Introduction

Illicit networks, including drug trafficking, people smuggling, and terrorist networks, are often characterised as dynamic, fluid and adaptive. The flexibility of illicit networks allows them to quickly adapt to changing circumstances such as new business opportunities, competition, and law enforcement interventions (Duijn et al. 2014; Kleemans and Van De Bunt 1999; Raab and Milward 2003). Most previous studies of illicit networks, and particularly, drug trafficking networks, have employed cross-sectional methods in which one or more networks are examined either at a single time point or merged across a discrete period of time (e.g., Bright et al. 2012; Morselli 2010; Natarajan 2006; and see Bichler et al. 2017). However, this type of research does not permit the study of network dynamics. Only a handful of studies have investigated illicit networks using longitudinal methods to investigate changes across time (e.g., Bichler and Malm, 2013; Bright and Delaney 2013; Broccatelli et al. 2016; Grund and Morselli 2017; Morselli and Petit 2007).

Although the study of network dynamics is not new to the study of social groups (see, for example, (Doreian and Stokman 1997; Holland and Leinhardt 1977; Snijders 2001; Wasserman 1980; Xing et al. 2010) the longitudinal study of illicit networks is fraught with difficulty, especially with respect to data collection. Indeed, collection of viable data is arguably the main challenge facing researchers in the illicit networks field (see Morselli 2009a). The collection of relational data about an illicit network is difficult even for cross-sectional research. However, the problem of data quality is exacerbated in the case of longitudinal research on illicit networks. In order to conduct a longitudinal analysis of an illicit network, researchers must not only collect relational data, but must also collect panel data on the network across multiple time periods. Nonetheless, given that dynamic network analyses have been termed the “holy grail” of networks research (Morselli 2009a; Wasserman et al. 2005), some researchers have attempted this daunting task. The current study adds to this small but growing set of studies with a focus on network dynamics in drug trafficking networks.

Social Network Analysis (SNA) is a set of analytic techniques used to describe social groups by examining the actors in the groups and the connections between them. SNA can reveal patterns in social structure or connectedness in the group (e.g., density, a measure of connectedness) and the positioning of actors within the group (e.g., degree centrality, a measure of the number of ties an actor has to other actors; betweenness centrality, a measure of the extent to which an actor lies on the shortest social paths between pairs of actors; see Freeman 1978). While SNA has traditionally been used to examine the structure of a network at a single point in time (or merged across time points), analytic techniques such as exponential random graph modelling (ERGM) (Frank and Strauss 1986; Snijders et al. 2006; Lusher et al. 2013) and stochastic actor oriented modelling (SAOM) (Snijders 2001) are enabling the study of social processes that generate network structures. The current study uses SAOM using the SIENA program to examine changes across time in an illicit network. SAOM has not been used previously to study the evolution of illicit networks, but has been used to study the longitudinal dynamics of other illicit activities [e.g., the trade of small arms across countries; (Bichler and Malm 2013; Snijders 2001) and adolescent delinquency (Dijkstra et al. 2010; Turanovic and Young 2016; la Haye et al. 2013)].

In cross-sectional (or static) SNA, dynamic processes that occur at the level of actors, ties, subgroups and networks can only be observed indirectly. The majority of cross-sectional studies on illicit networks to date have focused on global network structure (e.g., density and centralisation; Bright et al. 2012; Morselli 2009a) and on the strategic positioning of actors in the network (e.g., Baker and Faulkner 1993; Morselli 2009b). These studies help to identify typical structural characteristics of illicit networks. Some studies have concluded that illicit networks are sparsely connected and highly centralised, and that a minority of actors in the network have a disproportionally large number of ties (e.g., Baker and Faulkner 1993; Bright et al. 2012; Morselli 2009a, b; Cockbain et al. 2011; Varese 2011). Other studies claim that illicit networks are decentralised (see for example, Enders and Su 2007; see also discussion on the inconsistency of claims in Oliver et al. 2014). While such observations have improved our understanding of illicit networks, such studies are not able to shed light on the social processes involved in the formation and evolution of illicit networks (but see Grund and Densley 2015 regarding detection of mechanisms in cross-sectional criminal networks).

