This document discusses using an agent-based model and social network analysis to evaluate the effectiveness of different strategies for disrupting terrorist networks. The model is based on a 271-member al-Qaeda network and analyzes how network metrics change when kinetic and non-kinetic strategies are implemented under varying levels of network morale. The goal is to determine which strategies most impact network structure and achieve disruption goals. The document provides background on using social network analysis to understand terrorist networks and their evolution. It then describes how machine learning was used to train the al-Qaeda network model and outlines different disruption strategies that could be implemented in the model.

1. 1
STRATEGIC OPTIONS FOR TERRORIST NETWORK DISRUPTION:
UNDERSTANDING THE STRUCTURE AND COMPLEXITY
by
Stefani Fournier
A Project Submitted to the Interdisciplinary Studies Program of
George Mason University in Partial Fulfillment of the Requirements for the Degree of
Master of Arts in Interdisciplinary Studies with a Concentration in Computational Social Science
Committee:
Dr. Andrew Crooks
Associate Professor, Department of Computational
and Data Sciences, Program Chair
Dr. Clifton Sutton
Associate Professor, Department of Statistics
Dr. WilliamG. Kennedy
Research Assistant Professor, Krasnow Institute for
Advanced Study
Dr. Andrew Crooks
Head, Concentration in Computational Social Science
Sciences
Dr. Meredith Lair
Director, Interdisciplinary Studies
Date:
Fall Semester 2015
George Mason University
Fairfax, VA

2. 2
Abstract
Governments spend billions of dollars every year fighting terrorism, but still terrorism remains a
major national security risk. The question still remains as to what are the key strategies or
combination of strategies to combat terrorism, particularly as terrorist networks constantly
evolve. The need to understand the internal dynamics of terrorist organizations has been well
documented since the September 11th attacks, particularly the use of social network analysis
(SNA) as it provides valuable insight into covert organizations. Due to the nature of covert
organizations, complete network data is impossible, but extensive research has been done on the
networks, individual terrorist attributes, and the overall strategies and goals of terrorist
organizations. While much work has been done to collect information and analyze the network
structure and terrorist attributes, much less attention has been paid to the implementation of
successful strategies to disrupt the network and particularly how implemented strategies
influence networks to evolve. As terrorist networks constantly change, approaches to disrupt
them must constantly adapt. It is important to build onto the network and attribute data collected
to understand how particular strategies influence network structure and more importantly what
strategies achieve the goals they set out to accomplish. Only by tying together the terrorist
organization attributes, network structure, and how strategies influence network changes will
those implementing strategy make decisions that eventually weaken terrorist influence and
power. To address the issue of incomplete network data, particularly missing links, this paper
utilizes several methods of machine learning to train the network to predict hidden links. Agent-
based modeling is a tool that can utilize network and attribute data to enable the analysis of the
effects of disruption strategies on a terrorist network. This paper presents an agent-based model
to evaluate the network structural changes as disruption strategies are implemented. The focus
of the model is the implementation of both kinetic and non-kinetic disruption strategies on a
learned 271 al-Qaeda member network that is allowed to have varying levels of morale. The
model enables the exploration of how key strategies may impact terrorist network metrics such
as density, diameter, centrality, path length, the number of terrorists, and the ties between
terrorists. This model is based on the al-Qaeda Attack Network available in the John Jay &
ARTIS Transnational Terrorism Database.

3. 1
TABLE OF CONTENTS
1. Introduction …………………………………………………………………………… 2
1.1 Background of Terrorist Network Analysis………………………………………. 2
1.2 Understanding al-Qaeda Through SNA……………..…………………………….. 3
1.3 Previous Research Using SNA to Understand Terrorist Networks………………... 5
1.4 Previous Research Using SNA and Agent-based Modeling to Understand Terrorist
Networks…………………………………………………………………………… 6
1.5 Limitations of Previous Terrorist Network Analysis………………………………. 7
2. Terrorist Network Case Study…………………………………………………………. 8
3. Training the Network…………………………………………………………………... 9
4. Strategies for Combating Terrorism…………………………………………………… 12
5. Model Framework and User Interface……………………………………………...... 14
5.1 Visual Display……………………………………………………………………………………………...15
5.2 Strategy Methodology………………………………………………………………………………….19
6. Network Metrics and Model Findings……………………………………...........…… 22
6.1 Low Morale Results………………………………………………………………... 23
6.2 Low-Average & Average Morale Results………………….……………………… 23
6.3 Average-High Morale Results…………………………………………………… . 25
6.4 High Morale Results……………………………………………………………….. 26
6.5 Overall Results………………………………………………………………………27
7. Discussion……...……………………………………………………………………….. 28
8. Conclusion………………....………………………………………………………….... 29
9. References……………………………………………………………………………… 30

4. 2
1. Introduction
This project presents an agent-based model that utilizes an identified and trained al-Qaeda
network and its individual terrorist attributes to better understand how implemented disruption
strategies affect network structure and thus, which strategies appear to be more effective under
different scenarios. To determine the effectiveness of the disruption strategies, network
measurements such as density, diameter, centrality, path length, the number of terrorists, and the
ties between terrorists are compared to the original network after a strategy is implemented.
Each strategy is also implemented for differing levels of morale in the network to determine
whether morale plays a role in the effectiveness of the strategy. The model outputs show total
links, total terrorists, and the count of terrorists in each position type in the network. The
network created in the agent-based model is then used to calculate network metrics. This model
is a starting point for understanding network changes as four particular strategies are
implemented on a given network. This paper provides an overview of the background and
limitations of previous efforts used to better understand terrorist networks (Section 1), an
overview of the al-Qaeda network and terrorist attributes utilized (Section 2), the methods of
machine learning and results to train the network (Section 3), an overview of the strategies used
for combating terrorism (Section 4), the model framework and user interface (Section 5), a
comparison of network metrics between the original network and one where a strategy has been
implemented to conclude model findings (Section 6), model discussion and expansion ideas
(Section 7), and concluding thoughts (Section 8).
1.1 Background of Terrorist Network Analysis
Social network analysis (SNA) provides a visualization of individuals (nodes) and their
relationships between one another (links) to form a network structure. In addition to providing
visualizations that can uncover hidden relationships or patterns and potentially motivations of
behavior, SNA generates metrics that identify the importance or influence of individuals, the
strength of ties, and the density and distance of the network. These metrics are useful to
understanding influential people in the network and how information flows through a network.
For example, shorter path lengths and distance found in more centralized networks can facilitate
resources and information much easier, but less centralized networks allow for more adaptability

