This document discusses using social network analysis to study terrorism. It outlines a process for retrieving evidence of terrorism from online social networks, including acquiring evidence, examining digital evidence, and reconstructing data. The document also examines quantitative assessment of the 2008 Mumbai attack and the structure of terrorist organizations like Jemaah Islamiyah. It describes measures to analyze individual centrality, network centrality, and uses the 9/11 hijacking network as an example, identifying key individuals and analyzing network properties.

1. Social Networking Analysis
A STUDY OF TERRORISM
Maria Margarida da Silva Faisco, student l45541Gestão de Dados, Lisboa 2018

2. Introduction
• England in 2017
• Switzerland in 2017
• Paris in 2017
Gestão de Dados, Lisboa 2018
Social Networking Analyses

3. Using Online Social Netwoking Sites for Forensic Evidence
Gestão de Dados, Lisboa 2018
Evaluation and
Assessment
Acquisition of
Evidence
Survey of Digital
Scene
Examination of
Digital Evidence
Data
Reconstruction
Conclusion
Figure 1. Process to retrieve evidence of
terrorism from OSNSs. Source: Created by the
author (2018)
• Belkasoft Evidence Center
• Internet Examiner Toolkit
• Internet Evidence Finder
"The selected digital forensic tools were not able to recover
all the data posted on OSNSs. Nevertheless, sufficient
evidence can still be gathered in order to confirm the
likelihood of criminal activities, as each tool was able to
recover a large portion of the evidence posted on OSNSs. "
(Saud Abdulaziz Alshaifi, in 2016, page 119).

4. A Quantitative Assessment on 26/11 Mumbai Attack
Gestão de Dados, Lisboa 2018
Assessment of
Data Available
Creation of the
Adjacency
Matrix
Drawing a
Graph of all
Conections
Evaluation of
Groups and
Connections
Degree,
Closeness,
Betweenness
and
Eigenvector
Conclusion
Figure 2. Process to understand the nature of terrorist organizations. Source: Created by the author (2018)
Dr Sarita Azad and Dr. Arvind Gupta

5. Jemaah Islamiyah
Gestão de Dados, Lisboa 2018
Size Number of nodes within a network or data set.
Density
The extent to which links that could possibly exist among persons do in fact exist.
Degree of
Connection
Average number of relations each member has with other members of the
network.
Centrality
Level at which a node is accessible to the persons in the network.
Closeness How close an actor is to others in the network.
Betweenness
Individual’s activity/ability within a network, measuring the ability to control the
flow of information within a network.
Clusters
Areas of a network with a higher density in relation to other areas or cliques
within the network.
Table 1. Network Centrality Measures. Source: Created by the author (2018) but based on the work of Stuart Koschade
Stuart Koschade

6. Using Social Networking Analyses to Prevent Terrorism
• Collection of Data
• Adjacency Matrix
• Forensic Evidence
• UCINET
• Type of Graph Figure 3. Types of Networks. Source: Journal of Terrorism Research (2011)
Gestão de Dados, Lisboa 2018

7. Individual Centrality Measures
Degree Centrality Number of connections a node (individual) has in the network
Betweenness
Centrality
Location of each person in
the network 𝑔 𝑥 =
𝑠≠𝑣≠𝑡
𝜎𝑠𝑡 𝑣
𝜎𝑠𝑡
Closeness Centrality
Measures the mean distance
from a node to other node
𝐶 𝑥 =
1
𝑦 𝑑(𝑦, 𝑥)
Eigenvector Centrality
Measures the influence of a
node in the network
Table 2. Individual Centrality Measures. Source: Created by the author (2018)
Gestão de Dados, Lisboa 2018

8. Network Centrality Measures
Network Centralization
Network Reach
Network Integration
Boundary Spanners
Peripheral Players
Table 3. Network Centrality Measures. Source: Created by the author (2018)
• Who is the central node in the network?
• What sub-groups exist in the network?
• What are the patterns of interaction
between sub-groups?
• What is the overall structure of the network?
• How does information flow in the network?
Gestão de Dados, Lisboa 2018

9. The 9-11 Example
Figure 4. Matrix with hijackers and their connections. Source: Mapping Networks of Terrorists Cells/ Krebs (2002)
Gestão de Dados, Lisboa 2018

10. The 9-11 Example
Figure 5. Network extrapolated from UCINET or similar software. Source:
Mapping Networks of Terrorists Cells/ Krebs (2002)
Looking at the graph it was possible to see that
it was a sparse network (network
centralization), that there were many on the
same flight that were more than two steps
away from each other (network reach), and
that the members were far from each other
and from other groups (network integration).
In this network Mr. Valdis E. Krebs got to the
conclusion that they " trade efficiency for
secrecy." (Valdis E. Krebs, in 2002, page 46).
Gestão de Dados, Lisboa 2018

11. The 9-11 Example
Figure 6. Individual centrality measures regarding the hijackers from 9/11 and their direct contacts.
Source: Mapping Networks of Terrorists Cells/ Krebs (2002)
Mohamed Atta
Gestão de Dados, Lisboa 2018

12. The End
Gestão de Dados, Lisboa 2018