Investigating Terrorist Attack Networks

Investigating Terrorist Attack Networks

by Punit Khiyara, Mathew Marcel, and Katherine Gibbons

Dataset: Origins & Significance

All Nodes

Master Data Set

All Relations

Master Data Set

In order to analyze and search for relationships between multiple terrorist events, we had to collect data on multiple terrorist networks that were preferably related to major attacks. As such, we found multiple crime network datasets a website called John Jay & ARTIS Transnational Terrorism Database. Out of the twelve terrorist network datasets available on the database, we chose to only use nine terrorist attack network datasets since three attack network datasets did not follow the standardized column structure implemented by the rest of the datasets. Each attack dataset had separate CSV files for nodes and relationships between nodes. The nodes in each dataset represent an individual terrorist. To fulfill our goal of finding a relationship between multiple attack networks, we concatenated the nine datasets using Python and Jupyter notebook to create one master nodes CSV with all the nodes from the datasets and one master relations CSV with all the relations between nodes from the datasets. Additionally, we added multiple label columns for each nodes to label them based on their respective attack's dataset, codename, city, and country.

If multiple terrorist networks spanning numerous countries and bombings over the years were to be entered into a network modeling and analysis program, we hypothesize that we would be able to uncover certain connections or relationships between multiple attacks that would have otherwise not been discovered through the individual analysis of each attack’s network. Therefore, we set out to investigate terrorist attacks in the hopes of finding certain relationships between one another in order to determine areas of vulnerability within the network that could be exploited by government agencies.

9 Network Overview

Bali Bombings 2002, Indonesia

Bali Bombings 2005, Indonesia

Australian Embassy Bombing, Indonesia

Hamburg 9/11, Germany

S.E.A Attack, Indonesia

Christmas Eve Bombings, Indonesia

Beside are each of the original networks we were working with. We looked at 9 different attacks. We ran the modularity statistic, which tells us how closely related each node within the network are, and colored-coded each node by their modularity class. Each node represents a person that is connected to the specific attack and the size of each node is based on their betweenness centrality. Betweenness centrality refers to a person’s role in allowing information to pass throughout the network -- this helped us identify critical nodes and pinch points in each network. We can see that certain networks would be easier to eliminate based on pinch points such as these four Indonesian attacks (Bali2002, AE, Bali2005, PAR) and the London attack. The other networks have emerging complexity in comparison. The vivace attack in London is not based upon modularity but instead is based upon kinship, which shows that this attack had familial ties.

Madrid Train Bombing, Spain

Philippines Ambassador Residence Bombing, Jakarta

Vivace Bombing, United Kingdom

Mass Terrorist Attack Network

Germany

Nodes Color Coded by: Modularity Class

Lines Color Coded by: Modularity Class (Except for UK which is coded by Kinship)

Nodes Sized by: Betweeness Centrality

Nodes Labeled by: Database of Origin

United Kingdom

Conclusion

However, the largest, most interesting (yet simultaneously terrifying) revelation we found within the combined network is that there was one individual that played a role in both the Hamburg Bombing (black nodes) and the Bali 2002 bombing (green nodes). After this revelation, curiosity seemed to consume our group as we wanted to investigate how the clusters in our mass terrorist network were being formed, what they were composed of, and if there were any similar patterns within them that were noticeable in the larger network as well. In other words, we wanted to look at the subnetworks within the subnetwork.

Modularity Class 2

Each network here is just one modularity class upon which we ran another modularity statistic to further investigate how the smaller network was being formed. From the modularity class 2 network, we can specifically observe how the individuals who had a role in the Bali 2005 bombing were linked to the Australian Embassy bombing perpetrators. Likewise, the modularity class 0 network shows us similar findings but between the Bali 2002 bombing and the Christmas Eve bombing.

Modularity Class 0

By developing several different networks and layers within those networks, we can see how certain individuals are related to each other, something the dataset alone would not show us (especially when most nodes have no kinship with other nodes). This is key to understand if you are the police or a government agency that needs to capture terrorists, weaken communication among terrorist groups, and breakdown large terrorist networks.

We have created visuals that can help one target the individuals that have the largest influence within these networks, as well as find key relationships between bombings across Indonesia and Germany. The reason that we felt the finding that an individual had ties to bombings in two different countries was the most interesting revelation is because we can speculate that the individual was able to learn terrorist tactics from the Germany bombing (that took place in 2001) and apply it in Bali a year later. Moreover, through this revelation, we could speculate that there are some larger terrorist networks in the world that have the ability to share information with each other through such individuals.

Indonesia

Spain

Group Member Roles

Network Designers: Katherine Gibbons & Mathew Marcel

Chief Social Network Analyst: Mathew Marcel

Data Manipulation Specialists: Punit Khiyara & Katherine Gibbons

Prezi Expert: Punit Khiyara

Germany

Works Cited

• https://sites.google.com/site/ucinetsoftware/datasets
• https://www.sciencedirect.com/topics/computer-science/betweenness-centrality

Above is the network that was created after running the Yifan Hu layout, running the modularity statistic for color-coding, and labeling each node with which attack they were originally related to. Right away, we can see that the bombing in Madrid (purple) and in the UK (tan) are not related to the other bombings and the networks responsible for those bombings are isolated from the rest of the data. Looking at the modularity classes in the Indonesia bombings (green, red, orange and blue), we can also see that there are subnetworks that primarily focused on one attack. For example, the blue nodes are primarily related to the Australian Embassy bombing that took place in 2004 but, they are still heavily connected to the 2002 and 2005 Bali bombings. This suggests that time is a big factor to consider when analyzing the different clusters created within our network as our modularity classes seem to differentiate based on the time of the attack.