A Bayesian Model for Determining Crew Affiliation with Terrorist Organizations

brewerobstructionΤεχνίτη Νοημοσύνη και Ρομποτική

7 Νοε 2013 (πριν από 3 χρόνια και 11 μήνες)

72 εμφανίσεις

A Bayesian

Model

for

Determining Crew Affiliation with Terrorist Organizations


Richard J. Haberlin Jr.

EMSolutions Inc.

1421 Jefferson
Davis Hwy, Suite 200

Arlington, VA 22202

richard.haberlin@emsolve.com


Dr. Paulo C
esar
G. da Costa

Center of Excellence for C4I

George Mason University

4400 University Dr.

Fairfax, VA 220
30
Abstract

Merchant vessels are frequently manned with multinational crews having limited
recorded background history. Whether by the natural inadequate technology associated
with their typical upbringing or by design, the persona of a merchant sailor is often
shrou
ded in mystery. For this reason, the merchant marine community is one possible
avenue that terrorist organizations may use to gain entry into target countries for men and
material. Without comment on the ethical dilemma that some identify with the practi
ce,
creating a profile of a terrorist from the available merchant population serves as a starting
point to reduce the volume of individuals requiring further investigation by limited
analytic resources.
This paper introduces a model to suggest an individu
al
crewmember’s terrorist affiliation given his close relations, group associations,
communications, and background influences
.

Intelligence analysts and merchant
companies may
employ

it

to identify those crew members that bear further scrutiny and
pose a risk to target countries or ocean
-
going vessels.


1.0 Introduction

Crewmembers of merchant vessels are regularly multinational and transient. This is one
possible way that terrorists
or terror organizations can smuggle personnel or material into
target countries. However, using information about an individual crewmember’s
relations,
group
associations, communications, and background
influences
may provide
insight into the likelihood o
f that
sailor

being involved in terrorism. This determination
provides valuable input into inferential reasoning systems such as the Office of Naval
Research PROGNOS project.

This paper introduces a model to suggest an individual
crewmember’s terrorist a
ffiliation given his close relations, group
associations
,
communications, and background

influences

(
Figure
1
).



Figure
1

-

Terrorist Affiliation


Terrorist organizations are persistently looking for new ways to deliver personnel and
material into target countries to adva
nce their agendas. Profiling personnel with
opportunity to arrive in western ports under legitimate pretences presents prospects to
identify these individuals prior to their arrival.

Background

Communications

Associations

Relationships

Crewmember

2



While some affiliations may increase the likelihood that an individual
may join a terrorist
group and attempt access to a target country via merchant ship, there is always the
uncertainty that comes from the human condition. This uncertainty associated with the
multitude of factors affecting the character’s context must be c
aptured conditionally.
However, no model can guarantee a prediction of the human psyche.
Similarly,
affiliations with diverse civilian and governmental organizations, economic standing, or
political and/or ethno
-
religious environments may drive an
individual in one direction or
the other. The difficulties lie in modeling these various interrelationships accurately and
capturing the conditional associations from available statistical data.

This model

captures

some of these associations, but additio
nal research is required to fully map the interaction
between an individual and those with whom he interacts.


The
Office of Naval Research (ONR)
PROGNOS project uses information about
crewmember terrorism affiliation in its hypothesis management and in
ferential reasoning
processes. However, at this point in development it has not been determined how that
information is obtained. Th
is

model is one tool which may help intelligence analysts
determine the likelihood that a particular crewmemb
er is associa
ted with terrorism

based
on his relationships, organizations, and environment, both geopolitical and economic.

2.0 Background

Since the terrorist attacks of September 11, 2001, there has been a great deal of interest in
expeditious determination of the com
position, operations and resourcing of terrorist
networks. In the information technology domain, much of the focus has been on mining
open
-
source material such as email, weblogs, and news articles to build a representation
of terrorist social, resource, a
nd operational networks.



In the initial review of the literature, several models were revealed that sought to map the
terrorist social network using social network analysis and some method of probabilistic
inference. In each of these cases, the authors

sought to identify interconnections between
terrorists through automation to minimize operator workload. Yang and Ng constructed a
social network from weblog data gathered through topic
-
specific exploration

[2
6
]
.
Similarly, Coffman and Marcus performed
social network analysis through pattern
analysis to classify the roles of actors within a network using communication data

[
4
]
.
And
Dombroski and Carley

propose a hierarchical Bayesian inference model to produce a
representation of a network’s structure and the accuracy of informants

[
5
]
.

A large
amount of unclassified data about terrorist networks

and their communications
has been
compiled by the Univer
sity of Arizona’s Dark Web project through which

information is
mined from open
-
sources using web spiders and crawlers. Krebs has mapped a terrorist
netwo
rk topology from open
-
sources following the September 11, 2001 attacks and
introduced a model represe
nting the degrees of separation involved in Al Quaida
leadership

[
10
]
.




In a few cases, these network analyses were taken a step further and used to evaluate
effects of friendly force courses of action, effects of removing particular individuals, and
p
redicting attacks based on patterns of activity. Wagenhals and Levis used a timed
influence net to add a temporal component to a model with terrorists embedded in a
society that is supporting them to describe desired and undesired effects to both the
adve
rsary and local population caused by friendly forces

[
23
]
. Moon and Carley linked
social and spatial relations to predict the evolution of a terrorist network over time, and
posit the effect of “isolating” particular individuals within the network

[
12
]
.




3


These models all perform at a high level of analysis, uncovering groups, their members,
and linkages. What is needed is a tool that combines information about relations, group
affiliations, communications, and ethno
-
religious or political background int
o a model
describing the likelihood that a particular individual becomes a terrorist. The model
introduced in this paper
provide
s

a means for intelligence information gathered about
merchant vessel crew members to be used as input t
o inferential reasoning

systems.

3.0 Description

Creating a model that performed analysis on an individual crew member’s terrorist
inclination
proved

challenging. While the logic behind
individual
relationships seems
intuitive, elicitation of data on the social characteristics of terrorism is difficult as most
studies have not been performed with this in mind. Instead,
this

model performs logically

using data available from open
-
sources of informat
ion. Further research and classified
data collection would improve the quality of the likelihoods produced.


