Typology of Terrorist Profiling Using Centrality Metrics: Hinge Figures, Influential Operatives and Trusted Assets

ABSTRACT

The increase in terrorist activity worldwide has prompted the development of research tools and methodologies to study the phenomenon of terrorism. Among them, social network analysis (SNA) has found its way into the security studies discipline, which, despite its still timid presence, has increasingly been proven to be a useful tool for detecting underlying structures and key actors. This article seeks to contribute to the body of knowledge on the uses of SNA in the study of covert networks by testing the usefulness of metrics such as betweenness, closeness, and eigenvector centrality in identifying terrorist roles and functions in the cells that were behind the major terrorist attacks orchestrated by the Islamic State’s external operations apparatus. The study ends with the proposal of a new typology of terrorist profiling according to the results obtained from centrality measures: hinge figures, influential operatives and trusted assets.

KEYWORDS:

• Social network analysis
• centrality measures
• terrorism
• Islamic State’s external operations apparatus

Introduction

Social network analysis applied to the study of terrorist networks

Generally defined as the process of investigating social structures through the use of networks and graph theory, social network analysis (SNA) came to the fore after 9/11, when media and academia focused on the potential uses for this methodology when applied to the study of terrorist networks.

In this vein, The Washington Post reiterated Kathleen Carley’s meta-matrix as a sophisticated tool for understanding and dismantling terrorist networks in an article published on September 17, 2001, and a few years later, the controversy over the National Security Agency’s wiretapping revived the debate on the application of SNA to millions of intercepted communications, as published in The New York Times on March 12, 2006, under the headline “Can Network Theory Thwart Terrorists?” However, the media was only playing catch up with the momentum that SNA had gained in academic circles, where its prospective applications to the mapping of dark networks had been under discussion for some time. In this respect, among researchers applying SNA methodology in the social sciences, distinction is often made between modelers like Carley, that use complex computational systems to make predictive behavioral models, and data collectors, who start with a descriptive analysis of the information collected and then model it with SNA tools. While modelers may offer great insight on theoretical terrorist networks, they often do not have the best data, as they do not assemble individual biographies like data collectors usually do.¹

This study falls into the latter group, the data collectors, following in the footsteps of Valdis Krebs, who was one of the first to apply this methodology to the study of the plot behind 9/11. To do so, he compiled all the personal stories that had been published about the nineteen people involved in the attacks and classified the relationships between them according to the strength of their ties in order to draw conclusions about the operability of the group according to the position of the actors in the network.²

Similarly, this study primarily sought to elucidate the inner workings of the networks behind the major terrorist attacks that took place in Europe between 2014 and 2016 instigated by Islamic State (IS) units formed in Syria, mostly composed of European foreign fighters. Being common knowledge that the masterminds of the attacks in Europe were linked to IS’s external operations apparatus, also known as Emni for the abbreviation of Amn al Kharji, which is the Arabic name by which IS’s external security unit is known, it was ultimately decided to include as well the cells behind the 2015 attacks in Tunisia, the 2016 attack at Breitscheidplatz in Berlin and the 2017 attack in the U.K. Manchester Arena that were orchestrated from Emni’s base in Libya. This decision draws on the theory that the progressive loss of territory in Syria and Emni finding common ground with the Katibat al Battar al Libiyya (KBL), a battalion mainly made up of Libyans and Tunisians, eventually led to a gradual shift to Libya as Emni’s new base of operations.³

Considering the enduring concern of the European Union and its member states to advance in the implementation of more efficient policies in combating terrorism and addressing the phenomenon of foreign fighters, the main purpose of this study is to identify which individuals were crucial in Emni’s network according to metric indicators in order to assess the usefulness of SNA as a tool to detect key profiles. To this end, several centrality metrics have been tested with the aim to extract a profile typology that could potentially serve intelligence analysts as a basis for selected deactivation or neutralization of individuals when seeking to dismantle other covert networks.

Terrorist networks, somewhere between efficiency and secrecy

Given that terrorist organizations tend to be covert in nature, the application of SNA is somewhat limited when it comes to mapping the links between actors. This difficulty becomes particularly complex when it comes to information that those involved are determined to conceal by all means. With good reason it is said that what matters most is often what cannot be seen or what may first appear to be irrelevant links, as they are not activated until they must be put into action or when the group publicly declares its intentions or objectives.⁴

Krebs categorized the relationships between those involved in the 9/11 plot into three levels, where friendship and family ties were the strongest ties, encounters in meetings or joint trips were moderately intense ties, and transactions or occasional encounters were weak ties.⁵ However, when he entered the ratios into a graph in which the terrorists were represented by nodes and the relationships by edges, he observed that the attackers on the same plane were linked by very weak ties (more than two degrees of separation) which, according to Friedkin, would be above the horizon of observability at which one actor can hardly have knowledge of the performance of another.⁶ The strangeness of finding weak ties between those who formed the assault groups for each aircraft is explained by the fact that although they had all trained in Afghanistan, once they arrived in the United States there was hardly any contact between them. This is in line with the strategy that Osama bin Laden recounted in a recording found a few months after 9/11,⁷ said strategy being designed so that the attackers did not know the details of the operation or who would accompany them in the attack until the moment they boarded the plane. Consequently, what at first glance appeared to be a decentralized network of weak ties was in fact a network sustained by strong ties forged long ago, which ties in with Erickson’s theory that a secret society needs prior knowledge and trust among its members in order to function well.⁸

In the same vein, Rodríguez applied SNA to the study of the plot behind the 2004 Madrid train bombings, concluding that the network that prepared and carried out the attack was a diffuse network based on weak ties.⁹ Here too, part of the success subscribes to what Granovetter defined as the strength of weak ties, in the sense that sometimes greater social distance can be effective in distributing non-redundant information as more dispersed networks connecting people from other social circles may provide access to resources and skills of a different nature.¹⁰ In practice, it is common for networks operating underground to straddle the line between efficiency (close or frequent contacts) and concealment (distant or few contacts). However, as Baker and Faulkner point out, all networks must be activated occasionally to achieve their goals, at which point they are particularly vulnerable to detection.¹¹ As observed by Wu and Knoke, who applied SNA to the study of the links between terrorism and organized crime, beyond the dilemma between efficiency and flexibility, covert organizations seek to structure themselves in a decentralized way because this makes detecting and dismantling the group more difficult.¹²

