A good way to understand how terrorist networks work is to map them. A well constructed map provides insight into how the network operates. In his paper, "Uncloaking Terrorist Networks" Valdis Krebs uses social network analysis to map the terrorist network that attacked on 9/11. Despite incomplete knowledge of all the connections between members, his analysis is still cogent and probably fairly close to reality. Here's what he found out about the networks structure:
A sparse operational network. The 19 members of the operational cells (the actual 9/11 hijackers) were relatively isolated. The mean path length -- the average number of hops between any one member of the network to any other -- was a high 4.75. The greatest number of network connections between members was 5. Additionally, key members pulsed connections to other key members in the network through brief coordination meetings. These brief meetings reduced the distance between operational members by 40% (from a mean path length of 4.75 to 2.79).
A larger administrative network to support the operational teams. The administration network provided a means to "keep alive" many of the weak connections between sparsely connected members of the operational network. They also provided much of the ongoing care needed to prepare an otherwise isolated operational team member for the attack.
A leadership structure despite a lack of formal hierarchy. When the network is looked at in its entirety (operational plus administrative), Mohammed Atta emerged as the leader. Atta had 22 connections to other people in the network, much more than any other (the nearest other outlier was 18). Mohammed Atta's position on the network gave him control of its operation. Atta scored high in all measures of network connectivity: degrees (activity on the network), closeness (his ability to access others on the network -- fewer number of hops), and betweeness (control over the network -- a central position that allowed him to broker the flow of information across the network).
The costs and benefits of this network configuration
Al Qaeda didn't design this network. It grew organically based on a combination of the operational requirements and the initiative of its members. Despite this organic nature, the design worked extremely well. Here are the dynamics:
The interplay of distance in the operational network and the closeness of the administrative network enhanced the network's operation. The intentional lengthening of the mean path in the operational network improved the security of the network (no one member knew a majority of the others). The administrative network mitigated the detrimental aspects of this configuration (less learning, poorer planning, etc.) by helping to lower the mean path between members. It also provided supplemental clusters of skills and capabilities to provide localized enhancement of the operational network. NOTE: Notice that three of the four the operational cells were at the minimum size for small groups while the entire group -- operational plus administrative -- is at the optimal size for a medium sized group (see "What is the optimal size of a terrorist network?") The only small cell that failed (crashed in PA) was below the lower limit of five members.
Trust between members of the network was based on deep relationships. Many of the relationships between members of the 9/11 terrorist network were developed years before in the al Qaeda training camps in Afghanistan. This prior knowledge/experience allowed the communication between network members to operate at a high degree of sophistication. It also lowered the transaction costs of forming and operating the network (which may be one of the keys to why these networks can be so lean -- more on this later, its a complicated issue that will take some explaining). The downside to this trust requirement is that people with unique skills may not be included.
There was too much overlap between unique skill sets and leadership positions in the network. Examination of the network indicates that the trained pilots (a unique skill) were also the network leaders (identified by the number of connections). This overlap of skills/responsibilities made the network vulnerable. The reason for this is probably a combination of personal bias of Mohammed Atta when building this network and the requirement for an extreme level of commitment necessary to conduct a kamikaze operation.
Hard Lessons
The 9/11 terrorist network will likely serve as a model for future activities. Here's what can be applied to future counter-terrorist efforts:
Expect these operational networks to be run by relative unknowns.Osama bin Laden, nor many of his top aides, were not a direct part of the network map. Osama's absence indicates that he has a "hands-off" management style. He does not micromanage. The network structure indicates that projects sponsored by al Qaeda are operated like independent businesses that acquire their own resources, do their own planning, and execute their plans without reference to senior authority. This is further support for the idea that bin Laden is operating a venture capital incubator model of terrorism. This also implies that Osama's removal will likely not have any measurable impact since al Qaeda's operations are run by entrepreneurs over the period of years.
Assassination of a single network leader will not work. Despite the concentration of leadership and unique skills in Mohammed Atta, his assassination would not have prevented the operation. A second emergent leader with a high degree of connectivity was present: Marwan al-Shehhi. If Atta was removed, his loss would have eliminated one cell from the operational team (he was a pilot) while leaving most of the network intact. In order to disrupt the network fully, multiple high flow targets must be taken out simultaneously in order to prevent the emergence of alternative leadership. NOTE: There also is a high degree of dynamism in the network structure not captured by this analysis. This will be a topic of future analysis.
Strategic attacks are possible with a network of less than 70 people. The small size, and low cost, of the 9/11 terrorist network should give pause to all counter-terrorist planners. Given that an estimated 100,000 people trained in Afghanistan, the potential for replays of 9/11 style strategic attacks is very high. The key members of the 9/11 network relied on trust built on face-to-face meetings in the Afghanistan camps. This implies that the key to unraveling the entire network is to gain access to Osama's list of people who trained in the camps (al Qaeda literally means "the database").
