The Use of Similarity-based Algorithms to Predict Links in Mexican Criminal Networks

Abstract

This paper uses social network analysis (SNA) and node similarity-based algorithms to predict links in Mexico’s network of criminal organizations. We use four algorithms to estimate the likelihood that a link will be formed between two unconnected organizations in the network. We find that all four algorithms are useful to predict the formation of new connections, but that the preferential attachment algorithm performed the best given the power law-like distribution[1] of the criminal network. Further, our qualitative analysis indicates that these predicted relationships may represent existing alliances that have not been observed due to the clandestine nature of the criminal network. Thus, these link-predictive algorithms may be an important policy and intelligence tool for identifying potential missing data and allowing intelligence officials and policymakers to gain a better understanding of these network structures.

Introduction

During the past two decades, the number of criminal organizations in Mexico has spiked from fewer than 10 large cartels in 2004 to more than 150 in 2020 and 387 criminal groups in 2021.[2] Several studies have argued that the militarization and kingpin strategy of the Mexican federal government led to this dramatic increase,[3] while others have pointed to the process of political decentralization as one of the main factors.[4]

Given the context of heightened violence in the country, the configuration of alliances between these organizations provides important information about the state of Mexico’s organized crime.[5] Therefore, some important questions arise, given the current network of alliances between these organizations:

• Which new alliances are more likely to happen next?
• What is the probability that these new alliances actually happen?
• Which metrics are better suited to make such predictions?

This paper uses social network analysis (SNA) and node similarity-based algorithms to predict links in Mexico’s network of criminal organizations. We use four algorithms to estimate the likelihood that a link will be formed between two unconnected organizations in the network. We argue that, by using node similarity-based algorithms, it is possible to successfully predict the formation of new connections between criminal organizations. This could have a wide impact on the study of organized crime, from the formulation of more-efficient government policies to tackle criminal networks, to a better understanding of the underlying mechanisms by which criminal networks evolve. Further, our qualitative analysis indicates that these predicted relationships may represent existing alliances that have not yet been observed due to the clandestine nature of the illicit network. Thus, these link-predictive algorithms may be an important intelligence tool for identifying potential missing data and allowing intelligence officials and policymakers to gain a better understanding of these dark network structures.

The rest of the paper is organized by sections in which we:

1. Review the literature on social network analysis and machine-learning techniques to understand criminal networks and violence.
2. Provide the context of Mexico’s organized crime dynamic.
3. Detail the four algorithms that we use in our analysis.
4. Summarize the data and the methods we use to analyze the network and evaluate the performance of all four algorithms.
5. Show the results of our analysis and discuss the strengths of each algorithm. We determine that the preferential attachment index shows the best “area under the curve” (AUC) score, given the structure of the criminal network. In this section, we also perform a qualitative analysis of some links that are repeated across algorithms, and we determine that such links are more likely to happen.
6. Lay out the conclusions and policy recommendations stemming from our research.

Social Network Analysis and Machine Learning

Social network analysis (SNA) methodologies have become crucial for developing and adapting techniques in criminal network analysis (CNA).[6] SNA methodologies combine graph theory, which “provides the conceptual constructs, methods, and techniques for the analysis of graphs,” with the “application of analytical techniques and visualization tools developed specifically for the analysis of social and other networks.”[7] As Renée van der Hulst explains, “In addition to visualizations of network graphs, SNA is an arithmetical technique that analyzes relational patterns of nodes (actors) and connections (ties) based on mathematical computations.”[8]

The use of SNA to better understand criminal networks has become increasingly popular in law enforcement worldwide.[9] SNA methodologies are applied to a wide range of cases, from illegal cannabis operations in the Netherlands to uncovering the unintended consequences of the kingpin strategy on the Fernando Sanchez organization (better known as the Tijuana cartel).[10] Most recently, Nathan P. Jones, Irina Chindea, Daniel Weisz Argomedo, and John P. Sullivan used SNA to demonstrate differential alliance structures within Mexico’s bipolar illicit network system.[11] The differences threaded out by SNA techniques helped develop specific recommendations to weaken and disrupt each unique alliance network. Overall, there is a growing field of opportunity to use SNA methodologies alongside machine-learning techniques to better understand criminal networks and develop strategies to weaken them.

