitive estimate
• Can generate too many possibilities that may distract analyst
• An exhaustive approach will quickly grow to involve a large number of scenarios, requiring computer assistance
• When used as a modifier, there is not a large amount of support in the literature

How-To:

• Step 1: Determine the objective or situation that needs to be analyzed or defined
• Step 2: Identify and properly define the dimensions of the problem – that is to say, the relevant issues involved.
• List the things about the situation that can be varied or changed in some way. Select a subset of two to six variables to investigate further. These will normally be significant parts of the situation
• Step 3: For each issue (parameter), a spectrum of “values” must be defined. These values represent possible, relevant states or conditions that each parameter can assume.
• Reduce the total set of (formally) possible configurations in the problem space to a smaller set of internally consistent configurations representing a “solution space”.
• Evaluate the solution space to assess relative probabilities of the remaining scenarios.
• In an idea generation modifier of this technique, plotting the criteria and the corresponding situations is the primary step. Then, visually matching the corresponding scenarios can assist in discovering new ideas and assist in further analysis.

Personal Application of Technique:

For the in-class exercise, a less-structured version of MA was used as an idea generation technique. A PowerPoint presentation was produced defining Morphological Analysis, application, value and included instructions for the class exercise. For the class exercise, all students were paired up into groups of two and worked together on Google Docs. A matrix on Google Docs was constructed with predefined dimensions: Group, Type of Attack, Target, and Impact. The scenario the groups explored was: A Terrorist Attack in Erie. Each group filled out the matrix with criteria matching the dimensions. The second step involves generating scenarios, intelligence gaps and low-probability high-impact events based upon on the ideas generated within the matrix. Each category in the second step was separated to give room for the groups to type out their answers.

For Additional Information:

Ritchey, T. (1998). General Morphological Analysis. Swedish Morphological Society. Retrieved from: http://www.swemorph.com/pdf/gma.pdf

Swedish Morphological Society

"Using Morphological Analysis To Solve Complex E-Learning Problems"
By: John Aleckson
Web Courseworks: a learning technologies company

Summary:
 The scenario begins by presenting a situation in which a business has multiple decisions and scenarios to deal with. Possible questions that may need to be answered: How do you compensate Subject Matter Experts (SMEs)?, Do you hire full-time employees or do you outsource?, etc, etc. All of these are issues facing businesses where analytical methods could assist in the decision making process.

In this article, the author selects morphological analysis to use in this selected scenario. The benefit of morphological analysis is that it allows the analyst to look at an issue from many different angles and allows for the discovery of different and unique details of a problems. In the example the author uses a situation in analyzing how a business should go about hiring a SME.

As you can see, the general issue at hand is how to hire a SME. The two overarching factors are SME Compensation and SME Involvement in the project. There are then 3 levels of commitment criteria to analyze and 4 factors of compensation to input into the matrix and analyze. Depending on the resources available and the exact project at hand, you can then select the best or the top few SME situations that will fit your current projects/scenario.

Critique:
The main criticism of this is that it does not go into detail as to how you select the various factors to input into the matrix. Similar to the issues of MCIM, there still is the potential for bias when it comes to "weighting" and deciding what to input into each box. If an analyst already has a preconceived idea of the best plan this method's usefulness will be severely weakened. The author mentions and I agree, this method is best when a group of people work on it. If only one person works on it the advantage of idea generation is definitely weakened as well.

Source:
http://www.webcourseworks.com/using-morphological-analysis-solve-complex-elearning-problems/ 




 

A Morphological Approach for Proactive Risk Management in Civil Aviation Security

By: Hernando Jimenez, Ian C. Stults, and Dimitri N. Mavris

Summary:

This article discusses a study in which morphological analysis was used in order to create a framework that would proactively assess the rest of a terrorist attack on an air transportation system (ATS). The goal of morphological analysis is to create possible attack scenarios and the likelihood of those scenarios. In this example, profiles of various terror organizations were developed and outlined so that a specific assessment of high-risk scenarios was able to be made. If this method was used by defensive organizations, then they would be capable of quickly assessing the risks of the various terrorist attack scenarios and be able to protect air transportation systems more effectively. This is a very practical example as the commercial aviation system continues to be a very critical part of infrastructure, gets a lot of attention from the media when something occurs, and continues to be a high risk target for terrorist attacks. 

This article also discusses the background of risk management and assessment. According to this article, risk is "the combination of the likelihood of a given event and the consequence or associated outcome of that event if it occurs." When the risk has been characterized and evaluated, then the next step is the mitigation of that risk. The combination of risk assessment and risk mitigation is known as risk management. Risk assessment is when the risk is modeled and quantified by estimating values for risk parameters.

