Introduction

Understanding the clandestine actions of criminal groups is crucial not only for law enforcement detection but also for scholars in fields such as criminology. Many large-scale or profit-oriented crimes are not perpetrated by individuals alone but are coordinated by numerous actors operating in ways that are difficult to detect. Although criminal activities are inherently illicit, they may still adhere to fundamental principles common to legitimate businesses. A key focus is organizational hierarchy, prevalent in nearly all economic organizations, from small enterprises to large corporations. An intriguing question arises: Do criminal groups exhibit organizational hierarchy? If so, what underlies such a hierarchy?

Investigating organizational hierarchy within criminal groups is challenging due to inherent difficulties. First, unlike legitimate businesses, unlawful organizations would not publicize their operational structures. Second, while the confessions of arrested or deceased criminals are useful, they cannot be entirely relied upon to reveal the organizational hierarchy. Criminals’ statements are likely to be biased and manipulated to protect key figures in the organization from detection. These limitations indicate that it is difficult to infer the organizational hierarchy of illicit groups from explicit evidence, such as interviews with criminals or any documents obtained from the organization. Instead, a more viable approach may be to infer the hierarchy through indirect methods.

In this paper, we demonstrate how wiretap data can be used to reveal the command hierarchy within a drug trafficking group. Wiretap data has previously been utilized by researchers to understand criminal operations (see, for example, [10], and [9], for a review). Our dataset includes timestamps of telecommunications intercepted during the investigation. We hypothesize that the pattern of communication could expose the structure of the criminals’ organizational hierarchy based on a key principle: higher-status criminals are more likely to issue orders to subordinates. Consequently, communications are more likely to originate from a superior to a subordinate than vice versa. The timing and directionality of the caller-recipient relationship can help us determine who is higher and who is lower in the command hierarchy. By analyzing pairwise communications, we can estimate the status ranking of each actor within the group, delineating each person’s position in the hierarchy, if one exists, within the criminal organization.

Literature

Status hierarchy in criminal organizations

Command hierarchies are ubiquitous in various organizations, ranging from economic corporations to military units to public sectors. A seminal question that remains unsettled is whether command hierarchies are present in criminal operations [1, 26]. Below, we review some representative studies on this topic.

The qualitative study by Natarajan [22] was one of the earlier efforts to use wiretapped conversations to determine each criminal’s position in the status hierarchy of a drug trafficking organization. By analyzing the transcripts for language indicative of command authority differences, such as issuing orders or requesting information from subordinates, the study identified hierarchical relationships. Each conversation was reviewed by two coders to identify indicators that one actor was higher in status than another. Natarajan ultimately calculated a status score for each individual. Out of the 28 criminals analyzed, she identified a hierarchy of 13 levels within the organization. Applying the same coding scheme to a different heroin trafficking organization, Natarajan [23] observed a flatter, more egalitarian structure, where the 38 core members were divided into only two levels: 13 sellers at the top and the remaining 25 at the bottom.

Drawing on wiretapped conversations, Varese [27] investigated the authority structure of a Russian mafia group in Rome, Italy. By analyzing the content of conversations for issues related to group management, the author identified a three-level status hierarchy: the boss at the top, followed by the boss's wife and his right-hand man at the second level, and the remaining businessmen at the bottom.

Calderoni [7] examined judicial documents to identify the organizational structure of a mafia group in southern Italy. Based on leadership descriptions documented in court records, he categorized a total of 215 gang members into 2 levels, with 33 at the upper level and the remaining 182 at the lower level.

There have also been comparative studies aimed at drawing inferences across crime organizations of varying sizes. For example, Eck and Gersh [13] analyzed 620 cases from the Washington-Baltimore area, concluding that most criminal groups are loosely structured rather than being large, hierarchically organized networks. Similarly, Natarajan et al. [24] compared 89 organizations—50 investigated nationwide by the Drug Enforcement Administration and 39 active in New York City—and found that only 12.8% resembled a corporate organization with a formal hierarchy and division of labor.

It is important to note that many of the studies mentioned above had access to either the full accounts of wiretapped conversations or judicial documents that directly addressed the status hierarchy of the criminal organizations under investigation. In these instances, identifying the ranking position of each criminal was straightforward. However, such comprehensive data sources are rare, and researchers often need to infer the status hierarchy of criminal organizations from limited data. Below, we will demonstrate how to infer criminals’ rankings from wiretap data of their communications without analyzing the content of each conversation. The key is to draw inferences from the timing and directionality of each call made by a criminal to another. Analytical tools developed in complex network science have enabled the prediction of characteristics, such as status ranking, from the dynamic relationships represented in a temporal network [16].

