Destabilization of Adversarial Organizations with Strategic - CASOS

275 Pages·2008·12.41 MB·English

Destabilization of Adversarial Organizations with Strategic Interventions
Il-Chul Moon
CMU-ISR-08-124

June 2008

School of Computer Science
Institute for Software Research International
Carnegie Mellon University
Pittsburgh, PA

Thesis Committee
Kathleen M. Carley, Chair
Alexander H. Levis (George Mason University)
James D. Herbsleb
John M. Graham (United States Military Academy)

Submitted in partial fulfillment of the requirements
for the Degree of Doctor of Philosophy
Copyright © 2008 Il-Chul Moon
This research was sponsored by CAPES project (FA8650-07-C-6769) of Air Force Office of
Scientific Research (AFOSR), MURI project (FA9550-05-1-0388) of Air Force Office of Scien-
tific Research (AFOSR), DNA project (N00014-06-1-0921, N00014-06-0104) of Office of Naval
Research (ONR), Geospatial analysis project (W911NF0710317) of ERDC-TEC, Army Research
Institute (ARI), and SPAWAR project (N0016403D6623) of Naval Warfare Center. Additional
support came from Carnegie Mellon University’s Center for Computational Analysis of Social
and Organizational Systems (CMU CASOS). Finally, George Mason University’s System Archi-
tectures Laboratory (GMU SAL) provided valuable support. The views and conclusions in this
thesis should not be interpreted as representing the official policies, either expressed or implied,
of AFOSR, ONR, ARI or the U.S. government.
CMU SCS ISR -1 - CASOS Report
Abstract

Destabilization of adversarial organizations is crucial to combating terrorism. The adversarial
organizations are complex adaptive systems, which include different types of entities and links to
perform complex tasks and evolve over-time to adapt to changing situations. Both the complexity
and the adaptivity of the adversary make it difficult for friendly forces to destabilize the adversary
and to damage the performance of the adversary’s organization. The commander desires to identi-
fy the terrorists command structure, key leader; assess their capability; and identify weaknesses;
current technologies do not support these desires. At best, the commander might know historic
activities, and most of the web of connections among known terrorists.

By taking a dynamic network analytic approach and focusing on how to identify, reason about,
and break 1) the adversary’s decision making structure, 2) the likelihood that the adversary can
engage in key tasks; and 3) the adversary’s over-time social and geospatial behavior, we can be-
gin to make headway in reasoning about this complexity and adaptivity. I develop four different,
interoperable approaches supporting this assessment and estimation on adversarial organizations.
These four approaches analyze different aspects of an organization, i.e. the core decision making
structure, the high level assessment of task completion likelihood and the micro level simulation
of the behavior of adversaries. By unifying these approaches, we can grasp a complete picture of
the target as well as the destabilization strategies against it. First, I estimate the decision making
structure of the organization, apply dynamic analysis metrics to it, and identify critical terrorists
to be removed. This decision making structure is a trimmed organizational structure expected to
be the critical command structure of the adversaries. Second, I extract an influence network for
the key tasks. This is an assessment about the organizational support for the adversaries’ mission.
Third, I use a multi-agent simulation (JDynet) to analyze organizational change. I simulate the
CMU SCS ISR -2 - CASOS Report
adversaries’ social interactions and task execution behavior. Also, I create and test simulation
scenarios of removing key adversaries over the course of simulations. This estimates the damage
that we can inflict on the adversarial organization with interventions. Fourth, I augment a geospa-
tial component to JDynet, so the relocations of personnel and resources are included in the desta-
bilization analysis. I use the geo-spatial-JDynet to simulate the strategic intervention effects with
a joint picture from adversaries’ social and geospatial behavior.

To ground and demonstrate this research, I use, primarily, three adversarial organizations, the
terrorist networks responsible for 1998 US embassy bombing in Tanzania and Kenya; 1998 US
embassy bombing in Kenya; and a global terrorist network. These are adversarial organizational
structures including a task dependency network for mission execution; geospatial terrorist, re-
source and expertise distributions; and terrorist social networks. I regard these datasets as an ob-
served target adversarial structure and provide analyses results that are basis for destabilization
strategies.