5. 3
from any kinds of shocks to the network, such as the removal of the leader, and this makes it
more resilient. Perliger (2014, p. 49) explains, “successful networks obtain enough hierarchy
(level of centrality) to ensure effective coordination and cohesive operational vision, and on the
other hand, provide enough freedom and flexibility to its members and subgroups - a practice
which ensures survival when some parts of the network become dysfunctional.” Terrorist
networks must balance that need for effective communication and coordination with information
flowing through the network with the need for security and adaptability. In addition to keeping
the network secure and efficient, network members must also worry about defection. Dense
networks provide an additional benefit of being able to better minimize defection as numerous
links can provide a greater sense of belonging, but also a monitoring mechanism. Everton and
Cunningham (2015) explain that network density is a result of terrorists recruiting through strong
social ties as this provides a security benefit, but requiring too much security can isolate a
network to the point of collapse, as they do not have access to necessary information and
resources. SNA metrics provide a method to understand the goals of a network and structurally
where weaknesses exist. Whether a network is more focused on security or efficiency will
determine how adaptable a network is and what kind of disruption strategies will work against it.
1.2 Understanding al-Qaeda Through SNA
While al-Qaeda began as a small guerilla organization in the 1980s, today it comprises many
regional branches and affiliates across many countries. As the al-Qaeda network grew in
strength and size, it also changed in structure in part because of the need to evolve and adapt to
counterterrorism strategies and in part due to bin Laden’s vision of inspiring jihad globally.
Figure 1 from Metzger (2014) shows the hierarchical structure of al-Qaeda in the 1990s when the
primary goal was resource mobilization as a response to defending Afghanistan against the
Soviets and the timeline in Figure 2 displays the evolution to a more decentralized al-Qaeda
network structure. Borum and Gelles (2005) provide rationale for the evolution by noting that
the American focus on al-Qaeda since 9/11 have forced core members of al-Qaeda to change
functional roles in order to spread the inspirational message of jihad instead of providing tactical
leadership. As terrorist networks are evolving, it only makes sense that the approach to analyze
and disrupt them also adapts. Previous efforts of identifying and targeting leaders of an
organization did prove to be successful against hierarchical guerrilla organizations, however, bin

6. 4
Laden successfully adapted the organization to a more decentralized network that is able to
inspire the vision of jihad from within and thus make it more difficult to detect. As enemy
network structures change from the traditional hierarchical structure, more advanced analytic
tools such as SNA must be used to identify central nodes and understand how information flows
through a network in order to implement strategies that more effectively fight terrorist networks.
Knoke (2015) supports the movement and points out that some link analysis was done prior to
9/11, but after the attacks researchers significantly changed methodology to incorporate SNA
into their foundational efforts in order to better understand the al-Qaeda network, the Jemaah
Islamiyah cell that was responsible for the Bali bombing, the network responsible for the Madrid
train bombing, and several other networks.
Figure 1 1990s Hierarchical Structure of Al-Qaeda (Source Metzger, 2014)

7. 5
Figure 2 Development of Al-Qaeda Structural Changes (Source Metzger, 2014)
1.3 Previous Research Using SNA to Understand Terrorist Networks
Researchers have recognized the need for updated analytic tools when attempting to understand
terrorist networks and have made use of SNA as such a tool. In addition to Krebs’ (2002)
research using SNA to map the 9/11 hijackers, Sageman (2004), Koschade (2006), Magouirk et
al (2008), Xu et al (2009), Medina (2012), and several others have contributed greatly to the
understanding of terrorist networks, even with the acknowledgement that data on covert
networks will never be complete. Particularly, previous work has given insight on the network
structure of terrorist organizations and network measures that identify central and influential
individuals in the network. For example, Koschade (2006) found a high density of ties (0.43)
among the Jemaah Islamiyah cell that was responsible for the Bali nightclub bombing and noted
a centralized network allowed for both efficiency and security. Sageman (2004) argues that
terrorist networks are built upon ties of kinship and friendship. Medina (2012) found in his
analysis that the Islamic terrorist network was surprisingly resilient and efficient even as two key
figures identified by highest degree centrality, betweenness centrality, and closeness centrality
were removed from the network. A central actor can be identified as someone who has a large

8. 6
number of ties to other actors (degree centrality), someone who lies on the shortest path between
numerous pairs of actors in a network (betweenness centrality), someone who is close in terms of
path distance to other actors (closeness centrality), or someone who has numerous ties to highly
central actors (eigenvector centrality). The density of a network tells how well connected the
nodes in a network are and thus can give an indication of how resilient the network may be when
shocks occur. The diameter of a network is defined as the longest geodestic path between two
nodes and can be thought of as a measure of reachability. Path distance provides an additional
measure of node closeness and the clustering coefficient measures the connectivity of each
node’s neighborhood. Overall, SNA has greatly attributed to the greater understanding of
terrorist network structure and implementing the network into an agent-based model will allow
for an understanding of network changes as particular disruption strategies are taken.
1.4 Previous Research Using SNA and Agent-based Modeling to Understand Terrorist Networks
Kathleen Carley has done a great amount of work tying SNA, agent-based modeling, and
terrorism together to think about networks from a dynamic perspective as strategies are being
implemented. Tsvetovat and Carley (2002) use a multi-agent network simulation to conclude
that targeting random members of a terrorist network doesn’t have a permanent effect on
operation effectiveness as the organization recovers and restores itself to normal operation in
time, but the targeting of highly central members does make the recovery time longer.
Additional work tying agent-based modeling and SNA has been performed by Ko and Berry
(2002) to understand what variables most effect terrorist camp enlistment. Edward MacKerrow
(2003) performed research with the Defense Threat Reduction Agency (DTRA) on an effort
known as the Threat Anticipation Program (TAP) to simulate terrorist networks using agent-
based modeling in an effort to examine the questions related to why terrorist organizations
originally form. Carley (2003, p. 6) also developed a tool called DyNet that has been made
available to intelligence personnel, researchers, and military strategist in order “…to see how the
networked organization was likely to evolve if left alone, how its performance could be affected
by various information warfare and isolation strategies, and how robust these strategies are…”
While the DyNet tool should provide the analyst the tools to understand how networks evolve,
the shortcomings is that it only focuses on the removal of nodes in the network as the
counterterrorism strategy. As has been demonstrated, this may work as a short-term strategy, but

9. 7
it at least needs to be combined with other strategies to achieve long-term results. Overall,
previous efforts have tied SNA and agent-based modeling to better understand terrorism, but
these efforts have focused on the rise of terrorist organizations and targeting central members to
disrupt them.
1.5 Limitations of Previous Terrorist Network Analysis
Previous efforts have collected a tremendous amount of data on individual terrorists and the
relationships they have within their networks. Ressler (2006) points out the University of
Arizona’s Artificial Intelligence Center’s Terrorism Knowledge Portal which makes publically
available over 360,000 terrorism news articles and websites. START provides a Global
Terrorism Database (GTD) that includes data on over 140,000 domestic and international
terrorist attacks from 1970 to 2014 (Global Terrorism Database). Due to the nature of covert
networks, however, it is nearly impossible to know and collect all persons and relationships in a
network. In addition, personal attribute data may not be complete to fully utilize network
information. Some researchers, such as Medina (2012) and Krebs (2002), have accepted
incomplete networks in order to understand as much as possible about terrorist organizations.
This approach may be sufficient if key individuals or relationships are not missing in the
network. However, when implementing strategies a more complete network will increase the
significance and acceptance of simulation results as missing links or nodes in a network,
particularly if between or of influential individuals, is devastating to the use of network analysis
for strategy implementation. Magouirk et al (2008, p. 2) notes, “A major problem facing the
study of terrorism today is a lack of strong, quantitative data that is freely available…. This
dearth of data unfortunately results in theoretical modeling that is often divorced from important
policy questions….” While collection efforts have greatly added to the overall understanding of
the organizational structure, Roberts and Everton (2011) point out that the exploration of
disruption strategies is limited. Of particular importance is evidence to suggest a positive
relationship between strategy, or a combination of strategies, and results for particular network
structures. Some strategies may achieve a particular goal, but without understanding structural
effects improper goals may be set and lead to devastating long-term results. For example, the
death of Osama bin Laden was considered a major success and hopes were that the network
would be disrupted. Not only did the network persevere, but the targeting of bin Laden may