This model of a decentralized network of loosely controlled and coordinated cells is what Sageman called a “leaderless jihad” in 2008 to describe the organizational structures of terrorism in the 21st century.¹³ A few years earlier, Sageman had popularized the term “a bunch of guys” to explain the importance of personal ties over formalized structures in the configuration of terrorist cells, seeing that many groups were made up of people who shared previous family and social relationships, something that was necessarily also a determining factor in their recruitment.¹⁴ Naturally, from the point of view of security forces and intelligence services, hierarchically structured criminal and terrorist organizations are easier to detect and dismantle. Covert organizations therefore often prioritize security at the expense of more efficient coordination or communication, knowing that greater decentralization often also entails the risk that individual nodes or small cells will make decisions that are not necessarily aligned with the group’s overall interests and may jeopardize the mission.¹⁵

One way to analyze network typology is to check whether the network structure conforms to Milgram’s small-world theory, often referred to as the theory of six degrees of separation.¹⁶ When applied to social network analysis, a network is usually considered to have small-world characteristics when the mean distance is low and the clustering coefficient is high,¹⁷ which in a graph can be visualized as an irregular distribution of links, with more densified areas and less connected areas. In order to test whether small-world theory applied to covert networks, Lindelauf et al. took a terrorist network and a criminal group as case studies, the Jemaah Islamiyah cell behind the 2002 Bali attack, and a heroin distribution network in New York, respectively. Although they concluded that both networks had avoided forming clusters, preferring to structure themselves in a less articulated fashion,¹⁸ small-world theory has often been proved to be a useful methodology for mapping contacts and outlining the toponymy of a network and also for detecting those nodes of particular relevance to the network’s operations.¹⁹

This is why strategies for understanding the terrorist network operations that focus on who is central have become particularly important, making the concept of centrality an important tool for identifying key actors. Researchers such as Sparrow, Borgatti, Schwartz and Rousselle, and Morselli and Roy have focused their research on the applicability of centrality measures in the fight against organized crime and terrorism, seeking to identify roles and profiles whose selective elimination can serve to destabilize a network.²⁰

Use and scope of centrality measures

Beyond degree centrality, which measures the number of connections a node has, this study sought to test the metrics that other experts have previously used to analyze terrorist networks, namely the centralities of closeness and betweenness proposed by Freeman²¹ and the eigenvector centrality formulated by Bonacich.²² While degree is the measure of centrality par excellence, closeness measures the mean distance of each actor from the other nodes, and betweenness calculates how often a node is on the shortest route between each pair of nodes. The fact that the network behind 9/11 was a fairly decentralized network resulted in Mohammed Atta, who at the time already seemed like the network leader, scoring high on the centrality measures of degree and closeness, but lower on betweenness.²³

In this sense, betweenness is not a measure of centrality as such; it allows us to trace those links that connect a node with other communities beyond its natural group. Betweenness can therefore be used to detect those actors who occupy a brokerage position, what Burt called social capital because of their ability to fill structural holes with different resources,²⁴ and which Stephenson defined as “gatekeepers” because of their control over information flows.²⁵ When applied to the study of four terrorist groups operating in and against Australia between 1963 and 2003, namely Hrvatsko Revolucionarno Bratstvo, Aum Shinrikyo, Lashkar-e-Taiba and Jemaah Islamiyah, Koschade found that the betweenness metric was useful in identifying cell leaders who, being part of more centralized structures than the networks behind 9/11 and the 2004 Madrid train bombings, played a connecting role to other networks and core nodes.²⁶ On the other hand, SNA also helped Milla et al. to draw the map of terrorism in Indonesia, concluding that it was structured in a single extensive network made up of small cells connected to one another. In this sense, betweenness was decisive in detecting the operational leaders of the network, who in turn acted as a link between the groups, planned the actions, and recruited new members.²⁷

With regard to the closeness metric, in the field of organizational theory it has been a measure to assess centrality, sometimes contested, as discussed by Borgatti et al., due to the complexity of its measurement.²⁸ However, it can be very useful for identifying key actors in opaque organizational structures, as Pilny and Proulx showed in their study of the network of international alliances of global terrorism between 1998 and 2005, to which they applied different measures of centrality, including closeness. Unlike degree or betweenness centrality, they found that the closeness metric allowed them to detect relevant nodes hidden in plain sight.²⁹ Thus, it is assumed that nodes that score high on closeness, by having shorter paths to the rest of the nodes, can more easily access scarce resources and be more efficient, meaning they are likely to be perceived of as important.³⁰ In this sense, actors with a high degree of closeness are those with more unique connection patterns, which Stephenson has defined as “pulsetakers.” These are, by definition, the opposite of “hubs,” since, as they are barely visible in the network fabric, they are assumed to have the capacity to exert a subtle influence from the shadows.³¹

Finally, there is eigenvector centrality, which builds on a more developed approach to degree centrality. Specifically designed to assess the prominence or importance of a node within a network, eigenvector centrality takes into account the quality of connections rather than the quantity, to the effect that a node is considered more powerful or influential if it is connected to other nodes that are also prominent, in the sense of being central or well-connected. However, eigenvector centrality is not a measure that works for all types of network structures. It is especially sensitive to situations where an individual with low degree centrality is linked to a few actors with many connections, or where a vertex with a high degree centrality is related to several poorly connected nodes.³² This case-based reasoning is also noticeable in Horne and Horgan’s analysis of British extremist networks linked to Finsbury Mosque, where they found that, unlike Abu Hamza, Omar Bakri scored very low on the eigenvector metric, while both were in first position on all other metrics.³³ The explanation lies in the type of leadership exercised by each. Bakri operated in a horizontal structure in which he had contact with many actors who nevertheless had few connections beyond him. Meanwhile, Abu Hamza led a more hierarchical network, in which he was central to other individuals in the middle layers who in turn were also central to actors at the grassroots.