The study of network dynamics has the potential to reveal social processes that facilitate the formation and growth of illicit networks and which have implications for investigation, prevention and interventions (e.g., Bichler & Malm, 2015). For example, McCulloh and Carley (2011) analysed the Al Qaeda communication network across the period 1988–2004 utilising a procedure called “social network change detection”, a statistical approach for detection of “abrupt and persistent” changes in the group’s behaviour over time. They found that average betweenness and closeness centrality scores increased between 1988 and 1994 and then plateaued. Interestingly, the authors report a “critical, yet stable” change in the network in 2000, a year before the 2001 terrorist attacks on the United States. In studies of the Provisional IRA and the inner circle of the Suffragette movement, researchers have attempted to capture change by studying changes in cross-sectional summary measures, such as betweenness, density, etc. (Crossley et al. 2012; Stevenson and Crossley 2014). These results underscore one potential use of dynamic modelling: the identification of critical changes that may foreshadow future action.

Despite recent progress in the field of illicit network dynamics, a number of questions remain unanswered. For example, what types of ties are common in illicit networks? What social processes account for the social structures present in illicit networks? How do some individuals increase the number of ties to other actors over time? What social processes facilitate the evolution of illicit networks? The current study makes an important contribution to the understanding of social processes that underlie social structures observed in illicit networks. The study extends SNA on illicit networks from descriptive accounts of social structure to an exploration of the social processes that drive such observed structure. This will aid our understanding of collaboration in illicit contexts, with implications for policy and practice in law enforcement and security contexts. The study of network dynamics may also help to generate interventions against illicit networks. For example, are different foci required for law enforcement intervention that occurs early in illicit network development compared with more evolved networks? The following section outlines some of the previous theory and research on the types of social processes that occur within illicit networks across time.

Processes of Covert Tie Formation

Research and theories of illicit networks typically incorporate references to the dynamic nature of networks, and generate predictions about the kinds of social processes and social structures likely to predominate in illicit networks (e.g., Bouchard 2007; Crenshaw 2010; Milward and Raab 2006). There are a number of social process explanations that may account for the growth and evolution of illicit networks. For example, Diviak et al. (2017) derives a number of possible social mechanisms that are consistent with the efficiency/security trade-off (see Morselli et al. 2007 for discussion of the trade-off). He identifies the balance between efficiency and security as the combination of different processes. With longitudinal data we can refine the combination of mechanisms that achieve this balance. We focus on four primary possibilities that emerge from the literature on illicit networks.

Preferential Attachment

Preferential attachment is a mechanism whereby actors joining a network prefer to connect to actors who have a large number of existing connections. Originally coined by Merton (1968) and referred to as the Matthew effect, rich-get-richer phenomenon, or cumulative advantage (de Solla Price 1976), this represents an endogenous network mechanism whereby actors gain new ties by virtue of already having many ties.

Preferential attachment could explain the high levels of centralisation in covert networks identified by some authors. More specifically, it is consistent with the degree distributions found in illicit networks by a number of authors (Bright et al. 2015; Malm and Bichler 2011; Natarajan 2006; Qin et al. 2005; Duijn et al. 2014; Varese 2012). Wood (2017) suggests preferential attachment as an underlying mechanism for the formation of ties in a drug trafficking network—large hubs create efficiency and allow for direct control. Xu et al. (2004), however, found no evidence for preferential attachment in illicit networks and argued that in illicit networks, individuals may prefer not to be connected to a large number of individuals due to the risks involved in being so “visible” (see also Morselli 2010). A number of authors (e.g., Carley et al. 2002) suggest that the presence of hubs introduce vulnerabilities in criminal networks. Most argue that decreasing density reflects actors’ desire for secrecy (Everton 2009; Crossley et al. 2012). All else being equal, we do not expect to find support for preferential attachment in the illicit network under examination here, as connecting to high centrality actors becomes a handicap (Baker and Faulkner 1993; Morselli et al. 2007). Visibility is the key driver of preferential attachment but also something that individuals aim to avoid—if someone is visibly popular in a criminal network, this person is also a liability.

