A Bayesian Model for Determining Crew Affiliation with Terrorist Organizations Quantitative Methods in Defense and National Security 21 Rick Haberlin May 25-26, 21
Agenda Background Research Model Case Studies Conclusions 2
Background Background 3
Probabilistic Ontologies for Net-Centric Operations Systems - PROGNOS Provide consistent higher-level fusion through knowledge representation and inferential reasoning Enable predictive analysis with principled hypothesis management Predictions & Impact Assessments Queries Low level fusion + Stovepiped systems + Fog of War = Cognitive Overload 4
High-Level Fusion Architecture 5
Maritime Domain Awareness * From Carvalho April 21 6
Statement of the Problem Minimize the likelihood that the transient and multinational nature of merchant vessel crewing can be leveraged as a means for international terrorist organizations to smuggle personnel and material into target countries Develop a model to suggest an individual crewmember s terrorist affiliation given his close relations, group membership, communications, and background 7
Research RESEARCH 8
Project Overview Iterative spiral of development Open-source data sparse Draft/Update Model Three iterations Analyze & Review Review Literature Case Study Set Model Parameters 9
Literature Review Yang, et. al. Coffman, et. al. Dombrosky, et. al. Arizona State University Krebs Wagenhals, et. al. Moon, et. al. Sageman Social network from weblog data Social network via pattern analysis Hierarchical Bayesian influence network Dark Web Project Terrorist network topology Timed influence nets for population interaction Network evolution over time Psychology of Terrorists 1
Hypothesis Given that terrorist organizations are persistently looking for new ways to deliver personnel and material into target countries, profiling personnel with opportunity to arrive in western ports under legitimate pretences presents prospects to identify these individuals prior to their arrival. An individual crewmember s terrorist affiliation can be estimated given his close relations, group associations, communications, and background influences 11
Model MODEL 12
The Hydra Model Influence Partition Communicates with Terrorists Crewmember is a Terrorist Cluster Partition Relationship Partition 13
Assumptions Terrorists leave clues in their past Terrorist proportion in target demographic is.1% Terrorists communicate among themselves with certainty Inadvertent interaction with terrorists is possible Model area is Middle East, North Africa, Southeast Asia Terrorists fall into four major cluster organizations Maghreb Arab Central Staff Core Arab Southeast Asia 14
Knows Imprisoned in OIF/OEF The Hydra Model True False.42 99.6 Knows Killed in OIF/OEF True.42 False 99.6 Cellular Comms True 31.7 False 68.3 FamilyStatus Married 56.2 Single 43.8 Place of Worship True 5. False 5. OIF/OEF Influence True 16.7 False 83.3 Communicates with Terrorist Yes.2 No 99.8 Email Comms True 28.9 False 71.1 Weblog Comms True 28.9 False 71.1 Military/Police FormerMilitaryPolice 5. NotFormerMilitaryPolice 5. Influence Partition Yes No 2.1 79.9 Chatroom Comms True 28.9 False 71.1 Government GovtInfluence NoGovtInfluence 5. 5. Crewmember is a Terrorist True.1 False 99.9 Friendship with Terrorist Yes.22 No 99.8 Nationality Egypt 9.1 SaudiArabia 3.2 Kuwait.4 Jordan 1. Iraq 3. Sudan 5. Libya 1. Lebannon + Indonesia 28. Malaysia 3. Singapore 1. Pakistan 2. Philippines 11. France.1 Algeria 4. Morocco 4. Syria 3. Tunisia 1. UAE 1. Yemen 2. CANUKUS.3 Cluster Partition CentralStaff.18 SoutheastAsia.12 MaghrebArab.3 CoreArab.32 Other 99.9 Economic Standing UpperClass 2. MiddleClass 3. LowerClass 5. Occupation Professional 5.3 SemiSkilled 3. UnSkilled 65. Education Level MiddleSchool 44. HighSchool 2. College 15. BA BS 1. MA MS 8. PhD 3. Relationship Partition RelatedtoTerrorist.17 NotRelatedtoTerrorist 99.8 Social Network Affected 5. NotAffected 5. Kinship to Terrorist Yes.12 No 99.9 15