Methodology

With the aim of compiling all persons directly or indirectly linked to the major attacks carried out by the IS’s external operations apparatus, this research has taken into account those operatives who participated in the attacks in Europe and Tunisia between 2014 and 2017 that have been either claimed by the organization and/or the involvement of their operatives is known, as well as the recruitment networks from which they came and the main ideologues who influenced their radicalization process.

The database therefore includes a list of the people behind the attack on the Jewish Museum in Brussels in May 2014, the Charlie Hebdo and Hypercacher attacks in Paris in January 2015, the foiled plots in Villejuif, on the Thalys train to Paris and the dismantled cell in Verviers in 2015, the attacks in Stade de France, in Bataclan and in the 10th and 11th arrondissements of Paris in November 2015, the attacks on the Bardo Museum in Tunis in March 2015 and on the beach of the Hotel Rui Imperial near Sousse in May 2015, the attacks at the Brussels subway station and airport in March 2016, the attack on the Promenade des Anglais in Nice in July 2016, the attack at Breitscheidplatz in Berlin in December 2016, and the attack on the Manchester Arena in May 2017.

Due to the large number of actors, plots and subgroups, which comprise a total of 129 people and 412 connections, the decision was made to work with a binary formulation in the form of an adjacency matrix that indicated whether there is a relationship between each pair of actors. For this purpose, a broad definition of “connection” was used, covering family ties, emotional attachments, and friendships to more sporadic contacts, such as a joint trip, participation in a meeting, a phone call or a written exchange. This rather cautious approach was chosen over grouping connections based on the strength of their ties, given the formal impossibility of obtaining accurate details regarding the intensity of every relationship.

All information to determine the possibility of contact between actors was obtained from publicly available sources, such as the media, databases, official documents, transcripts of court proceedings and academic articles and publications on the cells under investigation. To the extent possible, data has been triangulated in order to minimize the margin of error and potential bias in the results. Working on an opaque network whose acts took place some time ago and have therefore been profusely covered in the media, with the main actors involved brought to trial, unaccounted for or deceased, made it possible to have some prior information on the roles that the different actors under investigation played in the course of their work for Emni. In turn, this made it easier to obtain a more complete reading of SNA.

Therefore, starting with previous knowledge of the network under study, this research used the small-world methodology to determine whether Emni’s network corresponded to this type of structure. To this end, a random network was constructed with the SocNetV program following the Watts and Strogatz model.³⁴ This network included the same number of nodes and connections as the original, in order to compare the values of the mean distance and the clustering coefficient. The degree, closeness, betweenness and eigenvector centrality metrics were also tested using the SocNetV program for the statistical calculation and the Gephi software was used to elaborate the graphs. The formulas used for the calculation of the metrics are as follows:

• - The degree centrality of a node (CGi), where R is the analyzed network and A is the adjacency matrix, where the arrangement of nodes in symmetric rows and columns implies that the ratio [i,j] equals [j,i]. The normalization factor (N – 1) was applied to this formula, where N represents the total number of nodes:

$\mathit{C}{G}_i=\frac{{\sum }_{j\text{isin}R}^{\hspace{0.17em}}{A}_{\mathit{ij}}}{\mathit{N}-1}$

• - The betweenness centrality of a node ($\mathit{C}{I}_i)$, where $g_{\mathit{jk}}$ is the total number of shortest paths between nodes $\mathit{j}$ and $\mathit{k}$, and $g_{\mathit{jk}}\left(\mathit{i}\right)$ represents the total number of shortest paths between $\mathit{j}$ and $\mathit{k}$ including the one that goes by $\mathit{i}$. The normalization factor (N – 1) (N – 2) was applied to this formula:

$\mathit{C}{I}_i=\sum \mathit{j},\mathit{k}=\mathit{G}\frac{{\mathit{g}}_{\mathit{jk}}\left(\mathit{i}\right)}{g_{\mathit{jk}}}\left(\mathit{N}-1\right)\left(\mathit{N}-2\right)$

• - The closeness centrality of a node ($\mathit{C}{C}_i)$, where $D_{\mathit{ij}}$ is the distance between nodes $\mathit{i}$ and $\mathit{j}$. The closeness centrality has been normalized by multiplying it by (N – 1), since it corresponds to the inverse value of the sum of the length or number of edges of the shortest path for each node with respect to the rest of the actors:

$\mathit{C}{C}_i=\frac{\left(N-1\right)}{{\sum }_{j\text{isin}R}^{\hspace{0.17em}}{D}_{\mathit{ij}}}$

• - The eigenvector centrality for a node ($\mathit{C}{V}_i)$, where Nbi represents all nodes close to i and λ is the eigenvector. To normalize it, it has been divided by the sum of eigenvectors:

$\mathit{C}{V}_i=\frac{1}{\lambda }\sum _{j\text{isin}N{b}_i}^{\mathit{\hspace{0.17em}}}{A}_{\mathit{ij}}\cdot X_j$

Results

A first approach to the network under study has shown that it is a fairly compact network, in the sense that the mean distance between any pair of nodes is 4.1 and the geodesic distance (the shortest path between a pair of nodes) is 3 degrees, while the diameter (the longest distance recorded between two nodes) is 12 degrees. However, this only occurs on 15 occasions, compared to the 1,833 times a 3-degree path is found. These cohesion indicators are quite indicative that the analyzed network converges toward a small-world structure, which is further corroborated by comparison with the randomly generated network (see Table 1).

