Network Methods as a Tool for Defence Analysis

Policy and Capability Studies Department,

UK Defence Science and Technology Laboratory

© British Crown Copyright – Dstl 2004 – published with the permission of the Controller of Her Majesty’s Stationary Office

Introduction

It can be argued that social interaction is a significant factor in influencing an individual’s behaviour.
In fact, it is fair to say that decision-makers in any organisation, be it an investment bank, a dictatorial
regime or a government department, are influenced by others, either because those others have some
specialist knowledge, or because they hold particular positions. Indeed, successful leaders, from Tony
Blair to (until recently, at least) Saddam Hussein, invariably surround themselves with their most
trusted advisers. The concept of social structure is thus at least as important as social and
psychological factors such as personalities when analysing a group’s workings and recent years have
seen greater reference to social networks and network analysis as tools for improving our awareness
of these issues.

Networks exist in abundance: from the neural systems within us to the complex inter-connected and
evolving system of pages and hyperlinks making up the World Wide Web. Globalisation and
improved communications have made business more networked and dynamic - deals and share trading
are done electronically, companies are often ‘here today, gone tomorrow’ and sometimes only exist in
cyberspace. Networks are intrinsic to our social structure; informal information sharing, or networking
is often favoured over official channels in business and in government. Unofficial connections are
most effective when based on trust and successful networkers rely on good reputations and are better
able to identify those ‘in-the-know’. Networked structures can provide greater flexibility than
hierarchies and tend to arise in situations where hierarchical structures are undesirable and where less
formality (and perhaps accountability) can be tolerated. The al-Qa’ida network is an excellent
example of this and is discussed later in this article.

For clarity, we will use the term network to mean any system of interdependent entities, or nodes,
whose interactions are represented by links. Traditionally, nodes are used to represent individuals, but
they can be defined more generally to represent groups, companies or even electronic components.
Similarly, links can denote any relation such as friendship, kinship, command relations or electronic
communication.

With this definition, any interactive system can be thought of as a network. Traditionally, the term has
been used to describe inter-connected systems such as telecommunication grids or to distinguish
hierarchical (vertical) organisations, such as the Army, from less formal (horizontal) organisations,
such as the ‘old boy network’, whose memberships are less rigorously defined. Henceforth, in this
article, we use the term network to refer to such horizontal systems, although those organisations may
be technical (e.g. telecommunications networks) as well as social.

Methods for dealing with physical (or technical) network problems have long existed in Operational
Research; perhaps the most notable are the maximum flow, minimum path length, critical path or
minimum spanning tree problems. In each of these examples, nodes and links are defined fairly

1
generally, but usually represent physical (non-human) entities. Social Network Analysis (SNA) is an
emerging discipline that can be used to analyse the structure of social groupings via concepts and
metrics that quantify particular structural attributes, such as network density, clustering or the
prominence (centrality) of some nodes over others. This structural focus extends traditional OR
network methods and distinguishes SNA from standard social sciences.

SNA was pioneered by researchers in sociology and anthropology, during the mid-1900s, as a tool for
visualising social groupings. But, in recent years, the growing diversity of SNA concepts, availability
of data and increased computer power have facilitated its application to a wider range of problems.
Network methods are now being used in the fields of intelligence analysis (see Klerks, 2001 and
Sparrow, 1991), analysis of complex interactive systems (see Albert & Barabasi 2003), business (see
Michael, 2003), human behaviour (Liljeros 2001) and are the focus of much work to extend their
utility into the more intractable world of dynamic networks at academic institutions such as the
Computational Analysis of Social and Organisational Systems (www address provided in the
references section).

SNA methods allow analysts to appreciate more fully the characteristics of complex, distributed,
interactive systems. Such issues arise regularly in defence analysis problems such as the need to
assess communications or organisational structures, targets’ vulnerabilities or, more recently, with
high profile defence concepts such as Network Enabled Capability and Effects Based Operations
(refer to the penultimate section for a fuller discussion). This article aims to raise awareness of the
utility of SNA to the wider OR community by introducing some of its key concepts, briefly discussing
its utility in tackling everyday analytical problems and issues and, more importantly, how it
complements work done at Dstl and other organisations in the defence analysis community.