Triadic Closure

Trust is critical to how people deal with uncertainty in social situations. Individuals who tend toward criminality are unlikely to be “reliable, trustworthy and cooperative” (Gottfredson and Hirschi 1990). The criminal context is fraught with uncertainty, distrust, suspicion and paranoia (Gambetta 2009). Complicating matters further, in the criminal world, actors have no recourse to legal avenues of dispute resolution. This leaves actors in a quandary: how does one evaluate the trustworthiness of potential collaborators? Some possibilities are: reputation, observations of previous behaviour, and observations of current behaviour. Trust becomes an important commodity and may drive relational structures in networks. Indeed, Von Lampe and Ole Johansen 2004 note that it is “rational to assume that the trustee will not want to put his or her reputation in jeopardy through disloyal behaviour.” (p. 170). Triadic closure may facilitate trust in illicit networks (e.g., Grund and Densley 2015). Triangles as a closed social structure, offer a secure setting in which trustworthy or untrustworthy behaviour can be observed and used to render decisions to collaborate or not. This is illustrated in Fig. 1. In the social structure shown here, A’s behaviour toward C is observed by B. A is therefore motivated to behave in a trustworthy fashion toward C in order to prove his trustworthiness to B. Further, triads enhance trust by facilitating a collective responsibility and commitment to illicit activities; what we might call collective responsibility and culpability. In the current study, we seek to determine whether there is a preference for triadic closure in the network. While triadic closure is a prerequisite for trust-worthy ties, clustered regions (cohesive subgroups or communities) create redundancies and increase the risk of detection (Diviak et al. 2017; Robins 2009).

Fig. 1
figure 1

Triadic closure

Full size image

Social Distance and Indirect Connections

As mentioned, actors in illicit networks must balance efficiency with security (Morselli et al. 2007).To prioritise security, actors may prefer to be separated by a two path rather than having direct connections with others. This creates social distance and a buffer (i.e., by intermediaries or brokers) that can enhance security. For example, in Fig. 2 below, if C is arrested, A is insulated by the presence of the intermediary B. “Distance two” is a SNA metric that is defined by the number of actors to whom an actor is indirectly tied (through one intermediary). To balance security with efficiency, actors may prefer to connect with many others in the network, but will do so via intermediaries rather than directly. In illicit network then, “distance two” may represent an active attempt by actors to strike a balance between the efficiency that is facilitated by many connections, and the security provided by indirect ties. A preference for indirect ties may provide incentives and opportunities for some individuals to act as brokers or intermediaries between other actors. The desire for many indirect connections may result in the presence of hubs, formed not by preferential attachment, but emergent from attempts by actors to balance security and efficiency.

Fig. 2
figure 2

Distance Two

Full size image

Roles and Supply Chains

Previous research on group structure and formation suggests that diverse and complementary skills can enhance the capacity of a group to undertake complex tasks (e.g., Bales 1953; Ruef et al. 2003). According to Brinton, Milward and Raab (2006), illicit networks are characterised by a division of labor between actors who play different roles. In addition, Bakker et al. (2012) theorise that illicit networks will be characterised by few direct ties, but will show “transitory shortcuts” that connect different groups within the network. They also predict that illicit networks will build in redundancies in skills that render the network less efficient. They make specific predictions regarding replacement of skills: “the capability to maintain, replace or substitute nodes and linkages that have disappeared is the key to understanding the development of operational activity after a shock. Having a sufficient number of individuals who have adequate skills and are willing to risk their freedom and their lives is a necessary condition for dark networks to engage in any kind of action” (p. 51). A range of different roles have been identified in a number of different illicit networks including heroin trafficking (Natarajan 2006), vehicle ringing operations (Morselli and Roy 2008), terrorist networks (Gilroy 2013), and methamphetamine trafficking (Bright et al. 2012). For example, some actors undertake a role as “courier”, conveying drugs or money between locations. Other actors have specialised skills in the manufacture of illicit drugs. Previous research suggests that actors will connect with other actors who play different roles (usually those who play roles that are temporally close in the supply chain) in order to facilitate the crime commission process (e.g., Bright and Delaney 2013; Malm and Bichler 2013).

Each role may be associated with a different balance of considerations of efficiency and security. For example, a labourer may have a larger number of ties to enhance efficiency of operations but this can increase vulnerability. Conversely, methamphetamine cooks may have a smaller number of ties and show increased transitivity (i.e., increased emphasis on trust) to ensure security and reduce probability of detection and arrest. Individuals who play particular roles may have different tendencies to connect with others, both in terms of the number of connections they tend to form with others, and the particular roles with whom they tend to make connections (see Bright and Delaney 2013; Morselli and Roy 2008).

In summary, previous theory and research suggests three potential drivers for relational structures in illicit networks: (1) trust and triadic closure; (2) balancing security and efficiency; and (3) roles and supply chains.