The first iteration of the model focused on probabilities that the crewmember is a terrorist

given some attribute
; for

example, P(Terrorist|
Commun
icates

w/Terrorists). Eliciting
these probabilities proved unrealistic during the course of this project, as each one of
these conditional probabilities would require a psychoanalytic study of terrorist
individuals with this end probability in mind.
Inst
ead, using the body of existing work
profiling terrorists and their organizations, the second iteration of the model represented
what a crewmember’s background and affiliations
should

be given that he is a terrorist;
e.g. P(LowerClass|Terrorist).
Still, t
he conditional probability tables and
interrelationships proved daunting and unsupported by current research. In it
s final form,
the model
is partitioned into four groups representing the domains of background
influences, communications, relationships, an
d group affiliations.

Leveraging studies
into the
composition of terrorist organizations fighting the “far war” against foreign
powers
, especially the work of Marc Sageman

[
1
8
],
the final model captures
a
background profile of terrorist attributes. Focusing on
Southeastern Asia,
Middle East
,
and
North
African countries that frequently supply crew members to merchant vessels

as
well as terrorists to the global jihad
, a possible population
emerged
that mig
ht have
motive and
opportunities to smuggle elicit

material into a
w
estern country.


The
overriding goal of the program is for an intelligence

professional, or merchant ship
company,
to

use the
attributes

specified in the

nodes of the model

to determine if a
crewmember

or recruit

is likely

to be

involved in terrorism. Of course, there is the
possibility that an innocent person may have
coincidentally positively identified with
many of the
flagged attributes and the possibility that a guilty

party will appear innocent
,
either by accident or design
. Th
ese prospects are
further investigated in case studies

II
and III introduced

below.


The model is
introduced

in
Figure

2

using Netica
. The nod
e of interest
,
Crewmember is a
Terrorist,

is located in the center of the diagram and represents the probability

that an
individual crew
member, whose attributes are deli
neated in the surrounding nodes, is
involved in terrorist activities. By answering as many of the specific

question


nodes as
possible for the individual, the analyst may determine a clearer picture of the background
of the individual and his tendenc
y to
ward elicit activities
.

All individuals observed in the
model are assumed male, and the sample population is adjusted accordingly. With very
few exceptions, the merchant marine industry is an all male industry and a female would
draw undue attention by her presence alone. It is

unlikely that a terrorist attempting to
smuggle goods or herself into the country would choose an activity that would draw such
obvious attention.

4




Figure
2

-

The
Crewmember
Model

3.1 Dependence

and Independence Assumpti
ons

Some appropriate assumptions were necessary to accommodate available data without
compromising the utility of the model.
First,
a terrorist will communicate with

other

terrorists

in some form with certainty, but
there is variability in which
c
ommunication
path will be used
.

There is also the possibility that an individual will communicate with
terrorists inadvertently.
Next, t
here is a
one
-
tenth of one percent (
0.001
)

chance that any
random person in the ta
rget demographic is a terrorist. Th
is assumption is used to model
the coincidental interaction between
a

crewmember and someone who may happen to be
a terrorist

without his knowledge
. Third,
because the target area is the Middle East,
North
Africa and Southeast Asia, the
groups for the ass
ociation partition are based on
cluster
organizations introduced by Sageman [
18
].

The rest of the attributes
within this
partition
are compiled given the individual’s participation in one of those groups.
Additionally, there is
a
chance that a
crewmember

could be involved in a terrorist
organization
other than the
four

identified
, and that would negatively affect the outcome
result as he would be grouped with non
-
terrorists.
However, i
t is likely that
smaller

groups are splinters from one of these major
clusters and could therefore be included in
the analysis under their super
-
group.

Finally, in its current form,
the model

only

captures

the

influence of OEF/OIF and marital status

in the crewmember’s background
.
Place of
worship, military/police

background, and government are all areas of future research.

The following section details each of the nodes and the source of the data. A complete
set of probability distributions

for the baseline model

is available in

the
Appendix
.

3.1.1 Probability

A
ssessments

While
analysts

are constantly on the lookout for clues to terrorist affiliations, there is
always the chance that interaction with a terrorist group occurs coincidentally by an
innocent individual. To represent this,
the model

assigns

a likelihood of one
-
tenth of one
percent to the general
potential crewmember
population that may be involved in terrorist
activities.

While this figure may be sufficient for the particular demographic
studied
for
the crewmember scenario, further research
is needed to accurately reflect this likelihood
Government
GovtInfluence
NoGovtInfluence
50.0
50.0
Military/Police
FormerMilitaryPolice
NotFormerMilitaryPolice
50.0
50.0
Influence Partition
Yes
No
20.1
79.9
Crewmember is a Terrorist
True
False
0.10
99.9
Place of Worship
True
False
50.0
50.0
FamilyStatus
Married
Single
56.2
43.8
Occupation
Professional
SemiSkilled
UnSkilled
5.03
30.0
65.0
Economic Standing
UpperClass
MiddleClass
LowerClass
20.0
30.0
50.0
Education Level
MiddleSchool
HighSchool
College
BA BS
MA MS
PhD
44.0
20.0
15.0
10.0
8.00
3.00
Nationality
Egypt
SaudiArabia
Kuwait
Jordan
Iraq
Sudan
Libya
Lebannon
Indonesia
Malaysia
Singapore
Pakistan
Philippines
France
Algeria
Morocco
Syria
Tunisia
UAE
Yemen
CANUKUS
9.01
3.02
.004
1.00
3.00
5.00
1.0
0 +
28.0
3.00
1.00
20.0
11.0
.010
4.00
4.00
3.00
1.00
1.00
2.00
.003
Knows Imprisoned in OIF/OEF
True
False
0.42
99.6
Knows Killed in OIF/OEF
True
False
0.42
99.6
Communicates with Terrorist
Yes
No
0.20
99.8
Chatroom Comms
True
False
28.9
71.1
Weblog Comms
True
False
28.9
71.1
Email Comms
True
False
28.9
71.1
Cellular Comms
True
False
31.7
68.3
Relationship Partition
RelatedtoTerrorist
NotRelatedtoTerrorist
0.17
99.8
Friendship with Terrorist
Yes
No
0.22
99.8
Kinship to Terrorist
Yes
No
0.12
99.9
Social Network
Affected
NotAffected
50.0
50.0
Cluster Partition
CentralStaff
SoutheastAsia
MaghrebArab
CoreArab
Other
.018
.012
.030
.032
99.9
OIF/OEF Influence
True
False
16.7
83.3
5


for each context for which the model is applied.