10. 8
have led to further decentralization that makes targeting more difficult in the future. Carley
(2003, p. 2) explains, “finally, and critically, this approach [SNA] does not contend with the
most pressing problem – the underlying network is dynamic. Just because you isolate a key
actor today does not mean that the network will be destabilized and unable to respond. Rather, it
is possible, that isolating such an actor may have the same effect as cutting off the Hydra’s head;
many new key actors may emerge.” Strategies should not be implemented without
understanding the full effect on the network. This is a difficult task considering the varying
conditions under which strategies are implemented and while predictions are never going to be
completely accurate, a better understanding of broad tendencies will be beneficial. To
effectively combat covert networks, an understanding of how strategic options affect the
structure of a network must be considered. While some research ties SNA and agent-based
modeling to discover the structural effects of the network, the focus has been on node removal
and needs to be extended to other strategic options.
2. Terrorist Network Case Study
This model utilizes the John Jay & ARTIS Transnational Terrorism Database (2015) to access
the al-Qaeda attack network and individual attributes of terrorists. The network data provides
aggregate data representing the relations of individuals associated with 23 terrorist attacks linked
to al-Qaeda between 1993 and 2003. This network, seen in Figure 3 as a visualization generated
in Gephi version 0.8.1, represents 271 al-Qaeda members and 1,512 social ties between the
members. The provided terrorist attributes from the terrorism database used in the model include
place of birth, educational achievement, occupation, whether they are a former terrorist, the
specific al-Qaeda group they belong to, the country where they joined the organization, and the
position they hold within the organization. There is one leader, or Emir, in the network. Three
members of the religious/fatwa committee are responsible for justifying al-Qaeda actions and
preaching the al-Qaeda model of Islam. Twelve members of the military committee are
responsible for selecting targets for attacks and operatives for conducting them. Twenty-four
members raise and spend money for al-Qaeda as part of the finance committee. The logistics
committee consists of thirteen members who are devoted to executing attacks. Additionally
there are 22 local leaders, 72 regional leaders, 55 general subordinates, one central leader, and 68

11. 9
members whose position is unknown. It must be understood that this data is as complete and
reliable as open source data allows. The collection of a comprehensive covert dataset is
understood to be impossible, but the data is deemed sufficient to understand the network
structure and determine influential individual nodes. In addition to missing links or nodes, the
attribute data does not provide information on every node.
Figure 3 Structural overview of al-Qaeda network of 271 members and 1,512 social ties
represented in a Fruchterman Reingold layout. Darker blue, larger nodes represent terrorists
with higher closeness centrality while edge color provides a visualization of those members
participating in the same attacks.
3. Training the Network
There is an understanding when dealing with covert networks that data will usually be
incomplete. As researchers gather network and attribute data, most assume it is sufficient to do

12. 10
analysis. Medina (2012) explains in his research that a comprehensive database of all Islamist
terrorists is not possible, but the real goal is a database of sufficient size to conduct analysis that
provides meaningful results. While it may be the case that the data is sufficient for conclusive
evidence, the use of predictive learning may be able to tackle the data limitations in order to
provide a more complete framework. Predictive learning, better known as the field of machine
learning, is currently used by a variety of fields such as neuroscience and sociology to solve
problems of varying complexity. Overall, the goal of machine learning is to use algorithms to
learn from and make predictions about data. In regards to social networks, the need for machine
learning is recognized particularly to solve the link prediction problem. This problem addresses
predicting future links between nodes. Lichtenwalter et al (2010) explain that link prediction is
important to network science and particularly security agencies as it allows them to more
precisely focus their efforts on unobserved probable relationships. Given the dynamic nature of
social networks and the importance of understanding those dynamics, machine learning allows
for an evolution of the network by predicting edges that will be added in the future. A practical
application of solving this problem is building recommendation systems that predict future
connections, such as is done by Facebook and LinkedIn (Jannach et al, 2014). Related to the
link prediction problem is dealing with missing links due to incomplete data as applicable to
identifying missing terrorist links. Budur et al (2014) focus on finding hidden links in criminal
networks and conclude from their experiments that decentralized networks have better
performance in solving the link prediction problem because the machine learning model avoids
over-fitting due to the lower variance.
Al Hasan and Zaki (2011, p. 1) state, “There exist a variety of techniques for link prediction,
ranging from feature-based classification and kernel-based methods to matrix factorization and
probabilistic graphical models.” Once a specific technique has been decided upon, there are
several machine learning models that can be used. For classification based on features, these
models include Naïve Bayes, Neural Networks, Support Vector Machines, Multilayer
Perceptron, K Nearest Neighbors, Decision Trees, Logistic Regression, Random Forest, and
Boosting. While there are various techniques and models available to address the link prediction
problem, the data determines which model is more applicable based on prediction performance
metrics such as recall, precision, F-measure, and accuracy. Recall is the portion of actual

13. 11
positives that are predicted positive while precision is the portion of predicted positives that are
actually positive. F-measure is the weighted harmonic mean of precision and recall. Accuracy is
the portion of classifications that are correct. Forman (2003) points out that none of these
measures alone give enough information in each situation to make an informed decision so all
performance metrics are used together. This paper utilizes six different classification based
machine learning methods to predict the most complete network. These methods include
Random Forest (Breiman, 2001), Decision Trees (Quinlan, 1986), Support Vector Machines
(Cortes and Vapnik, 1995), Boosting (Breiman, 1998), Logistic Regression (Cox, 1958), and K
Nearest Neighbors (Altman, 1992). Each method predicts links based on given node attributes in
addition to three proximity measures (Jaccard, Dice, and Adamic/Adar). The performance
metrics of the six machine learning methods are shown in Table 1. These metrics were
generated in RStudio version 0.98.1091 utilizing the randomForest package (Random Forest
results), the tree package (Decision Tree results), the e1071 package (Support Vector Machine
results), the gbm package (Boosted results), the glm function (Logistic results), and the knn
function (K Nearest Neighbors results). Recall, precision, F-Measure, and accuracy are
calculated based on the confusion matrix produced in the results. Random Forest provides the
best overall results and is the chosen method to predict hidden links of the al-Qaeda network.
Beginning with an al-Qaeda network of 1,512 social ties, the Random Forest algorithm predicts
hidden links and expands the network out to 1,574 links. Overall, the network has 1574 links,
271 nodes, a density of 0.0108, a diameter of 8, 0.0320 degree centrality, 0.0062 betweenness
centrality, 0.0018 closeness centrality, path length of 2.75, and cluster coefficient of 0.6070.
KNN Logistic Boosted Radial SVM
Decision
Tree
Random
Forest
Recall 61.3% 92.4% 96.4% 97.9% 100.0% 96.9%
Precision 79.3% 88.7% 89.7% 89.2% 87.9% 93.5%
F-Measure 69.1% 90.5% 92.9% 93.3% 93.6% 95.2%
Accuracy 80.4% 94.9% 96.1% 96.5% 96.7% 97.4%
Table 1 Performance results of machine learning methods calculated in RStudio