The Hydra Model Background Communications Knows Imprisoned in OIF/OEF True.42 False 99.6 Knows Killed in OIF/OEF True.42 False 99.6 Cellular Comms True 31.7 False 68.3 FamilyStatus Married 56.2 Single 43.8 Place of Worship True 5. False 5. OIF/OEF Influence True 16.7 False 83.3 Communicates with Terrorist Yes.2 No 99.8 Email Comms True 28.9 False 71.1 Weblog Comms True 28.9 False 71.1 Military/Police FormerMilitaryPolice 5. NotFormerMilitaryPolice 5. Yes No Influence Partition 2.1 79.9 Chatroom Comms True 28.9 False 71.1 Government GovtInfluence NoGovtInfluence 5. 5. Crewmember is a Terrorist True.1 False 99.9 Friendship with Terrorist Yes.22 No 99.8 Nationality Egypt 9.1 SaudiArabia 3.2 Kuwait.4 Jordan 1. Iraq 3. Sudan 5. Libya 1. Lebannon + Indonesia 28. Malaysia 3. Singapore 1. Pakistan 2. Philippines 11. France.1 Algeria 4. Morocco 4. Syria 3. Tunisia 1. UAE 1. Yemen 2. CANUKUS.3 Associations Cluster Partition CentralStaff.18 SoutheastAsia.12 MaghrebArab.3 CoreArab.32 Other 99.9 Economic Standing UpperClass 2. MiddleClass 3. LowerClass 5. Occupation Professional 5.3 SemiSkilled 3. UnSkilled 65. Education Level MiddleSchool 44. HighSchool 2. College 15. BA BS 1. MA MS 8. PhD 3. Relationship Partition RelatedtoTerrorist.17 NotRelatedtoTerrorist 99.8 Social Network Affected 5. NotAffected 5. Relationships Kinship to Terrorist Yes.12 No 99.9 16
Case Studies CASE STUDIES 17
Case Studies I. The Egyptian (Guilty Obvious) II. The Indonesian (Guilty looks innocent) III. The Jordanian (Innocent looks guilty) 18
Study I: The Egyptian (Guilty Obvious) FamilyStatus Married Single 1 Place of Worship True 5. False 5. Military/Police FormerMilitaryPolice 5. NotFormerMilitaryPolice 5. Government GovtInfluence NoGovtInfluence Knows Imprisoned in OIF/OEF True 1 False 5. 5. OIF/OEF Influence True 87.9 False 12.1 Yes No Knows Killed in OIF/OEF True 1.77 False 98.2 Influence Partition 84.9 15.1 Crewmember is a Terrorist True 61.5 False 38.5 Cellular Comms True 67.6 False 32.4 Communicates with Terrorist Yes 61.6 No 38.4 Chatroom Comms True 63.4 False 36.6 Email Comms True 51.1 False 48.9 Weblog Comms True 1 False Friendship with Terrorist Yes 45. No 55. Parameters Student Middle class Egyptian Uncle terrorist Single Blog postings Colleagues detained Nationality Egypt 1 SaudiArabia Kuwait Jordan Iraq Sudan Libya Lebannon Indonesia Malaysia Singapore Pakistan Philippines France Algeria Morocco Syria Tunisia UAE Yemen CANUKUS Cluster Partition CentralStaff 16.8 SoutheastAsia.78 MaghrebArab 1.63 CoreArab 39.8 Other 4.9 Economic Standing UpperClass MiddleClass 1 LowerClass Occupation Professional 31.3 SemiSkilled 31.8 UnSkilled 36.9 Education Level 1 MiddleSchool HighSchool College BA BS MA MS PhD Relationship Partition RelatedtoTerrorist 66.1 NotRelatedtoTerrorist 33.9 Social Network Affected 5. NotAffected 5. Kinship to Terrorist Yes 1 No Strong effects of influence, communications, and relationships Estimated to be associated with Core Arab clique 19