Current Paper

Using a stochastic actor-oriented model (SAOM), the current study examines a methamphetamine manufacture and trafficking network that expanded from small scale social dealing to a large scale profit-motivated business. Dynamic network analysis was used to evaluate both overall network structure and actor level characteristics. This paper aims to determine which social processes (e.g., preferential attachment, triadic closure, and “distance two”) guide the tie-formation in the drug trafficking network?

Hypotheses

The current project tests the following three hypotheses:

  1. 2a.

    Actors will form triadic relationships with others (to facilitate trust and security);

  2. 2b.

    Actors will form indirect ties with others but avoid too visible others (to facilitate efficiency while maintaining security);

  3. 2c.

    Actors will form ties with other actors who play different roles.

Method

Data

Data were extracted from file records of the Office of the Director of Public Prosecutions in the state of New South Wales, Australia. Files related to the investigation and prosecution of a group of individuals who were involved in the sourcing of precursor chemicals and laboratory equipment, manufacture of methamphetamine, and distribution of methamphetamine at wholesale and retail market levels. We requested files for two of the individuals deemed by law enforcement agencies to have been two of the most active and important individuals in the network (actors 33 and 61). We made the case file selection on this basis in an attempt to enhance our prospects of revealing as much of the network as possible. Files included a large number (thousands) of documents detailing the activities of, and connections between, the network of individuals. Files included a range of documents: transcripts from listening devices and telephone intercepts, telephone call records, police surveillance reports, witness statements, sections of trial transcripts, and judges’ sentencing comments. Each document was assessed as to whether it contained relevant information (i.e., information on the actors, relational data on links between actors, and information about resources possessed by actors).

Although the files were marked with the names of these two individuals, they included a range of data relating to the broader activities of the network and to connections between actors. In this sense, the activities of actors 33 and 61 define the context of the ties—much like a workplace may define nodes in an organisational network—but not in the straightforward manner of a snowball sample or overlapping egonets. If data are aggregated across time, the actors who are directly connected to at least one of 33 or 61 do have higher average degree (5.75) than actors who are neither directly connected to 33 nor 61 (average degree: 4.1) but this may equally reflect a core-periphery. There are also indirectly connected nodes that have a higher betweenness than directly connected nodes (betweenness calculated on the induced subgraph that omits 33 and 61).

A total of 86 actors were identified. All actors named in files as contributing to the illicit activities of the group were included in the network. Ties between actors were considered present if there was any information in files that the two actors communicated with each other, had met each other, or had exchanged goods or information. This included direct evidence (e.g., photographed or observed together by police) or indirect evidence (e.g., someone provides a statement that two actors knew each other or had met each other). We consider ties as being states rather than events (see Morselli and Petit 2007; Grund and Densley 2015). As such, the presence of a tie is judged based on an overall assessment of the material and not necessarily on any individual instance of contact such as a wiretapped conversation. Based on the state of the network and its nodes, data were grouped according to four phases or waves: (Wave 1) 1991–1992, (Wave 2) 1992–1993, (Wave 3) 1994–1995, (Wave 4) 1995–1996.

Data were recorded regarding the role played by each actor.Footnote 1 Information extracted from files was used to allocate each actor to a specific role. We started by allocating individuals to roles based on categories used in similar research (Bright et al. 2012), adding categories if required. Due to the nature of the data source, it was not possible to identify the roles played by some actors. Actors for whom role information was not available for a particular wave of data were given a code in the data to indicate that such data was missing.

We determined when actors joined and exited the network across the four waves. The files included sufficient information for us to pinpoint when actors joined and left the network across these time points. Table 1 displays descriptive statistics for each wave. Some actors were absent from the network in between one and three waves. Each time period was treated as separate for the purposes of data extraction. If there was no mention of an actor in the documentation across a particular time period, they were considered not to be part of the network across that wave. For example, actor A may have been mentioned in the documentation between 1991–1992, 1992–1993, and 1994–1995, but not in 1995–1996. This actor would be not be considered to have been a network member in 1995–1996.

