Introduction

Although terrorism recurs throughout human history, the recent wave of transnational jihadism arose over the past four decades and shows few signs of abating. The social structures and dynamics of both terrorist networks and counterterror organizations coevolved and continue their mutual adaptations to changing environments and innovative technologies. A key issue in tracking transnational terror trends is the utility of social network analysis, both as a theoretical perspective and as a methodological toolkit, for understanding and assessing terror organizations, and for developing counterterror policies and practices to detect and disrupt terror attacks. Advances in terrorism research have implications for investigating and thwarting other types of criminal clandestine, covert, and dark networks, such as arms-trafficking, diamond smuggling, human and sexual trafficking, nuclear proliferation, toxic waste disposal, and trade in endangered species. These applications have broader significance for the many professions and fields contributing to terrorism studies, including sociology, criminology, organization studies, political science, international relations, military science, mathematics, computer science, security studies, law, and law enforcement.

The myriad definitions of terrorism typically emphasize the political objectives of individuals or groups engaged in violent acts. These goals often derive from an ideology, such as anarchism or Marxism, or from group identification, such as nationalist or religious affiliation. This article concentrates on emerging trends in transnational terror networks and counterterror efforts against them. Title 22 of the United States Code defines international terrorism as “premeditated, politically motivated violence perpetrated against non-combatant targets by subnational groups or clandestine agents” which involves citizens or the territory of more than one country (U.S. Department of State, 2013, p. 293). Further, section 219 of the United States' Immigration and Nationality Act defines a “foreign terrorist organization” (FTO) as one that “must engage in terrorist activity … or terrorism … or retain the capability and intent to engage in terrorist activity or terrorism” and “must threaten the security of U.S. nationals or the national security (national defense, foreign relations, or the economic interests) of the United States” (p. 244). For 2012, the State Department designated 51 FTOs fitting this definition. On the basis of their thumbnail sketches, 36 FTOs were Islamist; three Colombian; two Irish; two Greek; and one ach Basque, Filipino, Israeli, Japanese, Kurdish, Peruvian, Sri Lankan, and Turkish. Of course, many hundreds of terrorist groups operate within national or subnational territories.

Foundational Research

Although Claire Sterling's The Terror Network (1981) described links among Palestinian and Irish Republican Army terrorists and the KBG in the 1970s, academic researchers began applying social network methods to terrorist networks after the 9/11 Al-Qaida attacks inside the United States. Foundational efforts were case studies of particular groups or operations, culling data from newspaper reports and court trial documents, then creating matrix files for analysis with social network computer programs. Within weeks after 9/11, Valdis Krebs (2001, 2002) constructed a seminal two-dimensional diagram (graph) showing the connections among the 19 hijackers and 43 accomplices who provided money, skills, and information. Mohammed Atta, leader of the field operations, was the central actor and the four pilots formed a tight clique. Every hijacker was two or fewer steps from two others, Nawaf Alhazmi and Khalid Almihdhar. The Central Intelligence Agency knew these two men had participated in a January 2000 planning meeting with top Al-Qaida leaders in Malaysia. But, the CIA failed to inform the Federal Bureau of Investigation when the men returned to America (National Commission, 2004). The Intelligence Community's failure to track these suspects was a missed opportunity to detect and possibly apprehend the 9/11 network before it struck. Krebs (2001) concluded that a “dense under-layer of prior trusted relationships made the hijacker network both stealth and resilient,” but “concentrating both unique skills and connectivity in the same [persons] makes the network easier to disrupt—once it is discovered.” In another foundational analysis, Marc Sageman (2004) used biographies of 366 participants in the “global Salafi network” to identify ties based on kinship, friendship, religious, and work relations. He found four large clusters built around highly connected “hubs”: Al-Qaida Central Staff, Maghreb Arabs (North Africa), Core Arabs (Saudi Arabia, Egypt, Yemen, Kuwait), and Southeast Asians (Indonesia and Malaysia). However, his only network diagram was schematic, rather than based on actual relations among specific individuals.