For the remainder of this section
interesting tables
are embedded
into the text;
the complete set of conditional probability
tables and distributions are give
n in
the
Appendix.

3.1.2 Crewmember

is a Terrorist

For a given set of life influences and personal relationships, what is the likelihood that a
particular merchant vessel crewmember is involved in terrorism?

The penultimate
question answered by the model
is whether or not a particular individual is likely to be
involved in terroris
t activities

given a set of known attributes about his background
.
Ethical dilemmas aside, this calculated probability may serve as a starting point for the
application of further resources for background investigation. Posed with the problem of
not being able to afford to fully investigate everyone,
the model
aids in

prioritization of
those who bear further scrutiny.

Recall from
S
ection
3.1 that 0.001 percent of the target
demographic is involved in terrorism.
This assumption is that of the author and based on
the notion that one terrorist in every 1,000 potential c
rew members is reasonable.
Specific terrorist proportions from countries of interest were not available in open
-
source
material.

3.1.3 Influence

Partition

The first of the four major partitions is the
Influence Partition
shown in

the upper left
quadrant of
Figure
2
.
This node summarizes the likelihood of terrorism involvement due
to the crewmember’s
life influences including marital status a
nd the possibility he has
witnessed personal tragedy associated with operations Enduring Freedom and Iraqi
Freedom. These influence factors capture the background common to those involved in
terrorism without the specificity of a particular clique.


The u
nderlying assumption behind this partition is that an individual who chooses to
become involved in terrorism
has been

negatively
influenced in some way

by his
personal history

as shown in
Table
1
.

It can be read as P(Negatively influenced by
history given he is a terrorist).
For a terrorist crewmember it is assumed with certainty
that his history

affects his decision to become involved. For non
-
terrorists from the
demographic of interest, 20% likelihood is assigned to past history affecting this decision.
In the geographic region of interest, OEF/OIF
has

been ongoing for nearly a decade, and
comm
unity

plays a large part in life. More specific probabilities are an area of future
research.



Table
1

-

Influence Partition

Crewmember

Yes

No

True

1

0
.
0

False

.20

.8


In its current state,
the model

elicit
s
two of the possible

factors influencing
crewmembers. Three others are discussed below
;
their probabilities are left for future
research.

O
E
F/O
IF

Influence

Operations Enduring Freedom and Iraqi Freedom have been ongoing throughout

North

Africa, the Middle East and Southeast Asia for nearly a decade. Beyond direct combat
operations there have been campaigns by both sides that have directly affected local
populations. T
he
OEF/OIF Influence

node introduces the possibility that an individu
al is
negatively affected by having direct knowledge of someone either detained or killed by
6


coalition forces during the conflict. Somewhat unrealistically, all blame in this node is
directed at the coalition.
For example
, a car bomb detonated by terrori
sts to kill coalition
forces that kills civilians is not modeled

as detrimental to the terrorist
group.

Table
2

depicts the effect of OEF/OIF
i
nfluen
ce.


Table
2

-

OEF/OIF Influence

Influence Partition

TRUE

FALSE

Yes

.
75

.
25

No

.0
2

.
98


A
“yes” response to the
OEF/OIF
Influence P
artition

represents the percentage of
terrorists that
were influenced by their
background

and OEF/OIF in particular by
know
ing

someone who was killed or detained as a result of coalition operations. The
underlying assumption here is that the event
directly

affected them and led them toward
terrorism. The
“no” response

to
the
OEF/OIF
I
nfluenc
e
P
artition

represents the
estimated two percent of people in the geographic area who have witnessed one of these
events

as discussed below
. Overall, t
his partition summarizes the effects of coalition
operations on local populations and the likelihood tha
t is leads a crewmember to
involvement in terrorism.

Knows Killed in O
E
F/O
I
F

Operations Iraqi Freedom and Enduring Freedom have been controversial in some parts
of the world. Knowing someone killed as a result of these operations could affect the
likelihood of becoming involved in terrorism.

In the geographic area of interest, an
estimated 2% of the population knows someone who was killed as a result of OEF/OIF
[
11
].

In the case of non
-
influence, there is still a 0.001% chance that the crewmember

knows someone coincidentally who happens to be affiliated with terrorism.
A more
accurate estimate for this assumption was not available in open
-
source documentation.

Knows Detained in O
E
F/O
I
F

The search for international terrorists has been global in sc
ope and resulted in thousands
being detained for questioning or imprisonment. During the course of
Operations
Enduring Freedom

and
Iraqi

Freedom
c
oalition forces have captured civilians as well as
combatants
for the purpose of intelligence gathering and o
ffensive operations.
Knowing
someone captured as a result of these operations could affect the likelihood of becoming
involved in terrorism.

In the geographic area of interest, approximately 2% of the
population knows someone detained as a result of coal
ition operations [
11
].

There is also
a 0.001% chance that the interaction was unintentional.

Family Status

Family status is an indicator of the individual’s state of marriage. Contrary to common
perception, terrorists are predominantly married in keeping

with the teachings of the
Quran

[
18
]
. Those who are
not

may be too young to afford the dowry normally required
to
acquire

a bride.
Table
3

summarize
s the marital status of a crewmember

given his
background influence.



7


Table
3

-

Family Status

Influence

Married

Single

Yes

0.73

0.27

No

0.52

0.48


Th
e
Family Status

node captures the probability that an individual is married
given that
he is involved in terrorism

[18]
.

Marital status varies by country, but is often affected by
age and social status. Lower status means less likely to be married at early age because
cannot afford a dowry.

The probabilities associated with not being influenced by
terrorism are based on Egyptian marriage statistics

for a similar age demographic

[
15
].