Table 1. Comparison of the values of Emni’s network with those of a randomly generated network

	Current mean distance	Random mean distance	Current clustering coefficient	Random clustering coefficient
Emni network	4.14959	4.16509	0.698697	0.166777

Small-world parameters are considered to be met when the clustering coefficient of the current network is higher than that of the ad hoc generated network, and the mean distance is less.

With regard to the centrality measures, and for the sake of readability, we have chosen to show only the numerical results of the most prominent nodes on the understanding that the complete tables can be made available to the reader on request and observing the graphs is sufficient to appreciate the singularities of each of the metrics used (see Figures 1–4).

Figure 1. Network behind the Islamic State’s external operations apparatus. In the graph, the tonal gradient reflects modularity, which differentiates the cells behind each of the attacks, and the size of the nodes indicates degree centrality.

Graph consisting of the 129 nodes forming Emni’s network along with the 412 connections between them, with cells representing the analyzed attacks visually differentiated into subgroups by color gradients.

Figure 2. Prominent nodes in the network behind the Islamic State’s external operations apparatus from the perspective of betweenness.

Graph comprised of nodes and edges, with the nodes exhibiting higher betweenness centrality highlighted in a darker shade.

Figure 3. Prominent network nodes behind the Islamic State’s external operations apparatus from the perspective of closeness centrality.

Graph comprised of nodes and edges, with the nodes exhibiting higher closeness centrality highlighted in a darker shade.

Figure 4. Prominent network nodes behind the Islamic State’s external operations apparatus from the perspective of eigenvector centrality.

Graph comprised of nodes and edges, with the nodes exhibiting higher eigenvector centrality highlighted in a darker shade.

In this sense, although the highest scorer on all centrality measures was Abdelhamid Abaaoud, who Khalid Zerkani recruited in Belgium and who once in Syria quickly rose through the ranks of the Katibat al Muhajireen (KAM) to become the coordinator of IS operatives in Europe and Emni’s middle command, there were clear differences between metrics in terms of subsequent positions (see Table 2).

Table 2. Selection of the nodes with the highest scores on the degree, betweenness, closeness and eigenvector centrality measures

Degree centrality		Betweenness centrality		Closeness centrality		Eigenvector centrality
Abdelhamid Abaaoud	0.320313	Abdelhamid Abaaoud	0.483252	Abdelhamid Abaaoud	0.400000	Abdelhamid Abaaoud	0.060173
Salah Abdeslam	0.195313	Boubaker al Hakim	0.251849	Boubaker al Hakim	0.374269	Salah Abdeslam	0.043638
Najim Laachraoui	0.164063	Seifallah ben Hassine	0.250594	Salim Benghalem	0.366762	Najim Laachraoui	0.039766
Mohamed Abrini	0.148438	Abu Qatada	0.172363	Fabien Clain	0.342246	Mohamed Abrini	0.038206
Salim Benghalem	0.125000	Djamel Beghal	0.158361	Farid Melouk	0.340426	Ibrahim el Bakraoui	0.027489
Boubaker al Hakim	0.125000	Ramadan Abedi	0.158342	Abdelnasser Benyoucef	0.340426	Khalid el Bakraoui	0.026949

Hinge figures

Of all of metrics, betweenness was undoubtedly the one that yields the most differentiated results with respect to degree centrality, as can be seen in Figure 2. Thus, after Abaaoud, the most prominent node in betweenness is Boubaker al-Hakim, the French-Tunisian member of the Buttes-Chaumont network and veteran of the Iraqi jihad, partner of the Kouachi brothers (perpetrators of the attack on the Charlie Hebdo offices), who upon relocating to Tunisia took over the leadership of the military wing of Ansar al Sharia in Tunisia (AST)³⁵ under the orders of Seifallah ben Hassine and later became a prominent member of the Emni structure (Mediapart, September 5, 2020).

He is followed by Seifallah ben Hassine, disciple of Abu Qatada (International Center for Counter-Terrorism, March 21, 2013) and mentor of Khalid Zerkani (L’Obs, February 19, 2016), a Tunisian veteran of the Afghan jihad, co-founder of the Tunisian Combatant Group, and later leader of AST, an organization whose members mostly joined IS and relocated to the training camp in Sabratha, Libya, from where they plotted several of the attacks that struck Tunisia in 2015.³⁶

The third person who stands out for his betweenness score, included in the analysis network not for his direct involvement in the attacks orchestrated by Emni, but for his personal ties and influence on many of the ideologues and reference persons of the networks that supplied recruits to IS’s external operations apparatus, is Omar Mahmud Othman, better known by the nickname Abu Qatada. A preacher of Salafist ideas, Abu Qatada settled in the United Kingdom in the 1990s, where he set up the media outlet Usrat al Ansar together with Abu Hamza al Misri and Abu Musab al Suri, which distributed, among others, publications of the Armed Islamic Group (GIA) and the Libyan Islamic Fighting Group (LIFG).³⁷ These ties, forged some time ago, are those that on the one hand link Abu Qatada to Djamel Beghal (The Guardian, January 11, 2015), former GIA militant responsible for the radicalization of the Kouachi brothers and Amedy Coulibaly, and to Ramadan Abedi (BBC, June 12, 2017), father of the Manchester attacker and close to the LIFG, which correspond to the last two profiles of the betweenness metrics that we will examine in further detail.

After the Paris attacks in 1995, Djamel Beghal took refuge in the United Kingdom, where he came under the influence of the Islamists of Finsbury Mosque. After travelling to Afghanistan, where he befriended Seifallah ben Hassine (Harper’s Magazine, January 2016) he was intercepted on a flight back to Europe and sentenced to prison in France. It is in the Fleury-Mérogis prison that he met one of the future Charlie Hebdo attackers and the Hypercacher assailant, who quickly saw him as a reference person (Le Monde Diplomatique, February 2015). On the contrary, Ramadan Abedi, connected to LIFG figures such as Abu Anas al Libi (AP News, May 25, 2017), went into exile in the United Kingdom fleeing the Gaddafi dictatorship, where he forged close ties with Abu Qatada and Abd al Baset Azzouz. At the dawn of the Libyan revolution, he returned to his native country, where he joined a brigade close to Ansar al Sharia in Libya (BBC, December 8, 2020), which undoubtedly served as a precursor to the radicalization of his sons.