Estimating status hierarchy

How do we measure hierarchy? One method for estimating an individual’s status is by analyzing their interactions with others in the group. These interactions are often competitive, such as sports contests or confrontations in fights. More formally, let G = {V, E} represent the competition results of a set of actors: each node v represents an actor, and an edge eij is defined as:

$${\text{e}}_{ij}=\left\{\begin{array}{ll}{w}_{ij-}{w}_{ji} & if\, {w}_{ij}>{w}_{ji} \\ 0 & otherwise\end{array}\right.$$
(1)

where wij is the number of times actor i defeats actor j in their encounters.

Defined in this way, the graph of G characterizes the dominance relationships among a group of actors. Over the past decades, research in both the social and physical sciences has proposed a variety of methods to analyze the directed graph of actors’ dominance relationships to infer their ranking positions within the group [18]. These methodologies can be categorized based on the scope of the directed graph from which researchers extract information to compute an actor’s ranking.

The first type of metric measures ranking based on summary statistics from an individual's relationships with others. Consider sports competitions as an example. A simple way to rank an athlete or sports team is by calculating their number of wins and losses. Such metrics are based on the idea that ranking is proportional to the win/loss ratio: a higher-ranked player is expected to dominate more often than be dominated. Representative methods of this kind include early metrics, such as those developed by Bradley and Terry [5], as well as subsequent variants like those by Massey [20] and Colley [12].

The second type of metrics computes an actor's ranking by evaluating each pairwise interaction. The underlying principle is that if actor i has a higher ranking than actor j, then it is more likely that i dominates j in confrontations, rather than the reverse. The goal is to estimate individuals’ rankings such that the expectation mentioned is maximally fulfilled across all considered dyadic interactions. Representative metrics of this type are discussed in the work of De Bacco et al. [2].

The third type of metrics considers not only dyadic relationships but also relationships “two steps away” from a vertex in the dominance graphFootnote 1; this involves considering the competitors of an actor’s competitors. With this approach, higher rankings are attributed to individuals who have records of defeating opponents with relatively high rankings. Essentially, winning a challenging contest earns more credit than achieving an easy win. This measurement approach was first proposed by van den Brink and Gilles [6] and later expanded upon and tested in subsequent studies, including those by Bouyssou and Marchant [4] and Chiang and Wang [11].

In summary, these three methods utilize different scopes of the directed graph of dominance relationships to compute an individual’s ranking within the group. Importantly, these methods also differ in whether the computations of rankings are theory-driven or data-driven. By “theory-driven,” we mean that the computations are manually crafted—we import the data of the directed graph, and the ranking of each vertex is obtained by following a formula developed ad hoc by researchers. In contrast, the data-driven approach attempts to estimate rankings by aligning with what we would expect from the data of the directed graph. This typically involves an optimization approach that requires no predetermined theoretical assumptions about how rankings should be computed. In this paper, we employ the data-driven approach, as it is more generalizable and does not require specifying any theoretical basis. This is particularly crucial when attempting to estimate the command hierarchy of a criminal group, whose illicit nature makes it challenging to identify a theoretical foundation that could justify the choice of a specific, hand-crafted estimation method.

Data

In collaboration with the Ministry of Justice Investigation Bureau in Taiwan, we analyzed the wiretapped communications of a drug trafficking group’s members from July 1, 2014, to June 1, 2015. The group consisted of eight individuals who were subsequently arrested and executed in 2015 for drug trafficking violations. These individuals utilized a total of 63 phone numbers and messaging accounts for their communications. Among these, 4123 communications were intercepted, including 562 phone calls and 3561 voice messages.

Although we do not have access to the transcripts of each conversation and message within these criminals’ communications, we do possess data on the timestamps of each call. For messages, we also have details about the identities of callers and recipients, as well as the timing of each message. Collectively, this information enables us to construct a temporal network that maps who called whom and when during the investigation. Temporal networks, utilized by scholars in statistical physics, have been applied to analyze various topics, such as the spread of diseases [15] and the evolution of cooperation [17]. In the following sections, we demonstrate how we can analyze the wiretap data represented by a temporal network to uncover the command hierarchy within the drug trafficking group.

Methods

Communications represented as static and temporal networks

We formalize criminals’ communications as static and temporal network r. In the static network GS = {VS, ES}, each node vi denotes a criminal, and an edge eij represents the number of calls made by criminal i to j during the investigation period. It is important to note that GS is a directed network.