Network Analysis Concepts

SNA is based upon a set of mathematical concepts that represent and measure real-world socio-
structural phenomena and allow the analyst to study a network’s structure and the ways that nodes are
embedded within it. An obvious advantage provided by SNA methods is that of visualisation – the
sociogram (see Moreno, 1946 and Figure 1) may seem overly simplistic, but it provides obvious
benefits for analysis of large groups.

[Insert Figure 1 Here]

SNA concepts and measures are numerous and have diverse applications. We will only discuss the
best known, which are commonly used to identify key nodes and groupings, in order to provide a brief
summary of their usefulness. The most common network measures can be grouped under the
following broad headings (see Wasserman , 1994 for a far more comprehensive list).

Network Level Measures. These are measures that provide insight of a network’s characteristics on a
global level. The best-known concepts that facilitate global analysis are density, connectivity,
reachability and centralisation. In physical terms, they elucidate how well known everyone is to
everyone else, how easily communications travel between nodes and the degree to which the network
revolves around small, well-connected clusters. Since pairs of nodes may have many possible paths
connecting them (comprising nodes as well as links), inter-node distance (the number of links on a
path) is usually thought of in terms of geodesic distance: the shortest, although not necessarily the
most practical path between two nodes. A network’s longest geodesic is referred to as its diameter.

2
Centrality. These measures are often used for identifying nodes that are more prominent. Centrality
has many variants: degree centrality, which is the number of links a node has (perhaps denoting
popularity, or being well-connected); betweenness centrality, which measures the extent to which a
node can access connections between others (a contact broker or key communication channel) and
closeness centrality, which quantifies the ease with which a node can reach many others. Centrality
measures are most commonly associated with key positions, as highly central nodes are the best
connected, although not necessarily an organisation’s leaders. Centrality would thus be a useful
measure for identifying those ‘in-the-know’ or for determining the best means of conveying a message
to a group.

[Insert Figure 2]

Cliques. The way that link density is distributed throughout a network can be analysed via concepts
such as cliques, which are fully connected sub-networks - portions of the network where each node is
directly connected to all others. Clique analysis allows us to identify more cohesive or, perhaps, more
isolated/elitist sub-sections. It is worth noting that this definition is flexible - an n-clique is a clique in
which all nodes are a maximum distance n from each other, accounting for the fact that some cliques
are more cohesive than others. Clique analysis allows us to model what has become known as the
small world (s-w) network (see Watts, 1999). S-w networks are characterised by having dense clusters
of nodes that are connected to each other by relatively few links. More rigorously, s-w networks are
highly clustered networks, whose average path length is comparable to that of a similarly sized
random (un-clustered) network. Human social networks tend to follow this structural pattern (we all
have groups of friends), providing grounding for the famous anecdote that anyone can reach anyone
else through six links or fewer.

Uneven density is a defining trait of another important concept, known as the Scale-free network, so-
called as its links are very un-evenly distributed, giving it no characteristic scale. Scale-free networks
commonly arise in nature, afford many advantages over standard network structures and may have
application for some of the defence problems discussed in the penultimate section of this paper.

Scale-Free Networks

Networked structures are more robust to random disruption than non-networked structures, especially
if their structures are scale-free (s-f). S-F networks have many nodes that have few links, and a small
number of ‘hub’ nodes that have many. S-F networks are very important, as they are poorly
understood in general and are commonplace in our society - the Internet, World Wide Web,
international airline networks (most nodes are minor airports, with few ‘hubs’ such as Heathrow and
JFK) and the National Grid are all good examples (see Barabasi & Bonabeau 2003). S-F networks are
highly resistant to random disruptions, but vulnerable to targeted attack, as failure of pivotal nodes can
lead to disproportionate disruption (c.f. the recent power disruptions in California), warranting close
criticality/impact assessment of their key nodes. Recent research has found that s-f networks are more
vulnerable to epidemic spreading than other network forms (see Pastor-Satorras & Vespignani 2001).

Many real world networks have been shown to have s-f characteristics. Experiments (by Albert &
Barabasi, 2002) to map the Internet, WWW, networks of citation in academia, social structures, such
as the movie actor network (see Watts, 1999) and telephone call networks all found these structures to
be scale-free, with the probability of any one node having k links being given by

3
 P(k) ~ k - γ ,
where γ is some positive constant that reflects the network’s attributes.

Several iterations of these mapping experiments (e.g. considering 300 thousand, 40 million and 200
million web pages and 53 million telephone callers) found remarkably similar results – that γ lies
between 2 and 2.5, in all cases. It is worth noting that, where in and out degrees were considered
separately, the exponent for out degree distributions is slightly higher, perhaps suggesting that nodes
‘prefer’ to receive than extend links.