Broadly speaking, the main characteristic shared by those who score high in betweenness is seniority, but also the ascendancy they enjoyed in their respective groups of influence. In many cases, this earned them the trust and respect to establish links beyond the networks where they were first affiliated, serving as connectors to other organizations. The nodes with a high level of betweenness, therefore, do not have an operational profile, but have mostly been mentors and ideologues who, legitimized by their transnational experience, became reference persons for the new generations, enabling IS to use the same recruitment pools as Al Qaeda. This is why they have been deemed “hinge figures,” as they not only provided the resources and international connections to launch IS’s external operations apparatus, but also provided the strategic vision and leadership that would set the organization’s long-term direction.

Influential operatives

In terms of closeness centrality, after Abaaoud, the person who scores highest is Boubaker al Hakim, who also ranks second in the betweenness metric. However, the lower scoring positions are worth a look, since they are where the metric starts to offer the most peculiar results. In third place is Salim Benghalem, a member of the Parisian network of Buttes-Chaumont, who traveled to Yemen with Chérif Kouachi to meet with members of AQAP (France Télévisions, September 24, 2020) and then to Tunisia with Boubaker al Hakim and Mohamed al Ayouni, who was his mentor in France. Finally, Benghalem headed for Syria, where he was in charge of organizing the arrival and training of French jihadists, including Mehdi Nemmouche, the direct perpetrator of the attack on the Jewish Museum in Brussels in 2014 (Le Monde, December 1, 2015).

He is followed by Fabien Clain of the Artigat network, involved in the recruitment of assets during the Iraq war. In early 2014, Clain left for Syria where he quickly climbed through the ranks of IS and claimed responsibility for the Paris attacks in November 2015 (L’Obs, June 29, 2022). Consequently, he is presumed to be a co-conspirator in the organization of the attacks (L’Express, June 27, 2018). Succeeding Clain is Farid Melouk from France, a member of the GIA and a veteran of the Bosnian and Afghan jihad. As a result of an international arrest warrant, he was captured in Belgium and extradited to France, where he coincided in prison with Chérif Kouachi, Amedy Coulibaly and Djamel Beghal (Le Monde Diplomatique, February 2015). In October 2012 he joined IS in Syria, placing himself at the head of one of the training camps (Mediapart, March 13, 2016), a position that allowed him to be in contact with Abaaoud and other members of the cell that would lead the attacks in Paris in November 2015 and Brussels in March 2016.

To finish outlining the characteristics that define actors with a high closeness centrality, it is also necessary to look at Abdelnasser Benyoucef. Of Algerian origin, previously linked to the Moroccan Islamic Combatant Group (Le Parisien, July 2, 2010) he is considered the mastermind behind the Coulibaly attack at the Hypercacher and instigator of the Verviers plot and the failed Villejuif attack alongside Fabien Clain and/or Abdelhamid Abaaoud (Le Monde, September 4, 2020).

All of them have in common having influenced the organization of IS’s external operations apparatus from Syrian territory, selecting the members who would form part of said apparatus and the targets to be attacked. As we can see in Figure 3, beyond Abaaoud and Al Hakim, the rest of the actors who score high in closeness are not so immediately noticeable because they are not so central. However, those who stand out in terms of closeness, having a sufficient number of contacts to be neither too far from nor too close to the central nodes, tend to be aware of everything that happens in the network, allowing them to exercise leadership from the shadows. In Emni, those who stand out in terms of closeness were decisive commanders, had knowledge about the attacks and, to a greater or lesser degree, instigated them, which is why they have been defined as influential operatives.

Trusted assets

The eigenvector centrality, on the other hand, revealed those profiles linked to more prominent nodes and better quality contacts. In the second position after Abaaoud we find Salah Abdeslam, a Frenchman of Moroccan origin born in Belgium and childhood friend of Abaaoud. Abdeslam played an important role in the logistical preparation of the attacks in Paris in November 2015 and in Brussels in March 2016, as he not only made several trips to pick up the future attackers as they entered Europe, but also booked the apartments and hotels where they would stay, eventually integrating himself into one of the commandos who attacked in Paris.

He is followed by Belgian Najim Laachraoui, who left for Syria in early 2013 along with Abaaoud and other recruits from Zerkani’s network. With studies in electromechanics and previous work experience at Brussels Zaventem airport, Laachraoui was in charge of the manufacture of the explosives used in the attacks in both cities, forming part of the commando that attacked the Brussels airport in March 2016 (The Telegraph, April 21, 2016). The fourth is Mohamed Abrini, also Belgian, a childhood friend of Abaaoud, who, after a brief foray in Syria, was assigned to the organization of the attacks from European soil, accompanying Abdeslam in the preparation of the Paris attacks and participating in the commando that attacked the Brussels airport (RTL Info, November 23, 2020).

The last two profiles with high scores in eigenvector centrality that need to be mentioned were the Bakraoui brothers involved in the Brussels attacks. While Ibrahim was the third member of the commando that attacked the airport, Khalid did the same at the Maelbeek metro station. Both had been recruited by their cousin Oussama Ahmed Atar (Politico, March 22, 2017), who, having risen to a command position in Emni, is considered one of the masterminds of the attacks in Paris and Brussels (France TV Info, September 9, 2021) and is ranked just a few tenths below Abdelnasser Benyoucef in the closeness metric.

