Communications - October 2008

two of them if they committed at least one crime together for which they were convicted.

Although the network was carefully validated by the crime analysts in the Tucson Police Department, ¹²the co-occurrence links we generated from crime-incident records may not reflect the real relationships among the criminals. Two related criminals would appear to be unconnected if, for example, they never committed a crime together. On the other hand, a coincidental link may connect two criminals if they happened to have participated in the same crime. These two problems—missing link and coincidental link—are also common in other types of networks (such as those involving movie actors¹²) based on the co-occurrence of two nodes in the same events or activities.

Another group of 3,917 criminals involved in gang-related crimes in Tucson from 1985 to 2002.¹² As in Meth World, the links in this network were generated through co-occurrence analysis of the crime-incident records.

A terrorist Web site network (“the Dark Web”). In 2005, based on reliable government sources, we identified 104 Web sites created by four major international terrorist groups—Al-Gama’a al-Islamiyya, Hizballa, Al-Jihad, and Palestinian Islamic Jihad—fetching all of their pages and extracting all of their hyperlinks. We recognized a link between any two Web sites if at least one hyperlink existed between any two Web pages in them.

lack complete information about all relationships among criminals, causing missing links between the giant component and the smaller components. The isolated components in the Dark Web are possibly the result of the differences in the four terrorist groups’ distinctive ideologies.

As in many other network-topology studies (such as Barabási²), we performed a topological analysis on only the giant component in the four elicited networks. Table 2 lists the average degrees and maximum degrees of the four networks, showing that some terrorists in the GSJ network and some terrorist Web sites in the Dark Web are extremely popular, connecting to more than 10% of their nodes.

This “assortativity” reflects the tendency for nodes to connect with others that are similarly popular in terms of link degree. The assortativity coefficients of the four networks are all significantly different from 0. The GSJ and the gang networks present positive assortativity, meaning that popular members tend to connect with other popular members. In positively assortative networks, high-degree nodes tend to cluster together as core groups, ⁸a phenomenon evident in the GSJ network in which bin Laden and his closest cohorts form

the core of the network and issue commands to other parts of the network. ⁹In contrast, Meth World and the Dark Web have negative assortativity coefficients, or “disassortativity.”

Meth World consists of drug dealers selling illegal methamphetamine to many individual buyers who do not connect with many other buyers or dealers. Moreover, studies have found that street drug-dealing organizations are led by a few high-level individuals who connect with a large number of low-level retail drug dealers. ⁶ Because high-degree nodes connect to low-de-gree nodes, Meth World is characterized by disassortative mixing patterns. On the other hand, the disassortativity in the Dark Web is the result of the fact that the popular Dark Web sites routinely receive many inbound hyperlinks from less popular Web sites.

To ascertain if the dark networks are small worlds, we calculated average path lengths, clustering coefficients, and global efficiency (see Table 3). For each network, we generated 30 random counterparts with the same number of nodes and the same number of links as in the corresponding elicited networks. We found that all of them have significantly high clustering coefficients compared to their random counterparts. Moreover, although the

table 2. Basic statistics and scale-free properties concerning dark networks. the numbers in parentheses in the third row are the percentage of total nodes included in the giant components. the numbers in parentheses in the fifth row are the percentage of total nodes connected to the highest-degree nodes. ** p-value < 0.05 p-value < 0.01

Results

Table 2 lists the basic statistics of the four elicited networks. Like many other empirical networks, each of them contains many isolated components and a single giant component. The giant component in a graph is defined as the largest connected subgraph. ¹ The separation between the 356 terrorists in the GSJ network and the remaining 10 terrorists is because we found no valid evidence to connect the 10 terrorists to the giant component in the network. The giant components in Meth World and the gang network contain only 68.5% and 57.0% of the nodes, respectively. This may be because we collected the data from a single law-enforcement jurisdiction that might