The fact that such structures are commonplace merits some speculation on the principles governing s-f
evolution. Each structure that Albert& Barabasi considered is a knowledge network, so, in all
likelihood, each joining node will optimise its joining location by seeking other nodes with many
contacts. This is obviously the case for the Internet, as additions to the web are anything but randomly
placed and are usually linked to other related and commonly accessed pages; the successes of search
engines such as Google are based on this assumption. Similarly, people will usually seek out those
who are well-connected when trying to identify people who are ‘in-the-know’ and friendship networks
usually comprise clusters of closely connected people who maintain relatively few links with
‘outsiders’. Albert & Barabasi, 2002 used these assumptions to simulate network growth by making
the probability that a joining node connects to a given node i an increasing function of i’s degree.
Simulations using this rule produce s-f networks with exponent 3, providing some validation to the
attachment assumptions. Other more specific factors that might influence attachment decisions are
commonalties between nodes’ attributes such as experience, background or age, but such attributes are
difficult to quantify and would pose some calibration problems, making their inclusion in network
models somewhat complicated.

S-F networks are very common in natural and man-made social and technical structures. A better
understanding of the rules governing their evolution, strengths and weaknesses is thus highly
desirable, particularly as s-f characteristics feature prominently in the types of problems tackled by
defence analysts.

Defence Applications

Terrorism

SNA methods have recently been mooted as a useful tool for intelligence analysis (see Carley , 2002,
Krebs , 2002, Sparrow, 1991 and Van Meter 2002). Many recent studies provide validation for this,
most notably the testimony of those involved in the hunt for Saddam (see Vernon 2003) and Valdis
Krebs’ a posteriori case study of Al Qa’ida’s 9/11 hijackers. Krebs gathered information about the AQ
cells from open sources and showed how centrality measures such as degree, betweenness and
closeness could be used to identify the three main hijackers Atta, Alhazmi and Hanjour as the most
structurally prominent (their key structural positions do not necessarily suggest leadership status).
This analysis contains unavoidable collection biases, as does all intelligence analysis, not least as it
tends to centre on those who are initially regarded as the prime suspects – this was certainly the case
with post 9/11 media reporting. AQ derives strength from its highly cohesive, trust-based links and its
low density - if operatives are captured, they are unlikely to betray other members and are unable to
reveal much information.

4
 [Insert Figure 3 here]

A second example of SNA use in Counter Terrorism is provided by the Greek November 17th (N-17),
a group whose structure is totally unlike AQ’s. N-17’s cliqueyness and operational secrecy served it
well – it remained un-penetrated for over 20 years – but, once one member was caught, its dense
structure allowed the Greek authorities to collapse it (almost completely) overnight. In this case,
centrality and betweenness calculations may have been unnecessary for targeting, as the group’s high
density rendered all members highly central.

[Insert Figure 4 here]

Figures 3 and 4 illustrate two structural extremities: AQ’s network density (the ratio of actual ties to
the maximum number possible) is 13%, c.f. November 17th’s density of 25%. It is clear from these
examples and from the groups’ histories that the denser group would be more vulnerable, were a
random member caught.

Despite acquiring greater flexibility and dynamism, terror organisations do not necessarily become
more robust to disruption purely by becoming networked. Groups such as AQ and the Provisional
Irish Republican Army (PIRA) have reduced their vulnerability by becoming more cellular –
compartmentalising according to operational necessity, adopting a “need-to-know” principle. The
strength derived from this scale-free structure forces us to consider targeting alternative pressure
points, such as leaders, decision-makers, members with specialist skills or, more fundamentally, the
group’s support base.

SNA methods allow the analyst to draw together and elucidate intelligence data, which is often
scattered, incomplete, difficult to visualise and incomprehensible as to key players’ identities. Recent
work, done within this department, on applying SNA methods to real social data has highlighted many
other issues, such as the need for clear and consistent definitions for links and the need to weight some
links in terms of relational intensity, or information reliability (clearly an issue for intelligence
analysis).