When the risk was assessed in this case, it was determined as a product of probability and a consequence scalar index, then identified within a risk-level matrix that is depicted in the article. This event impact is categorized as low, medium, or high, with corresponding scalar values of 10, 50, and 100. In addition, the low, medium, and high likelihood events are modeled via probability values of 0.1, 0.5, and 1.0. For this example, the values for high risk events scored above 50, the medium risk events scored between 10 and 50, and low risk events scored below 10.

To study the vulnerabilities of the ATS in this example, the system's architecture was explored from a purely operational perspective which means that the only important elements were the ones directly involved in the architecture (i.e. control tower of the airport and the airport itself).In order to do this, morphological analysis was used. What the morphological approach allows analysts to do is to break down the potential attacks into their key components, examine and identify the combinatorial rules between them, and search for specific attacks that would reveal those vulnerabilities. The first step to do this in this specific example was to define an attack model that featured the key elements. In the model, the target is the parts of the ATS that will be primarily affected (i.e. aircraft or parts of an airport), and the tactical objective defines the impact or effect caused by the attacker. There were two limitations in the study however: the model couldn't capture ulterior motives or higher level objectives by the attackers. 

Based on the morphological field that was created by the authors, there were 5,040 different attack scenarios that were created and 1,172 of them were internally consistent. Something to keep in mind with this example, however, is that the authors of this study are not experts on ATS security, so the values and results are notional and meant just for the demonstration of this method. When the results were generated, it was found that explosives are a high-risk weapon, weapons transported in a ground vehicle or in garments or carry-on luggage were particularly interesting, and people who use airports are high-risk targets in comparison to other assets. Because of this, it seems that no single particular area of focus exists and that points of entry in areas that are more accessible and closer to passengers are at a much higher risk.

The results say that the use of morphological analysis was helpful overall. They specifically say that top-level and tactical attack models provide general applicability and show a wide range of scenarios and sensitive security information can be avoided. The fact that the results could be visually represented was also a plus since the authors say that it's vital for adequate assessment and evaluation of potential risks. It was also helpful because the attacker profiles mapped to data filters allowed the generic attack data set to be characterized and refined which then allowed a defense approach tailored to what the entities of interest were.

Critique:

Overall, I thought this article was beneficial and interesting. In intelligence analysis I can definitely see the value of using a method such as morphological analysis because scenarios are created and then different aspects of them are weighted which isn't an option with some methods. In this particular example, however, there seemed to be a few critiques that could be made which are the fact that the authors who conducted the study were not experts on ATS security which could have affected the scenarios that they were able to come up with and the fact that this method seems to be most useful for tactical analysis. It did provide a good example of a morphological analysis though, so I think it is worth the read.

Source: http://enu.kz/repository/2009/AIAA-2009-1636.pdf

MAE Design Model and Morphological Analysis

Morphological Analysis

This technique helps generate ideas. In this example, this technique helps establishes a vegetable collection system. The analysts set up a table and incorporates the vegetables and options by collating them into a single matrix. This set up helps analyst see all of the ideas together. When building the table analysts should, “try to reduce the number of generated ideas from the lateral thinking diagram into those that really are the most suitable.” The table will help the analyst visualize the various systems that will combine to the final product.

Figure 1 is the Morphological Table for a vegetable collection system. This chart shows how the Generated Alternatives are formed into a matrix with images to help supplement the variable. Analysts then begin to formulate a path in order to develop a design or scenario. This step is depicted by Figure 2.

According to the author, analysts are now at a stage to begin concept design. For starters, “the first few concept designs should follow different routes through the Morphological Matrix, that is why you have compiled it. Do not ignore it. In this instance;”
Concept 1 could be – scoop > conveyor belt > water from well > bowl > track system > wind blown
Concept 2 could be – triangular plow > rotating mover > water from well > wheel > hand push
Concept 3 could be - scoop > conveyor belt > square mesh > wheel > hand push

Analysts should be able to produce at least three well-considered concepts. These are then annotated and developed to a level that is distinguishable as an acceptable solution or key assumption.

Critique 

This method leaves a clear audit trail about how the judgments were reached and it reduces the chance the events will play out in a way that the analyst has not previously imagined. Although it, allows analysts to identify intelligence gaps, it may yield too many possibilities. Morphological analysis could also be confusing. It is effective when used early in an analytic product to generate ideas.

 

Source: http://cuba.coventry.ac.uk/maedesign/concept-design/l1-sketching-brainstorming-ideas-and-morphological-analysis/l1-morphological-analysis/