Keywords

1 Introduction

Criminal groups, such as terrorists and organized crime, sometimes make formal agreements with each other [1], such as the 2015 alliance between Boko Haram and ISIS. There are, however, obvious deterrents to such agreements: they are unenforceable, generate evidence, and illegal organizations tend to be unstable and have rapidly changing alliances. Groups can collaborate in other, less formal but more observable ways, by operating in the same way or in similar locations, thus forming Implicit Terrorist Networks [2, 3]. An implicit terrorist network represents a congruence of violent behavior from two or more terrorist groups that may or may not result from their decision to act together. In implicit networks, terrorist groups seemingly or actually cooperate together without mechanisms for direct collaboration. We examine implicit networks among Islamic terrorist groups in India between 1990 and 2015.

2 Theory

The locations of terrorism vary widely [4]. We examine three key factors motivating the selection of targets. First, terrorist groups favor targets that result in high civilian casualties [5]. Thus, those targets that likely lead to high casualties are more attractive and more likely to be selected by extremist groups for violence. The key here is crowds and cities versus individuals and rural countryside. Second, terrorism often remains the only option available for actors unable to project force through more conventional military means against a stronger foe [6]. Terror groups thus select less protected, soft targets given the tremendous asymmetry of power. A third factor concerns the symbolic importance of a state, city, or building. Symbolic targets are selected by terrorists to garner attention and spread their political message [7]. We explore these factors and the insights they provide on implicit networks with the use of two-mode social network analysis. We investigate both the network centrality of terrorist groups and their attack locations, and the subgroup formation of terrorist attacks within India.

3 Methods

3.1 Data

We employ the Global Terrorism Database/GTD [8], an open-source database maintained by the National Consortium for the Study of Terrorism and Responses to Terrorism (START); and South Asian Terrorism Portal/SATP [9]. SATP provides data on 15 Indian Islamist groups. GTD data consist of 51 locations and 154 events, representing all terrorist attacks, bombing or explosions in India conducted by groups between 1990 and 2015. We considered multiple strikes in a given location on the same day as one single attack. Also, an attack claimed by multiple terrorist groups at a specific location was coded as an incident for both groups. Despite the high level of activity (7th highest in the world, GTI 2016), terrorism within India using social network approaches has been rarely studied [10, 11].

3.2 Two-Mode Network Analysis

Two-mode networks consist of two types of nodes: “actors” and “events,” where direct ties exist only between nodes belonging to different types [3, 12,13,14]. We constructed a 51 by 15 two-mode, or bipartite, network, where rows represent the 51 locations that experienced terrorist incidents and the 15 columns represent the extremist organizations. An entry in the \(m \times n\) matrix cell represents the number of attacks in location m by actor n (see Fig. 1). For the centrality analysis, this matrix was dichotomized to a binary matrix, with a one indicating the occurrence of any attack, and zero otherwise. In order to perform the analyses, the two-mode network is converted into two one-mode, symmetric networks, with one of them representing target locations and the other representing extremist organizations. The ties in the two resulting one-mode networks indicate at least one incident of an attack by common terrorist groups between any two pairs of locations, and at least one commonly attacked location between any two pairs of organizations. We focus on degree centrality (the most direct measure of groups’ connection to violence) and include three other common measures as a robustness check.

Fig. 1.
figure 1

Two-mode network (blue rectangles/groups; red ovals/locations attacked) (Color figure online)

Full size image

4 Results

4.1 Centrality of Organizations and Locations [15, 16]

As seen in Table 1, Lashkar-e-Taiba (LeT) exhibits the highest normalized degree centrality of all the terrorist organizations, with a score of 0.471. This reflects the fact that LeT perpetrated the most number of attacks in the dataset. Following LeT in degree centrality is Hizb ul-Mujahidin (HM), which has a slightly lower score of 0.392. Each terrorist group is ranked according to their level of centrality (‘1’ = highest rank of centrality) on four different network centrality measures (Table 1). The extremist groups, LeT and HM, achieve the two highest ranks across all four centrality measures. The high level of centrality of these two groups is evident in the two-mode network graph, as well, with numerous edges emanating from each of these groups towards multiple target locations (see Fig. 1). Note that there are three isolate organizations in the data set, with centrality scores of ‘0’, which likely operate at a distance.

The normalized two-mode degree centrality measure for geographical targets indicates that Srinagar, the capital of Jammu & Kashmir, is highly conflictual and violent (in analysis not shown here). With the highest level of degree centrality (0.533), Srinagar is also the most central and highly attacked location. It is followed in degree centrality by the capital of India, New Delhi (0.400). These findings mean that Srinagar was attacked by more than 50 percent of the Islamic terrorist organizations and New Delhi by 40 percent. Places such as Agartala (0.067) and Taper (0.067), on the other hand, exhibit the lowest degree centrality, indicating that they were struck by just one group. It is not the case, however, that all state capitals are highly central or particularly susceptible to violence.