Table 1 Descriptive network statistics across the four time periods
Full size table

Analytic Plan

The main aim of the analysis was to explain the evolution of the network and to account for the formation and termination of relationships across the set of actors. We used RSiena to explore network dynamics and network evolution. Specifically, we estimated five models with different combinations of triadic closure, preferential attachment, indirect ties, and role-heterophily. SAOM (Snijders 2001) are a class of statistical network models for longitudinal data that assume a network changes from “time 1” to “time 2” through a series of incremental changes. These incremental changes are called “mini-steps” and are conceived as being the change of exactly one tie-variable. More specifically, change is modelled as a combination of a process for the decision to change and a model for what change is actually made given that a change is permitted. Here we follow the model formulation for undirected networks proposed by (Snijders and Pickup 2017), where ties are updated as a result of a ‘negotiation’ between the two actors. The decision process is constructed according to the “Unilateral initiative and reciprocal confirmation rule” (Ripley et al. 2017). In this model, one actor (the focal actor) is given an opportunity to change one of their tie-variables. The focal actor decides to make the change that is most satisfactory to them. If the change is the dissolution of a tie, the tie is dissolved. However, if the change is the creation of a tie, the actor at the other end of the tie (the “alter”) must first agree. The focus of interest is to model ‘satisfaction’ with the outcomes of different decisions, which is modelled as a linear combination of network statistics \(f_{i} \left( x \right) = \beta_{1} s_{i,1} \left( x \right) + \beta_{2} s_{i,2} \left( x \right) + \cdots + \beta_{p} s_{i,p} \left( x \right)\), weighted by statistical parameters that indicate how important the different local structures are to the focal actor. The alter agrees to the tie being created with probability \(f_{j} \left( {x^{ + } } \right) - f_{j} \left( {x^{ - } } \right)\), on the logit scale, where \(x^{ + }\) and \(x^{ - }\) is the network with and without the tie \(\left\{ {i,j} \right\}\) present, respectively. Similar to other discrete-choice models, the conditional probabilities of changes to tie-variables take the form of conditional logistic regression.Footnote 2 We estimate the model parameters using the Bayesian inference scheme of Koskinen and Snijders (2007) as implemented in the function sienaBayes in RSienaTest (the Bayesian inference procedure offers the advantage that it is more efficient than the method of moments and that it admits consistent inference under data missing at random).

Missing Data Approach

An actor is assumed to be part of the period [t, t + 1] if the actor is observed in at least one of the waves t and t + 1. This means that actors can be present in one period but absent in another (similar to the method used with changing composition). However, an actor is not forced to enter the network with degree zero. When an actor is absent at wave t (t + 1) but present at t + 1 (t), all of their ties at wave t (t + 1) are assumed to be missing and are imputed by draws from the full conditional posterior given everything else. Under the assumption of ‘missing at random’, this is the statistically optimal way of dealing with missing ties (Rubin 1976).Footnote 3 Some actors were absent in between one and three waves.

For assessing the goodness-of-fit (GOF) of a model, you need to compare networks simulated from the fitted model conditionally on the observed data as well as unconditionally (as in Koskinen et al. 2013).

Results

SAOM

To investigate if preferential attachment is a plausible generative mechanism for the network, we disaggregate the network in time, allowing us to observe and analyse how the network was actually formed. If preferential attachment were driving the network, we would expect to see actors having a preference for connecting to high-degree nodes over time.

To make our four time-slices amenable to analysis using SAOMs, we made some assumptions about missing data and how consecutive waves relate to each other. As described above, for pairs of consecutive waves we define the actor set as those actors whose ties are observed in at least one of the waves. Table 2 gives a break-down of the actor numbers by wave and interval. By dividing the number of jointly observed actors (those that are present in both t and t + 1) by the combined number of actors (those that are present in at least t or t + 1 or both), we obtain the proportion of actors that are observed in both consecutive waves as 50, 53, and 17%. The change in the subgraphs induced by the actors that were consecutively observed is fairly constant and the Jaccard indicesFootnote 4 indicate a relatively high degree of stability.

Table 2 Summaries of dynamic data
Full size table

Figure 3 illustrates the pattern of missingness and how consecutive waves are structured. Observed actors are indicated by white areas and correspond to 42.7% for wave 3 and 74.7% for wave 4. The tie variables observed in both waves is indicated by grey hash ( ) corresponding to 17.3% of actors. As the missing actors are to be considered non-respondents, there are no tie-variables for missing actors. Hence, while 42% of actors are observed in wave 3, only \(\left( {\begin{array}{*{20}c} {32} \\ 2 \\ \end{array} } \right) = 496\) tie-variables out of \(\left( {\begin{array}{*{20}c} {75} \\ 2 \\ \end{array} } \right) = 2775\) tie-variables (i.e., 18%) are observed in wave 3. The networks resulting from pairwise analyses are displayed in Fig. 4. From top to bottom, networks at waves 1, 2, 3 and 4 are displayed pairwise after missing data arrangement. Colours of nodes correspond to roles, observed ties are indicated by black lines and missing tie-variables are indicated by grey lines. The network sizes for these pair-wise defined waves are 30, 38, and 75, respectively. While the combination of changing actor-sets and missing data adds considerable uncertainty in the estimation process, disaggregating the cross-sectional network still gives us more information on any given dyad.

