Actionable Intelligence for Disrupting Criminal Networks

Transcription

1 Actionable Intelligence for Disrupting Criminal Networks Timothy C. Haas University of Wisconsin-Milwaukee, United States February 24, 2014 Actionable Intelligence for Disrupting Criminal Networks 1 / 20

2 This talk will cover the following. 1. Network centrality measure examples. 2. Constructing actionable intelligence items based on these measures. Actionable Intelligence for Disrupting Criminal Networks 2 / 20

3 Criminal networks have different types of key players. Social Network Analysis (SNA) can be used to identify these individuals. Crime Fighting Strategy: identify the smallest number of players whose removal would disrupt the network the most. Actionable Intelligence for Disrupting Criminal Networks 3 / 20

4 Define key players in terms of SNA measures. A player is key if his/her eigenvector centrality, betweenness centrality, or Gould-Fernandez (GF) total brokerage score is in the network s top five. Actionable Intelligence for Disrupting Criminal Networks 4 / 20

5 A player with high eigenvector centrality can communicate with most other players through many different short paths. Such a player can propagate information quickly to many players in the network. In a criminal network, information means money, contraband, criminal action instructions, guns, or cars. Actionable Intelligence for Disrupting Criminal Networks 5 / 20

6 Example: A B C D E F G Player C has many short-path options to reach any one of the other players. Actionable Intelligence for Disrupting Criminal Networks 6 / 20

7 A player with high degree centrality can propagate information to a large number of directly linked players. B A E C D F Player E has degree 4, player C has degree 2. Actionable Intelligence for Disrupting Criminal Networks 7 / 20

8 A player with high betweenness centrality receives and transmits most of the information propagated through the network. For player A, compute on average, the proportion of paths between a pair of players that pass through A. Actionable Intelligence for Disrupting Criminal Networks 8 / 20

9 Example: A C E B D Three paths from A to B. Two of these paths pass through C. Similar for the pairs AE, AD, EB, ED, and BD. Actionable Intelligence for Disrupting Criminal Networks 9 / 20

10 A player with a high GF total brokerage score controls the communication between many pairs of players who are not directly linked. A player with a high brokerage score functions as a broker for many pairs of players who are not directly linked to each other but are directly linked to him/her. Actionable Intelligence for Disrupting Criminal Networks 10 / 20

11 Example: C A B D Player A s brokerage score is 2 since the pairs BC and BD need him/her to communicate with each other, but the pair CD does not. Actionable Intelligence for Disrupting Criminal Networks 11 / 20

12 How well connected is a network? The network s first eigenvalue is a single number measure of how well players are connected to each other (network connectedness). A network s resiliency index is the inverse of how long after a wave of arrests it takes the network to regain 90% of its former connectedness. Actionable Intelligence for Disrupting Criminal Networks 12 / 20

13 A quick way to guess whether a link is missing or not is with Common Friends. C A B D E Pair AB s number of Common Friends is 3. Actionable Intelligence for Disrupting Criminal Networks 13 / 20

14 Adding missing links to an observed network produces a reconstructed network. All actionable intelligence items are computed on the reconstructed network. Actionable Intelligence for Disrupting Criminal Networks 14 / 20

15 Actionable intelligence item 1 is the list of all key players. Action: remove all of these players from the network if possible. Reason: players with high eigenvector centrality generate information such as sponsoring criminal actions. Players with high betweenness or high brokerage scores organize the network so that it can take these actions. Actionable Intelligence for Disrupting Criminal Networks 15 / 20

16 Actionable intelligence item 2 is the sequence of arrests to make. Action: remove the player with the highest eigenvector centrality first. Then, remove the player with the highest betweenness centrality. Reason: remove the player that everyone talks to last so that his/her absence does not alert the network to the attack since many players know him/her. Actionable Intelligence for Disrupting Criminal Networks 16 / 20

17 Actionable intelligence item 3 identifies who will replace those arrested. Action: increase surveillance on these potential successors. Reason: these players are most likely to be the next information creators, and information re-transmitters. Actionable Intelligence for Disrupting Criminal Networks 17 / 20

18 Actionable intelligence item 4 identifies an important player who is trying to avoid detection. Action: increase surveillance on this player. Reason: this player is either the network s true linchpin or is linked to other networks. A high ratio of betweenness to degree centrality is uncommon and hence, probably intentional. Actionable Intelligence for Disrupting Criminal Networks 18 / 20

19 Actionable intelligence item 5 lists the network s rising stars. Action: increase surveillance on these increasingly important players. Reason: these players are the network s future. Actionable Intelligence for Disrupting Criminal Networks 19 / 20

20 Actionable intelligence item 6 is the resiliency index of the network. Action: increase the frequency of arrests if this index is high. Reason: the network is regaining its ability to function long before the next wave of arrests hits it. Actionable Intelligence for Disrupting Criminal Networks 20 / 20