Tag: open source intelligence

Terrorism On The Web

Anwar al-Awlaki

Anwar al-Awlaki (born April 22, 1971 in Las Cruces, New Mexico) is an American Muslim lecturer, spiritual leader, and former imam believed to be a senior talent recruiter and motivator “for al-Qaeda and all of its franchises.” With a blog and a Facebook page, he has been described as the “bin Laden of the Internet.”  He is currently believed to be in Yemen and has been linked to two recent terrorist events (Ft. Hood shooter and the underwear bomber). In this post we’ll analyze Awlaki’s evolution, influence and momentum on the web.


Below we can see his links to these events are evident in the web.

Anwar al-Awlaki link analysis

Click to expand

Anwar al-Awlaki Link Analysis

Click to expand

When we analyze al-Awlaki with Recorded Future open source intelligence data we see some interesting trends. Below we see a time-line showing Awlaki’s momentum online (the curved gray line) from June 2009-June 2010. We can see that at the beginning of 2009 Awlaki had very little notoriety on the Internet — was able to gain momentum following two high profile terror incidents, and is currently losing momentum.

On 07APR10 news broke that a C/K order was issued for Awlaki, and one could assume that this is likely a contributor to the drop in his momentum online:

U.S. citizen Anwar Awlaki added to CIA target list
The Obama administration has authorized the CIA to capture or kill the New Mexico-born Muslim cleric believed to be in Yemen. He is thought to have taken on an operational role in terrorist plots…(LA Times)

Awlaki Momentum Online

Click to enlarge

The  Ft. Hood shooting took place on 5NOV09, this was the first time Awlaki was publicly linked to a terrorist incident since 9/11 (when hijackers Nawaf al-Hazmi and Khalid al-Mihdhar arrived in San Diego in mid-2000, they attended a mosque Awlaki ministered at). Even after 9/11 he was not well known enough to garner major media attention or a large following. Note the low momentum between 2001-2006 below.

Anwar Awlaki link analysis

Anwar Awlaki momentum

Anwar Awlaki momentum in the blogosphere

Momentum in the blogosphere increases

The above visualizations show momentum (curved line) as well as media sources (stacked bars; red=blogs, blue=mainstream media). We can see that traditional news-media coverage of Awlaki was very high following the Ft. Hood shooting, while his blog coverage was relatively low. However, following the Ft. Hood attack, he picked up significant momentum in the blogosphere heading into DEC09.  Awlaki may have gained such momentum because he is one a handful of radical clerics who have the respect of traditional extremists (think bin Laden and crew) while also having the ability to reach out to the English speaking world (as he proved through his talks with Ft. Hood shooter Maj. Nadal Hassan).

On 28DEC09, following consultation with Awlaki, Umar Farouk Abdulmutallab (the underwear bomber) attempted to detonate an explosive device while on-board a flight to Detroit. (See spike below) As the trend line shows, following the attempted airline bombing, traditional media was all over the event; which may have lead to his increase in coverage on the blogosphere for the next 2 months.

Following the attempted airline bombing

Following the attempted airline bombing, increase in coverage on the blogos for the next 2 months

He continued to grow in references in blogs throughout March, however, on 07APR10 the United States Government issued the C/K order (a first of it’s kind against a US citizen) for Awlaki. Following the issue of the C/K mission, his traditional media covered increased, while his coverage in blogs decreased (see below). It’s possible this shows the impact of this policy decision and announcement in the press. It’s also likely that those following Awlaki’s activities have realized that they could be targeted for C/K missions or targeted for surveillance. It remains to be seen if he was able to inspire any other terrorist actors, or what will happen to his trend should he be captured or killed.

Online Terrorism Analysis

Online momentum drop


Has Hu Jintao’s Behavior Changed?

As we’ve noted previously, Hu Jintao was a very active traveller in 2009 and an active participant in international meetings. However – after his non-appearance at the global warming summit in Copenhagen (when he was busy doing energy deals in Kazakhstan and Uzbekistan) his travel activity has decreased, his coverage in media as fallen, and finally, his external communications have plummeted.

We will explore these patterns using open source intelligence and discuss their potential implication.