14. 12
4. Strategies for Combating Terrorism
As the structure of terrorist networks evolve and adapt over time, it is important to not only fully
understand their current structure, but also the long-term effects that counterterrorism strategies
have on the network. Strategies that have been successful in the past on hierarchical structures
may not be effective and worse yet, they may actually make the network harder to combat in the
future. Xu et al (2009) argue that terrorist organizations in the past were identified as
hierarchical organizations where the leader held total control and, thus, made themself vulnerable
to attacks, but modern terrorist organizations have adopted a decentralized structure that spreads
leadership across the organization.
Understanding the limitations of strategies focused on targeting leaders in more decentralized
networks will allow for a more robust set of strategies focused on understanding the effects on
the network. Roberts and Everton (2011) explore two approaches to combating dark networks.
The goal of a kinetic approach is to capture and kill terrorists through aggressive means. This
approach is very visible and has been highly supported in the past, particularly when it was
effective against hierarchical organizations. For example, the United States won the Philippine-
American War with strong military force against the Philippine Army in which Gates (2002)
estimates that 34,000 Filipino soldiers and up to 200,000 civilians were killed. A non-kinetic
approach, on the other hand, is much more of a long-term strategy that requires cooperation and
patience. The non-kinetic approach can be taken by rebuilding war-torn communities,
disseminating information for the purpose of influencing behaviors (to include deception tactics
that tarnish relationships), using information operations to undermine terrorist ideology, and
rehabilitating detainees and their families by providing incentives to defect. Brown (2007)
points out that al-Qaeda has been at war with itself from the beginning as there has been a
constant battle over what the organization should be, the strategy to be implemented, and who
the enemy is and this has led to two factions that differ in ideology and also provide an
opportunity to turn members against one another through deception tactics. The key to defeating
an enemy is understanding their weaknesses and exploiting them. If a decentralized network is
capable of rebuilding itself when leaders are taken out, then other weaknesses such as network
infighting, weak ideology, or low morale must be explored. Jenkins (2014) explains that
network infighting within al-Qaeda has become commonplace over issues such as strategy,

15. 13
ideology, tactics, and targets and this provides an opportunity for the United States in not only
creating new intelligence and propaganda, but it also lowers recruitment and increases defection.
Both of the described approaches have their strengths and weaknesses and it may be the case that
they need to be implemented concurrently, but applying them to the proper network structure is
key to any long-term positive result.
Roberts and Everton (2011) recognize great efforts to collect information on terrorist networks,
but are shocked by the lack of attention paid to strategies that disrupt these networks. While the
White House does offer a National Strategy for Combating Terrorism, this offers only general
policy direction and doesn’t give specific strategy alternatives. To demonstrate, one of the eight
overarching goals of the National Strategy for Combating Terrorism (2011, p. 8) is to “Disrupt,
Degrade, Dismantle, and Defeat al-Qa’ida and its Affiliates and Adherents”, but no further
details are provided as to how that is accomplished. The lack of strategy attention may be due to
secrecy, but most of the focus, in terms of both published and media research, is solely on the
kinetic approach. Davis and Sisson (2009) from the RAND organization have identified thirteen
policy tools to achieve strategic goals: provide assistance to friendly nations for
counterterrorism efforts, offer military assistance to friendly nations for counterterrorism efforts,
kill or capture terrorist leadership figures, compromise terrorists’ use of technology, prevent
access to conventional weapons, deny terrorist safe havens, pressure states to reduce/curb
terrorist support, disrupt terrorist financial support, tarnish relationships between jihadists,
partner with authoritative voices such as religious leaders to undermine terrorist ideology,
impede recruitment, create incentives for members to defect, and use moderate Muslims to
counter jihadist ideology. Even among several RAND experts identified by Davis and Sisson
(2009) evaluating these policy tools, however, there were differing views regarding priority and
effectiveness.
In addition to focusing on particular strategies of disruption, Ash (1999, p. 34) explains that
“…strategies must target morale to break the enemy’s will to resist.” While morale is complex
because it relates to both situational and psychological factors, it is ultimately a factor of
motivation (Bekerian and Levey, 2005) and overall organizational success. Terrorist leaders
recognize the need to boost morale, both internally and for recruitment purposes, as they put out

16. 14
propaganda to make members motivated to fight harder. Counterterrorism strategies must also
think about morale and understand how morale affects the effectiveness of disruption strategies
and in turn how disruption strategies affect morale. For example, Hibbert (2006) explains if
morale is high and members are motivated to fight aggressively towards their cause, actions that
promote more aggressive behavior will only influence a stronger will to fight. On the other
hand, if morale is low and aggressive actions are taken towards the individual, the lack of
motivation may be enough to influence the individual to not fight back.
The complexity of moving parts in a terrorist network make this evaluation difficult for the
human mind, no matter what level of subject matter expertise the individual obtains. Thus, a
more scientific evaluation that allows for computer simulation utilizing subject matter expertise
is needed. This is not to say that all strategies will be feasible, but a better understanding of the
effects of the different options will allow for more insightful policy decisions. Krawchuk (2005,
p. 3) sums it up by saying, “…[T]he United States must know where the enemy is today,
understand what he is doing and prepare for his future moves. If not, this nation will always be
one step behind and is certain to suffer another tragic surprise.”
5. Model Framework and User Interface
Once machine learning has provided a more complete picture of the terrorist network, research
can be taken beyond the foundational case studies to apply the understanding of the network
structure to devising strategies to disrupt the network. When devising strategies, however, it
must be understood that both terrorist networks and the environment that they survive in change
and adapt quickly. Everton and Cunningham (2011) point out that both endogenous and
exogenous factors, such as recruitment and responses to counterterrorism strategies, change the
environment that a terrorist network exists within and in response to the changing environment,
the terrorist network structure adapts. Thus, flexible models must be created in order to account
for these varying conditions. Agent-based modeling offers this flexibility, as Bonabeau (2002)
explains it provides the methodology for modeling complex emergent phenomena. Given the
complexity of interactions in a terrorist network, particularly when a strategy of disruption is
implemented, agent-based modeling offers insight about the emergence of the network to

17. 15
evaluate under what circumstances a particular strategy is effective. Thus, the simple behavior
of the agents generates the complex behavior of the dynamic network.
5.1 Visual Display
To represent the synthetic network built out by the Random Forest algorithm to expose hidden
links, the agent-based model was developed using NetLogo version 5.2.1 that utilizes the NW
(abbreviation for network) extension. The model visual display shows the al-Qaeda network
using a spring layout with circles representing network members. Those members with high
betweenness centrality are represented with larger node size and node color represents the
position the member holds in the organization. The Emir is represented in red, the religious
committee in yellow, local leaders in brown, the logistics committee in orange, regional leaders
in pink, the finance committee in blue, the central leader in violet, the military committee in
green, general subordinates in white, new recruits in turquoise, and those with an unknown
position in magenta. In addition to having additional links, the network visualization in NetLogo
will differ from the initial visualization shown in Figure 3 due to the limited capabilities of
NetLogo to manipulate graphical features. Interface monitors also capture the counts of
members in each position. Attribute data for each member is stored within the model. As is
reasonable in a terrorist network, the visual display shows that agents may be eliminated from
the network as they are captured or killed and links may be removed from the network as
relationships are tarnished or as agents are deterred from the network. In addition, agents can
also be added to the network through recruitment. The outputs are monitors of total links, total
nodes, counts of positions within the network, and the identification of the most central figure as
defined by betweenness centrality.
The model graphical user interface, shown in Figure 4, supports user interaction to import the
network, adjust value settings for parameters, and select and execute the disruption strategy. The
user can adjust the recruitment potential of the terrorist network (as a percentage of the entire
network) by adjusting the “Recruitment-Potential-%-of-terrorist-network” slider. This parameter
is defaulted to 5% in order to set the user to a low-side estimate of recruitment. Recruitment
statistics for al-Qaeda are not available and opinions vary widely as to what these values are, but

