Social Network Analysis in Intelligence Emily Keefe Policy and Capability Studies

Presentation overview Introduction to SNA SNA in Government and Dstl Intelligence SNA 21 November 201821 November 2018

Social Network Analysis (SNA) What is SNA? Origins, applications, usefulness etc. Depth of this intro will depend upon the audience… Show diagram. Most will understand SNA to be visualisation of networks. Explain there is more to it. Pick out most central node using SNA measures as an example. Refer back to this when the whole network diagram is flashed up later on… Nodes can be whatever you want them to be, groups, people, hair colour, car that you drive... 21 November 201821 November 2018

The history of SNA Psychology Anthropology Mathematics Psychology: sociometry, sociograms, group behaviour, strutural properties of groups, social perceptions and attitudes, balance theory. 21 November 201821 November 2018

Genres of Social Network Analysis ∑(cmax - c(vi)) Visual, academic and applied. Also other things such as tools, network structures, Graph theory, complexity theory. Tools Structures Graph theory Complexity 21 November 201821 November 2018

∑(cmax - c(vi)) Structures Tools 21 November 201821 November 2018

Origins of SNA applications in Dstl Modelling target dynamics Modelling the critical national infrastructure Bayesian inference for link prediction Social networks of terrorist groups Proof of concept study Social Network Analysis Case Study The point of this is to show that we have been playing with SNA for a while. Each project has taught us different lessons that we have then heeded in later work. Recommendations of SNACS are actually recommendations based on other project experiences as well. Key findings within innovation project: 2 people were found to be the same person and the use of affiliation analysis Cross-Government Case Study 21 November 201821 November 2018

SNA in Government X ∑(cmax - c(vi)) 21 November 201821 November 2018

Why use SNA? Helps people understand the groups they are interested in. SNA may identify network characteristics not apparent by eye SNA allows group structures and flows of communications to be explored Systematic approach to data coding allows for quick and easy “what-if?” analysis Coding data forces people to challenge their assumptions and allows knowledge to be transferred 21 November 201821 November 2018

Intelligence SNA Data management Present results Set up Coding Analysis 21 November 201821 November 2018

Intelligence SNA Data management Present results Set up Coding Analysis 21 November 201821 November 2018

Set up Getting a tasking Identifying the team Determining aims: questions to be answered Deciding on a taxonomy Sharing out responsibility Selecting and obtaining software Creating a suitable database 21 November 201821 November 2018

Intelligence SNA Data management Present results Set up Coding Analysis 21 November 201821 November 2018

Coding Finding people to code Holding an initial training session or workshop Regular team meetings Coder interviews Inter-coder reliability exercises 21 November 201821 November 2018

Why coding and definitions matter Is A co-located with B if: They work in the same building? They work on the same site? They work for the same company? They attend the same meeting? They meet and talk on the street? They were in jail together? Using this example to illustrate divergence of processes and importance of taxonomies. Common understanding Need to provide the group with tight definitions. Confirm that all have the same definition in their heads. Need to have a warm up period- a time to check that people are all coding the same way before they start the case study. 21 November 201821 November 2018

Intelligence SNA Data management Present results Set up Coding Analysis 21 November 201821 November 2018

Data management Configuration control Database merging Database refinements The human element Data tidying Information entered into the wrong field Locations not entered Dates associated with data entered Entity disambiguation 21 November 201821 November 2018

Intelligence SNA Data management Present results Set up Coding Analysis 21 November 201821 November 2018

Questions and Techniques Who are the key people in the system of interest? Centrality measures Are there any links between A and B? Path analysis Affiliation analysis How does X talk to Y? How close are M and N? Link type analysis Who is linked to whom through training, upbringing or operating locations? How has X’s connections changed over time? Centrality variation analysis What are the key links in the system of interest? Link centrality analysis How can the system be influenced? Key nodes Key links Stronger links Other links 21 November 201821 November 2018

Intelligence SNA Data management Present results Set up Coding Analysis 21 November 201821 November 2018