The inevitable sparseness of intelligence data reduces SNA’s usefulness; only a small amount of work
has been done to estimate the effect of missing data (see Butts 2000).

Formal vs. Informal

Analysis of formal networks can elucidate an organisation’s command structure, but can fail to
capture the subtleties of informal influence present in most organisations. Renfro & Deckro 2003
recently illustrated the limitations of ignoring informal networks. Their case study uses SNA methods
to identify key influential members of the Iranian government by weighting links and regarding the
network as an optimal flow problem. Their analysis of the regime’s formal network, based on official
command relations, (unsurprisingly) identified President Khatami as exerting the greatest influence
over the government. However, when informal links were considered, analysis identified the former
president Hashemi Rafsanjani as the most influential figure, owing to his influence over the president
and the fact that he most likely retained strong ties with each department beyond the end of his
presidency.

Critical National Infrastructure

5
The business community, government and essential services such as power, water and sewerage are
inter-connected via the Internet, power grid and other, less obvious bureaucratic and social networks,
collectively referred to as the Critical National Infrastructure (CNI). Key CNI nodes, such as power
stations, internet servers or communications nerve centres can easily be identified, as can many
connections between them. However, CNI modelling is more complex than this, as many intrinsic
elements are societal, bureaucratic or even virtual, with very opaque interrelations.

Recent work, done within Dstl, investigated the challenges associated with protecting the CNI, using
strategic gaming methods (see Davies 2003). That research concluded that, despite the high-level
insight provided by the gaming exercise, there is no robust tool in existence that can tackle the ‘grass-
roots’ problems associated with CNI weaknesses, primarily due to a dearth of relevant data and an
absence of suitable modelling techniques.

Without understanding CNI inter-relations, any useful SNA work would most likely be confined to
simplified physical networks, which although analytically simpler, would ignore much of the hidden
societal and human decision-making aspects of the problem. In addition to complications associated
with data sparseness, CNI networks require dynamic network modelling, which is still very much in
its infancy. Initial steps have been made in this direction by the Computational Analysis of Social and
Organisational Systems Institute (CASOS) (see Carley 2002) and, more recently (and substantially),
by Monge & Contractor 2003. Their computer simulation work, the Blanche model in particular (see
p. 104), allows the user to define dynamic interrelations between social entities, based on appropriate
social theories.

SNA and dynamic modelling both have a long way to go before they can adequately address CNI
problems, but clear potential exists for identifying and assessing vulnerabilities and for facilitating our
scenario and crisis planning. Growing concern over CNI vulnerabilities has led the US and UK
governments to establish their own national infrastructure protection centres (details can be found at
the web addresses provided in the References section).

Network Enabled Capability

It is often noted, during post conflict analysis, that there is a need for more effective communications
and information sharing in the battlespace. This problem is currently being addressed by a defence
concept known as Network Enabled Capability (NEC), which is designed to improve battlespace
management through more effective collation and distribution of information. NEC will achieve this
objective by linking sensors, weapons and decision-makers in a networked fashion, thus providing a
coherent, shared awareness between units allowing them to better synchronise their activities and
enabling a more rapid and precise delivery of controlled and reliable military effect. It is envisaged
that this will facilitate synergy and synchronicity between units, granting access to a wide range of
information sources to those who need it and improving overall battlespace management. Network
methods have obvious applications here, in assessing the merits and feasibility of force configurations
for varying contexts and in assessing their structural weaknesses. SNA can also help to elucidate
issues of interactions between technical and social networks that arise within our forces’ decision-
making structures and may facilitate the way in which we model Command and Control (C2) systems.

Preliminary advances in the application of SNA methods to military systems have been made by
Dekker 2002, who examined their usefulness for studying information collection, collation,
distribution and decision-making, collectively referred to as C4ISR (Command, Control,

6
Communications, Computers, Intelligence, Surveillance and Reconnaissance). In that paper, the
author presents a methodology for assessing C4ISR systems, defining nodes in terms of military HQ
and intelligence collection assets, weighting links in terms of information flow and considering nodes’
closeness centrality. Dekker also developed a proof of concept, using a humanitarian relief operation
as a specific example.