18. 16
Black and Norton-Taylor (2009) argue that many believe that al-Qaeda’s failure to carry out
significant attacks since the London bombings has weakened its power to recruit. The morale of
the network can be set with the “Network-Morale” drop-down button to Low, Low-Average,
Average, Average-High, or High. The “incentive –potential” slider allows the user to define the
potential when a strategy of creating incentives is executed. The default value is set to 20% and
the strategy is shown to be ineffective with a potential under 20%. Statistics for the effectiveness
of incentives are not available so the 20% default is set to make the strategy minimally effective.
The user imports the al-Qaeda network through the “import-network” button and executes the
strategy though the “Execute Strategy” button. The user can choose one of four strategies with
the “Strategies” drop-down button: target central figure (member with highest betweenness
centrality), use deception tactics, undermine terrorist ideology, or create incentives. These four
particular strategies are selected from the thirteen policy tools identified by Davis and Sisson
(2009) because they focus on behavioral changes of communication in a terrorist network. The
model’s logic and execution of strategies are summarized in Figure 5.

19. 17
Figure 4 Agent-based model user interface in NetLogo

20. 18
Figure 5 Model Logic and Execution of Strategies

21. 19
5.2 Strategy Methodology
The first strategy, target central figure, allows the user to test the belief of Brafman and
Beckstrom (2006) that using a kinetic approach on a decentralized network will actually make
the network harder to combat in the future. This strategy kills the most central (as defined by
betweenness centrality) agent in the network. As a consequence of killing the most central node,
potential recruits are motivated to join the network as a result of injustice. The amount of
recruits to join the network is determined by the recruitment slider. These recruits then randomly
create links with any member of the terrorist network because as Sageman (2004) points out, the
main recruitment factor for al-Qaeda is kinship and friendship links. Thus, any member of al-
Qaeda may act as a potential recruiter and it is through those previous social ties that new
members join the network. In response to the killing, those agents that had links to the targeted
node will be forced to make a decision on how they react to the strategy. Those agents with high
morale will respond aggressively by creating links in order to cultivate relationships and take
over tasks. This assumption is based on the work of Hibbert (2006) who argues that soldiers
with high morale will have more confidence to defeat the enemy so they will fight harder. These
actions may be self-motivated in order to advance in the organization or as a general action to
make the network stronger. On the other hand, those agents without high morale will be more
apprehensive about the security for themselves and the organization and will cut ties in order to
make members less detectable. Byman (2006, p. 104) explains these actions by stating, “(t)o
avoid elimination, the terrorists must constantly change locations, keep those locations secret,
and keep their heads down, all of which reduces the flow of information in their organization and
makes internal communications problematic and dangerous.” Once members have reacted to the
strategy, they will adjust their morale based on the morale of all members they are linked to.
The following three strategies (use deception tactics, undermine terrorist ideology, and create
incentives) utilize a non-kinetic approach to disruption and incorporate four policy tools
identified by Davis and Sisson (2009) from RAND. These policy tools include tarnishing
relationships between jihadists by using deception tactics, partnering with authoritative voices
such as religious leaders and using moderate Muslims to undermine terrorist ideology, and
creating incentives for members to defect. Other RAND policy tools were not focused on
because the purpose on this paper is to understand terrorist behavior within the network. Given

22. 20
the data set available, focusing on military assistance, technology, or the financial network is not
applicable.
The strategy of creating incentives provides incentives to those that do not have high morale, are
skilled occupationally, and have an education higher than high school because their benefits of
being part of a terrorist group are not as high. These individuals have the ability to get a job and
money outside of the terrorist organization and aren’t in need of the training provided. In
addition, these incentives are targeted towards everyone except the Emir, those in the religious
committee, and those in the military committee because these individuals have a higher level of
commitment to the organization as they are responsible for either the planning and
implementation of attacks or spreading and justifying the ideology. With an understanding that
those with fewer friends in the network will be easier to incentivize, members with fewer friends
will be offered the incentives. This assumption is based on the work of Disley et al (2012) that
explains the role of social ties, both as a pull from the network when social ties are greater to
society and reinforcement to the network when members have more ties within the network. Of
all of those members offered an incentive, only the percentage identified by the user in the
“incentive-potential” slider will be removed from the network. Once members have left the
network due to incentives, all remaining members will evaluate their morale based on the morale
of members they are linked to. As a response to the incentive strategy, local leaders, regional
leaders, central leaders, and members of the logistic committee who have an average or above
average morale will try to make sure the organization feels united so they don’t lose any further
members. They will do this by increasing the level of communication to lower level members.
Again members will reevaluate their morale based on the morale of members they are linked to.
The strategy of undermining terrorist ideology gets implemented by utilizing moderate Muslims
and authoritative religious leaders to undermine terrorist ideology. These individuals each reach
out to ten members of the network who have average or below average morale, are skilled
occupationally, and have an education level higher than high school because their benefits of
being part of a terrorist group are not as high. These individuals have the ability to get a job and
money outside of the terrorist organization and aren’t in need of the training provided. These
individuals implementing will avoid reaching out to the Emir, members of the military

23. 21
committee, or members of the religious committee because these individuals have a higher level
of commitment to the organization as they are responsible for either the planning and
implementation of attacks or spreading and justifying the ideology. Ten network members are
targeted by each of the seven moderate Muslims and authoritative religious leaders in the model
because the goal is to reach all of the 67 network members who have higher potential to be
converted, as assumed by the level of benefit that the network provides them. Additionally,
understanding that those with fewer friends in the network and those who were not previously
apart of a terrorist network will be less influenced by the terrorist ideology, these individuals will
be targeted. Of those members that were contacted by the moderate Muslims and religious
leaders, half of them will be influenced to leave the organization. Members of the network will
evaluate their morale based on the morale of members they are connected to. As a response to
the undermining strategy, members of the religious committee will reach out to local leaders in
order to strengthen the terrorist ideology within the network. Again, members will reevaluate
their morale based on connected members.
The strategy of using deception tactics identifies members with the highest betweenness
centrality that have differences in group alignment, place of birth, and county in which they
joined the organization in hopes of identifying members at potential odds with one another. The
members with the highest betweenness centrality are chosen due to their ability to act as brokers
of information in the network and thus weaken ties as they spread deceptive information.
Differences in group, place of birth, and country joined identifies which members are part of
different affiliates. As Jenkins (2014) points out, infighting is common amongst al-Qaeda,
particularly its different affiliates and identifying these potential quarrels will increase the
success of deception tactics. Once the member is identified, false information will be fed
through a member of lower position connected to the target (this member identified by an
airplane in the model). With an understanding that fed information may not be believable to the
target, the target will only believe the information if they feel that the member feeding the
information is well connected within the network so that the information can be trusted. If the
target believes the message, they will cut links to other members that the message told them not
to trust. If they don’t believe the message nothing will happen. Then, additionally, any member