My research makes contribution at theoretical, technical and empirical levels. First, I provide a
theory of how to create a joint picture from different organizational and computational theories. I
create theories to merge various existing theories, i.e. merging multi-agent simulations and dy-
namic network analysis, dynamic network analysis and Bayesian network, dynamic network
analysis and decision making structure, etc. This theoretical advancement provides a joint
thought and analysis process about reasoning organizational behavior to managers, commanders
and intelligence analysts. Second, I develop and test an interoperable analysis framework sup-
ported by the suggested joint theory. This analysis framework is realized by expanding an analy-
sis system (Organization Risk Analyzer), so that real world analysts can apply the suggested
theory to their target organizations. Third, I empirically analyze three adversarial organizations to
demonstrate the usage of this framework and the newly enabled analysis results. For example, the
CMU SCS ISR -3 - CASOS Report
newly enabled analysis approaches estimate Bin Laden considered as a non-critical terrorist in the
U.S. Embassy Bombing in Tanzania and Kenya based on the existing dataset and approach is an
actual critical contributor over the mission execution.

This unifying theory and framework for adversarial destabilization, a partially automated intelli-
gence analysis capability, 1) provide intelligence analysis results that can meet the operation tem-
po in the real world, 2) bridge dynamic network analysis and various inference theories, and 3)
provide a better tool that human analysts may use to reduce their time and cost of destabilization
analysis.

CMU SCS ISR -4 - CASOS Report
Acknowledgement

I thank God for allowing me to complete this thesis.

Supports for this work came in part from the below research funding of various agencies.

 CAPES project of Air Force Office of Scientific Research (AFOSR, FA8650-07-C-6769)
 MURI project of Air Force Office of Scientific Research (AFOSR, FA9550-05-1-0388)
 DNA project of Office of Naval Research (ONR, N00014-06-1-0921, N00014-06-0104)
 Geospatial analysis project of ERDC-TEC, Army Research Institute (ARI,
W911NF0710317)
 SPARWAR project of Naval Warfare Center (N0016403D6623)

Additional support came from Carnegie Mellon University’s Center for Computational Analysis
of Social and Organizational Systems (CMU CASOS). Finally, George Mason University’s Sys-
tem Architectures Laboratory (GMU SAL) provided valuable support. The views and conclusions
in this thesis should not be interpreted as representing the official policies, either expressed or
implied, of AFOSR, ONR, ARI or the U.S. government.

This thesis is completed because I was able to get help from three predecessors. Dr. Kathleen M.
Carley is my academic advisor, and she enabled this work by her previous work on the multi-
agent social modeling, the dynamic network analysis approach, the meta-network concept, etc.
She is also a mentor who I will thank during my life time. I thank her for her advice on various
matters, academic, research, job, etc. Time-to-time, i.e. a long drive from DC to Pittsburgh, early
morning at a hotel lobby or meetings in her office, I had chances to talk to her about research,
personal life, etc. She is a very enthusiastic researcher and advisor with a warm heart. Dr. Alex-
ander H. Levis is another predecessor who developed many models that I used in this thesis. I met
him when the MURI project started about three years ago. He makes comments and questions
that go directly to the center of a problem or a task. I am glad to have his comments and questions
about my works because those improve my research a lot. Dr. Lee Wagenhals is the one who de-
veloped the Influence Network Analysis approach, which is used heavily in this thesis. He is also
a nice researcher who reviewed my work and advised me with potential usages. I enjoyed work-
ing with him.

I want to thank Dr. John Graham and Dr. Jim Herbsleb. They are my thesis committee members
and provided me valuable comments. Dr. John Graham gave me good comments about the do-
main that I discuss in this thesis. Dr. Jim Herbsleb gave me unbiased comments that enabled me
to think about the potential applications of my work to industries.

I thank CASOS members for every support that they gave to me. They have been great work col-
leagues, team mates, reviewers, and friends.

I thank for my family and friends. I know that they know that I love them. Also, they know that I
know that they love me.
CMU SCS ISR -5 - CASOS Report
Table of Contents 