Fig. 3
figure 3

Schematic representation of missingness pattern in adjacency matrices for waves 3 (left) and wave 4 (right)

Full size image
Fig. 4
figure 4

Incomplete network over time (pairwise analysis)

Full size image

The results from the five models are provided in Table 3. The similarity in Jaccard coefficients (reported in Table 2) is reflected in the similarity of the estimated rate parameters in Table 2. At any given time interval, an actor is given on average eight opportunities to change their ties. To parse out whether the model is driven by purely dyadic mechanismsFootnote 5 or extra-dyadic endogenous processes,Footnote 6 the models are divided into two main classes: dyadic and endogenous dynamics. By dyadic mechanisms, we refer to tie-formation processes that only depend on properties of the nodes of the tie. For example, the effect on tie-formation of two actors’ Roles does not depend on the roles of other actors. Extra-dyadic processes are those where the actions of one pair of actors are affect by the existence of a tie for another pair of actors. A typical example is triadic closure (Fig. 1), whereby the existence of a tie from A to B and from B to C increases the probability of the tie A to C.

Table 3 SAOM Model Posterior Summaries. Point estimates given by the posterior mean
Full size table

Dyadic Mechanisms

Model One displays the effect of the dyadic mechanism role heterophily—the type of role played by the actors (same role is treated as a time-varying dyadic covariate). The coefficient for ‘Role match’ is negative with high posterior probability suggesting that actors chose to form and maintain ties with alters who undertook roles that were different to the roles they themselves undertook.

Endogenous Dynamics

The tendency towards local closure (i.e., closure within the network surrounding an actor) is included in all structural models (the effect is called ‘transitive triads’ in RSiena). There is strong evidence that actors show a preference for closure in all models. In addition to local closure we want to test two competing mechanisms that explain the emergence of hubs. The first is preferential attachment, here modelled using the preference for having ties to actors with a high number of direct connections to others (in RSiena sqrt degree of alter). From Model 3, we conclude that there is no evidence for any tendency towards preferential attachment (the posterior probability that the parameter is positive is only 0.91). Model 4 shows that the evidence for the preference to have indirect ties is much stronger—the coefficient for actors at distance 2 (‘number of actor pairs at dist 2’) is positive with probability one (up to the computational precision of the MCMC inference scheme).

While evidence seems to be in favour of indirect ties explaining the emergence of hubs, a fair comparison can only be had from including both of the effects (distance 2 and preferential attachment) in the same model. In the complete model (model 5) we include all of the investigated effects. Controlling for dyadic effects, triadic closure, and preferential attachment the preference for having indirect ties is increased in magnitude. Consequently, preferential attachment does not explain actors’ preference for having indirect ties. Conversely, dyadic effects, triadic closure, and the preference for having indirect ties changes the sign of preferential attachment. Thus, given the actor’s preference for local closure and their preference for being indirectly tied to many, actors actively avoid having ties to high-degree nodes [the coefficient is negative with probability 1 and the 95% and 99% posterior probability intervals are (− 1.41, − 0.85) and (− 1.53, − 0.78) respectively].

Goodness-of-Fit

The relatively high turn-over of actors in the network warrants a careful examination of the fit of the model. Here we focus on the transition from wave three to wave four, as this is the transition with the smallest overlap between observed actors. Figure 5 provides five illustrative examples of how goodness of fit is appraised by comparing observed networks (where ties are imputed from the conditional posterior distribution in the course of estimation) with networks simulated from the fitted model.

Fig. 5
figure 5

Illustrative realisations from goodness-of-fit distributions. Model-based imputed networks at wave 4 (left panels) and corresponding simulated networks from the posterior predictive distribution (right panels)

Full size image

Figure 6 shows a reasonable overlap in the goodness-of-fit for the degree distribution for model 5. There is considerable uncertainty for degrees in the middle range (the bulge roughly in the range 20–40) of the predictive distribution. For model 6 (plot not included here), when dummies for the case selection are included, the uncertainty in the middle range of degrees decreases and the overlap of the predictive distribution increases.