It is well known that the actors with a high eigenvector centrality mostly came from Abaaoud’s closest environment, being his trusted men in the execution of the November 2015 attacks in Paris and in Brussels in March 2016 (see Figure 4). With very similar patterns, they occupied operational and facilitating roles in a plot that they knew well because of their close ties to the most central node. They have been called trusted assets since their relationship is based on strong ties, such as the existing friendship between Abaaoud, Abdeslam and Abrini, family ties in the case of the Bakraoui and his cousin Atar, and the need for unique technical expertise, such as Laachraoui.

Discussion

In applying metrics such as degree centrality, Roberts and Everton point to the fact that our mental schemas predispose us to attribute greater leadership and status to those nodes that are more central, an assumption that is amplified by the visual bias of assuming that leaders are always placed in the center.³⁸ It is therefore interesting to take into account other measures of centrality, such as those analyzed in this study, which have not only been useful for unpacking the concept of leadership but also for outlining new roles and functions in the network of groups and cells that formed the network behind IS’s external operations apparatus.

In this way, betweenness made it possible to create the category we have termed “hinge figures,” who, thanks to their intergenerational contacts and transnational connections, laid the foundations of Emni and guided the group’s strategy. In their skills and tasks, hinge figures resemble Stephenson’s gatekeepers³⁹ and Nesser’s profile of entrepreneurs, who, being more senior, are the ones who usually manage external relations with other extremist organizations and sustain the link with mentors and ideologues.⁴⁰ Our conclusions regarding betweenness in this sense differ slightly from the results of Milla et al., who used betweenness to draw a more operational profile rather than that of ideologue or strategist,⁴¹ and of Mullins, who used betweenness to profile middle managers.⁴²

On the other hand, and in contrast to more skeptical voices, such as those of Borgatti et al.,⁴³ the closeness metric not only offered us another vision of centrality, but also allowed us to better locate the operational leaders who captained and planned the main attacks orchestrated by Emni. By virtue of this, and due to the ascendancy they exercised over the network from one position, albeit a less noticeable but still privileged position, as also demonstrated by the results of Pilny and Proulx, who used closeness to identify key players in opaque structures,⁴⁴ we characterized the profile provided by closeness as influential operatives. This influential operative typology shares characteristics with Stephenson’s definition of pulsetakers,⁴⁵ as their prominence and reputation are built on indirect ties, while sharing with Barnett et al. the notion that the ease of access to scarce resources lies in the shortest paths, which necessarily makes those with a high degree of closeness more efficient and sought after.⁴⁶

Ultimately, eigenvector centrality served to distinguish trusted assets, an actor typology that is close to the category that Nesser defined as protégés: those who in a terrorist organization enjoy the trust of the leaders and therefore are used to occupy second-in-command functions.⁴⁷ In the case of the network behind IS’s external operations apparatus, the eigenvector centrality shows us an operational profile radicalized on the basis of loyalty generated by family or friendship ties who gains access to the hard core precisely through these close ties, so that he ends up acting as executor and/or facilitator of the attacks.

As regards to the topology of the network in global terms, (without prejudice to the fact that the construction and limits are circumscribed to a certain degree of discretion by the author) this topology was observed to meet the criteria that normally define a small-world network, just like the network behind the 9/11 terrorist attacks⁴⁸ and the post Al Qaeda transnational movement.⁴⁹ In light of the results obtained in the different metrics and the qualitative reading of same, the theory of Waniek et al. that in covert networks an inner circle of “captains” tends to form, (nodes with high scores in degree, betweenness and closeness centralities) whose function is to conceal the identity of the leaders while conveying their influence to the rest of the network, is not entirely off the mark.⁵⁰

Conclusions

The greatest obstacle encountered by SNA applied to the study of covert organizations continues to be the difficulty of mapping the actors and the existing relationships among them, given the lack of publicly available information and the strategies pursued by the organizations themselves to preserve their leadership and safeguard the purpose for which they were created. Thus, it is difficult to have sufficient information until the groups disintegrate or major terrorist attacks take place, at which point the media are eager to gather the personal histories and trajectories of those involved. This was also the case in this study, which has been carried out after most of the actors were deceased, imprisoned or missing. Accordingly, it has been very useful to accompany SNA with previous qualitative and descriptive knowledge to facilitate the subsequent interpretation of the mathematical results. However, it is undeniable that the selection made at the outset of the research regarding the boundaries of the group to be investigated and the decision to work with a binary formulation that only determines the existence or not of a link between each pair of actors, have necessarily influenced the outcome.

Nonetheless, despite the previously mentioned limitations and SNA’s challenges in accurately depicting network dynamics when they are not static, the simple visualization of the force-directed graph, encompassing all nodes and edges, intuitively reveals a relational convergence over time. This confluence can be observed between the Franco-Belgian corridor that orchestrated the initial attacks from the Emni base in Syria and the Libyan-Tunisian contingent from the KBL involved in the second wave of attacks organized from Libya. These findings, in turn, support the theory that the two organizations likely found common cause and organized under a joint mantle. SNA has also proven its potential to uncover latent leadership that might not always be evident through a descriptive-qualitative approach. By aggregating all plots into a single network analysis, we were able to spotlight certain actors who were not necessarily considered central players according to prior research, court findings or media reports.

Furthermore, the testing of different centrality metrics to find patterns diverging from degree centrality showed that betweenness yields the most strategic profile of all. Those who score high in betweenness have therefore been called “hinge figures,” as they bridge the different groups, bring experience and transnational contacts, but above all have the ability to mobilize resources and lure recruits with their discourse. From a perspective aiming to disband a network, the deactivation of hinge figures appears to be a useful measure to curb the growth and expansion of one such network.

Closeness, on the other hand, has also proved to be a thought-provoking metric, as it allows us to find those actors who reach other network vertices most quickly. This is the case of what we have named “influential operatives,” a category that encompasses those who plotted and captained the attacks that would bear the stamp of IS’s external operations apparatus. With a lesser known profile compared to hinge figures, but with a high chance of becoming the leaders of tomorrow, the influential operatives detected by the closeness metric make it an interesting measure to explore in future lines of research that seek to delve into the usefulness of SNA to find hidden leaders in covert networks. Also, from the perspective of intelligence analysis, these can be interesting profiles to keep under observation for eventual neutralization due to their significant ability to drive things forward.

