Compared to other types of social networks, criminal networks present particularly hard challenges, due to their strong resilience to disruption, which poses severe hurdles to Law-Enforcement Agencies (LEAs). Herein, we borrow methods and tools from Social Network Analysis (SNA) to (i) unveil the structure and organization of Sicilian Mafia gangs, based on two real-world datasets, and (ii) gain insights as to how to efficiently reduce the Largest Connected Component (LCC) of two networks derived from them. Mafia networks have peculiar features in terms of the links distribution and strength, which makes them very different from other social networks, and extremely robust to exogenous perturbations. Analysts also face difficulties in collecting reliable datasets that accurately describe the gangs’ internal structure and their relationships with the external world, which is why earlier studies are largely qualitative, elusive and incomplete. An added value of our work is the generation of two real-world datasets, based on raw data extracted from juridical acts, relating to a Mafia organization that operated in Sicily during the first decade of 2000s. We created two different networks, capturing phone calls and physical meetings, respectively. Our analysis simulated different intervention procedures: (i) arresting one criminal at a time (sequential node removal); and (ii) police raids (node block removal). In both the sequential, and the node block removal intervention procedures, the Betweenness centrality was the most effective strategy in prioritizing the nodes to be removed. For instance, when targeting the top 5% nodes with the largest Betweenness centrality, our simulations suggest a reduction of up to 70% in the size of the LCC. We also identified that, due the peculiar type of interactions in criminal networks (namely, the distribution of the interactions’ frequency), no significant differences exist between weighted and unweighted network analysis. Our work has significant practical applications for perturbing the operations of criminal and terrorist networks.

Covert networks refer to criminal organizations that operate outside the boundaries of the law; they can be mainly classified as terrorist networks and criminal networks. We consider how Social Network Analysis (SNA) is used to analyze such networks in order to attain a greater knowledge of criminal behavior. In fact, SNA allows examining the network structure and functioning by computing relevant metrics and parameters to identify roles, positions, features, and other network functioning that are not otherwise easily discovered at first glance. This is why Law Enforcement Agencies (LEAs) are showing growing interest in SNA, which is also used to identify weak spots and disrupt criminal groups. This paper provides a literature review and a classification of methods and real-case applications of disruption techniques. It considers covert network adaptability to such dismantling attempts, herein referred to as resilience. Critical problems of SNA in criminal studies are discussed, including data collection techniques and the inevitable incompleteness and biases of real-world datasets, with the aim of promoting a new research stream for both dismantling techniques and data collection issues.

Social Network Analysis (SNA) is an interdisciplinary science that focuses on discovering the patterns of individuals interactions. In particular, practitioners have used SNA to describe and analyze criminal networks to highlight subgroups, key actors, strengths and weaknesses in order to generate disruption interventions and crime prevention systems. In this paper, the effectiveness of a total of seven disruption strategies for two real Mafia networks is investigated adopting SNA tools. Three interventions targeting actors with a high level of social capital and three interventions targeting those with a high human capital are put to the test and compared between each other and with random node removal. Similar tests on artificial model networks have also been carried out. Simulations show that actor removal based on social capital proves to be the most effective strategy, by leading to the total disruption of the criminal network in the least number of steps. The removal of a specific figure of a Mafia family such as the Caporegime seems also promising in the network disruption.

Data collected in criminal investigations may suffer from issues like: (i) incompleteness, due to the covert nature of criminal organizations; (ii) incorrectness, caused by either unintentional data collection errors or intentional deception by criminals; (iii) inconsistency, when the same information is collected into law enforcement databases multiple times, or in different formats. In this paper we analyze nine real criminal networks of different nature (i.e., Mafia networks, criminal street gangs and terrorist organizations) in order to quantify the impact of incomplete data, and to determine which network type is most affected by it. The networks are firstly pruned using two specific methods: (i) random edge removal, simulating the scenario in which the Law Enforcement Agencies fail to intercept some calls, or to spot sporadic meetings among suspects; (ii) node removal, modeling the situation in which some suspects cannot be intercepted or investigated. Finally we compute spectral distances (i.e., Adjacency, Laplacian and normalized Laplacian Spectral Distances) and matrix distances (i.e., Root Euclidean Distance) between the complete and pruned networks, which we compare using statistical analysis. Our investigation identifies two main features: first, the overall understanding of the criminal networks remains high even with incomplete data on criminal interactions (i.e., when 10% of edges are removed); second, removing even a small fraction of suspects not investigated (i.e., 2% of nodes are removed) may lead to significant misinterpretation of the overall network.