Many are quite surprised at the level of importance Social Network Analysis (SNA) plays in our global "War on Terror" efforts. In fact, it's widely unknown that SNA led to the capture of Saddam Hussein (we'll get to that tomorrow.) In the meanwhile, the below is my best effort to copy and paste SNA-specific portions of the U.S. Military "Counterinsurgency" Field Manual, FM 3-24.
(Note: As you read through this, you'll come to see that the decentralized nature of "Tribal" elements in Afghanistan are a core element of what makes it so difficult for us to fight and defeat them ... just like the Spaniards learned with the Apaches. Considered in another context, you might find it interesting that our efforts to instill a central government are, in essence, efforts to establish hierarchy. After all, hierarchy is much easier to control, influence, and defeat than a truly decentralized network with asymmetrically distributed power. Just ask the Soviets.)
EVALUATE THE THREAT
B-28. Evaluating the threat involves analyzing insurgent organizations, capabilities, and tactics to identify vulnerabilities to exploit. Tools like social network analysis, link diagrams, and association matrices help analysts do this. Other tools such as historical time lines and pattern analysis tools assist in developing event and doctrinal templates to depict enemy tactics.
SOCIAL NETWORK ANALYSIS
B-29. Social network analysis (SNA) is a tool for understanding the organizational dynamics of an insurgency and how best to attack or exploit it. It allows analysts to identify and portray the details of a network structure. Its shows how an insurgency’s networked organization behaves and how that connectivity affects its behavior. SNA allows analysts to assess the network’s design, how its member may or may not act autonomously, where the leadership resides or how it is distributed among members, and how hierarchical dynamics may mix or not mix with network dynamics.
B-30. SNA supports a commander’s requirement to describe, estimate, and predict the dynamic structure of an insurgent organization. It also provides commanders a useful tool to gauge their operations’ effectiveness. SNA allows analysts assess the insurgency’s adaptation to the operational environment and friendly operations.
Social Network Analysis—Terms and Concepts
B-31. The social network graph is the building block of social network analysis. A social network graph
consists of individuals and connections between them. Individuals in a network are called actors or nodes. (Actor and node are often used interchangeably.) The contacts between nodes are called links. The basic element of a social network graph is the dyad. A dyad consists of two nodes and a single link. In the simplest form of a network, the two nodes represent people and the link represents a relationship between them. (See figure B-5.)
B-32. Social network measures allow units to analyze and describe networks. They fall into two categories: organizational-level and individual-level.
Organizational-Level Analysis
B-33. Organizational-level analysis provides insight about the insurgent organization’s form, efficiency,
and cohesion. A regional insurgency may consist of large numbers of disconnected subinsurgencies. As a
result, each group should be analyzed based on its capacities as compared to the other groups. Organizational-level capacities can be described in terms of network density, cohesion, efficiency, and coreperiphery. Each measure describes a characteristic of a networked organization’s structure. Different network structures can support or hinder an organization’s capabilities. Therefore, each organizational measure supports the analyst’s assessment of subgroup capabilities.
B-34. Network density is a general indicator of how connected people are in the network. Network or
global-level density is the proportion of ties in a network relative to the total number possible. Comparing network densities between insurgent subgroups provides commanders with an indication of which group is most capable of a coordinated attack and which group is the most difficult to disrupt. (Figure B-6 shows three networks with different densities.)
B-35. Most network measures, including network density, can be mapped out to evaluate performance over time. Based on changes in network density over time, a commander can—
- Monitor enemy capabilities.
- Monitor the effects of recent operations.
- Develop tactics to further fragment the insurgency.
B-36. An increase in network density indicates the likelihood that the insurgent group can conduct coordinated attacks. A decrease in network density means the group is reduced to fragmented or individual-level attacks. (Figure B-7 illustrates an example of how tactics and activities can change based on network density.) A well-executed COIN eventually faces only low-network-density subgroups. This is because high network-density subgroups require only the capture of one highly connected insurgent to lead counterinsurgents to the rest of the group. So while high-network-density groups are the most dangerous, they are also the easiest to defeat and disrupt.