Fig. 6
figure 6

Goodness-of-fit for the degree distribution. Approximate 99% prediction intervals for the complementary cumulative distribution functions (the median for the imputed distribution in red) (Color figure online)

Full size image

Central to the interaction between indirect ties and preferential attachment in the model is the distribution of distances. The GOF for the geodesic distances (see Fig. 7) suggest a good fit of the model. The GOF distribution for the triad census (not reported here) also suggests good fit.

Fig. 7
figure 7

Goodness-of-fit for the distribution of geodesic distances. 95% prediction intervals for the complementary cumulative distribution functions

Full size image

Sensitivity to Foci

Given the nature of the selection of actors based on two cases, there are two actors that have a special status in the network. In studies of egonets it is know that analysing egonets as if they were networks obtained from a network census biases and sometimes make your analysis meaningless (McCarty 2002; McCarty and Wutich 2005; Crossley et al. 2015). Here the central individuals in the cases are also central in the generated network at wave 4 but they are not, like egos in egonets, connected to everyone. Nevertheless, given their status in the investigations, the robustness of results to the positions of these individuals need to be appraised. Model 6 adds two dummies for actors 33 and 66 to control for the possibility of ties to these actors being contingent on the case selection. Some of the other affects are attenuated by the inclusion of these effects and the preference for having ties to these two actors is strong.

Discussion

Overall, there was a relatively high degree of stability in the network across time. For consecutive waves, transition 1–2 had 50% of actors in consecutive waves, and transition 2–3 had 53% of actors in consecutive waves. In transition 3–4, a relatively smaller proportion (17%) of actors were seen in consecutive waves. This final transition represented a shift to large scale, profit motivated methamphetamine production and trafficking, including the addition of a large number of actors. A large number of actors enter the network at wave 4, primarily being added to the periphery of the network. The highly central actors (or hubs) tend to be seen in both waves 3 and 4, or in wave 3 only suggesting that central actors are already in place by wave 3 and 4, and that new actors are added to the periphery only.

The results provide partial support for our hypotheses. It is clear that clustering is explained by a combination of triadic closure and preference for indirect ties, confirming hypotheses one and two. While the actors prefer to close open two-paths to form triangles, there is also a preference for acting via proxies, having ties to actors who are themselves highly connected. Since we include both the distance two effect and the preferential attachment effect and only the former is positive, this indicates a preference for having indirect ties to many. The negative preferential attachment effect also gives us more confidence in the presence of triadic closure as it acts as a control for the presence of open two-paths.

Our results support hypothesis three, confirming that actors will form ties with those who play different roles in the drug trade. Part of this result may be accounted for by missing actors in subsequent time periods, but the consistent negative role homophily result from model one and model five suggests that there is a clear tendency for individuals to connect with those who have different roles rather than to connect with those who play the same role.

Taken together, these results paint an interesting picture of how a drug trafficking network balances efficiency with security. Over time, the network sought to increase profits and maximize efficiency. The literature on the security/efficiency trade-off for illicit networks is contradictory when it comes to which structural characteristics represent each of these concepts—some suggest that centralization (presence of hubs and decreased density) reflects more efficient and less secure networks (Bright and Delaney 2013; Calderoni et al. 2014; Mainas 2012; Malm and Bichler 2011; Morselli et al. 2007) while others promote the opposite view (Duijn et al. 2014; Morselli 2010; Morselli and Petit 2007; Tenti and Morselli 2014). The current study shows that this trade-off should not simply be measured in terms of centralization, but rather the type of connections that promote network centralization. The preference for indirect connections may be interpreted as a Yogi Berra effect (Hedström and Swedberg 1998) where an actor ‘is so popular that no one has ties to them’, but the combination of effects implies a more complex situation where actors are seeking to maximize efficiency, while still maintaining secrecy. Three main processes appear to account for the pattern of results: (1) being tied to actors who are tied to actors you are tied to creates clusters or groups; (2) actors pursue a strategy of keeping the network connected by minimising the number of ties outside of their local clusters; and (3) brokers emerge as contacts between otherwise disconnected local clusters.