Why use SNA? Systematic approach to data coding allows for quick and easy “what-if?” analysis Coding data forces people to challenge their assumptions and allows knowledge to be transferred SNA may identify network characteristics not apparent by eye SNA allows group structures and flows of communications to be explored 21 November 201821 November 2018

Centrality measures Used to explore who is key in the network Degree Centrality – Well connected hubs Betweenness Centrality - Gatekeepers Eigenvector Centrality – Who does who you know know? 21 November 201821 November 2018

What about missing data (1)? 21 November 201821 November 2018

What about missing data (2)? 21 November 201821 November 2018

What about deliberately concealed data? Is there anything we can do? Should we compensate for missing and concealed data, or simply accept that it exists and try to minimise the impact it has? 21 November 201821 November 2018

Reachability and distance 21 November 201821 November 2018

Affiliations: inferring links through shared attributes Groups People 21 November 201821 November 2018

Reachability and distance 21 November 201821 November 2018

More trustworthy links 21 November 201821 November 2018

Reachability and distance Normal link Trusted link 21 November 201821 November 2018

Difficulties encountered Software packages available Balance between coding and analysis Nature of available data Applicability of SNA measures We have used UCINET mainly, with the associated tools NetDraw and Pajek. Have also used Key Player at times. Far too much time has been spent on trying to make the tools we have do things that they are not really designed to do. Need to obtain a bespoke software tool to support ISNA if it is to be used effectively in the future. Balance between coding and analysis. It takes ages to do the coding part! I estimate that we have spent a total of 38 man days on undertaking the case study, split down as 16 days coding and 22 days analysis. This is a ratio of approximately 40% to 60%, which in retrospect may have been coding heavy. Guidance on the optimal balance will be informed by future studies. Nature of the data available e.g. incomplete, possibly inaccurate, focussed upon specific people of interest, sheer quantity of reporting There is a real and significant difference between SNA and Intelligence SNA (ISNA). The tools, techniques and approaches used in SNA (predominantly in academia at present) cannot simply be picked up extant and applied to ISNA. New techniques, approaches and solutions to Intelligence specific problems need to be developed for ISNA. Mistakes not tidied e.g. repeated nodes are spotted throughout analysis. Do you re-do analysis or not? Continual process of data tidying 21 November 201821 November 2018

Demonstration of added value Identification of a key individual through inferred links Identification of a different inter-group structure to that which had been assumed Understanding of the importance of an individual of interest 21 November 201821 November 2018

Assumed structure Group A Group B 21 November 201821 November 2018

Structure suggested by SNA Group A Group B 21 November 201821 November 2018

Links of a person of interest 21 November 201821 November 2018

21 November 201821 November 2018

The history of SNA Psychology Anthropology Mathematics Psychology: sociometry, sociograms, group behaviour, strutural properties of groups, social perceptions and attitudes, balance theory. 21 November 201821 November 2018

Review of Terrorist disruption Historical CT success factors Exploitation: Group analysis and assessment / DIS, PJHQ & HQ ARRC Operational assessments A&B Analysis A&B Assessment Metrics SNA Case studies Influence Analysis / PAM Media assessment Media monitoring Suicide Terrorism Computer-assisted sentiment analysis Modelling Info Ops Target Dynamics Leadership assessment Coercion / Intent gaming Prediction of surprise attack Body movement profiling LAPA R&V Assessment Exploitation: Remote personality assessment DIS Leadership and Personality Assessment (LAPA) 21 November 201821 November 2018

Proposed ISNA Activities Support development of Behavioural, SNA and SNEE Science Base Proposed ISNA Activities Operational Exploitation Dstl Behavioural, SNA and SNEE Science Base Technical / software support ISNA Capability Development Operational Exploitation MoD & OGAs Technical / software support Operational Exploitation Dstl Science base Technical support ISNA Capability Development Operational Exploitation MoD & OGAs ISNA Capability Development Operational Exploitation Dstl Operational Exploitation MoD, OGAs and OGDs Current End 2007 21 November 201821 November 2018 End 2010

Questions & Comments