B-37. Network density does not consider how distributed the connections are between the nodes in a network. Better metrics of group and organizational performance would be network centrality, core-periphery, and diameter. A few nodes with a high number of connections can push up the group network density, even though the majority of the people nodes are only marginally linked to the group. In the case of a highly centralized network dominated by one or a few very connected nodes, these nodes can be removed or damaged to fragment the group further into sub-networks.
B-38. A fully connected network like the one figure B-8 portrays is an unlikely description of the enemy
insurgent order of battle. A regional insurgency can be fragmented within itself.
B-39. Sometimes a region may actually contain multiple subinsurgencies that are either unaware of, or
even competing with, other subinsurgent groups. In this case, the insurgency resembles a fragmented network. (See figure B-9.)
Individual-Level Analysis
B-40. Individual-level analysis characterizes every member of an organization and identifies its key members. Effective SNA allows analysts to identify key individuals from a large mass of data. SNA describes individuals based on their network position in relation to the network position of every other individual in the network. Descriptions are in terms of the following individual-level measures: degree centrality, betweenness centrality, and diameter. Individual network centralities provide insight into an individual’s location in the network. The relationship between the centralities of all nodes can reveal much about the overall network structure.
B-41. One node or a very few central nodes dominate a very centralized network. If these nodes are removed or damaged, the network may quickly fragment into unconnected subnetworks. Hubs are nodes
with a very high degree of centrality. A network centralized around a well-connected hub can fail abruptly
if that hub is disabled or removed.
B-42. A less centralized network has no single points of failure. It is resilient in the face of many intentional attacks or random failures. Many nodes or links can fail while allowing the remaining nodes to still reach each other over other, redundant network paths.
B-43. Degree centrality describes how active an individual is in the network. Network activity for a node is measured using the concept of degrees—the number of direct connections a node has. Nodes with the most direct connections are the most active in their networks. Common wisdom in organizations is “the more connections, the better.” This is not always so. What really matters is where those connections lead and how they connect the otherwise unconnected. If a node has many ties, it is often said to be either prominent or influential.
B-44. Betweenness centrality indicates the extent to which an individual lies between other individuals in
the network, serving as an intermediary, liaison, or bridge. A node with high “betweenness” has great influence over what flows in the network. Depending on position, a person with high betweenness plays a
“broker” role in the network. A major opportunity exists for counterinsurgents if, as in group C of figure
B-6 (page B-11), the high betweenness centrality person is also a single point of failure which, if removed, would fragment the organization.
B-45. Nodes on the periphery receive very low centrality scores. However, peripheral nodes are often connected to networks that are not currently mapped. The outer nodes may be resource gatherers or individuals with their own network outside their insurgent group. These characteristics make them very important resources for fresh information not available inside their insurgent group.
Social Network Analysis and Counterinsurgency
B-46. Figure B-10 shows a simple, social network of key individuals and relationships. The nodes in this
data set are from a modified, subnetwork of the link diagram representing Saddam Hussein and his connections to various family members, former regime members, friends, and associates. The original diagram contained hundreds of names and took shape on a large 36-by-36-inch board. Each “box” in the network contained personal information on a particular individual. This information included roles and positions of certain people within the network—for example, chief of staff, chief of operations, and personal secretary. These were not necessarily positions the individuals occupied before the fall of Hussein; rather they were based on an understanding of the role they were filling in the insurgency or Saddam’s underground operations. Analysts assigned these roles based on an assessment of various personalities and recent reports. Such a process helped coalition forces focus their efforts in determining those who were closest to Hussein and their importance.