1.  Introduction ........................................................................................................................... 13 
1.1.  Integrated framework and potential applications ......................................................... 16 
1.2.  Illustration of usages of integrated framework ............................................................. 17 
1.3.  Complex adaptive organization and adversarial organizations ..................................... 19 
1.4.  Representation of Organizations of Interests: Meta‐Networks .................................... 20 
1.5.  Analysis Component 1: Decision Making Structure Analysis ......................................... 20 
1.6.  Analysis Component 2: Influence network analysis ...................................................... 21 
1.7.  Analysis Component 3 and 4: Multi‐agent simulation and its geo‐space enabled 
version 22 
1.8.  Strategic intervention and destabilization ..................................................................... 24 
1.9.  Thesis organization ........................................................................................................ 25 
2.  Requirements of Integrated Destabilization Analysis ............................................................ 26 
2.1.  Critical aspects of an adversarial organization in destabilization analysis .................... 26 
2.1.1.  The nature of traditional organizations and their destabilization ........................... 26 
2.1.2.  The nature of adversarial organizations of interest and their destabilization ......... 28 
2.1.3.  Real world destabilization cases of adversarial organizations ............................... 34 
2.2.  Existing destabilization analysis approaches ................................................................. 35 
2.2.1.  The definition of destabilization ............................................................................ 35 
2.2.1.1.  The concept of destabilization ........................................................................... 35 
2.2.1.2.  Levels of destabilization .................................................................................... 36 
2.2.2.  Existing destabilization analysis approaches ......................................................... 37 
2.2.2.1.  Dynamic network analysis ................................................................................. 37 
2.2.2.2.  Decision making structure analysis .................................................................... 38 
2.2.2.3.  Influence network analysis................................................................................. 39 
CMU SCS ISR -6 - CASOS Report
2.2.2.4.  Multi-agent simulation ....................................................................................... 39 
2.2.2.5.  Problems in using these approaches ................................................................... 40 
2.3.  Summary of Identified Requirements and Selected Destabilization Approaches to 
Satisfy the Requirements ........................................................................................................... 41 
3.  Integrated Destabilization Analysis Framework .................................................................... 43 
3.1.  Overview of the integrated analysis system .................................................................. 44 
3.2.  A type of input dataset – Meta‐network of an adversarial organization ...................... 45 
3.3.  A type of output result – Assessment on adversarial organization and its 
destabilization effect estimation ............................................................................................... 46 
3.4.  Interoperability among analysis approaches ................................................................. 46 
3.5.  Dataset transformation to support the interoperations ............................................... 46 
3.6.  Enabled destabilization analysis by interoperations ..................................................... 47 
3.7.  Potential challenges in the integration .......................................................................... 48 
4.  Dataset for Empirical Analysis................................................................................................ 50 
4.1.  Meta‐Network for Representing an Organizational Structure ...................................... 50 
4.2.  1998 US Embassy Bombings in Kenya and Tanzania ..................................................... 52 
4.3.  1998 US Embassy Bombing in Kenya ............................................................................. 54 
4.4.  Global terrorist network ................................................................................................ 56 
5.  Building Static Destabilization Strategies – Decision making structure Analysis ................... 58 
5.1.  Background about Integration of Dynamic Network and Decision Making Structure 
Analyses ..................................................................................................................................... 60 
5.1.1.  Inferring a decision making structure from a complex system of an organization 60 
5.1.2.  Assessing vulnerabilities and criticalities of the organizational structure ............. 61 
5.2.  Method .......................................................................................................................... 62 
5.2.1.  Extracting a decision making structure from a meta-network ............................... 63 
5.2.1.1.  Limiting a task network and finding decision makers ....................................... 64 
5.2.1.2.  Information sharing structure ............................................................................. 65 
CMU SCS ISR -7 - CASOS Report
5.2.1.3.  Result sharing structure ...................................................................................... 68 
5.2.1.4.  Command interpretation structure ..................................................................... 68 
5.2.2.  Assessing a network structure with measures ........................................................ 69 
5.3.  Application ..................................................................................................................... 70 
5.3.1.  Initial result and descriptive statistics .................................................................... 70 
5.3.2.  Embedded decision making structures in an observed meta-network ................... 72 
5.3.3.  Personnel with different levels of importance in structures ................................... 73 
5.3.4.  Personnel clusters with similar characteristics ....................................................... 76 
5.4.  Conclusion ...................................................................................................................... 78 
6.  Building Macro‐level Destabilization Strategies – Influence Network Analysis .................... 81 
6.1.  Background about the Integration of the Dynamic Network and the Influence Network 
Analyses ..................................................................................................................................... 82 
6.1.1.  Influence network used in the real world ............................................................... 82 
6.1.2.  Traditional management methodologies for task completion and found critical
factors  83 
6.2.  Method – Generating an influence network from a meta‐network .............................. 84 