Lastly, eigenvector centrality outlined a type of operative that is close to the most central figures, who has been defined as a trusted asset and whose involvement in the network was crucial to having successfully carried out the attacks. In the case of the network studied, the closeness to well-connected nodes was explained by the fact that the recruitment of the trusted assets was largely based on family and friendship ties, a safeguard that later facilitated access to the hard core of the operational commands. A priori this profile would seem the most likely to respond to deradicalization and disengagement programs, particularly when removed from the groups where radicalization was driven by social pressure. In any case, caution should be exercised when inferring results, since the eigenvector metric does not work equally in all organizational structures, which, added to a rather meager literature on its application to the detection of roles and functions, would invite future research on the uses that the eigenvector has in its differentiation from degree centrality.

In conclusion, while SNA has the potential to assist intelligence analysts in devising strategies to combat terrorist recruitment efforts or disrupting a network by eliminating individuals in strategic network positions, it is advisable for social scientists employing SNA methodology to collaborate more closely with mathematical disciplines. This collaboration would allow for the integration of descriptive approaches with enhanced of computational tools, such as dynamic network analysis, where a more statistical analysis might be able to overcome the limitations of the data while introducing an additional analytical framework.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Data availability statement

The data supporting the conclusions of this study are part of the author’s ongoing doctoral research, not yet publicly available.

The data can be obtained from the author upon request.

Additional information

Notes on contributors

Elena A. López Werner

Elena A. López Werner is a political scientist and doctoral candidate at the International Security Program at the Instituto Universitario General Gutiérrez Mellado (IUGM), Universidad Nacional de Educación a Distancia (UNED). Her research focuses on the field of Islamic radicalization and terrorism, where she applies relational theory and social network analysis to understand the functioning of violent extremist groups and profile their members.

Notes

1. Steve Ressler, “Social Network Analysis as an Approach to Combat Terrorism: Past, Present and Future Research,” Homeland Security Affairs 2, no. 2 (2006): 4–5, art. 8, https://www.hsaj.org/articles/171.

2. Valdis E. Krebs, “Mapping Networks of Terrorist Cells,” Connections 24, no. 3 (2022): 43–52.

3. Elena L. Werner, “La Exportación del Terrorismo a través de Emni: Un Repaso de los Atentados desde Siria hasta Libia, Instrumentados bajo la Marca del Servicio de Operaciones Exteriores de Estado Islámico entre 2014 y 2017” [A review of the Orchestrated attacks from Syria to Libya under the label of the Islamic State’s external operations service]. Revista Del Instituto Español De Estudios Estratégicos 21 (2023): 139–67, https://revista.ieee.es/article/view/5327.

4. Steven T. Zech and Michael Gabbay, “Social Network Analysis in the Study of Terrorism and Insurgency: From Organization to Politics,” International Studies Review 18, no. 2 (2016): 214–43, https://doi.org/10.1093/isr/viv011.

5. Krebs, “Mapping Networks,” 44.

6. Noah E. Friedkin, “Horizons of Observability and Limits of Informal Control in Organizations,” Social Forces 62, no. 1 (1983): 54–77, https://doi.org/10.1093/sf/62.1.54.

7. Andrew Hill, “The Bin Laden Tapes,” Journal for Cultural Research 10, no. 1 (2006): 35–46, https://doi.org/10.1080/14797580500421986.

8. Bonnie H. Erickson, “Secret Societies and Social Structure,” Social Forces 60, no. 1 (1981): 188–210, https://doi.org/10.1093/sf/60.1.188.

9. José A. Rodríguez, “La Red Rerrorista del 11-M” [The terrorist network of the 11-M]. Revista Española de Investigaciones Sociológicas 107, no. 4 (2004): 155–79.

10. Mark Granovetter, “The Strength of Weak Ties,” American Journal of Sociology 78, no. 6 (1973): 1360–80, https://doi.org/10.1086/225469.

11. Wayne E. Baker and Robert R. Faulkner, “The Social Organization of Conspiracy: Illegal Networks in the Heavy Electrical Equipment Industry,” American Sociological Review 58, no. 6 (1993): 837–60, https://doi.org/10.2307/2095954.

12. Marie Wu and David Knoke, “Dark Networks: The Terror-Crime Nexus,” in Palgrave Handbook of Inter-Organizational Relations in World Politics, ed. Joachim A. Koops and Rafael Biermann (London: Springer, 2017), 471–84.

13. Marc Sageman, Leaderless Jihad: Terror Networks in the Twenty-First Century (Philadelphia: University of Pennsylvania Press, 2008), 144.

14. Marc Sageman, Understanding Terror Networks (Philadelphia: University of Pennsylvania Press, 2004), 76.

15. Walters Enders and Paan Jindapon, “Network Externalities and the Structure of Terror Networks,” The Journal of Conflict Resolution 54, no. 2 (2010): 262–80, https://doi.org/10.1177/0022002709355439.

16. Stanley Milgram, “The Small World Problem,” Psychology Today 1, no. 1 (1967): 61–67.

17. Duncan J. Watts and Steven H. Strogatz, “Collective Dynamics of ‘Small-World’ Networks,” Nature 393 (1998): 440–42, https://doi.org/10.1038/30918.

18. Roy Lindelauf, Peter E. M. Borm, and Herbert J. M. Hamers, “Understanding Terrorist Network Topologies and Their Resilience Against Disruption,” in Counterterrorism and Open Source Intelligence. Lecture Notes in Social Networks, ed. Nasrullah Memon and Uffe Wiil (Vienna: Springer, 2011), 61–72, https://doi.org/10.1007/978-3-7091-0388-3_5.