Place of Worship

Some religious institutions are recognized for affiliation with radical preaching and
terro
rist recruitment. Given some level of
negative influence in a crewmember’s
background,
what is the likelihood that
his chosen religious institution is one of those
identified as radical? Put another way, what percentage of terrorists attend a radical
rel
igious organization?
While this would be a valuable addition to the profile, open
-
source information regarding this node

was not available
. I
t is
therefore depicted
with a
dashed

line

for influence
.
It is an area of future research.

Military/Police

A cr
ewmember’s former military or police affiliation may affect
his

involvement in
terrorism and also the possibility that he knows someone killed or detained as a result of
O
E
F/O
I
F. It
seems intuitive

that

military and police service has an inverse relationship
with propensity for terrorism.
This is another possible area of future research.

The
Military/Police

node is depicted with dashed lines connecting to the
I
nfluence
P
artition

and to the
Knows Killed

and
Knows Detained in

OEF/OIF

node
s
.

Government

Because this model is focused on the global jihad against what Sageman calls the “far
enemy,
” it

does

not include government influence

[18]
. However, if dissatisfaction with
his

own government were to be included, this node would also affect the
Influence
Partition
.

Crewmember

angst could manifest itself from individuals living under a
repressive government who see terrorism as a means to escape their socio
-
ethnic caste.

This n
ode is
depict
ed
as
dashed in
Figure
2

to represent the possibility of inclusion in a
future model and area of future research.

3.1.4 Communicates

with Terrorists

Th
e
Communicates with Terrorists

node summarizes different communications media
that a crewmember may use given some likelihood of being involved in, or affiliated
with, terrorism. It is also possible that a crewmember
may

communicate with a terrorist
witho
ut being involved in terrorism due to non
-
terrorist affiliations or other relationships
that have

some normal expectation of interaction. This partition infers some level of
suspicion associated with modes of communication frequently used by terrorists du
e to
their security and obscurity [
25
].


The
C
ommunication
P
artition is comprised of
the
five nodes

shown in

the upper right
quadrant of
Figure
2
.
The underlying assumption of the partition is that terrorists will
communicate with certainty as shown in
Table
4
.

Coincidental interaction by any of the
8


communication paths is left to one tenth percent (0.001) figure associated with terrorism
in the general demographic population

as discussed above
.



Table
4

-

Communicates with Terrorists

Crewmember

Yes

No

True

1

0

False

0.0
01

0.9
99


Not all modes of communication are equally likely

for either terrorist or non
-
terrorists
,
and the relative ranking of communication paths between terrorists is
assumed

to be
shown in
Figure
3

[
25]:



Figure
3

-

Communication Hierarchy


For each of the
internet
communications paths there is also the

background usage

rate of
28.8
% in

the Middle East

[
28
]
. Because the data is not broken down for the three internet
transmission paths, this probability was applied equally to chat room, email, and weblog
methods of communication
. A distribution tables f
or each is included in
the
Appendix.

Similarly, cellular telephone usage

among the general population

is assumed to be 31.6
%

based on Egyptian subscriber rates

[
29
].

C
ellular Communications

Given that a crewmember is communicating with terrorists, innocently or otherwise, what
is the likelihood
he

does so
using cellular communications? Statistics on exact usage
rates for terrorist communications are understandably difficult to elicit using o
pen
-
source
information. Given the availability of cellular technology and subscribing to the
prioritization shown in
Figure
3
, a probability of
90
% is assigned to terrorists
communicating using cellular telephones.

Chat Room

Communications

Given that a crewmember is communicating with terrorists, innocently or otherwise, what
is the likelihood
he

does so using
chat room

communications?
The transient nature and
unfettered availability of chat room communications makes it appealing to individ
uals
who desire to remain nameless. A probability of
85
% is assigned to terrorists
communicating through chat rooms.

Email Communications

Given that a crewmember is communicating with terrorists, innocently or otherwise, what
is the likelihood
he

does so
using email communications?
Email is the least desirable
form of communication because it requires some form of subscriber account. Even in the
event that fictitious information is used in creating such an account, an auditable trail
may lead
determined
forces
to the originator. Still, it is a versatile means of
communication and is assigned a probability of
65
% for terrorists.

Email

Weblog

Chat Room

Cellular

9


Weblog Communications

Given that a crewmember is communicating with terrorists, innocently or otherwise, what
is the likelihood
he

does so using weblog communications?

The anonymity associated
with weblog

interaction is very appealing to terrorists. This path is similar to chat room
communications, but is less transient in content and can reach more subscribers
simultaneously. F
or these reasons, a probability of
80
% is assigned to weblog
communications.

3.1.5 Relationship

Partition

Some

of the greatest effects on terrorist recruits
are

their relationships with those that are
close in their lives
, shown in the lower right quadrant of
Figure
2
.
The opinions, b
eliefs
,
and actions

of these core people play a large part in recruiting the next generation of
fanat
ics.

Interestingly enough, the data indicate that friendship has a greater effect than
kinship on
enrollment
.
This node
directly affects the likelihood that a crewmember is
involved in terrorism and
summarizes the likelihood of terrorist involvement due
to
involvement of close relations

in the form of friends and family
.

Social networks also
play a key role in “cheerleading” potential recruits, but
s
eparat
ing

social networking
participants from friends and family

proved untenable

as they clearly overlap.

The effect
of social networking is an area of future research.


The
R
elationship
P
artition

(
Table
5
) summarizes the effect of friends and family on
potential terrorist recruits [
18
].
The greater effect of friends

may be caused by the close
relationships established by co
-
habitators or members of organizations.


Table
5

-

Relationship Partition

Crewmember


Related

Not Relate
d

True

0.75

0.25

False

0.001

0.999


There is no open
-
source data on nuclear family vs. extended family

realtionships
, but it
seems intuitive that a close family member would have an effect resembling a friend.
This is an area of future research.

Distribution tables for
Friendship with Terrorist

and
Kinship to Terrorist

are given in
the
Appendix.

Friendship with Terrorist

From the general population there exists some proportion of individuals who is involved
in terrorism.
Research shows that
if
a
crewmember has a relationship with terrorists,
there is a 68% chance that he has a friend who is a terrorist.
While the great
preponderance of people across the world
is

not,
the model

assigns
a general figure

of
0.1%

that an individual chosen at random is involved in terrorism.