Results suggest that there is no justification for assuming that preferential attachment operates in drug trafficking networks, particularly when the formation of ties are related to considerable costs (e.g., of discovery, arrest, prosecution). Although preferential attachment may account for the growth of evolution of other social networks, the specific efficiency-security trade-off characteristics of drug trafficking networks brings into play alternate social processes that facilitate actor connectivity. The analysis revealed that actors appear to eschew direct connections with high degree actors and prefer indirect connections to enhance security, triadic connections to enhance trust, and connections with actors who play a different role to their own, to enhance network efficiency.

Limitations

There are number of limitations that need to be taken into account when interpreting our results. First, in general, due to the undirected nature of ties, we cannot strictly infer the presence of preferential attachment. That is, we cannot determine whether less popular nodes prefer to attach to popular nodes or whether popular nodes like to attach themselves to each other. Here the effect is negative suggesting either negative cumulative advantage (popular nodes like to attach themselves to less popular nodes) or an overall preference against having ties to high-degree nodes. For the decision rule used here (model type = 3), dissolving a tie does not require confirmation by the alter; however, we cannot infer the exact mechanisms here in actor-oriented terms as either side of the dyad may initiate the change.

Second, there is always the risk that interpretations are affected by missing data. Figure 4 provides an illustration of how missingness is reflected in the pair-wise analysis procedure. The figure gives a clear picture of the effect of missing actors over time in the sense that it is obvious that actors that are not necessarily peripheral immediately before/after they disappear/appear. Furthermore, it would seem likely that some of the missingness may be conceived of as actors entering and then leaving the network. This changing composition may or may not be endogenous to the network dynamics. The rich forms of missing data that the network displays points to some issues that are common to the study of covert networks. At the very least, the temporal dimension has allowed us to make a slightly more principled analysis of the drug trafficking network in the face of missing data. Criminal justice data may include unintentional errors (e.g., transcription errors) and intentional misinformation (e.g., false names). Criminal justice data sets may suffer from missing information including missing actors or information about actors, and missing links between actors. Criminal justice data may incorporate biases due to the focus of the police investigation into members of the drug trafficking network. When some actors (but not others) are the focus of the investigation, more information will naturally be collected on these actors, including more information about connectivity to others in the network. This can translate into artificially inflated centrality scores.Footnote 7 Nonetheless, the data we collected included information relating to the police investigation of the entire network, included a range of sources (e.g., witness statements, judges’ comments, police interviews), and contained detailed information on the majority of network participants, which mitigates (but not eliminate) this data limitation.

Finally, the generalisability of the results is, at best, limited. The dataset relates to an Australian drug trafficking group that manufactured and distributed methamphetamine. Further research is needed to determine the extent to which our findings will generalise to networks that traffic other drugs (e.g., marijuana), other illicit commodities (e.g., stolen motor vehicles), and ideologically based networks (e.g., terrorist networks).

Implications for Policy/Practice

The results have important implications for law enforcement policy and practice. First, actors tend to connect with others who are in key roles along the supply chain. Targeting some key connections in drug trafficking networks (e.g., between supply of precursor chemicals and clandestine laboratories) is likely to not only disrupt the operation of illicit networks but also to dismantle the network. Second, indirect connections are a key social structure within drug trafficking networks. Targeting brokers may be an effective strategy to dismantle such networks at all stages of network development (see Bright et al. 2017). Third, trust is important for the resilience of drug trafficking networks. Law enforcement interventions should target trust within such networks (e.g., undermining trust through informants) or remove actors based on trust relationships (e.g., triadic structures). Fourth, the results underscore the importance of the collection of intelligence on connectivity of the network and on the individual characteristics (e.g., roles) of individual actors. Social network analysis should be used by intelligence agencies and law enforcement agencies to facilitate intelligence collection and to guide prevention and intervention strategies.

Conclusions

In this article we reported the results of an analysis of a drug trafficking network that incorporated a temporal dimension. We showed that:

  1. (1)

    the network was not formed as a result of preferential attachment. Indeed, results reveal that other social processes are at play, probably strongly influenced by the illicit nature of the activities of the network and the threat of detection and incapacitation.

  2. (2)

    the presence of high degree nodes is an artefact of a mechanism of indirect tie formation; a type of social structure used to increase security (with associated costs in efficiency).

  3. (3)

    actors’ interactions are based primarily on enhancing security and trust. There is a clear tendency toward transitive closure and brokerage (indirect connections).