24. 22
who believes the message will also cut links to those members that the message told them to not
trust. Members will evaluate their morale based on connected members.
6. Network Metrics and Model Findings
In order to generate network metrics from the final network generated by the agent-based
model for each strategy, the RNetLogo package was used to allow an interface to embed the
agent-based modeling platform NetLogo into the R environment. Within the R
environment, the igraph library was used to allow for the calculation of various network
structure properties. The algorithms utilized from igraph for this paper include density,
diameter, degree centrality, betweenness centrality, eigenvector centrality, closeness
centrality, path length, and cluster coefficient. Prior to calculating network metrics,
however, verification of the model was performed. Verification is the process of
determining that the implemented code for the model matches the intended design (North
and Macal, 2007). In addition to walking through the code, verification of the model was
performed by using model outputs and metrics and model visualization and plots to ensure
the model was working as intended. These measures insured that the intentions of the
code matched the resulted actions of the agents and thus, there were no coding errors.
After conducting this verification, there is high confidence that the intentions of the model
are accurately carried out in the design.
To identify the network structure changes after a strategy is implemented, each strategy
was executed ten times in NetLogo for each level of morale and the defaulted values of
recruitment potential (5%) and incentive potential (20%). Each network metric was
calculated for each run of the strategy and the averages were calculated for each specific
network metric. All metrics are compared to the metrics of the original network before any
strategy is implemented.
As terrorist groups seek to balance efficiency and security, there is a tradeoff between
having a centralized network and a decentralized network. Centralization promotes
efficiency, but less centralized networks have the ability to adapt quickly and can be less
vulnerable to the removal of central targets. Bin Laden was successful in adapting the

25. 23
terrorist network into a more decentralized network to promote security as can be seen by
Table 2 the original density metric is 0.0108. In addition, a high cluster coefficient makes
the network more resilient to defection as nodes are more connected to their neighbors
and monitoring is higher. The high eigenvector centrality shows a close proximity to
central actors locally, but the other low centrality scores demonstrate that there isn’t a
close proximity across the network.
6.1 Low Morale Results
Table 2 shows the averaged results for the four disruption strategies when the starting
morale of the network is low, the recruitment potential is 5%, and the incentive potential is
20%. With a low morale across the network, the density remains very similar among all
disruption strategies, but the network becomes even more decentralized and thus harder
to detect when targeting central figures and creating incentives. The clustering coefficient
and closeness centrality also remain similar across strategies, with the exception of the
strategy of undermining terrorist ideology. This strategy increases the closeness centrality
and decreases the clustering coefficient. These metrics indicate a slightly less resilient
network. Overall, the best strategy when morale is low is to take advantage of the low
morale and undermine terrorist ideology. This strategy will make the network slightly less
resilient. Targeting central figures is the worst strategy when morale is low as it increases
the number of members and makes the network more decentralized and thus even harder
to detect. Given that the recruitment potential was set at only 5% when executing this
strategy, higher recruitment potential would only increase the number of members added
to the network when executing the strategy of targeting central figures.

26. 24
Table 2 Network metrics with Low Morale, 5% Recruitment Potential, and 20% Incentive
Potential
6.2 Low-Average and Average Morale Results
Table 3 shows the averaged results for the four disruption strategies when the starting
morale of the network is low-average, the recruitment potential is 5%, and the incentive
potential is 20%. Again the density remains similar among all disruption strategies, but the
network becomes even more decentralized and harder to detect when targeting central
figures. Undermining terrorist ideology proves to be the best strategy in terms of making
the network less resilient as the closeness centrality increases and the clustering coefficient
decreases. Under this environment, creating incentives seems to be more beneficial as the
network maintains the same density, but loses nodes and links. Particularly when the
incentive potential is higher, this strategy could be very effective at decreasing the size of
the network. Overall, the best strategies when morale is low-average is to take advantage
of the lower morale and undermine terrorist ideology and create incentives. Depending on
the incentive potential, reducing the network size may be much more important than
making the network less resilient. Targeting central figures again seems to be
counterproductive as the size of the network increases and the network becomes more
decentralized. With high recruitment potential, this strategy would be more detrimental.
With almost the exact same metrics for average morale as seen in Table 4, the same
conclusions can be made about the most effective disruption strategies.
LOWComparison Links Nodes Density Diameter
Degree
Centrality
Betweenness
Centrality
Eigenvector
Centrality
Path
Length
Cluster
Coefficient
Closeness
Centrality
Original 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018
UseDeceptionTactics 1466 271 0.0109 8.2000 0.0297 0.0065 0.9604 2.7673 0.6078 0.0017
UndermineTerrorist
Ideology 1715 275 0.0114 8.2000 0.0312 0.0066 0.9541 2.8356 0.5229 0.0049
TargetCentral 1516 283 0.0097 8.1000 0.0311 0.0057 0.9621 2.7880 0.5848 0.0017
CreateIncentives 1515 265 0.0098 8.1000 0.0324 0.0058 0.9593 2.7050 0.6069 0.0018

27. 25
Table 3 Network metrics with Low-Average Morale, 5% Recruitment Potential, and 20%
Incentive Potential
Table 4 Network metrics with Average Morale, 5% Recruitment Potential, and 20%
Incentive Potential
6.3 Average-High Morale Results
Table 5 shows the averaged results for the four disruption strategies when the starting
morale of the network is average-high, the recruitment potential is 5%, and the incentive
potential is 20%. With higher morale in the network, all strategies appear to have either a
neutral or negative consequence. The strategy of undermining terrorist ideology again is
successful in making the network slightly less resilient, but the number of members
increases so this benefit is offset. Targeting central figures pushes the network to become
slightly more decentralized and also runs the risk of a higher number of recruits depending
on recruitment potential. Creating incentives is much less effective under this scenario as
it is much harder to turn members when they are happy with their network. For a network
LOW-Average ComparisonLinks Nodes Density Diameter
Degree
Centrality
Btwn
Centrality
Eigen
Centrality
Path
Length
Cluster
Coefficient
Closeness
Centrality
Original 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018
Use Deception Tactics 1446 271 0.0109 8.1000 0.0281 0.0067 0.9612 2.7878 0.6083 0.0018
Undermine Terrorist
Ideology 1713 275 0.0114 8.3000 0.0306 0.0065 0.9558 2.8210 0.5226 0.0055
TargetCentral 1516 283 0.0097 8.3000 0.0304 0.0059 0.9617 2.8140 0.5864 0.0016
Create Incentives 1501 265 0.0108 8.2000 0.0322 0.0059 0.9600 2.6870 0.6050 0.0017
Average Comparison Links Nodes Density Diameter Degree Centrality
Btwn
Centrality
Eigen
Centrality
Path
Length
Cluster
Coefficient
Closeness
Centrality
Original 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018
Use Deception Tactics 1448 271 0.0108 8.1000 0.0280 0.0066 0.9614 2.7625 0.6040 0.0017
Undermine Terrorist
Ideology 1714 275 0.0114 8.2000 0.0312 0.0065 0.9554 2.8240 0.5232 0.0052
Target Central 1516 283 0.0097 8.4000 0.0304 0.0062 0.9605 2.8390 0.5890 0.0016
Create Incentives 1504 265 0.0110 8.2000 0.0318 0.0062 0.9600 2.7550 0.6096 0.0018