Kinship to
Terrorist

As is the case in the
Friendship with Terrorist
node, there is always the possibility that a
coincidental relationship brings an innocent individual into contact with a ter
rorist.

Given that a crewmember has a relationship with terrorists, there is a 14% chance that he
is related to a terrorist.

The model

assign
s

equal likelihood to randomly chosen family or
friends being involved in terrorism.

10


Social Network

Social netw
orks offer the opportunity for those who may be seeking affiliation with a
terrorist group to begin participation and

provide an introduction mechanism. This
would
be a valuable addition to the
relationship partition
,
but
available data does not support
separat
ing

those who are connected solely through social networks from friends and
family who also participate in social networks. This node is
therefore depicted with a
dashed line, and
should be
an area of future research.

3.1.6 Cluster

Partition

Th
e
Cluster Partition

node

in the lower left quadrant of
Figure
2

summarizes

the
likelihood of
being associated with any of the four primary terrorist cliques
introduced by
Sageman who are
operating in
the Middle East, North Africa

and
S
outheastern Asia
given that an individual is involved in terrorism

[
18
]
. The profile of each of these cliques
is distinct, having evolved from differing backgrounds and geopolit
ical events. The
concentration here is on terrorists who are fighting a global war on enemies of Islam, as
opposed to regional terrorists who are dissatisfied with their own governments.


For this model, it is assumed that all
active
terrorists fall into
one of these cliques or their
subsidiaries.
The assigned probabilities are based on statistics gathered on
172

terrorists
studied since 2001 [
18
].
Those individuals who are outside this construct, or are not
involved in terrorist activities are represent
ed by the “Other” category and evaluated as
non
-
terrorist as shown in
Table
6
.


Table
6



Cluster Partition

Crewmember

Central Staff

Southeast Asia

Maghreb Arab

Core Arab

Other

True

0.18

0.12

0.3

0.32

0.08

False

0

0

0

0

1


This assumption
should prove safe for the restricted geographic area and population
demographic associated with merchant crewmembers.

The Sageman study data is also
used in eliciting probabilities for the sub
-
nodes within this partition.

Descriptions for
these nodes
imm
ediately follow
; their probability distributions are given in
the
Appendix.

Occupation

Contrary to popular thought, terrorists tend to not be unskilled drifters with no options
other than martyrdom.

Given that a crewmember is associated with one of the four
primary terrorist cliques,
this node indicates the
likelihood that he is a professional,
semiskilled, or unskilled laborer
.

A distribution for the
Occupation

node is given
in the
Appendix.

Backgr
ound statistics for the “Other” population were difficult to elicit
, but
the probabilities assigned mirrored the statistics found in the CIA World Factbook

for
Egypt and Indonesia

[30].

Education Level

Again, many believe terrorist recruits to be uneducate
d simpletons who are easily
persuaded by eloquent muftis who appeal to their sense of
honor

and perception of
persecution.

In fact, the data indicate that the typical terrorist is more educated than the
average global citizen and is by far more educated t
han those in the
M
iddle
East,

North
Africa,
and
S
outheastern
Asia
region
s as shown in
Table
7

[
18
]
.



11


Table
7

-

Education

Cluster

Middle School

High School

College

BA BS

MA MS

PhD

Central Staff

0.04

0.04

0.04

0.64

0.04

0.2

Southeast Asia



0.12

0.18

0.47

0.23



Maghreb Arab

0.35

0.22

0.24

0.16

0.03



Core Arab

0.15

0.09

0.47

0.26

0.02



Other


0.44

0.20

0.15

0.10

0.08

0.03


The above table summarizes the likelihood that an individual has achieved a certain level
of education g
iven that
he is associated
with one of the terrorist cliques
. Education levels
for the background demographic represented by the “Other” category is based on
statistics for Egypt obtained from the CIA World Factbook for 2009 [
30
].

Economic Standing

The four cliques each represent

different strata of socio
-
economic standing.
This node
summarizes the likelihood that a crewmember is from the upper, middle, or lower class
g
iven that
he is
associated with one of the four primary terrorist cliques
. Economic
standing for the “Other” category is again based on Egyptian statistics found in the CIA
World Factbook [
30
].

A summary of the
Economic

node distribution is given in

the
Appendix
.

Nationality

Twenty three nations are represented by the four pr
imary terrorist cliques with Egypt and
Saudi Arabia far outnumbering the others.
This node summarizes the most likely country
of origin for a
crewmember associated with
a particular
terrorist cliques
.
Because actual
merchant crew demographics are difficul
t to quantify,
the model

uses
2008 census data
proportions for the
19 non
-
western
nations as the likely crew population [
30
]. Actual
demographic data

would include the western
nations at some low percentage and
is left
for future research.

3.2 Test

Cases and Results

Three case studies are used to evaluate the efficacy of the model in determining crew
terrorist tendencies. The first
is a
general case in which an individual fits
a profile
and
can therefore be “correctly” identified. In the
second an
d third
case
s
,
situations are
introduced
in which individual
s

could be incorrectly
profiled using the
se

technique
s
.

Each was modeled using Netica.


3.2.1 Case

I: The Egyptian
(Guilty


Obvious)

Bakari, a

student at Misr University in Cairo and
member of
a terrorist organization
,

has
been tasked with smuggling explosive materials into the United States for use in making
improvised explosive devices (IED).

He is from a middle
-
class
Egyptian

family with a
large extended family, including one uncle who is a
member of
the
Mojahedin
-
e Khalq
Organization
. Because he is a full
-
time student, he has not had the opportunity to earn
enough money for a suitable dowry and is still single.

Recently, postings on a terrorist
-
related weblog have been attributed to Bakari
’s
school

account,
in which he laments his
colleagues

he watched being taken prisoner by the coalition
.



Case
I

returns a probability of 61.5% that Bakari

is involved in terrorism, primarily due
to the weblog communications and affiliation of his uncle. Removing the
communications link drops him all the way down to 36.5%. Including communications
12


activity and removing the uncle affiliation drops his perce
ntage to 1.7%. It is clear that
being related to and communicating with terrorists will flag an individual very
significantly

as a terrorist candidate
.


