Criminal network security: An agent‐based approach to evaluating network resilience*

• Author: Scott W. Duxbury,Dana L. Haynie
• DOI: http://doi.org/10.1111/1745-9125.12203
• Date: 01 May 2019
• Published date: 01 May 2019

Received: 29 May 2018 Revised: 17 November2018 Accepted: 26 November 2018

DOI: 10.1111/1745-9125.12203

ARTICLE

Criminal network security: An agent-based

approach to evaluating network resilience*

Scott W. Duxbury Dana L. Haynie

Department of Sociology, The Ohio State

University

Correspondence

ScottW. Duxburry, Department of Sociology,

TheOhio State University, 238 Townshend

Hall,1885 Neil Avenue Mall, Columbus, OH

43210.

Email:duxbur y.5@osu.edu

Fundinginformation

NationalScience Foundation, Grant/Award

Number:GRT00046370

∗Wethank the attendants of the Illicit Networks

Workshop2017 for helpful comments and feed-

backon an earlier version of this article. We also

thank the UCINET team formaking the cr im-

inalnetworks examined in this study publicly

available.This research was supported by the

NationalScience Foundation (GRT00046370).

Abstract

Criminal networks are frequently at risk of disruption

through arrest and interorganizational violence. Difficul-

ties in designing empirical studies of criminal network

recovery, however, have problematized research into

network responses to disruption. In this study, we evaluate

criminal network resilience by examiningnetwork recovery

from disruption in an array of different criminal networks

and across different disruption strategies. We use an agent-

based model to evaluate how criminal networks recover

from disruption. Our results reveal the vulnerabilities and

time to recovery of numerous criminal organizations, and

through them, we identify which disruption strategies are

most effective at damaging various criminal networks.

KEYWORDS

criminal networks, deterrence, law enforcement, network disruption,

social network analysis

Recognizing that a considerable portion of criminal activity is group based (McGloin & Rowan,

2015; Shaw & McCay, 1942; Warr, 2002), criminologists are increasingly turning to social

network theory, data, and methods to understand how criminal groups form, organize, and

coordinate (Kennedy, 2008; McGloin, 2005; Papachristos, 2009, 2011, 2014). Many of these

criminal groups are complex and require substantial collaboration to operate, which is similar

to legitimate organizations. Organized criminal groups, however, face a unique and challenging

obstacle: the need to conceal activity under constant threat of detection and resulting risk of

severe legal consequences (Morselli, 2009; Wood, 2017). Moreover, if discovered, the organiza-

tional structure of a covert network should offer protection by making it difficult to identify key

network members and shut down operations (Baker & Faulkner, 1993; Erickson, 1981; Raab &

Milward, 2003). At the same time, to carry out network objectives, the pattern of ties linking criminal

members together depends on members’ ability to communicate and coordinate efficiently with one

314 © 2019 American Society of Criminology wileyonlinelibrary.com/journal/crim Criminology.2019;57:314–342.

DUXBURY AND HAYNIE 315

another. As a result, organized criminal groups constantly consider and balance issues of security

(maintaining covert operations and evading law enforcement) and efficiency (ability to carry out

illegal operations efficiently and maintain market standing) to sustain operations (Lindelauf, Borm, &

Hamers, 2009; McCormick & Owen, 2000; Morselli, 2009; Morselli, Giguere, & Petit, 2007; Raab &

Milward, 2003).

Criminal organizations vary considerably in the weight they place on security or efficiency, depend-

ing on the objectives of their organization and the constraints associated with the specific types of crime

in which a criminal group is engaged (Morselli, 2009). Successful criminal organizations must be flex-

ible in their responses to varying threats, such as disruption from law enforcement interventions, by

adjusting how they balance these two competing principles overtime. Alt hough some researchershave

begun exploring whether and how criminal organizations differ in the emphases placed on security or

efficiency, they have focused almost exclusively on static portrayals of criminal networks (i.e., snap-

shots) without considering how organizational preferences mayvary over time in response to changing

threats or disrupted environments. Resilient criminal organizations are those that can respond quickly

and effectively to disruptions, enabling them to maintain illegal activities over time. Thus, to mea-

sure resiliency, it is necessary to factor in both a network’s robustness to disruptions—the structural

characteristics of a network that insulate it from damage—as well as the length of time it takes for net-

work recovery when disruption occurs. Unfortunately, very little is known regarding criminal network

recovery or behavior in the aftermath of disruption.

Examining criminal organizations’ ability to recoverafter a disr uption providestwo key advantages.

First, and consistent with situational and rational choice theories of criminal behavior, criminal net-

works are composed of agentic actors, many of whom are rationally motivated with strong (typically

economic) incentives to limit periods of network inactivity (Clarke, 1996; Clarke & Cornish, 1985;

Weisburd, Braga, Groff, & Wooditch, 2017). Consequently, network activity in the aftermath of dis-

ruption offers insight into how criminal organizations behave in unstable environments or in the wake

of a criminal justice intervention (e.g., when actors in a criminal network are removed or arrested).

Second, law enforcement has begun to embrace social networkanalysis as an exceptionally useful tool

for aiding criminal intelligence, with its ability to identify critical vulnerabilities in the structure of ties

in organized criminal networks (Bright, 2015; Malm & Bichler, 2011; McGloin, 2005; Papachristos,

2014; Sparrow, 1991). In this body of research, information on criminal network structure is used to

develop law enforcement interventions that target integral actors within the criminal network with the

goal of eliminating or reducing criminal activity. In cross-sectional network studies, however, schol-

ars have been unable to identify whether these law enforcement disruptions have a lasting impact on

criminal activity or on the behaviors of a criminal organization over time. It is therefore possible that

in policy recommendations based on prior criminal network research, the effectiveness of various law

enforcement intervention strategies on criminal network structure and levels of offending are over- or

underemphasized.

By building on prior research, we advance the literature by 1) evaluating differentcr iminal network

disruption strategies to assess their a) immediate and b) long-term impact on criminal network structure

and 2) evaluating whether the immediate and long-term effectiveness of different disruption strategies

depends on the characteristics and objectives of the particular criminal organization studied.

Social network theory and analysis is ideally suited to address our objectives and to understand how

disruption efforts affect crime groups’ behavior, coordination, and time to recovery. In part, this is

because a network perspective treats crime groups as a series of affiliations, rather than as a stable

entity. We combine our network approach with a computational agent-based model (ABM) simulation

to overcome the well-known methodological and data collection problems involved with examining

criminal networks before and after law enforcement intervention (Bright, 2015; Bright, Koskinen, &