Machine learning has been applied in many different fields to produce predictions. Today machine-learning algorithms are part of our daily lives (for example, in internet search results and the facial recognition software many smartphones use).[12] Machine-learning techniques are “a set of mathematical models to solve high non-linearity problems of different topics: prediction, classification, data association, [and] data conceptualization.”[13] They manage to uncover generalizable patterns due to their ability to reveal complex structures that were not specified in advance.[14] Machine learning is closely tied to “predictive analytics,” as researchers utilize existing data to predict the likelihood of different outcomes.[15] Most importantly, machine-learning algorithms are designed to improve their performance on a given task over time as they build up their library of relevant data with more examples.[16]

Machine-learning algorithms can be either unsupervised or supervised. Most real-life applicable machine-learning algorithms use supervised variants.[17] A supervised variant is “a prediction model developed by learning a dataset where the label is known, and accordingly, the outcome of unlabeled examples can be predicted.”[18] In an unsupervised variant, on the other hand, the data is unlabeled, and the goal is to find a hidden structure from within the data.[19]

SNA and supervised machine-learning techniques are rapidly becoming critical tools for a number of fields, including:

• Law enforcement and criminal justice. In policing, machine-learning techniques are used to predict where crimes may occur based on past criminal activity.[20] A specific example of this occurs in Chicago, where the police department uses “predictive analytics to identify not only places that are particularly vulnerable to crime, but also people more likely to be involved in gun violence.”[21] Researchers can also bridge SNA methodologies and machine-learning techniques to understand criminal networks better and predict their possible evolution. In addition, courts use machine-learning techniques “to establish individual risk profiles and to predict the likelihood that a particular individual will re-offend.”[22]
• Cybersecurity. Machine-learning techniques have been successfully applied to detect malware, identify the authorship of phishing attacks, and even detect phishing emails.[23] Machine learning can also be applied to text data, which has been growing at a faster rate with the surge in internet and social media use.[24]
• National Security. Machine-learning techniques can be applied to abstract or encoded text data used to identify potential threats to national security.[25] With the rise of disinformation campaigns and foreign election interference, machine-learning techniques can be used to “automatically detect, analyze, and disrupt disinformation, weed out nefarious content and block bots.”[26]

Mexico’s Organized Crime Network Structure

Mexican organized crime is dominated by drug cartels and allied gangs that cause insecurity, challenge state solvency, and capitalize on illicit global economic flows.[27] These cartels are actually poly-crime organizations that intersect with networked criminal enterprises comprising corrupt politicians and transnational criminal organizations. Jones et al. examined the relationships and alliance structures of many of these cartel-gang networks, with an emphasis on the contrasting natures of the Sinaloa cartel and the Jalisco New Generation cartel (CJNG) networks.[28]

While some argue that drug cartels do not exist, the violence and insecurity resulting from criminal competition is all too real.[29] The violence resulting from the illicit economy (especially the drug trade) and corruption has been described in terms of crime wars and criminal insurgencies — on the one hand, criminal networks battle each other and the state and, on the other hand, alter the nature of the state and state sovereignty (as suggested by Charles Tilly[30]). The immediate result is a diminished state solvency, with insecurity compounded by weakened perceptions of state legitimacy, and a lack of state capacity.[31]

These dynamics play out in a battle for control of lucrative drug trafficking “plazas”[32] for the transshipment of drugs. These cities or areas often become the bases for criminal enclaves, where cartels enjoy territorial control and exercise criminal governance — often in league with corrupt government officials.[33]

This paper examines these dynamics with a focus on Guanajuato, the central Mexican city where the battle for criminal dominance results in a three-way competition for control of the illicit petroleum trade (called “huachicol”) between the Santa Rosa de Lima cartel (CSRL), the CJNG, and the state (including the state of Guanajuato, the Mexican government, and multiple municipalities). The situation in Guanajuato is fraught with violence as the CSRL and CJNG seek dominance of the illicit economy; their acts are often brutal and at times entail direct competition with the state.[34]

Algorithms

In this paper, we compare the performance of four of the most famous and widely used similarity-based indices. We focus on these algorithms because of their capacity to capture different forms of social capital, such as trust and expectations,[35] and access to information.[36] All these forms of social capital are fundamental for alliances to form between criminal organizations and can be good predictors of new relationships. Below are brief descriptions of each of the algorithms used.

Adamic-Adar Index

The Adamic-Adar algorithm is an improvement of the simpler algorithm that counts common neighbors. The common neighbors algorithm assumes that nodes i and j are more likely to have an edge (or link) if they have many common neighbors. The Adamic-Adar index refines simple counting by assigning more weight to less-connected neighbors[37] and is defined as:

where Sxy is the similarity score between the nodes x and y, and Γ(x) denotes the set of neighbors of x. Note that k(z) is the degree k of node z.