Also of note is effect of
the
Influence Partition

on

the outcome of this case. The scenario
introdu
ced information about Bakari’s marital status, and this has very little effect.
Removing the marital status results in a probability of being a terrorist of 65.8%
.

This
value

is higher, because the “
standard” terrorist profiled requires an individual to
be
married, not single. Knowing someone imprisoned has
a greater

effect

and removal of
this information reduce
s

the overall terrorism likelihood to 24.4%.


It is clear from this case study that family and friend relationships weigh heavily on the
determ
ination of terrorist activity. In the case where an individual has a casual or
coincidental relationship with someone involved, or there is a case of name
-
based
mistaken identity, this would likely lead to an incorrect determination. Ranking the
partitio
ns from most influential to least gives

an ordering of
Relationship
,
Communication, Influence,
and

Cluster
.

3.2.2 Case

I
I
: The Indonesian

(Guilty


looks innocent)

Arif leaves his
Indonesian village

at age 17

to provide for his family through life as a
merchant sailor.

He is an unmarried, unskilled worker who did not complete high school.

While looking for work

as a mariner

in Jakarta, he shared a room with 5 others, at least
one of whom has become involved
with the
Jemaah Islamiyah
organization. Arif joins
his friend at a
Jemaah Islamiyah
meeting where he is given a cell phone and contact
information.


In this case, Arif is involved in the beginning stages of the terrorist recruitment process.
While his ba
ckground has none of the profile indicators, his growing affiliation and
recruitment will eventually lead him to a positive assessment.

It is nearly impossible to
force a positive likelihood onto the crewmember being a terrorist by switching features in
t
he

Influence, Communications
, and
Relationship

partitions. This is due to the fact that
the cluster partition has driven the model to an unlikely terrorist character in the “Other”
category. Since he does not fall into one of the terrorist cliques, it will be difficult to
identify him as a terrorist
.

His background does not fit with the classic profile.


This scenario demonstrates a weakness of the model and intelligence collection in
general. Profiles are built on history, but cannot account for rapid transition from one
social caste to another.
Arif arrived in Jakarta as a farmer looking for work and through
rapid social affiliation became a terrorist suspect. The unknown question is whether he
will continue to grow his relationship with Jemaah Islamiyah, or turn toward life as a
commercial seam
an.

3.2.3 Case

III: The
Jordanian

(Innocent


looks guilty)

Irasto

leaves
Amman
,
Jordan

to earn a living as a merchant sailor.

He comes from a
middle class family and began studies at
the

U
niversity

of Jordan

before local violence
frightened him into leaving. While in school, several of his friends were detained by
coalition forces under suspicion of terrorist affiliation and have not been seen since. He
frequently communicated with them by email and cell ph
one prior to their disappearance.


The unknown status of Irasto’s friends mudd
ie
s the waters for this scenario. They were
detained as part of OEF/OIF, and therefore affect the
Influence Partition
, but we have no
information as to whether these friends w
ere actually confirmed to be terrorists. If the
13


safe route is taken (from an intelligence perspective) they will be considered terrorists
and Irasto will also be pronounced a terrorist with a likelihood of 90.2%
; without this
assumption

he is
found to be
97%
innocent
.



The model indicates that Irasto appears to be involved with either the Cental Staff or
Maghreb Arab clique. This drives the
Relationship

partition into strongly affecting the
overall likelihood. The same dilemma exists for communications
. Irasto communicated
with his friends using two of the profiled communication paths. If those friends are
determined to be terrorists, then his likelihood jump significantly over if they are not.

The model
recognizes guilt by association.
These two pa
rticulars illustrate some of the
problems
introduced when
intelligence is not shared between organizations. If the
analysts ha
ve

access to the final determination of his friends, Irasto
will

be more likely to
have a correct determination of guilt or innoc
ence.

4.0 Evaluation

In its current form,
the model

is a good proof of concept. For actual use

by military
or

corporate analysts
, more research is required to ensure that the conditional probability
tables accurately reflect the demographic of interest.

As the target population is refined,
detailed relationships and trends may be observed that would further clarify associations
between crewmembers, their relations, and terrorists.

Operational implementation should
be in a classified system to allow ful
l access to available databases and studies.


It was
clear through the literature review and research for conditional probabilities
that
assigning likelihoods
to attributes involving
the human mind

and personal choice is a
difficult task.

While anecdotall
y many may agree
on the

commonality of a certain
attribute, few are willing to commit a hard number to paper when it comes to “profiling.”

To use

this model

operationally, further research is needed in the relationship aspect of
terrorist recruiting.

Ove
rall the project serve
s

as a starting point for establishing profiles
of suspect individuals. The strength of the model is that through context
-
specific
research, it can be tailored to any particular
demographic in any given area. This proof of
concept is geared toward crewmembers on merchant ships, but future models might be
used for profiling spies or
corporate
embezzlers.


As a long
-
term project,
the model
requires a complete study for each of the
conditional
probability tables

introduced, as well as others that may be determined appropriate. The
intelligence community has access to classified data which may fill in some of the
unknowns.
The results of
the project
are appealing. The original inte
nt was to create a
basic model to assist in the determination of crewmember terrorist affiliation based on
background attributes

for use in the PROGNOS project
. While not all of the distributions
perfectly represent the background demographic, the model s
hows intuitive inferential
relationships when tested against the case studies. Additional case studies would further
test the model and identify areas requiring more detailed analysis.

5.0 Summary

and Conclusions

The model in its current form provides a p
roof of concept that a profiling technique can
assist analysts in determining terrorist inclinations in a target demographic. However,
before it is applied operationally it would be necessary to conduct more in
-
depth research
on the populations to verify
the conditional probabilities. Further, a case
-
by
-
case analysis
of known terrorists and their profiles would serve to validate the accuracy and efficacy of
the conditional probabilities and identify which are incorrectly stated. As much of this
informati
on exists at a classification above this paper, that was not possible for the initial
model.

