1. Social Network Analysis in Intelligence
Emily Keefe
Policy and Capability Studies

2. Presentation overview
Introduction to SNA
SNA in Government and Dstl
Intelligence SNA
21 November November 2018

3. Social Network Analysis (SNA)
What is SNA?
Origins, applications, usefulness etc.
Depth of this intro will depend upon the audience…
Show diagram. Most will understand SNA to be visualisation of networks. Explain there is more to it. Pick out most central node using SNA measures as an example. Refer back to this when the whole network diagram is flashed up later on…
Nodes can be whatever you want them to be, groups, people, hair colour, car that you drive...
21 November November 2018

4. The history of SNA Psychology Anthropology Mathematics
Psychology: sociometry, sociograms, group behaviour, strutural properties of groups, social perceptions and attitudes, balance theory.
21 November November 2018

5. Genres of Social Network Analysis
∑(cmax - c(vi))
Visual, academic and applied. Also other things such as tools, network structures, Graph theory, complexity theory.
Tools
Structures
Graph theory
Complexity
21 November November 2018

6. ∑(cmax - c(vi))
Structures
Tools
21 November November 2018

7. Origins of SNA applications in Dstl
Modelling
target dynamics
Modelling the critical
national infrastructure
Bayesian inference
for link prediction
Social networks of
terrorist groups
Proof of concept study
Social Network Analysis
Case Study
The point of this is to show that we have been playing with SNA for a while. Each project has taught us different lessons that we have then heeded in later work. Recommendations of SNACS are actually recommendations based on other project experiences as well.
Key findings within innovation project: 2 people were found to be the same person and the use of affiliation analysis
Cross-Government
Case Study
21 November November 2018

8. SNA in Government X
∑(cmax - c(vi))
21 November November 2018

9. Why use SNA?
Helps people understand the groups they are interested in.
SNA may identify network characteristics not apparent by eye
SNA allows group structures and flows of communications to be explored
Systematic approach to data coding allows for quick and easy “what-if?” analysis
Coding data forces people to challenge their assumptions and allows knowledge to be transferred
21 November November 2018

10. Intelligence SNA Data management Present results Set up Coding
Analysis
21 November November 2018

11. Intelligence SNA Data management Present results Set up Coding
Analysis
21 November November 2018

12. Set up Getting a tasking Identifying the team
Determining aims: questions to be answered
Deciding on a taxonomy
Sharing out responsibility
Selecting and obtaining software
Creating a suitable database
21 November November 2018

13. Intelligence SNA Data management Present results Set up Coding
Analysis
21 November November 2018

14. Coding Finding people to code
Holding an initial training session or workshop
Regular team meetings
Coder interviews
Inter-coder reliability exercises
21 November November 2018

15. Why coding and definitions matter
Is A co-located with B if:
They work in the same building?
They work on the same site?
They work for the same company?
They attend the same meeting?
They meet and talk on the street?
They were in jail together?
Using this example to illustrate divergence of processes and importance of taxonomies.
Common understanding
Need to provide the group with tight definitions. Confirm that all have the same definition in their heads.
Need to have a warm up period- a time to check that people are all coding the same way before they start the case study.
21 November November 2018

16. Intelligence SNA Data management Present results Set up Coding
Analysis
21 November November 2018

17. Data management Configuration control Database merging
Database refinements
The human element
Data tidying
Information entered into the wrong field
Locations not entered
Dates associated with data entered
Entity disambiguation
21 November November 2018

18. Intelligence SNA Data management Present results Set up Coding
Analysis
21 November November 2018

19. Questions and Techniques
Who are the key people in the system of interest?
Centrality measures
Are there any links between A and B?
Path analysis
Affiliation analysis
How does X talk to Y?
How close are M and N?
Link type analysis
Who is linked to whom through training, upbringing or operating locations?
How has X’s connections changed over time?
Centrality variation analysis
What are the key links in the system of interest?
Link centrality analysis
How can the system be influenced?
Key nodes
Key links
Stronger links
Other links
21 November November 2018