Other network researchers constructed matrices and diagrams of known connections within terrorist cells. Steven Koschade (2006) found a high density of ties (0.43) among 17 members of a large Jemaah Islamiyah cell that bombed a Bali, Indonesia, nightclub in 2002. The structure was very centralized, revealing a “mix between efficiency and covertness” (p. 570). Field commander Samudra and logistics commander Idris had exceptionally high scores on three centrality measures, which placed both men at the center of the graph. Samudra had “the highest ability to access others, and the greatest control over the flow of information in the network … Exclusively due to his connection to Team Lima [support group], and the suicide bomber Arnasan” (p. 571). Given the high connectivity inside the cell, detection and capture of any member by law enforcement might have exposed the entire group and thwarted the bombing. By comparing four terrorist cells operating in or against Australia, Koschade (2007) concluded that cells focused on efficiency rather than covertness were more successful in carrying out attacks. Betweenness centrality (control over information flow) was crucial for identifying cell leaders. A broader analysis of Jemaah Islamiyah mapped a half-dozen leadership, kinship, and attack networks from 1993 to 2005 (Magouirk, Atran, & Sageman, 2008).

A network of 45 jihadis conducted the March 11, 2004, Madrid train bombings (Jordán, Mañas, & Horsburgh, 2008). Although that operation was inspired by Osama bin Laden's explicit threat to target Spain because of its military involvement in the Iraq War, the participants had few connections to Al-Qaida. Instead, it was a largely grassroots action organized by three immigrants of Moroccan and Tunisian origins. Its decentralized cell structure had advantages of “autonomy of operational and tactical command and control, the capacity to adapt to environments, logistical autonomy, and protection by way of judicial guarantees” (p. 35). However, lack of professionalism and reliance on open social networks for recruitment, financing, and arms and explosives made the Madrid operation potentially vulnerable to detection and disruption. Ami Pedahzur and Arie Perliger (2006) diagrammed four Palestinian networks behind 42 suicide bombings during the al-Aqsa Intifada and Jewish terrorist networks inside Israel that targeted Palestinians and assassinated Prime Minister Yitzak Rabin (Pedahzur & Perliger, 2009). Other researchers applied network analytic methods to the Turkish Ergenekon terrorist organization (Demiroz & Kapucu, 2012), the Bakri-Hamza network at London's Finsbury Park mosque (Horne & Horgan, 2012), a global network of 381 persons affiliated with Islamist organizations (Medina, 2014), and a Melbourne jihadi cell disrupted before it could launch an attack (Harris-Hogan, 2013). Common features of these analyses were formal network measures that identify central, inner circle, and peripheral actors and plot their positions and connections in diagrams.

A related strand of terrorist research asserted an emerging nexus between organized criminals and terrorist groups. Terrorists not only engage in criminal activities to fund operations, but many transact with organized criminals to buy and sell goods and services, such as weapons and forged documents. Tamara Makarenko (2005) saw the origins of the nexus in 1980s Latin American narco-terrorism, exemplified in drug trafficking by the Revolutionary Armed Forces of Colombia (FARC). The terrorism-crime nexus went global in the 1990s with the ascendancy of transnational organized crime. Some analysts saw increasing integration (Curtis & Karacan, 2002), but others doubted whether genuine convergence is feasible (Dishman, 2001; Dandurand & Chin, 2004). This unresolved debate offers opportunities for future research.

Theorists speculated that counterterror pressures by law enforcement and military forces compel terrorist groups to change their structures and actions. In seeking an optimal balance between resilient security and communication inefficiencies, hierarchical organizations become more decentralized. Brian Jackson (2006) proposed an evolutionary process from tightly coupled organization, to coupled network, and thence to loosely coupled movement. Loose-coupling hinders the ability of counterterror organizations to detect tactical cells and “what actions should be taken to identify and exploit any vulnerabilities found there” (p. 242). Al-Qaida exemplified this trajectory from a corporate-like command structure before 9/11 to a subsequent “leaderless jihad” (Sageman, 2008). But, as decentralized cells acquire more independence to manage their logistics and select their own targets, top leaders lose control and efficiency. The shift to weakly connected network structures risks imperiling the organization's core mission, when incompetent rogue cells launch unsuccessful and counterproductive attacks.