14


There is a pejorative connotation associated with profiling. Yet despite what it is called,
humans profile those around them every day because it works. Th
is

mod
el takes some of
the bias out of the profiling process and standardizes the characteristics which flag an
individual as needing further analysis. While no system is perfect,
this model can

reduce
the workload of analysts attempting
to keep

countries and companies safe from terrorism.

References

[1]

V. Asal, C.C. Fair, and S. Shellman, “Consenting to a Child's Decision to Join a
Jihad: Insights from a Survey of Militant Families in Pakistan,”
Studies in Conflict
& Terrorism
, vol. 31, 2008
, pp. 973
-
994.


[2]

C. Bockstette,
Jihadist Terrorist Use of

Strategic Communication

Management Techniques
, Garmisch
-
Partenkirchen, Germany: 2008.

[3]

H. Chen, W. Chung, J. Qin, E. Reid, M. Sageman, and G. Weimann, “Uncovering
the DarkWeb: A Case Study
of Jihad

on theWeb,”
Journal of the American Society for Information Science and
Technology
, vol. 59, 2008, pp. 1347
-
1359.


[4]

T.R. Coffman and S.E. Marcus, “Pattern Classification in Social Network
Analysis: A Case Study,”
Proceedings of 2004 IEEE Aero
space Conference
, Big
Sky, MT, United states: 2004.

[5]

M.J. Dombroski and K.M. Carley, “NETEST: estimating a terrorist network's
structure
-

graduate student best paper award, CASOS 2002 conference,”
Computational & Mathematical Organization Theory
, vol.

8, 2002, pp. 235
-
41.


[6]

D. Gambetta and S. Hertog, “Engineers of Jihad,” Sociology Working Papers,
University of Oxford, 2007.


[7]

D.T. Halstead and K.D. Forbus, “Transforming between propositions and features:
Bridging the gap,”
Proceedings of the

National Conference on Artificial
Intelligence
, Pittsburgh, PA, United states: American Association for Artificial
Intelligence, 2005, pp. 777
-
782.

[8]

D.A. Hussain, “Predicting hierarchical structure in small world social networks,”
International MultiC
onference of Engineers and Computer Scientists 2009.
IMECS 2009
, Hong Kong, China: International Association of Engineers, 2009,
pp. 690
-
1.

[9]

D. Koelle, J. Pfautz, M. Farry, Z. Cox, G. Catto, and J. Campolongo
,
“Applications of Bayesian Belief Networks in Social Network Analysis,”
Proceedings of 4th Bayesian Modeling Applcations Workshop
, Cambridge, MA,
USA: 2006.

[10]

V.E. Krebs, “Mapping Networks of Terrorist Cells,”
Connections
, vol. 24, Winter.
2001, pp. 4
3
-
52.


[11]

J. Moody, “Fighting a Hydra: A Note on the Network Embeddedness of the War
on Terror,”
Structure and Dynamics
, vol. 1, Aug. 2006.


[12]

I.C. Moon and K.M. Carley, “Modeling and Simulating Terrorist Networks in
Social and Geospatial Dimensio
ns,”
IEEE Intelligent Systems
, vol. 22, 2007, pp.
40
-
9.


[13]

J. Ogando, “Engineering's Terrorism Link?,”
Design News
, vol. 63, 2008, pp.

15


25,27
-
8.


[14]

J. Qin, Y. Zhou, E. Reid, G. Lai, and H. Chen, “Analyzing terror campaigns on the
internet:
Technical sophistication,

content richness, and Web interactivity,”
International Journal of Human
-
Computer Studies
, vol. 65, 2007, pp. 71
-
84.


[15]

H. Rashad, M. Osman, and F. Roudi
-
Fahimi,
Marriage in the Arab World
,
Washington, D.C., USA: 2005.

[16]

S. Ressler, “Social Network Analysis as an Approach to Combat Terrorism: Past,
Present and Future Research,”
Homeland Security Affairs
, vol. II, Jul. 2006.


[17]

A. Russell, M. Clark, G. Mack, S. Ghoshal, and K. Pattipati, “Automated
Population of Dynami
c Bayes Nets for Pre Conflict Analysis and Forecasting,”
IEEE Aerospace Conference Proceedings
, Big Sky, MT, United states: 2006.

[18]

M. Sageman,
Understanding Terror Networks
, Philadelphia: University of
Pennsylvania Press, 2004.


[19]

S. Singh, J. Al
lanach, H. Tu, K. Pattipati, and P. Willet, “Stochastic modeling of a
terrorist event via the ASAM system,”
Conference Proceedings
-

IEEE
International Conference on Systems, Man and Cybernetics
, The Hague,
Netherlands: Institute of Electrical and Electron
ics Engineers Inc., 2004, pp. 5673
-
5678.

[20]

S. Singh, W. Donat, H. Tu, J. Lu, K. Pattipati, and P. Willet, “An advanced system
for modeling asymmetric threats,”
2006 IEEE Conference on Systems, Man, and
Cybernetics
, Taipei, Taiwan: IEEE, 2006, pp. 5031
-
6.

[21]

H. Tu, J. Allanach, S. Singh, K. Pattipati, and P. Willet, “Information Integration
via Hierarchical and Hybrid Bayesian Networks,”
IEEE Transactions on System,
Man and Cybernetics, Part A: Systems and Humans
, vol. 36, 2006, pp. 19
-
33.


[22]

J.
Victoroff and North Atlantic Treaty Organization.,
Tangled roots : social and
psychological factors in the genesis of terrorism
, Amsterdam Netherlands
;;Washington DC: IOS Press, 2006.


[23]

L.W. Wagenhals

and A.H. Levis, “Course of Action Analysis in a Cultural
Landscape Using Influence Nets,”
Proceedings of the 2007 IEEE Symposium on
Computational Intelligence in Security and Defene Applications
, Oakland, CA,
USA: 2007, pp. 116
-
123.

[24]

G.A. Wang, H. Ch
en, and H. Atabakhsh, “A Multi
-
layer Naïve Bayes Model for
Approximate

Identity Matching,”
A Multi
-
layer Naïve Bayes Model for Approximate Identity
Matching
, Heidelberg: Springer Berlin, 2006, pp. 479
-
484.