28. 26
that is energized and has higher morale, the incentive would have to be very appealing.
Finding key individuals who have a profound effect on undermining terrorist ideology or
offering highly appealing incentives seem to be the only available resources for making any
strategy successful when the morale is average-high.
Table 5 Network metrics with Average-High Morale, 5% Recruitment Potential, and 20%
Incentive Potential
6.4 High Morale Results
Table 6 shows the averaged results for the four disruption strategies when the starting
morale of the network is high, the recruitment potential is 5%, and the incentive potential
is 20%. The strategy of undermining terrorist ideology again is successful in making the
network slightly less resilient, but the number of members increases so this benefit is
offset. Creating incentives again is ineffective as happy, motivated individuals are less
likely to turn for an incentive. Targeting central figures, however, does show some
interesting results that could be beneficial for counterterrorism efforts. Terrorist
members are more confident when they have high morale and are more willing to take on
aggressive behavior. Hibbert (2006, p. 37) states, “If soldiers have high morale and think
they can win, they will fight harder. But if soldiers are tired, hungry, and feel they are
losing the battle, they might refuse to carry on.” This behavior may be self-motivated to
move up the ranks of a successful organization or group-motivated in order to improve the
recognition of the organization. Regardless of the motivating factor, more confident
behavior means less concern for the security of the member or the organization. As seen in
Average-High ComparisonLinks Nodes Density Diameter Degree Centrality
Btwn
Centrality
Eigen
Centrality
Path
Length
Cluster
Coefficient
Closeness
Centrality
Original 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018
Use Deception Tactics 1483 271 0.0108 8.1000 0.0295 0.0063 0.9613 2.7545 0.6022 0.0018
Undermine Terrorist
Ideology 1744 278 0.0113 8.5000 0.0312 0.0066 0.9559 2.8581 0.5253 0.0053
TargetCentral 1516 283 0.0097 8.5000 0.0304 0.0058 0.9611 2.8190 0.5821 0.0017
Create Incentives 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018

29. 27
the results, this means a less resilient network as closeness centrality increases and the
clustering coefficient decreases. In addition, the path length and diameter increase which
means that it is more difficult for members to organize and plan. While the number of
members in the network still increases, the increased betweenness centrality indicates that
information is moving through more people in the network. With a combination of a less
resilient network and more information flowing through the network due to the difficulty
of organizing, authorities could take advantage of this new network structure to more
easily identify plots before they happen and also arrest members who are key to
operations. There is a trade-off executing this strategy in that membership in the network
may increase, but information may be easier to attain about the network. The assessment
must be made by those in authority as to what side is more beneficial and this will partly be
determined by the recruitment potential.
Table 6 Network metrics with High Morale, 5% Recruitment Potential, and 20%
Incentive Potential
6.5 Overall Results
The results indicate that morale of the network plays a fairly important role when deciding
what strategy to implement. Recognizing when morale is lower will provide the best
environment for implementing non-kinetic strategies, particularly undermining terrorist
ideology and creating incentives. These strategies will make the network less resilient and
potentially reduce the size of the network. However, when morale is high, executing a
kinetic approach to disruption may change the network structure in such a way that
High Comparison Links Nodes Density Diameter Degree Centrality
Btwn
Centrality
Eigen
Centrality
Path
Length
Cluster
Coefficient
Closeness
Centrality
Original 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018
Use Deception Tactics 1469 271 0.0108 7.9000 0.0294 0.0063 0.9612 2.7371 0.6009 0.0017
Undermine Terrorist
Ideology 1744 278 0.0113 8.1000 0.0313 0.0067 0.9554 2.8550 0.5246 0.0050
TargetCentral 1626 283 0.0102 8.6000 0.0307 0.0108 0.9613 3.2110 0.5789 0.0024
Create Incentives 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018

30. 28
information gathering for authorities is much easier and thus they are able to better
prevent terrorist attacks. Given the changes in the network that do occur after
implementing a disruption strategy, it is important to note that none of the changes are
dramatic. No strategy changes the network in such a way that the organization will
collapse or that the decentralized network will become centralized. The network is able to
adapt quickly and adjust to strategies being implemented against it. This is the goal of
decentralized networks and as seen by the model and in real life, it is an effective strategy
taken by terrorist organizations to elude detection and collapse.
7. Discussion
The model successfully depicts the trained al-Qaeda network attained from the John Jay &
ARTIS Transnational Terrorism Database (2015) with given attributes and hidden links.
Four disruption strategies identified by Davis and Sisson (2009) from RAND are
successfully implemented in the model and network metrics are calculated. Given the
morale identified for the network, network metrics explain the effects on the network and
the potential success of each disruption strategy.
The objective of the model is to compare the network structure of the original al-Qaeda
network to the structure after each disruption strategy is implemented to determine the
long-term effects of each strategy. Particularly, does the strategy achieve the goal it set out
to accomplish? The results of the model indicate that morale of the network plays a role on
the effectiveness of the strategy. Non-kinetic approaches to disruption are more effective
when morale is lower and a kinetic approach influences structural changes that help
authorities identify useful information when the morale is high. However, none of the
disruption strategies have an effect of drastically changing the network. The al-Qaeda
network is able to adapt quickly to any tactic taken against them in order to remain
resilient and undetectable.
This model is a starting point for understanding network changes as four particular
strategies are implemented on a given network. The limitations of this model are that even
after training the model important nodes, links, or attributes may still be missing, this

31. 29
model only evaluates the effectiveness of strategies on one particular network, a limited
number of strategies are evaluated, and the network isn’t evaluated at different points in
time, but as an aggregate of all nodes and links. In addition, this model only looks at the
implementation of one strategy at a time instead of multiple strategies combined. Despite
these limitations, the model is able to provide results that show the implications of four
popular disruption strategies on the al-Qaeda network. More importantly, it provides a
starting point to build onto the model and evaluate additional terrorist networks. Next
steps to make the model more complete include allowing the disruption strategies to be
executed on varying terrorist networks that have differing network structures and are of
varying age, to allow multiple strategies to be executed at the same time, and to expand the
availability of strategies.
8. Conclusion
Combining applications of SNA and agent-based modeling allows for a model that
incorporates individual terrorist behavior following disruption strategies with network
metrics that identify structural changes. Importing known terrorist networks into an
agent-based model enables testing various disruption strategies under varying levels of
morale. The al-Qaeda network model takes a bottom-up approach to represent structural
changes to the network. The model is based on al-Qaeda network data provided in the John
Jay & ARTIS Transnational Terrorism Database, but it could easily be applied to any other
known networks with the necessary attribute data. Additionally, this model could be
expanded to explore the effects of other disruption strategies or a combination of
strategies.