[Insert Figure 5]

One of NEC’s key tenets is that our operational planning methods should comprise predictive
elements, ensuring that military actions are geared towards achieving a particular effect. In this sense,
effect expands upon traditional military attrition and may include coercive or other actions designed to
affect an adversary’s decision-making. With such aims in mind, there is a need for a tool that
facilitates “what-if” analysis on an organisational level that facilitates predictions of an adversary’s
behaviour. The need for modelling of this sort provides further opportunities for SNA methods in
defence research.

Limitations of Network Methods

Network measures and concepts are numerous and this article has gone no further than to introduce
only the most commonly used. Each measure has a precise mathematical definition, meaning that its
usefulness is entirely dependent on context. Where information diffusion is of interest (see Zanette
2001), measures such as closeness, geodesic distance and connectivity are relevant. Where prominent,
key nodes or weaknesses need to be identified, measures such as centrality and betweenness may be
more useful.

It should be noted that, although amenable to social attribute data, such as weighting links, network
methods are only a means of analysing scattered structural information and, used alone, cannot predict
behaviour. However, network methods can complement other techniques, such as social or political
analysis, thus providing a more holistic picture of the system under consideration. SNA methods thus
form a restrictive, but effective tool that can be used to better inform many of the decisions that are
made within the defence sector.

7
References

1. Albert, R. & Barabasi, A-L., Statistical Mechanics of Complex Networks, Reviews of Modern
Physics, Volume 74, Jan. 2002.

2. Barabasi A., Bonabeau E., Scale-Free Networks, Scientific American, May 2003.

3. Butts C., Network Inference, Error, and Informant (In) Accuracy: A Bayesian Approach, Center
for the Computational Analysis of Social and Organisational Systems, Carnegie Mellon
University, 2000.
4. Carley K., Destabilizing Networks, Connections 24(3): 79-92, 2002.

5. Davies S., Strategic Gaming to Support Critical National Infrastructure Protection: A

Practitioner’s View, OR Insight Vol. 16, Issue 2, April-June 2003.

6. Dekker A. Applying Social Network Analysis Concepts to Military C4ISR Architectures,

Connections 24(3): 93-103, 2002.

7. http://www.casos.cs.cmu.edu

8. http://www.homeoffice.gov.uk/terrorism/govprotect/infrastructure/

9. http://www.nipc.gov/

10. Klerks, P. The Network Paradigm Applied to Criminal Organisations: Theoretical nit-picking or a
relevant doctrine for investigators? Recent developments in the Netherlands, Connections 24(3)
(2001): 53-65.

11. Krebs V. Mapping Networks of Terrorist Cells, Connections 24(3): 43-52 (2002) see also
www.orgnet.com.

12. Liljeros F., Edling C., Amaral L., Stanley H., Aberg Y. The Web of Human Sexual Contacts,
Nature, Vol 411, 21 June 2001.

13. Michael, B. Using Network Analysis in Economics and Management, ORInsight, 16(4) Dec. 2003.

14. Monge P.& Contractor N. Theories of Communication Networks, Oxford University Press, 2003.

8
15. Moreno, J.L. “Sociogram and sociomatrix: A note to the paper by Forsyth and Katz. Sociometry.
1, 342-374, (1946).

16. Pastor-Satorras R., Vespignani A., Epidemic Spreading in Scale-Free Networks, Phys. Rev. Lett.
86, 3200 (2001).

17. Renfro R., Deckro R., A Flow Model Social Network Analysis of the Iranian Government, Military
Operations Research, V8, N1, 2003.

18. Sparrow, M. K. The application of network analysis to criminal intelligence: An assessment of the
prospects, Social Networks 13 (1991) 251-274.

19. Strategic Defence Review: A New Chapter, HMSO.

20. Van Meter K., Terrorists/Liberators: Researching and Dealing with Adversary Social Networks,
Connections 24(3): 66-78, 2002.

21. Vernon Loeb, Clan, Family Ties Called Key To Army's Capture of Hussein:
'Link Diagrams' Showed Everyone Related by Blood or Tribe, Washington Post, Tuesday,
December 16, 2003; Page A27.

22. Wasserman S., Faust K., Social Network Analysis: Methods and Applications, Cambridge
University Press 1994.

23. Watts D., Six Degrees: The science of a Connected Age, 1999, Princeton University Press.

24. Zanette D., Critical Behaviour of Propagation on Small-world Networks, Physical Review W,
Volume 64, 2001.