[25]

G. Weimann, “Virtual Terrorism: How Modern

Terrorists Use the Internet,”
Dresden, Germany: 2009.

[26]

C.C. Yang and T.D. Ng, “Terrorism and Crime Related Weblog Social Network:
Link, Content Analysis and Information Visualization,”
Proceedings of IEEE
International Conference on Intelligence and
Security Informatics
, 2007.

[27]

C.C. Yang, N. Liu, and M. Sageman, “Analyzing the Terrorist Social Networks
with Visualization Tools,”
Proceedings of the IEEE International Conference on
Intelligence and Security Informatics
, San Diego, CA, USA: 2006.

16


[
28]

“World Internet Usage Statistics News and World Population Stats,”
Internet
World Stats: Usage and Population Statistics
, 2010.

[29]

“Wireless/Mobile statistics,” 2010.

[30]

“CIA
-

The World Factbook,” 2010.


Appendi
x
-

Conditional
Probability Tables for Network

The following information provides amplification to the models and scenarios introduced
in the body of the paper.

This appendix provides a complete summary of the
distributions used in the baseline model.

Cells are color
-
co
ded by
:



Black



Direct s
ource data



Blue



Calculated
from data



Red



Estimated or assumed

By following the above color scheme, it becomes clear which areas require further
research or may incorrectly represent the population demographic.


T
able
1

-

Influence Partition

Crewmember

Yes

No

True

1

0

False

.20

.8


Table
2

-

OEF/OIF Influence

Influence Partition

TRUE

FALSE

Yes

.75

.25

No

.02

.98


Table
3

-

Family Status

Influence

Married

Single

Yes

0.73

0.27

No

0.52

0.48


Table
4

-

Communicates with Terrorists

Crewmember

Yes

No

True

1

0

False

0.001

0.999


Table
5

-

Relationship Partition

Crewmember


Related

Not Related

True

0.75

0.25

False

0.001

0.999


Table
6



Cluster Partition

Crewmember

Central Staff

Southeast Asia

Maghreb Arab

Core Arab

Other

True

0.18

0.12

0.3

0.32

0.08

False





1


17


Table
7

-

Education

Cluster

Middle School

High School

College

BA
BS

MA MS

PhD

Central Staff

0.04

0.04

0.04

0.64

0.04

0.2

Southeast Asia



0.12

0.18

0.47

0.23



Maghreb Arab

0.35

0.22

0.24

0.16

0.03



Core Arab

0.15

0.09

0.47

0.26

0.02



Other


0.44

0.20

0.15

0.10

0.08

0.03


Error! Reference source not found.

TRUE

FALSE

0.001

0.999


Table 9


Occupation

Cluster

Professional

Semiskilled

Unskilled

Central Staff

0.63

0.33

0.04

Southeast Asia

0.78

0.17

0.05

Maghreb Arab

0.1

0.4

0.5

Core Arab

0.45

0.33

0.22

Other

0.05

0.3

0.65


Table 10


Economic Standing

Cluster

Upper Class

Middle Class

Lower Class

Central Staff

0.35

0.5

0.15

Southeast Asia



0.83

0.17

Maghreb Arab



0.52

0.48

Core Arab

0.29

0.51

0.2

Other

0.2

0.3

0.5


Table 11


Nationality (part 1)

Cluster

EG

SA

KW

JO

IQ

SD

LY

LB

ID

MY

SG

Central
Staff

0.63

0.09

0.09

0.06

0.03

0.03

0.03

0.04







Southeast
Asia

















0.57

0.14

0.1

Maghreb
Arab























Core Arab

0.07

0.5

0.07

















Other


























18


Table
8



Nationality (part 2)

Cluster

PK

PH

FR

DZ

MA

SY

TN

AE

YE

WD

Central Staff





















Southeast Asia



0.09

















Maghreb Arab





0.34

0.28

0.19



0.09







Core Arab

0.04







0.07

0.04



0.04

0.07

0.1

Other






















Table
9

-

Detained in OEF/OIF

OEF/OIF Influence

TRUE

FALSE

True

0.02

0.98

False

0.001

0.999


Table 14
-

Killed OEF/OIF

OEF/OIF Influence

TRUE

FALSE

True

0.02

0.98

False

0.001

0.999


Table
10



Chat Room Communications

Communicates

TRUE

FALSE

Yes

0.85

0.15

No

0.288

0.712


Table 16
-

Weblog Communications

Communicates

TRUE

FALSE

Yes

0.8

0.2

No

0.288

0.712


Table 17
-

Email
Communications

Communicates

TRUE

FALSE

Yes

0.65

0.35

No

0.288

0.712


Table 18
-

Cellular Communications

Communicates

TRUE

FALSE

Yes

0.9

0.1

No

0.316

0.684


Table
11

-

Relationship Partition

Crewmember

RelatedTo

Not RelatedTo

True

0.75

0.25

False

0.001

0.999




19


Table 20


Friendship with Terrorist

RelationshipPartition

TRUE

FALSE

RelatedtoTerrorist

0.68

0.32

NotRelatedtoTerrorist

0.001

0.999


Table 21


Kinship with Terrorist

RelationshipPartition

TRUE

FALSE

RelatedtoTerrorist

0.14

0.86

NotRelatedtoTerrorist

0.001

0.999


Table 22


Social Network

Affected

NotAffected

0.5

0.5


Table 23
-

Government

GovtInfluence

NoGovtInfluence

0.5

0.5


Table 24


Military/Police

FormerMilitary

NotFormerMilitary

0.5

0.5


Table 25


Place of Worship

True

False

0.5

0.5


Richard Haberlin is a retired US Naval Flight Officer with extensive experience in anti
-
submarine warfare and airborne intelligence, surveillance and reconnaissance operations
in the Arctic, Atlantic, Mediterranean and Middle East. He is currently a senio
r analyst
and military subject
-
matter expert for Enterprise Management Solutions Inc. in
Alexandria, Virginia. An active member of the Institute for Operations Research and the
Management Sciences and the Armed Forces Communications and Electronics
Associ
ation, he holds an M.S. in Operations Research from the Naval Postgraduate
School and a B.S. in Ocean Engineering from the United States Naval Academy.