Cutting-Edge Research

Mathematicians, game theorists, and computer scientists are dramatically expanding research beyond foundational case studies of terrorist networks. Much of their work centers on devising strategies for counterterror organizations to destabilize clandestine organizations. They develop elegant and precise mathematical models and computer algorithms, then systematically change parameters to assess capabilities of detecting and disrupting terrorist activities under varying conditions. Some models are not based on empirical data, but are theory-driven efforts that simulate network dynamics with artificial datasets. Other models harvest vast quantities of information from open sources, such as news reports and Websites, then mine these texts for data patterns that identify key network actors, relations, and properties. This section discusses a few exemplary cutting-edge models of both kinds.

An early effort applied the mathematical theory of ordered sets to quantify the extent to which a terrorist group ceases to function when some members are captured or killed (Farley, 2003). Assuming a hierarchical cell structure of leaders and followers, the model enables counterterror agencies to estimate the probability of disconnecting a network by removing a specified number of members. The method involves searching for the network's cutset, the network actors whose removal breaks all vertical chains of command linking leaders to foot soldiers. Of course, the mathematical model is moot for real terrorist groups that are not structured as hierarchical communication networks. (For related work, see Farley, 2007, 2009 and McGough, 2009.)

Another approach applied graph theoretic metrics to recognize and understand network structural properties. Lindelauf, Borm, and Hamers (2009a) compared models of covert communication networks to find structures with optimal trade-offs between two group objectives: secrecy to avoid detection and operational efficiency of information flow to coordinate and control cell members. Which model is optimal depends on assumptions about the likely exposure of all cell members if one person is randomly detected. For example, a star graph (all cell members communicate only with the leader) is the optimal structure for balancing the conflicting objectives if the detection of one member also exposes all his links to the other cell members. In contrast, if the probability of exposure varies by member centrality in the network, the optimal structures are reinforced rings and reinforced wheel graphs. Other scenarios making different exposure assumptions and imbalanced secrecy-efficiency trade-offs identify different optimal structures. (For related models, see Lindelauf, Borm, & Hamers, 2009b, 2010.) Notably absent from these graph theoretic models are counterterror organizations that actively try to detect and disrupt the terror networks.

Computational methods allow computer simulations of terrorist networks and the impacts of alternative counterterror strategies on their resiliency and capacity to conduct future attacks. Agent-based modeling methods involve “(i) the simulation of automated agent behaviors and interactions in the context of their environments; (ii) the analysis of macro-level patterns resulting from micro-level agent interactions” (Keller, Desouza, & Lin, 2010, p. 1020). By running thousands of simulations under varying parameter assumptions, researchers can provide some understanding and insight into potentially effective counterterror strategies against terrorist networks adapting to their opponents' actions. An example is the Stochastic Opponent Modelling Agent (SOMA) package of computational and network tools that used textual data automatically extracted from document sources to generate rules explaining a terrorist group's behavior (Sliva, Subrahmanian, Martinez, & Simari, 2008). Applied to 25 years of monthly data on the Pakistan-based Lashkar-e-Taiba (LeT), SOMA learned 10 rules that predicted when LeT was most likely to attack targets in the disputed Jammu and Kashmir provinces of India and Pakistan (Mannes, Shakarian, & Subrahmanian, 2011). These rules could “provide accurate probabilistic forecasts for both real and hypothetical situations,” helping policymakers and counterterror organizations make strategic decisions (p. 6). Other exemplary data-mining, event-forecasting, link-prediction models, and experimental methods include Mahesh, Mahesh, and Vinayababu (2010); Arce, Croson, and Eckel, (2011); Chaurasia, Dhakar, Tiwari, and Gupta (2012); Desmarais and Cranmer (2013); and Petroff, Bond, and Bond (2013).