The “official view” on change in leadership in China is that in 2012 both Hu Jintao and Wen Jiabao will step down (when Hu’s maximum tenure is up, by the time of the 18th party congress), and the current vice president Xi Jingping will step up to become the new president. We can very easily see this in Recorded Future by just typing EmploymentChange Hu Jintao Future – and get the below result.

Recorded Future Employment Change

Click to enlarge

For updates on the future of Hu Jintao, click the below link and fill in your email address – and you’ll be subscribed to a Future for Hu Jintao (very easy to unsubscribe!).

Travel Patterns

First we review the travel patterns of Hu Jintao in 2009-10 by posing the question Person Travel Hu Jintao 2009-01-01–2010-12-31. We can visually inspect how President Hu’s travel has shrunk across 2009 and even come to a stand still lately (including uncertainty around a trip to the US in April for a key nuclear weapons summit). In 2009 Hu visited a whole set of countries, key meetings, and world leaders.

Timeline of Hu Jintao travel.

Timeline view of Hu Jintao travel.

We can also export these travel patterns to Google Earth to visually and geographically review where President Hu has travelled across time. Click here to explore Hu Jintao’s travel patterns in Google Earth.

Travel arcs over Google Earth

Travel patterns over Google Earth

To stay abreast of Hu Jintao travel click the below link to subscribe to a Future on travels of Hu Jintao.

Personal Communication

Personal Communications include meetings, phone calls or direct verbal communications – that Recorded Future picks up in news, blogs, government filings, speeches, etc. Just like we reviewed travel patterns we can review the personal communications of Hu Jintao. During 2009 we recorded a large number of public communications including Hu Jintao.

Hu Jintao Network Graph

However, in the first quarter of 2010, Hu Jintao’s public communications seem to have come to a halt as well, with only a few interactions being recorded, including Russian premier Putin, head of North Korea Kim Il, Barack Obama, and Harmid Karzai who recently visited in Beijing.

Hu Jintao Communications Patterns

Fewer Public Communications for Hu Jintao

Quantitative analysis of media flow

Now, the above analysis of reviewing travels and communication patterns may be quite insightful and compelling, however it might be that we miss signals that requires more rigorous quantitative analysis. The below plot shows the volume of media flow on Hu Jintao across the world – in a so called SPC chart allowing us to find extreme levels of media flow – when it goes outside say 3 standard deviations or when there is an improbable run of higher or lower than average levels of media flow. The data is normalized and low media flow/weekend days are omitted in an attempt to show “true outliers”.

The visualization is produced in R using the Recorded Future API. We will shortly share an entry in the Predictive Signals blog on how these were done.

An interesting note: from the end of 2009 President Hu seems to be disappearing off the face of the earth compared to earlier. We can’t answer exactly why – but clearly it is a signal that correlates with the above patterns of communication and travel.

R Process Chart of Recorded Future Data

R Process Chart of Hu Jintao on the web.

Now then, when comparing, on a normalized basis, Hu Jintao to Wen Jiabao it gets even more interesting. Whereas both them had a “media lull” around Christmas/Chinese New Year, Wen Jiabao has had an upwards trend in general and has come back strongly after the holidays. We might try to draw some “big conclusion” from that, but probably too early.

R Process Chart for Wen Jiabao

Wen Jiabao in the media.

Detecting co-occurrence in media flow

Finally we will explore media co-occurrence of key Chinese leaders over time, to see if we can find anything interesting regarding who is clustering in their behavior. To identify the key Chinese leaders along with Hu Jintao and Wen Jiabao, we consulted the CIA World Factbook/Word Leaders on China and extracted a set of key leaders with good coverage in Recorded Future. The below visualization (done in R) displays a dendrogram with Chinese leader clusters who’s behavior is similar in terms of media coverage over time (i.e. reaches peaks and lulls at same times). The theory would be that co-occurring in media systematically could infer subtle patterns alignment in behavior – such as part-taking in same events, travelling together, co-occurring in same speeches, etc.