Communications represented as static and temporal networks

We formalize criminals’ communications as a static and a temporal network respectively. In the static network GS = {VS, ES}, each node vi denotes a criminal and an edge eij represents the number of calls made by criminal i to j during the period of the investigation. Note that GS is a directed network.

To take full use of time stamps observed in the wiretap data, we also map temporal networks of criminals’ communications for analysis. We follow a convention in the literature [16] to split the whole wiretapping period into consecutive time windows, illustrated in Fig. 1. Specifically, we choose hour, half day and day as the width of the sliding time window.

Fig. 1
figure 1

Sliding time windows of the entire wiretap period. Each segment denotes the start and end time of a phone call

Full size image

Figure 2 illustrates the distributions of the number of communications wiretapped over time windows measured by hour, half-day, and day. All distributions are right-skewed, indicating that communications are typically sparse, but occasionally, there are periods with an exceptionally high number of calls.

Fig. 2
figure 2

The distributions of the number of communications wiretapped over time windows measured by hour, half-day, and day

Full size image

Each communication within a time window is ordered chronologically based on when it started. We are particularly interested in which calls occur earlier, as we hypothesize that calls made earlier are more likely to originate from criminals with higher command status. For standardization, we assign an order to each call on a scale from 0 to 1 as follows.

Suppose there are m calls recorded within a time window, and a call from individual i to j is the kth call in the window (based on the start time). The time order of the call is calculated using the formula: \({c}_{ij}=\frac{m-k+1}{m}\). This quantity is used to weight the timing of a call from criminal i to j, ensuring that earlier calls within a time window are assigned greater weights than later calls.

Once each call is coded according to its time order, we map a temporal network, GT = {VT, ET}, where each node vi, same as in the static network, corresponds to a criminal. Now, an edge eij represents the average order of calls from criminal i to j across all time windows, defined as: \({e}_{ij}=\frac{\sum_{t=1}^{\tau }{c}_{ij}^{t}}{\tau }\), where ctij is the average order of calls from i to j recorded in time window t, and τ is the total number of time widows.

Estimating hierarchy from static and temporal networks

We follow the approach by Neumann et al. [25] to identify a function to assign rankings to each criminal that minimizes the degree of ‘agony’ [14]. In this context, ‘agony’ refers to the extent to which a higher-ranked criminal receives a call from a lower-ranked individual in static networks, and the call arrives late in the time window in temporal networks. Essentially, agony signifies a deviation from the expected norms based on the rankings of the caller and the recipient within the group. This method efficiently assigns rankings (including ties) to each criminal to minimize these deviations.

More specifically, following Neumann et al. [25] we define agony as follows.

$${\text{Agony}}\text{\_}{\text{dir}}=\sum_{\left(i,j\right)\in {E}_{dir}}max\left\{r\left(i\right)-r\left(j\right)+1, 0\right\}\bullet {e}_{ij}$$
(2)
$${\text{Agony}}\text{\_}{\text{undir}}=\sum_{\left(i,j\right)\in {E}_{undir}}\left|r\left(i\right)-r\left(j\right)\right|$$
(3)

where r(i) is a function mapping a vertex i to an (integer) ranking, with a lower value of r(.) indicating a higher ranking. The value of eij represents the weight of edge from i to j in the static and temporal networks.

Agony occurs when the assigned ranking of i is lower than j (i.e., r(i) − r(j) + 1 > 0), and yet the weight of the edge eij is positive. This suggests that i calls j more than the other way around (in the static network), or the calls from i to j appear in the time window (in the temporal network). Our goal then is to minimize agony, which can be achieved using Linear Integer Programming (LIT) to solve the following equations constrained by a set of conditions:

$$\text{min }\sum_{\left(i,j\right)\in {E}_{dir}}agony\_dir+\sum_{\left(i,j\right)\in {E}_{undir}}agony\_undir$$
(4)
$$\text{s.t.} agony\_dir\ge \left(r\left(i\right)-r\left(j\right)+1\right)\bullet {e}_{ij} \quad for\, all\, \left(i,j\right)\in {E}_{dir}$$
(5)
$$agony\_dir\ge 0\quad for\, all\, \left(i,j\right)\in {E}_{dir}$$
(6)
$$agony\_undir\ge r\left(i\right)-r\left(j\right)\quad for\, all\, \left(i,j\right)\in {E}_{undir}$$
(7)
$$agony\_undir\ge r\left(j\right)-r\left(i\right) \quad for\, all\, \left(i,j\right)\in {E}_{undir}$$
(8)
$$\begin{aligned}&r\left(i\right)\ge 1 \cdots r\left(i\right), x\left(i,j\right), y\left(i,j\right) \in Z\end{aligned}$$
(9)