32. 30
References
Al Hasan, Mohammad, Vineet Chaoji, Saeed Salem, and Mohammed Zaki. "Link Prediction
Using Supervised Learning." : In Proc. of SDM 06 Workshop on Link Analysis,
Counterterrorism and Security (2006).
Ash, Eric. “Terror Targeting: The Morale of the Story.” Aerospace Power Journal. (1999).
<http://www.airpower.maxwell.af.mil/airchronicles/apj/apj99/win99/ash.htm>.
Altman, N.S. “An Introduction to Kernel and Nearest-Neighbor Nonparametric Regression.”
The American Statistician. 46.3. (1992):175-185.
Bekerian, Debra Anne., and A. B Levey. Applied Psychology: Putting Theory Into Practice.
Oxford: Oxford University Press, (2005):144-146.
Black, Ian, and Richard Norton-Taylor. “Al-Qaida faces recruitment crisis, anti-terrorism
experts say.” The Guardian. 10 September. (2009).
Bonabeau, Eric. “Agent-based modeling: Methods and techniques for simulating human
systems.” Proceedings of the National Academy of Sciences of the United States of
America. 99.3. (2002):7280-7287.
Borum, Randy, and Michael Gelles. "Al-Qaeda's Operational Evolution: Behavioral and
Organizational Perspectives." Mental Health Law & Policy Faculty Publications. (2005).
<http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.513.6687&rep=rep1&type=pdf>.
Brafman, Ori., and Rod Beckstrom. The Starfish and the Spider: The Unstoppable Power of
Leaderless Organizations. New York, NY, Penguin Books Ltd. (2006).
Breiman, Leo. “Arcing Classifier.” The Annals of Statistics. 26.3. (1998):801-849.
Breiman, Leo. “Random Forests.” Machine Learning. 45.1. (2001): 5-32.
Brown, Vahid. “Cracks in the Foundation: Leadership Schisms in Al-Qa’ida from 1989-2006.”
Combating Terrorism Center at West Point (2007).
Budur, Emrah, Seungmin Lee, and Vein S. Kong. "Structural Analysis of Criminal Network and
Predicting Hidden Links Using Machine Learning." (2014). 09 Dec. 2014.
Byman, Daniel. “Do Targeted Killings Work?” Foreign Affairs. 85.2. (2006).
Carley, Kathleen M. "Dynamic Network Analysis." Committee on Human Factors, National
Research Council (2003): 133-45.
Cortes, Corinna, and Vladimir Vapnik. “Support-Vector Networks.” Machine Learning. 20.3.
(1995): 273-297.

33. 31
Cox, David R. “The Regression Analysis of Binary Sequences.” J Roy Stat Soc B 20:215-242.
(1958).
Davis, Lynn E., and Melanie Sisson. A Strategic Planning Approach: Defining Alternative
Counterterrorism Strategies as an Illustration. Santa Monica, CA: RAND, (2009).
Disley, Emma, Kristin Weed, Anais Reding, Lindsay Clutterbuck, and Richard Warnes.
Individual disengagement from Al Qa’ida-influenced terrorist groups: A Rapid Evidence
Assessment to inform policy and practice in preventing terrorism. Santa Monica, CA:
RAND, (2012).
Everton, Sean F., and Dan Cunningham. “Dark Network Resilience in a Hostile Environment:
Optimizing Centralization and Density.” Criminology, Criminal Justice Law, & Society.
16.1 (2015): 1-20.
Everton, Sean F., and Dan Cunningham. “Terrorist Network Adaptation to a Changing
Environment.” Crime and Networks, edited by Carlo Morselli. 287-308. New York:
Routledge. (2011).
Forman, George. “An Extensive Empirical Study of Feature Selection Metrics for Text
Classification.” Journal of Machine Learning Research. 3:1289-1305. (2003).
Gates, John M. The U.S. Army and Irregular Warfare. Electronic edition (2002).
Available at http://www.wooster.edu/history/jgaates/book-contents.html.
Global Terrorism Database. University of Maryland, 03 July 2015.
<http://www.start.umd.edu/gtd/about/>.
Hibbert, Adam. In the Trenches in World War I (On the Front Line). Raintree. (2006).
Jannach, Dietmar, Jill Freyne, Werner Geyer, Ido Guy, Andreas Hotho, and Bamshad Mobasher.
“The Sixth ACM RecSys Workshop on Recommender Systems and the Social Web.” 8th
ACM Conference on Recommender Systems. New York, NY, USA. (2014).
Jenkins, Brian Michael. Brothers Killings Brothers: The Current Infighting Will Test al Qaeda’s
Brand. Santa Monica, CA: RAND, (2014).
John Jay & ARTIS Transnational Terrorism Database. 03 July 2015.
<http://doitapps.jjay.cuny.edu/jjatt/index.php>.
Knoke, David. “Emerging Trends in Social Network Analysis of Terrorism and
Counterterrorism.” Emerging Trends in the Social and Behavior Sciences. Online
(2015). <http://onlinelibrary.wiley.com/doi/10.1002/9781118900772.etrds0106/full>.
Ko, Teresa H., and Nina M. Berry. "Agent-Based Modeling with Social Networks for Terrorist
Recruitment." The Association for the Advancement of Artificial Intelligence. (2002).

34. 32
Koschade, Stuart. "A Social Network Analysis of Jemaah Islamiyah: The Applications to
Counterterrorism and Intelligence." Studies in Conflict & Terrorism 29.6 (2006): 559-75.
Krawchuk, Fred T. "Combating Terrorism: A Joint Interagency Approach." Landpower Essay
05.1 (2005).
Krebs, Valdis E. "Uncloaking Terrorist Networks." First Monday 7.4 (2002).
<http://pear.accc.uic.edu/ojs/index.php/fm/article/view/941/863>.
Lichtenwalter, Ryan N., Jake T. Lussier, and Nitesh V. Chawla. “New Perspectives and
Methods in Link Prediction.” 16th ACM SIGKDD International Conference. Washington,
DC, USA. July 25-28. (2010).
MacKerrow, Edward P. "Understanding Why: Dissecting Radical Islamist Terrorism with
Agent-Based Simulation." Los Alamos Science 28 (2003): 184-91.
Magouirk, Justin, Scott Atran, and Marc Sageman. “Connecting Terrorist Networks.” Studies in
Conflict & Terrorism 31: 1-16. (2008).
Medina, Richard M. "Social Network Analysis: A Case Study of the Islamist Terrorist Network."
Security Journal 27.1 (2012): 97-121.
Metzger, Tobias. “Social Movement Theory and Terrorism: Explaining the Development of Al-
Qaeda.” Student Pulse 6.09 (2014). < http://www.studentpulse.com/articles/916/social-
movement-theory-and-terrorism-explaining-the-development-of-al-qaeda>.
National Strategy for Combating Terrorism. Washington, D.C.: Executive Office of the
President, (2011).
<https://www.whitehouse.gov/sites/default/files/counterterrorism_strategy.pdf>.
North, Michael J., and Charles M. Macal. Managing Business Complexity: Discovering
Strategic Solutions with Agent-based Modelling and Simulation. Oxford University Press,
New York, NY. (2007).
Perliger, Arie. “Terrorist Networks’ Productivity and Durability: A Comparative Multi-level
Analysis.” Perspectives on Terrorism 8.4 (2014).
Quinlan, J.R. “Induction of Decision Trees.” Machine Learning. 1.1. (1986):81-106.
Ressler, Steve. "Social Network Analysis as an Approach to Combat Terrorism: Past, Present,
and Future Research." Homeland Security Affairs 2 (2006).
<https://www.hsaj.org/articles/171>.
Roberts, Nancy, and Sean F. Everton. "Strategies for Combating Dark Networks." Journal of
Social Structure 12.2 (2011).
<https://www.cmu.edu/joss/content/articles/volume12/RobertsEverton.pdf>.

35. 33
Sageman, Marc. Understanding Terror Networks. Philadelphia: U of Pennsylvania, (2004).
Tsvetovat, Maksim, and Kathleen Carley. "Knowing the Enemy: A Simulation of Terrorist
Organizations and Counter-Terrorism Strategies." Carnegie Mellon University. (2002).
<http://www.casos.cs.cmu.edu/publications/papers/tsvetovat_2002_knowingenemy.pdf>.
Xu, Jie, Daning Hu, and Hsinchun Chen. "The Dynamics of Terrorist Networks: Understanding
the Survival Mechanisms of Global Salafi Jihad." Journal of Homeland Security and
Emergency Management 6.1 (2009):1-33.