Kathleen Carley's (2003) Dynamic Network Analysis (DNA) package integrated traditional social network analysis of actor-to-actor links with computational multiagent modeling to connect actors, locations, events, tasks, knowledge, resources, and other elements. It treats terrorist groups as “complex dynamic networked systems that evolve over time” (Carley, 2006, p. 1). DNA is a “toolchain” of computer programs for collecting extracting data from texts, mapping networks of words in texts, and forecasting changes. “Map analysis systematically extracts and analyzes the links between words in a text in order to model the author's ‘mental map’ as networks of words” (Diesner & Carley, 2004, p. 2). Network analytic methods identify actors' spheres of influence, emergent leaders, and paths among critical actors. Theories of social interaction, such as homophily, can be applied to estimate the probability of a tie between two actors where no connection is observed. Analysts can run can virtual DNA experiments, simulating the removal of actors and observing the consequences. Quantitative measures assess potential immediate and near-term threats from alternative actions by counterterror organizations. Carley (2006) illustrated DNA with an automatic collection of thousands of open-source texts about Iraq and Al-Qaida. The emerging network had a “decidedly cellular structure with 5–12 persons per cell” (p. 5). Over a decade, it decreased in density and communication levels, but increased in congruence, suggesting “a movement to a more distributed and efficient organizational form, possibly with larger cells” (p. 4). One counterterror implication was that removing highly central actors in communication network would be less effective than taking out key emergent leaders. DNA software was provided to the Counter-Terror Social Network Analysis and Intent Recognition (CT-SNAIR) project, which sought to develop automated tools to “connect the dots” in raw multimedia data by modeling and simulating terrorist networks and attacks (Weinstein, Campbell, Delaney, & O'Leary, 2009, p. 1). A serious limitation was the difficulty in obtaining “truth-marked data” (p. 13) to test the SNAIR algorithms.

Key Issues for Future Research

Constantly mutating transnational terror networks will shape emerging trends in the social network analysis of terrorism and counterterrorism. Although predicting the actions of terrorist groups is notoriously imprecise, some broad tendencies are discernible. Under pressures by counterterror organizations, global jihadism evolved during the past two decades from centralized hierarchies to networked groups, then to fragmented or isolated cells. Disconnected units are more difficult to detect and disrupt, especially lone-wolf attacks (Borum, Fein, & Vossekuil, 2012), such as the November 9, 2009, Fort Hood shooting and the April 15, 2013, Boston Marathon bombing. Unstable and failed states increasingly offer sanctuaries for terrorists to assemble, train, plan, and launch operations, such as the September 21, 2013, attack by Al-Shabaab gunmen from Somalia on Westgate Mall in Nairobi, Kenya. Insurgencies and guerilla wars, flaring across Libya, Mali, Yemen, Sudan, the Sinai, Syria, and other parts of the Middle East and North Africa, offer training grounds for terrorist organizations and their foot soldiers to acquire arms, weapon skills, and combat experience. With the impending 2014 withdrawal of U.S. and NATO forces from Afghanistan, the Taliban, Al-Qaida, and “a dozen like-minded groups … are slowly and steadily returning to Afghanistan, re-creating the pre-9/11 sanctuary” (Gunaratna, 2013, p. 2). Although the U.S. and its allies decimated the original Al-Qaida top leadership, in the past five years, proliferating affiliate groups “have unquestionably expanded their operational reach and capability … We can be certain, however, that they will have much more extensive resources and capabilities than any group that has yet tried to attack us, if and when they do” (Kagan, 2013, pp. 5–6). Transnational terror will likely plague the planet into the foreseeable future.

Trends in transnational counterterrorism will likely continue the brutal, lethal, and sometimes illegal government strategies and tactics that emerged after 9/11 (Kurtulus, 2011). The Bush Administration's prosecution of “the global war against terror” violated the Geneva Conventions on torture and human rights, greatly expanded the national security state, and harmed domestic civil liberties (Chadwick, 2003; Liese, 2009). The Obama Administration curbed some egregious abuses of power, for example, closing the CIA's secret “black site” prisons and banning coercive interrogation methods. But, it extended other Bush counterterror policies and practices, such as asserting the state secrets privilege and federal immunity from lawsuits on behalf of tortured victims of U.S. renditions (Cole, 2010). Targeted killings of suspected terrorists by drone strikes in Afghanistan, Pakistan, and Yemen increased fivefold, with high numbers of civilian casualties, euphemistically called collateral damage. Obama greatly expanded the National Security Agency's phone and Internet surveillance programs (Greenwald, 2013). By creating a chain of contacts from massive metadata mining, NSA seeks “to identify hubs or common contacts between targets of interest who were previously thought to be unconnected, and potentially to discover individuals willing to become US Government assets” (Lizza, 2013, p. 57). After former NSA contractor Edward Snowden revealed the vast scope of data-dredging, one federal judge ruled the program an unconstitutional violation of privacy: “No court has ever recognized a special need sufficient to justify continuous, daily searches of virtually every American citizen without any particularized suspicion” (Nakashima & Marimow, 2013). But, another judge ruled it legal. Whatever the ultimate outcome of judicial appeals, presidential reviews, and congressional restrictions, cyber snooping will undoubtedly remain a counterterror priority for detecting dubious data.