Perhaps the most interesting thing is to look at Xi Jinping, the rumoured president to be. By exploring who clusters closely to him we might be able to find clusters of politicians that are close to him that we should watch in terms of their behavior and actions. Yin Weimin clusters the closest, his current portfolio is modest. Yang Jiechi, minister of foreign affairs, has had much more strong views on the US and its relationship to the China. Definitely worth watching.

Clustering of Chinese individuals in the media.

Clustering of Chinese individuals in the media.

Conclusion – using media behavior as a proxy for real life behavior

Hu Jintao is a very powerful leader – in fact has been noted to be one of the most powerful in the world. Knowing who takes over after him is of paramount importance. If everything goes to plan and he stays in place until 2012 we will have plenty of time to get ready. If something happens before then we’d want to detect such signals early. That’s what we have tried to demonstrate here – how you can detect differences in behavior – travel and communication behaviors, as well as media behavior which is an indirect way of detecting change – be it association with others, activity level, etc.

There is much to do from here – such as

  • Deepening the data set to include a wider variety of people beyond what’s in the CIA World Factbook, such as military, corporate, and local leaders (e.g. mayors in China are quite powerful) – as well as actual Chinese language media
  • Normalizing across the set of people in focus rather than the whole media flow
  • Cluster people based on not only momentum in media but also factors like sentiment. Who is angry at the same time?

The Predictive Signals blog will soon run a deeper analysis of this and demonstrate some of the techniques in detail.


Definition of Intelligence Analysis

We like the definition of intelligence analysis in Wikipedia – pretty amazingly good match with our project!

Intelligence Analysis is the process of taking known information about situations and entities of strategic, operational, or tactical importance, characterizing the known, and, with appropriate statements of probability, the future actions in those situations and by those entities

Sets a good bar for Recorded Future! Situations is a great way to think about events – and being able to characterize the known and future actions in those situations – not bad!


Intelligence: Early Warning Signs of Conflict

“In a way, it has become a holy grail to come up with ways to identify potential conflict before it actually erupts. Based on similar efforts to predict natural disasters and crop yields, for example, many have attempted to construct models for conflict early warning.”
- Eric Brahm, CRInfo

Based on this research publications compiled by CRInfo – The Conflict Resolution Information Source, these areas stand out as those worth monitoring for potential early warning signals to conflict:

  • sudden demographic changes and population displacement;
  • rising unemployment rates;
  • economic shocks or financial crises;
  • destruction or desecration of religious sites;
  • discrimination or legislation favoring one group over another;
  • government “clamp-downs”;
  • destabilizing referenda or elections;
  • a rise in “societal” intolerance and prejudice;
  • an increase in numbers of demonstrations or rallies;
  • foreign intervention;
  • an influx of refugees
  • drought and famine

Currently a tremendous amount of research and attention is being dedicated to the last bullet: drought and famine. Even the CIA has opened a Center On Climate Change to asses the “national security impact of phenomena such as desertification, rising sea levels, population shifts, and heightened competition for natural resources.” Simply put, there is significant and mounting evidence that climate change impacts nation state stability and is a contributing factor to conflict throughout the world. It seems rational that droughts will lead to crop shortages, which in turn lead to famine, which then contributes to instability of nation states and potentially conflict.

If we can spot these signals, or early warning signs through open source intelligence with Recorded Future we can better prepare policy makers, humanitarian aid works, and national security intelligence officials.

Using our geo overlay we can see a high-level view of drought around the world. India clearly stands out as a hot spot (click the map to zoom in).

With the dynamic charting capability we can focus our analysis more narrowly on drought only in India. Based on this increase in activity it may make sense to focus more on India and look for early warning signs of decreased crop yields, food shortages, and famine.

[include file=/dashboard/j1.html]

We can also use this chart feature to get an overview of famine around the world.

[include file=/dashboard/j2.html]

Likewise we can explore events related to desertification – with for example an interesting hit on Nambia. We want to hear your ideas! Feel free to post your thoughts below.

[include file=/dashboard/j3.html]

We can use Recorded Future to monitor these topics, across the world or narrow to a specific region of interest.


Copyright © 1996-2010 Analysis Intelligence. All rights reserved.
iDream theme by Templates Next | Powered by WordPress