20. Intelligence SNA Data management Present results Set up Coding
Analysis
21 November November 2018

21. Why use SNA?
Systematic approach to data coding allows for quick and easy “what-if?” analysis
Coding data forces people to challenge their assumptions and allows knowledge to be transferred
SNA may identify network characteristics not apparent by eye
SNA allows group structures and flows of communications to be explored
21 November November 2018

22. Centrality measures Used to explore who is key in the network
Degree Centrality – Well connected hubs
Betweenness Centrality - Gatekeepers
Eigenvector Centrality – Who does who you know know?
21 November November 2018

23. What about missing data (1)?
21 November November 2018

24. What about missing data (2)?
21 November November 2018

25. What about deliberately concealed data?
Is there anything we can do?
Should we compensate for missing and concealed data, or simply accept that it exists and try to minimise the impact it has?
21 November November 2018

26. Reachability and distance
21 November November 2018

27. Affiliations: inferring links through shared attributes
Groups
People
21 November November 2018

28. Reachability and distance
21 November November 2018

29. More trustworthy links
21 November November 2018

30. Reachability and distance
Normal link
Trusted link
21 November November 2018

31. Difficulties encountered
Software packages available
Balance between coding and analysis
Nature of available data
Applicability of SNA measures
We have used UCINET mainly, with the associated tools NetDraw and Pajek. Have also used Key Player at times. Far too much time has been spent on trying to make the tools we have do things that they are not really designed to do. Need to obtain a bespoke software tool to support ISNA if it is to be used effectively in the future.
Balance between coding and analysis. It takes ages to do the coding part! I estimate that we have spent a total of 38 man days on undertaking the case study, split down as 16 days coding and 22 days analysis. This is a ratio of approximately 40% to 60%, which in retrospect may have been coding heavy. Guidance on the optimal balance will be informed by future studies.
Nature of the data available e.g. incomplete, possibly inaccurate, focussed upon specific people of interest, sheer quantity of reporting
There is a real and significant difference between SNA and Intelligence SNA (ISNA). The tools, techniques and approaches used in SNA (predominantly in academia at present) cannot simply be picked up extant and applied to ISNA. New techniques, approaches and solutions to Intelligence specific problems need to be developed for ISNA.
Mistakes not tidied e.g. repeated nodes are spotted throughout analysis. Do you re-do analysis or not?
Continual process of data tidying
21 November November 2018

32. Demonstration of added value
Identification of a key individual through inferred links
Identification of a different inter-group structure to that which had been assumed
Understanding of the importance of an individual of interest
21 November November 2018

33. Assumed structure
Group A
Group B
21 November November 2018

34. Structure suggested by SNA
Group A
Group B
21 November November 2018

35. Links of a person of interest
21 November November 2018

36. 21 November November 2018

37. The history of SNA Psychology Anthropology Mathematics
Psychology: sociometry, sociograms, group behaviour, strutural properties of groups, social perceptions and attitudes, balance theory.
21 November November 2018

38. Review of Terrorist disruption
Historical CT success factors
Exploitation: Group analysis and assessment / DIS, PJHQ & HQ ARRC Operational assessments
A&B Analysis
A&B Assessment Metrics
SNA Case studies
Influence Analysis / PAM
Media assessment
Media monitoring
Suicide Terrorism
Computer-assisted sentiment analysis
Modelling Info Ops Target Dynamics
Leadership assessment
Coercion / Intent gaming
Prediction of surprise attack
Body movement profiling
LAPA R&V Assessment
Exploitation: Remote personality assessment DIS Leadership and Personality Assessment (LAPA)
21 November November 2018

39. Proposed ISNA Activities
Support development of Behavioural, SNA and SNEE Science Base
Proposed ISNA Activities
Operational Exploitation Dstl
Behavioural, SNA and SNEE Science Base
Technical / software support
ISNA Capability Development
Operational Exploitation MoD & OGAs
Technical / software support
Operational Exploitation Dstl
Science base
Technical support
ISNA Capability Development
Operational Exploitation MoD & OGAs
ISNA Capability Development
Operational Exploitation Dstl
Operational Exploitation MoD, OGAs and OGDs
Current
End 2007
21 November November 2018
End 2010

40. Questions & Comments