Scholars in the interdisciplinary field of terrorism studies too often trail behind event-driven trends in transnational terrorism. To get ahead of the curve, researchers must look beyond investigating contemporary incidents to understanding broader contexts and longer-range perspectives. Some key issues and opportunities for future network research include:

Conduct rigorous comparative analyses of four historical waves of modern terrorism for clues about the present and future waves. An anarchist wave, beginning in late-19th century, was followed by anti-colonialist, New Left, and the contemporary jihadist wave (Rapoport, 2001). Comparing each wave's long-term network dynamics will yield important contrasts and insights into their similar and unique trajectories. One result will be better understanding of the origins of terror campaigns, responses of counterterror organizations, innovation and evolution of strategies and tactics, and processes of desistance that bring terrorism to an end.

Build more comprehensive, cohesive, and integrated theoretical models capable of explaining the formation, structure, and consequences of terrorist networks. Analytic models of network dynamics must explicate the interpersonal processes by which people are recruited to clandestine organizations, trained in nefarious skills, allocated to organizational positions, and assigned roles in terror operations. Elements for building social network theories of terrorism will be drawn from diverse social science disciplines, encompassing psychological, sociology, geographic, political, economic, and related paradigms. Connecting these elements necessitates close collaborations among substantive experts. Generating testable hypotheses will benefit from the participation of researchers from the computational sciences. Barriers to effective interdisciplinary research must be overcome, particularly the lack of understanding of alternative professional perspectives and incompatible taken-for-grant assumptions.

Develop new methods of measuring network relations among terrorists. In addition to improving the accuracy of automated text analysis techniques, how will more reliable information be extracted from photographic, video, and audio recordings? Will security software, such as biometric authentication and face-recognition software, be adapted to generate new network data? How will these diverse modes of data collection be effectively integrated using network analytic methods?

Perform more laboratory experiments as an alternative to collecting inaccessible and dangerous field observation data. Researchers will construct theoretically based models of interdependent terrorist and counterterror networks comprising both computer programs and human subjects. Controlled manipulation of parameters, such as information and costs, will test hypotheses predicting actor reactions and network structural changes. Investigators will study the impacts of varying scenarios on subjects' actions and collective outcomes such as detection, deterrence, disruption, network resilience, security decision, resource allocation, target selection, and attack success. For greater complexity and realism, experimental findings will be adapted to massively multiuser online role-playing games pitting virtual terrorists against counterterror agents.

Create large, high-quality relational datasets to test social network theories of terrorism. Researchers will shift from case studies of particular events to encompassing systems of people, organizations, institutions, and events. Counterterror actions will be integrated with terrorist behaviors to create more realistic coevolving network dynamics. Given the paucity of primary data collected from terrorists, many researchers will continue to depend on collecting secondary data from public documents. Other analysts will emphasize the importance of the Internet and cyberspace communication networks linking thousands of extremist Websites for propaganda, radicalization, recruitment, and financial transactions. Vastly more sophisticated massive data-mining algorithms will improve content-based pattern detection. But, quality assurance will necessitate such automated routines be supplemented by painstaking hands-on correction of gaps and errors.

Regardless of specific future directions, social network researchers must surely rise to the challenge of how to use network analytic theory and methods for better understanding, detecting, and thwarting of miscreants engaged in terrorist activities.

Related Essays