Table 1. Two mode centrality for terrorist groups.(Degree centrality is the number of ties directly connected to an actor regardless of the direction of those ties, identifying the groups carrying out the most attacks and the locations targeted most frequently. Eigenvector measures the influence of a node in the overall network (Newman 2008), reflecting the groups sway over other terrorist groups. Closeness centrality is the average length of the shortest path between the node and all other nodes in the graph, indicating how close a specific group is to the sites or activities of other groups. Betweenness centrality measures how often a node lies in the shortest path between other nodes, capturing how a group affects the overall connections between nodes and locations.)
Full size table

4.2 Subgroups

For cluster analysis we constructed two sets of edge lists and two one-mode networks derived from the two-mode matrix. These one-mode networks are dichotomized, but we use the number of attacks to inflate node sizes in the network graphs. We employed a Clauset-Newman-Moore hierarchical clustering algorithm based on modularity to uncover the clustering of actors and events [17].

As depicted in Fig. 2, we identify three primary target subgroup clusters (G1, G2, G3). State capitals are clustered together in G2 (except for Srinagar), suggesting they represent a strategic target type. Locations outside of the conflicted state of Jammu & Kashmir (J&K) in India tend to be clustered in one of the subgroups. The geographic locations within J&K are clustered in G1 and G3. Two exceptions are Karimnagar and Ajmer, which are geographically located outside of J&K, but placed within G3, suggesting these cities act as transit points for terrorist groups active in J&K. An intervention strategy that increases state vigilance in Karimnagar and Ajmer may have an impact in reducing terrorism in J&K. The clustering of many cities within J&K together into subgroups underscores the notion that geographical location, as well as regional conflict, are critical for making an area attractive as a terrorist target. The findings also suggest that the two clusters, G1 and G3, are “in-effect” the same, forming an implicit network among themselves that may be analyzed as a single group.

Clustering also occurs among the terrorist groups (not shown). There were two main clusters, one consisting of the domestic organizations and the other international groups. The general clustering pattern for the non-isolates highlights the tendency of domestic groups and international entities to target similar locations within categories of organization (domestic/international), and to strike at locations that differ from those of the other category. Clustering can also indicate the presence of implicit terrorist networks.

Implicit terrorist networks have major theoretical and policy importance. Theoretically, they expand our notion of a terrorist network, connecting network-actors and behavior more closely together. Empirically, they allow us to measure networks through observable visible phenomena rather than employing questionable intelligence. There are also four critical counter-terrorism policy impacts.

4.3 Counter-Terrorism Policy

It is said that it takes a network to take down a network [18]. An addendum is that it takes an understanding of implicit networks to target and destroy terrorism networks. Terrorist groups often pick on specific locations that are referred to as hot spots, which tend to occur in clusters. Counter-terrorism resources should be focused on areas most likely to be targeted, such as state capitals, national capitals and other symbolic cities or areas. Extremist groups act in ways that are not independent, creating implicit networks. Counter-terrorists need to understand the interaction of groups and contexts [19] and recognize that violence does not inoculate an area but indicates the opposite - a high likelihood of more violence in the same area.

Fig. 2.
figure 2

Subgroups of locations (node size corresponds to the number of attacks experienced)

Full size image

Subgroups in unexpected locations may indicate an external presence or additional support. For example, Karimnagar and Ajmer, shown in Fig. 2 are two cities geographically located outside of Jammu & Kashmir (J & K), but placed together as part of the two subgroups G1 and G3 comprising locations based in J & K. Sub-groups might actually be variants of the same group. As found in our network community analysis (Fig. 2), there is a strong likelihood that the two clusters G1 and G3 are “in-effect” the same, and thus represent an “implicit terrorist group.” Counter-terrorist practices may benefit from effectively treating those in clusters as a single group, recognizing implicit networks.

5 Conclusion

Social network analysis (SNA) represents a tool for understanding terrorist networks. Krebs [20] was among the first to use SNA to analyze 9/11. Scholars argue that networked structures facilitate terrorists’ use of violence [18] and networks influence terrorist acts’ impact [21]. Several studies use SNA to examine network links within [22] or between extremist groups [1]. We extend extant research by treating the links between terrorist groups and the geographic location of their attacks as two-mode networks. To the best of our knowledge, this is the first work applying this approach to the study of terrorism and implicit terrorist networks.