Project MacDuff:
Network Disruption
Frank C. Mahncke
Chief Analyst
Joint Warfare Analysis Center
Dahlgren, Virginia
540-653-1872
Mahncke@aol.com
THIS PAPER IS
19th ISMOR: Oxford, UK
UNCLASSIFIED
27-30 August 2002
UNCLASSIFIED
Project MacDuff Overview
• Objective:
– Identify network vulnerabilities and concepts for potential
operations against them
– Apply organizational science concepts to the disruption of
opponent networks
• Process: Workshops with Academics and Military
–
–
–
–
Enablers of Emergence
Case Studies
Network Models and Simulations
Vulnerabilities and “Rules of Thumb” for Operations
UNCLASSIFIED
UNCLASSIFIED
Project Participants
• Academia & Consultants
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
UNC – Chapel Hill
U of Arizona
Boston College
Carnegie-Mellon
Clemson
Emory University
U of Nevada
U of Pittsburgh
U of Texas
Alidade
Aptima
Morgan Chase
NYMX
Orgnet
SAIC
• Government
–
–
–
–
JWAC
OSD Net Assessment
OSD SOLIC
MCWL
UNCLASSIFIED
UNCLASSIFIED
Enablers of Emergence
•
•
•
•
•
Search Agents (different models, diversity)
Search Process (protected)
Connections (external, internal)
Selection Mechanism
Time & Resources
Desert Storm v. Somalia
UNCLASSIFIED
UNCLASSIFIED
Case Studies: European Terrorists
• Three Generations
– Charismatic
– Professional
– National Servicemen
• Characteristics
– high loss tolerance
– autonomous cell structure
– ingenious
• Failure
– erosion of the “cause”
– failure to regenerate and recruit
UNCLASSIFIED
UNCLASSIFIED
Social Network Example
Highest Centrality
Highest Cognitive Load
Emergent Leader
UNCLASSIFIED
UNCLASSIFIED
Leadership Removal: Cellular Networks
Leadership Removal
Central v. Cognitive
Removal v. Time
.98
.98
Remove 20
people out
of 100 at
time 15
.97
.97
.96
.96
.00
1.00
N = 20
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
2020
20
.00
4.00
2.00
8.00
6.00
12.00
10.00
16.00
14.00
20.00
18.00
24.00
22.00
28.00
95% CI PERF
.95
.94
Remove 15 at time 15
KT
KL
The Most Central
Agents
.95
The Cognitive
Leaders
.94
.00
1.00
N = 50
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
5050
50
.00
4.00
2.00
26.00
8.00
6.00
12.00
10.00
16.00
14.00
20.00
18.00
24.00
22.00
28.00
Remove 15, 1 each time
period
26.00
ROUND
ROUND
Implication:
 remove cognitive leadership first
 steady removal over time
UNCLASSIFIED
UNCLASSIFIED
Centrality and Betweeness
centrality
betweeness
UNCLASSIFIED
Activity Networks
• Network activities can be
– mutually supportive, or
– in conflict
Community
Service
• Unexpected loads in high
stress situations can cause
network breakdown
Special
Events
Customer Service
Stocking
Physical
Maint.
Administratio
n
Merchandisin
g
Intelligence
Vendors &
DSD
Regulatio
n
Managing
People
UNCLASSIFIED
UNCLASSIFIED
Notional Terrorist Activity Network
Most Disruptive
Disrupt Simultaneously
UNCLASSIFIED
UNCLASSIFIED
A Few Rules of Thumb
for
Disrupting Networks
UNCLASSIFIED
UNCLASSIFIED
Scouting Networks
• Some indications that full knowledge of the
net is not needed to begin action
• Watch, stimulate “high betweeness” players
– activation of activity network leads to communication
– no damage to the network
– no reformation or adaptation of the network
UNCLASSIFIED
UNCLASSIFIED
Disrupting Cellular Networks
• most disruption:
cognitive leaders across network
• some disruption:
central leaders across network
• small or random removals have small effect
• cellular networks are robust !
UNCLASSIFIED
UNCLASSIFIED
Time Pacing Disruption
• Disruption requires multiple and
sustained attacks
• Takes time to show impact
• Networks recover by:
– reorganization
– new agents
• Covert networks: slower recovery
UNCLASSIFIED
UNCLASSIFIED
Disrupting at the Seams
• Seams: where the organization interacts with:
– major internal sub-organizations
– the outside world
• Disrupt at:
– functional seams
– organizational seams
– boundaries
• recruiting sources
• outside support structure
UNCLASSIFIED
UNCLASSIFIED
Notional Terrorist Network Seams
UNCLASSIFIED
Disrupting Social Capital
• Trust is critical to terrorist groups
• Disruptions of trust:
– deny leadership ability to create new links/reinforce
old ones
– inject elements of distrust in a paranoid organization
• plant people and organizations to sew distrust
– capitalize on less-violent sub-networks
UNCLASSIFIED
UNCLASSIFIED
Disrupting Network Adaptivity
• Deny
– search
– connections
– time & resources
• Attack innovative parts of the network
• Attack cohesion within network
– break links between it and other organizations
• Attack redundancy
UNCLASSIFIED
UNCLASSIFIED
Disrupting Activity Networks
• Simultaneous attacks on the security,
operations, recruiting, operations
funding, and logistic support foci appear
promising
• Attacks on public relations, strategic
alliances, institutional funding, and
community relations have little effect
UNCLASSIFIED
UNCLASSIFIED
Network Vulnerabilities (pro-tem)
• Leadership
• Seams
• Social Capital
• Adaptivity
• Activity Links and Nodes
UNCLASSIFIED
UNCLASSIFIED
Potential Future Research
• Activity Links and Nodes
• Leadership Dimensions
• Network Seams
• Social Capital Disruption
• Adaptivity Denial
• Intelligence Depth Required
• Covert Network Characteristics
UNCLASSIFIED