6.2.1.  Overall structure of a generated influence network ............................................... 85 
6.2.2.  Task network .......................................................................................................... 88 
6.2.3.  Task importance ..................................................................................................... 89 
6.2.4.  Task complexity ..................................................................................................... 89 
6.2.5.  Personnel sufficiency ............................................................................................. 90 
6.2.6.  Available resources ................................................................................................ 90 
6.2.7.  Accessible expertise ............................................................................................... 91 
6.2.8.  Difference among meta-network, traditionally created influence network, and
automatically generated influence networks .......................................................................... 91 
6.3.  Application ..................................................................................................................... 92 
6.3.1.  Evaluation of task completion likelihoods ............................................................. 93 
CMU SCS ISR -8 - CASOS Report
6.3.2.  Design of computational experiments for various settings .................................... 95 
6.3.3.  Task completion likelihoods under computational experiment settings ................ 98 
6.4.  Conclusion .................................................................................................................... 102 
7.  Building Micro‐level Destabilization Strategies ‐ Simulating the Social Behavior of 
Adversaries................................................................................................................................... 104 
7.1.  Simulation model description ...................................................................................... 105 
7.1.1.  Agent social behavior........................................................................................... 108 
7.1.2.  Selecting an interaction partner agent .................................................................. 109 
7.1.3.  Transfer an organizational element or a delivery request .................................... 110 
7.1.4.  Take-over the removed agent’s expertise, resource, task and social contacts ..... 111 
7.1.5.  Perform an assigned task...................................................................................... 112 
7.2.  Virtual experiment design ............................................................................................ 113 
7.2.1.  Remove an agent specified in the intervention sequence ..................................... 114 
7.2.2.  Performance measures ......................................................................................... 114 
7.3.  Result ........................................................................................................................... 116 
7.3.1.  Impact to performance measures ......................................................................... 116 
7.3.2.  Impact to task completion timing ......................................................................... 120 
7.3.3.  Agent interactions during simulations ................................................................. 123 
7.3.4.  Key individuals over the course of simulations ................................................... 126 
7.4.  Implementation of the social simulation model .......................................................... 129 
7.4.1.  Simulation model iteration management ............................................................. 129 
7.4.2.  Social interaction logics ....................................................................................... 130 
7.4.3.  Knowledge of space ............................................................................................. 131 
7.4.4.  Task execution logics ........................................................................................... 132 
7.4.5.  Link to the previous description ........................................................................... 132 
7.5.  Conclusion .................................................................................................................... 134 
CMU SCS ISR -9 - CASOS Report
8.  Building Micro‐level Destabilization Strategies ‐ Simulating the Social and Geospatial 
Behavior of Adversaries ............................................................................................................... 137 
8.1.  Simulation model description ...................................................................................... 137 
8.1.1.  Agent social and geospatial behavior ................................................................... 139 
8.1.2.  Selecting a location to move ................................................................................ 140 
8.1.3.  Regional resource and information gathering ...................................................... 141 
8.1.4.  Take-over the removed agent’s expertise, resource, task and social contacts 
considering the regional distribution.................................................................................... 142 
8.1.5.  Perform an assigned task considering the geospatial dimension ......................... 142 
8.2.  Virtual experiment design ............................................................................................ 143 
8.3.  Result ........................................................................................................................... 143 
8.3.1.  Impact to performance measures ......................................................................... 144 
8.3.2.  Impact to mission and task completion timing .................................................... 148 
8.3.3.  Agent movements and interactions during simulations ....................................... 151 
8.3.4.  Key individuals over the course of simulations ................................................... 157 
8.4.  Simulation result comparison between the social only model and the social and 
geospatial model ...................................................................................................................... 160 
8.5.  Implementation of the social and geospatial simulation model ................................. 162 
8.5.1.  Updated social interaction logic ........................................................................... 163 
8.5.2.  Updated knowledge of space ............................................................................... 164 
8.5.3.  New geospatial movement logic .......................................................................... 164 
8.5.4.  Updated task execution logic ............................................................................... 165 
8.5.5.  Simulation flow .................................................................................................... 165 
8.6.  Conclusion .................................................................................................................... 167 
9.  Case Study –  How To Use the Integrated Analysis Framework to Analyze the Terrorist 
Organization Responsible for the U.S. Embassy Bombing Incidents in Kenya and Tanzania ...... 170 
9.1.  Summary of the Integrated Framework Usage ........................................................... 170 
CMU SCS ISR -10 - CASOS Report