19. Gisela Bichler and Stacy Bush, “Networks in a Nutshell,” in Disrupting Criminal Networks: Network Analysis in Crime Prevention, ed. Gisela Bichler and Aili E. Malm (Boulder, CO: Lynne Reinner Publishers, 2015), 233–44.

20. Malcolm Sparrow, “The Application of Network Analysis to Criminal Intelligence: An Assessment of the Prospects,” Social Networks 13, no. 3 (1991): 251–74, https://doi.org/10.1016/0378-8733(91)90008-H; Stephen P. Borgatti, “Identifying Sets of Key Players in a Social Network,” Computational & Mathematical Organization Theory 12 (2006): 21–34, https://doi.org/10.1007/s10588-006-7084-x; Daniel M. Schwartz and Tony D. A. Rousselle, “Using Social Network Analysis to Target Criminal Networks,” Trends in Organized Crime 12, no. 2 (2009): 188–207, https://doi.org/10.1007/s12117-008-9046-9; Carlo Morselli and Julie Roy, “Brokerage Qualifications in Ringing Operations,” Criminology 46, no. 1 (2008): 71–98, https://doi.org/10.1111/j.1745-9125.2008.00103.x.

21. Linton C. Freeman, “Centrality in Social Networks Conceptual Clarification,” Social Networks 1, no. 3 (1978): 215–39, https://doi.org/10.1016/0378-8733(78)90021-7.

22. Philipp Bonacich, “Power and Centrality: A Family of Measures,” American Journal of Sociology 92, no. 5 (1987): 1170–82, https://doi.org/10.1086/228631.

23. Krebs, “Mapping Networks,” 47.

24. Ronald S. Burt, Structural Holes: The Social Structure of Competition (Cambridge, MA: Harvard University Press, 1995), 18.

25. Karen Stephenson, “Trafficking in Trust. The Art and Science of Human Knowledge Networks,” in Enlightened Power: How Women are Transforming the Practice of Leadership, ed. Lin Coughlin, Ellen Wingard, and Keith Hollihan (San Francisco: Jossey-Bass Willey, 2005), 242–65.

26. Stuart A. Koschade, “The Internal Dynamics of Terrorist Cells: A Social Network Analysis of Terrorist Cells in an Australian Context” (PhD diss., Queensland University of Technology, 2007), 298–99.

27. Mirra N. Milla, Joevarian Hudiyana, Wahyu Cahyono, and Hamdi Muluk, “Is the Role of Ideologists Central in Terrorist Networks? A Social Network Analysis of Indonesian Terrorist Groups,” Frontiers in Psychology 11, no. 7 (2020): 333, https://doi.org/10.3389/fpsyg.2020.00333.

28. Stephen P. Borgatti, Martin G. Everett, and Jeffrey C Johnson, Analyzing Social Networks (Thousand Oaks, CA: SAGE Publications, 2013), 173.

29. Andrew Pilny and Jeffrey D. Proulx, “Using Interorganizational Communication Networks to Predict Terrorist Attacks,” Communication Research 49, no. 1 (2022): 3–32, https://doi.org/10.1177/0093650219848271.

30. George A. Barnett, James. A. Danowski, Thomas H. Feeley, and Jordan Stalker, “Measuring Quality in Communication Doctoral Education Using Network Analysis of Faculty-Hiring Patterns,” Journal of Communication 60 (2010): 388–411, https://doi.org/10.1111/j.1460-2466.2010.01487.x.

31. Stephenson, “Trafficking in Trust,” 248.

32. Philipp Bonacich, “Some Unique Properties of Eigenvector Centrality,” Social Networks 29, no. 4 (2007): 555–64, https://doi.org/10.1016/j.socnet.2007.04.002.

33. Cale Horne and John Horgan, “Methodological Triangulation in the Analysis of Terrorist Networks,” Studies in Conflict & Terrorism 35, no. 2 (2012): 182–92, https://doi.org/10.1080/1057610X.2012.639064.

34. Watts and Strogatz, “Collective Dynamics,” 440–42.

35. Jean-Pierre Filiu, “The French Iraqi Networks of the 2000s: Matrix of the 2015 Terrorist Attacks?” Perspectives on Terrorism 10, no. 6 (2016): 97–101.

36. Aaron Zelin, Your Sons Are at your Service. Tunisia’s Missionaries of Jihad (New York: Columbia University Press, 2020), 209.

37. Jarret M. Brachman, Global Jihadism: Theory and Practice (London: Routledge, 2009), 190–20.

38. Nancy C. Roberts and Sean F. Everton, “Monitoring and Disrupting Dark Networks: A Bias toward the Center and what it Costs Us,” in Eradicating Terrorism from the Middle East, ed. Alexander R. Dawoody (Cham: Springer, 2016), 29–42.

39. Stephenson, “Trafficking in Trust,” 247.

40. Peter Nesser, Islamist Terrorism in Europe (London: Hurst Publishers, 2018), 13–14.

41. Milla et al., “Role of Ideologists,” 7.

42. Samuel J. Mullins, “Social Network Analysis and Counter-Terrorism: Measures of Centrality as an Investigative Tool,” Behavioral Sciences of Terrorism and Political Aggression 5, no. 2 (2013): 115–36, https://doi.org/10.1080/19434472.2012.718792.

43. Borgatti et al., Analyzing Networks, 173.

44. Pilny and Proulx, “Interorganizational Communication Networks,” 24–25.

45. See note 31 above.

46. Barnett et al., “Measuring Quality,” 391.

47. Nesser, Islamist Terrorism Europe, 14–15.

48. Krebs, “Mapping Networks,” 49.

49. Sageman, Understanding Terror, 140.

50. Martin Waniek, Tomasz P. Michalak, Michael Wooldridge, and Talal Rahwan, “How Members of Covert Networks Conceal the Identities of their Leaders,” ACM Transactions on Intelligent Systems and Technology 13, no. 1, 12 (2021): 1–29, https://doi.org/10.1145/3490462.