The constraint conditions (Eqs. 5)–(8) work in conjunction with the objective function (Eq. 4) to achieve the goal of minimizing agony, as demonstrated by Neumann et al. [25] in their study. Additionally, the last condition (Eq. 9) ensures that rankings are assigned as positive integers. Following the approach of Neumann et al. [25], we also aim to minimize agony in undirected graphs (denoted by agony_undir). This situation arises when the weight of an edge eij is zero, indicating no difference in the directionality or initiatory nature of the communication between i and j, yet the estimated difference in command ranking suggests otherwise, causing agony in the model.

Results

Structure of the command hierarchy

By minimizing agony, the Linear Integer Programming (LIP) estimates rankings for each criminal within the group. The left panel of Fig. 3 illustrates the hierarchy structure based on the static network of the criminals' telecommunications. The model estimates four hierarchy levels: one individual at the top, two at the second level, one at the third, and the remainder at the fourth level. The right panel of Fig. 3 displays the hierarchy as estimated from the temporal networks of the communications. This hierarchy consists of three levels, with two leaders at the top, two at the second level, and the remaining four criminals at the third level. Generally, the estimated command hierarchy resembles a pyramid structure, with fewer individuals at the top and more at the bottom.

Fig. 3
figure 3

The estimated hierarchy of the drug trafficking group

Full size image

There is no difference in the results regardless of whether the time window is split by hour, half-day, or day. This consistency suggests that the criminals’ communications exhibit a regular pattern over time. For instance, if a call from a criminal is observed early in one hour, calls from that criminal are likely to appear early in subsequent hours as well. Therefore, when the time window is expanded from an hour to a half-day or full day, the calls associated with that particular criminal are, on average, earlier than others. The regularity in communication patterns is also evidenced in aggregate, as we seen in Fig. 2, where a similar distribution of call frequencies is observed across different time window widths.

The rankings of individuals show high consistency across the network models. Mr. S and Mr. L are consistently ranked first and second respectively in all four network models. Similarly, Ms. C, Mr. W, Mr. Y2, and Mr. K are frequently placed in the lowest tier of the hierarchy. The exceptions are Mr. Y1 and Mr. T: Mr. Y1 is ranked second in the static network model, but is among the top leaders in the temporal network model. Conversely, Mr. T ranks third in the static model and second in the temporal model.

To ensure these estimations are not due to random chance, we compared the results against a benchmark that assumes communication between any two actors is independent of their status rankings. We adopted the 'null model' approach, as recommended by Váša and Mišić [28], reshuffling the caller-recipient network while maintaining certain network properties (see Fig. 4). Specifically, following the method of Bajardi et al. [3], we divided the edges randomly into two sets. In one set, each edge is paired with another—say, eij and elm—and the connected vertices of these edges are swapped to become, for instance, eim and elj. The other set of edges remains unchanged. After this, we randomly divided all edges into two groups again; one group had the directionalities of the edges swapped, while the original directionalities were preserved in the other group. These procedures—random vertex swaps and direction flips—help disrupt the correlation between vertex rankings and their connecting edges, yet maintain the vertex connectivity and the distribution of edge weights in the temporal network.

Fig. 4
figure 4

Illustration of the null model of random reshuffling

Full size image

After reshuffling the communication network, we reapply the agony-minimization model using the LIP process previously introduced to estimate a new set of rankings for each criminal, as shown in Table 1. Given that the model may estimate varying numbers of hierarchy levels in each replication of random reshuffling, we report the percentile position of each criminal in the hierarchy for easier comparison, rather than the integer-based positions originally estimated by the model.

Table 1 Estimation of rank position (in percentile) for each criminal
Full size table

In the estimations from the random reshuffling model, it is unsurprising that we found no significant differences in status ranking among the eight actors; on average, they are all positioned in the middle stratum. This suggests that connections in these randomly restructured networks do not correlate with actor rankings. Importantly, the hierarchy we initially estimated differs significantly from that observed in the reshuffled network, indicating that our original results cannot be attributed to random chance.

Validation of the method

Ideally, an estimation method should be validated by comparing its results against an objective ground truth. However, validation is particularly challenging in our case due to the absence of a credible source that can reveal the rankings, if any, of each criminal within the group. This is further complicated by the limited investigation records available, meaning that no ground truth exists for verification.