B-47. For an insurgency, a social network is not just a description of who is in the insurgent organization; it is a picture of the population, how it is put together and how members interact with one another. A tribal society already has affiliated social, economic, and military networks easily adapted to warfighting. The ways in which insurgents exploit a tribal network does not represent an evolved form of insurgency but the expression of inherent cultural and social customs. The social dynamic that sustains ongoing fighting is best understood when considered in tribal terms—in particular, from the perspective of a traditionally networked society. It is the traditional tribal network that offers rebels and insurgents a ready-made insurrectionary infrastructure on which to draw.
B-48. The full functioning of a network depends on how well, and in what ways, its members are personally known and connected to one another. This is the classic level of SNA, where strong personal ties, often ones that rest on friendship and bonding experiences, ensure high degrees of trust and loyalty. To function well, networks may require higher degrees of interpersonal trust than do other approaches to organization, like hierarchies. Kinship ties, be they of blood or brotherhood, are a fundamental aspect of many terrorist, criminal, and gang organizations. For example, news about Osama bin Laden and the Al Qaeda network reveal his, and its, dependence on personal relationships formed over years with “Afghan Arabs” from Egypt and elsewhere. These people are committed to anti-United States terrorism and Islamic fundamentalism.
B-49. To draw an accurate picture of a network, units need to identify ties among its members. Strong
bonds formed over time by family, friendship, or organizational association characterize these ties. Units gather information on these ties by analyzing historical documents and records, interviewing individuals, and studying photos and books. It is painstaking work, but there is really no alternative when trying to piece together a network that does not want to be identified. Charts and diagrams lead to understanding the insurgents’ means of operations. These same diagrams are also useful for understanding tribal, family, NGO, and transnational terrorist elements. Each diagram and chart may have links to another or several others, but they are not created overnight. It takes time, patience, detailed patrolling, and reporting and recording of efforts.
B-50. As a unit builds its situational awareness, it must create easy-to-understand, adaptable, and accurate diagrams and information sheets. These products feed one another and allow units to maintain and contribute to their understanding of the situation.
B-51. As commanders dispatch patrols to collect information, they can begin to build a graph of the population in the AO. As graphs grow, they may show that traditional, static organizational line charts do not produce viable explanations of insurgent organizational behavior. Individual insurgents may be constantly adapting to the operational environment, their own capabilities, and counterinsurgent tactics. A commander’s understanding of the insurgency is only as good as the patrol’s last collection.
B-52. Relationships (links) in large data sets are established by similarities between the nodes (people).
Figure B-11 shows an example activities matrix. People are identified by their participation in independent activities. When graphed, pairs who have engaged in the same activity (columns with dots) are designated with a link.
B-53. An association matrix portrays the existence of an association, known or suspected, between individuals. (See figure B-12.) Direct connections include such things as face-to-face meetings and confirmed telephonic conversations. Association matrices provide a one-dimensional view of the relationships and tend to focus on the immediate AO. Analysts can use association matrices to identify those personalities and associations needing a more in-depth analysis to determine the degree of relationship, contacts, or knowledge between the individuals. The structure of the insurgent organization is identified as connections between personalities are made.
Social Network Analysis Summary
B-54. Insurgents often form a networked organization embedded in a sympathetic population. Differentiating between insurgents, insurgent supporters, neutrals, and the HN government supporters is difficult. With every counterinsurgent success, the insurgent organization becomes further fragmented but remains dangerous.
B-55. SNA helps units formalize the informality of insurgent networks by portraying the structure of something not readily observed. Network concepts let commanders highlight the structure of a previously unobserved association by focusing on the preexisting relationships and ties that bind together such groups. By focusing on roles, organizational positions, and prominent or influential actors, commanders may get a sense of how the organization is structured and thus how the group functions, how members are influenced and power exerted, and how resources are exchanged.
B-56. COIN operations require assessing the political and social architecture of the operational environment, from both friendly and enemy perspectives. SNA can help commanders understand how an insurgent organization operates. Insurgent networks often do not behave like normal social networks. However, SNA can help commanders determine what kind of social network an insurgent organization is. That knowledge helps commanders understand what the network looks like, how it is connected, and how best to defeat it.
Recent Comments