Study II: The Indonesian (Guilty looks innocent) FamilyStatus Married Single 1 Place of Worship True 5. False 5. Military/Police FormerMilitaryPolice 5. NotFormerMilitaryPolice 5. Government GovtInfluence 5. NoGovtInfluence 5. Knows Imprisoned in OIF/OEF True.36 False 99.6 OIF/OEF Influence True 13.7 False 86.3 Knows Killed in OIF/OEF True.36 False 99.6 Influence Partition Yes 16.1 No 83.9 Crewmember is a Terrorist True 4.27 False 95.7 Cellular Comms True 1 False Communicates with Terrorist Yes 4.54 No 95.5 Chatroom Comms True 31.4 False 68.6 Email Comms True 3.4 False 69.6 Weblog Comms True 31.1 False 68.9 Friendship with Terrorist Yes 1 No Parameters Indonesian Unmarried Unskilled Incomplete high schl. Roommate terror aff. Cell phone Nationality Egypt SaudiArabia Kuwait Jordan Iraq Sudan Libya Lebannon Indonesia 1 Malaysia Singapore Pakistan Philippines France Algeria Morocco Syria Tunisia UAE Yemen CANUKUS Cluster Partition CentralStaff SoutheastAsia MaghrebArab.19 CoreArab Other 99.8 Economic Standing UpperClass MiddleClass LowerClass 1 Occupation Professional SemiSkilled UnSkilled 1 Education Level MiddleSchool 1 HighSchool College BA BS MA MS PhD Relationship Partition RelatedtoTerrorist 43. NotRelatedtoTerrorist 57. Social Network Affected 5. NotAffected 5. Kinship to Terrorist Yes 6.8 No 93.9 Time latency of model cannot keep up with shifting alliances Does not fit the terrorist profile 2
Study III: The Jordanian (Innocent looks guilty) FamilyStatus Married 72.5 Single 27.5 Place of Worship True 5. False 5. Military/Police FormerMilitaryPolice 5. NotFormerMilitaryPolice 5. Government GovtInfluence NoGovtInfluence Knows Imprisoned in OIF/OEF True 1 False 5. 5. OIF/OEF Influence True 96.5 False 3.45 Yes No Knows Killed in OIF/OEF True 1.93 False 98.1 Influence Partition 97.4 2.61 Crewmember is a Terrorist True 9.2 False 9.84 Cellular Comms True 1 False Communicates with Terrorist Yes 9.2 No 9.77 Chatroom Comms True 79.5 False 2.5 Email Comms True 1 False Weblog Comms True 75. False 25. Friendship with Terrorist Yes 1 No Parameters Jordanian Middle class College student Friends detained Email & Cell Friends terrorists? Nationality Egypt SaudiArabia Kuwait Jordan 1 Iraq Sudan Libya Lebannon Indonesia Malaysia Singapore Pakistan Philippines France Algeria Morocco Syria Tunisia UAE Yemen CANUKUS Cluster Partition CentralStaff 33.7 SoutheastAsia 16.5 MaghrebArab 34.4 CoreArab Other 15.5 Economic Standing UpperClass MiddleClass 1 LowerClass Occupation Professional 38.3 SemiSkilled 32.3 UnSkilled 29.4 Education Level MiddleSchool HighSchool College 1 BA BS MA MS PhD Relationship Partition RelatedtoTerrorist 94.1 NotRelatedtoTerrorist 5.9 Social Network Affected 5. NotAffected 5. Kinship to Terrorist Yes 13.2 No 86.8 Did he know his colleagues were involved? Do prior communications imply guilt? 21
Case Study Lessons I. The Egyptian: (Guilty Obvious) Heavy reliance on communications Name-based mistaken identity II. The Indonesian: (Guilty looks innocent) Profile on history Cannot account for transition III. The Jordanian: (Innocent looks guilty) Relationships determine guilt No feedback on friends determination 22
Conclusions CONCLUSIONS 23
Further Research Classified sources of material General population terrorist statistics for target demographics Terrorists who attend an affiliated religious institution Former military or police affiliation effect on terrorist recruiting Former military or police affiliation on effects of OEF/OIF Vengeance in terrorist recruiting Government (perception of) effect on terrorist recruiting Social networking effect on terrorist recruiting Nuclear family effect on terrorist recruiting 24
Conclusions Good proof of concept Needs to be classified for real use Context specific research required 25
A Bayesian Model for Determining Crew Affiliation with Terrorist Organizations Rick Haberlin Senior Analyst EMSolutions