Despite the challenges, we examined the investigation documents to find evidence supporting our model. One useful source was the verdicts issued by the courts.Footnote 2 Unlike other cases [7], these verdicts did not directly address the command hierarchy within the criminal group. However, the description of the crime facts might reveal clues about variations in status ranking among the criminals. Following the methodology of Natarajan [22], we inferred status rankings by identifying indications that one actor might be following another’s commands, orders, or instructions.

Our review of the verdict revealed only two instances where the wording suggested a difference in command authority. In one instance, it was noted, “Mr. T delivered three bags of heroin to designated locations after receiving instructions from Mr. L.” This statement supports our model’s estimation that Mr. L ranks higher than Mr. T, as the former issued orders to the latter. Conversely, another statement contradicted our estimates: “Mr. T instructs Mr. S to go to a hotel room to pick up the drugs imported from abroad,” suggesting that Mr. T may have a higher status than Mr. S, which is contrary to our assessment.

We acknowledge the possibility that Mr. S, though highly active and presumably a top figure, might be serving more as an operational executive than as the ultimate leader. This hypothesis aligns with findings from Natarajan [22], where the most active individual, based on telecommunications data, was ranked only 6th among 28 criminals in a drug trafficking organization. The author noted that the top leaders typically communicated less frequently. Similar observations were made by Moreselli [21] and Calderoni [8], indicating that criminals who are active on the phone might occupy upper middle-level positions, primarily to relay information to higher-ups.

Furthermore, the verdict mentioned that there was a debate during the court discussions about whether Mr. L or Mr. T was the boss. Although it remains unclear who holds the higher status, it is evident that both criminals are perceived to be at similar levels, which has caused confusion in the criminal investigation regarding who should be held accountable. Interestingly, this ambiguity is mirrored in our model, where we ranked Mr. L and Mr. T equally at the second level in the temporal network model. This correlation provides additional support for the methodology we used to estimate the command hierarchy within the criminal group.

Conclusion

We present a computational approach to estimate the command hierarchy of a drug trafficking group using wiretap data from criminals’ telecommunications. Understanding the command hierarchy is crucial for law enforcement authorities in identifying key players and dismantling the organization [10]. In our study, we convert communications data into static and temporal networks, following conventions in complex network research. We apply an optimization method to estimate each criminal’s rank by matching the weights and directionality of network ties to expected rankings, based on the assumption that higher-ranked criminals are more likely to initiate calls to subordinates. For a group of eight criminals, we estimated a hierarchy of three to four levels, characterized by a pyramid-like structure with fewer individuals at the top and more at the bottom. This pyramid structure is common across a wide range of both human and other biological species’ social and economic organizations [19]. Our findings suggest that, although criminal organizations operate illicitly, they adhere to fundamental organizational principles similar to those of legitimate businesses. In fact, to maintain secrecy, criminal groups may adopt a more hierarchical structure than typical businesses, complicating efforts for lower-level actors to disclose the identities of top leaders. Future research could empirically test this hypothesis to enhance our understanding of how illicit activities are organized.

In general, accurately estimating the rank of each individual criminal is more challenging than determining whether the organization is overall hierarchical or flat in structure. Importantly, as argued, verifying a criminal’s ranking is difficult because there is no definitive way to uncover the true rankings, if they exist at all. However, insights from the literature and informal discussions with the investigating agent in charge of the case suggest that ranking estimates are more reliable for actors at the bottom than at the top. In other words, predicting who is at the bottom of the command hierarchy is straightforward, but identifying the real leader remains ambiguous. This ambiguity is likely due to top leaders’ motivations to maintain a low profile and avoid police detection. If this holds true, we recommend that law enforcement agencies focus more on individuals at the mid-upper levels of the empirically estimated hierarchy. It is likely in these positions that the real leaders are found, even if they are not ranked at the very top of the organization.

To enhance the accuracy of estimating a criminal’s rank within the group, combining qualitative and quantitative analysis of wiretap data could prove more effective. As demonstrated in previous research [22, 23], analyzing the specific wording used in the transcripts can provide clearer information about the hierarchy. With the advancements in natural language processing—a powerful application of artificial intelligence—future research could rely on this technology to autonomously analyze wiretap data and uncover the hierarchical structure of criminal groups. However, this approach requires support from human experts who can label key phrases indicative of hierarchical relationships. This is where social scientists, such as criminologists, can apply their domain knowledge to aid computational methods in understanding organized crime.