Resource Allocation Index

The resource allocation algorithm assumes that nodes can send resources to each other. Their common neighbors play the role of transmitters, and each transmitter has a unit of resource that will distribute equally among all its neighbors. The similarity between nodes x and y can be defined as the amount of resource y receives from x:

Both the Adamic-Adar index and resource allocation index penalize the contributions of common neighbors with high degrees.[38] The difference between them will be small if the degree, k(z), is small, and large if k(z) is large. This means that the prediction results of both of these indices will be similar when the average degree is small, while for networks with a large average degree, the resource allocation index will normally perform better.[39]

Preferential Attachment Index

Following the Barabasi-Albert model,[40] the preferential attachment algorithm is commonly used to generate evolving or static scale-free networks (with power law-degree distribution or without growth)[41], where the probability that a new link is connecting x and y is proportional to k(x) and k(y). The similarity index for this algorithm is defined as:

Because this index requires less information than all the others, it also has a minimal computational complexity. This index will be especially useful for networks that reflect the rich-club phenomenon, where large-degree nodes will be densely connected to each other, and small-degree nodes will be sparsely connected to each other.[42]

Jaccard Index

The Jaccard index is the proportion of shared nodes between A and B relative to the total number of nodes connected to both A and B. This index is defined as:

Data and Methodology

The data set we analyzed in this paper was provided by the consulting firm Lantia Consultores, which specializes in public safety, organized crime, and violence.[43] It includes data on connections between criminal organizations in Mexico in 2021. As described in a previous research paper published by the Baker Institute, the initial relational data set came in two edge lists, one with alliance (undirected) data and another with subgroup (directed) data.[44] As before, we combined the two sets for an overall sense of illicit network relations in Mexico.

While the data included 395 organized crime groups, including 387 from the alliance data and additional from the subgroup data, many of those organized crime groups were isolates with no alliances or subgroup relationships. Previous research using similarity indices to make link predictions eliminated isolates to run the analyses.[45] We decided to follow the same approach in our paper, as similarity indices can only make predictions about connected nodes.

Finally, we binarized the data. This resulted in a network that consists of 176 nodes and 227 edges. Nodes represent criminal organizations in the network, and edges represent the positive relationships between them. These positive relationships can be understood either as alliances between criminal organizations, or hierarchical relationships in which some criminal groups follow the orders of other, more powerful organizations (see Figure 1).

In SNA, embedding measures help researchers understand a whole population and how the network’s structure affects actors in the network.[46] Statistics that measure how individuals are embedded in larger social structures include density, efficiency, clustering, and transitivity (see Table 1). The present criminal network shows a low density score (0.015), which implies that there are relatively few actual connections compared to all the potential connections. The low average degree of the network (1.29) tells us that each criminal organization has, on average, just over one alliance. Likewise, the network’s low average clustering coefficient (0.140) suggests a low likelihood that two organizations allied with the same organization are themselves allied with each other.

These network statistics can be more meaningful when comparing different types of criminal networks. For instance, multiple studies show that individuals in drug trafficking networks tend to have lower path length[47] and clustering coefficients than other criminal organizations.[48] In terms of density and centrality, studies also show that drug trafficking networks, whose primary purpose is to make money, tend to favor efficiency (higher density), while networks with more ideological goals or a longer time to act, favor sparseness with fewer central actors.[49] Similarly, Dorn et al. (2005)[50] concluded that drug traffickers are driven by profit and are more likely to have a durable core in their network with several connections to diverse groups and individuals. This differs from ideologically motivated criminals, who will not show such diversity of connections.[51]

 

Figure 1 — Mexico’s Organized Crime Network (2021)

 

 

Table 1 — Network Statistics

 

 

In addition to describing the overall structure of the network, one of the primary uses of graph theory in SNA is the identification of central actors in the network.[52] Here we focus on the structural and locational properties of nodes in the network using three of the most popular centrality measures: degree, betweenness, and closeness (see Table 2). Degree centrality measures the number of connections a node has, and shows that prominent actors have the most ties to other actors in the graph.[53] Betweenness centrality measures the number of times a node lies on the shortest path between all pairs of actors.[54] This measure is typically used to identify brokerage positions in a network.[55] Finally, closeness centrality measures the geodesic distance from each node to all other actors in a network.[56] This measure is helpful when trying to identify nodes that spread things (like information) more efficiently through the network.[57]

In this specific network, the five organizations with the highest degree centrality scores are the Sinaloa cartel (0.217), the Jalisco New Generation cartel (0.211), Cárteles Unidos (0.103), the Santa Rosa de Lima cartel (0.068), and the Nueva Plaza cartel (0.051). These represent the most active organizations in terms of positive ties. The Sinaloa cartel has a history of embedding itself in dense networks and may also be doing this to balance the threat of the CJNG.[58] The CJNG has a hierarchical alliance structure that is less dense, which may explain its high degree centrality but low closeness centrality.[59] Additionally, there is an important subgroup of organizations in the Tierra Caliente region aligned with Cárteles Unidos and the Sinaloa cartel. This may explain the low position of the CJNG in terms of closeness centrality. Interestingly, three of the cartels with high closeness centrality are positioned between the CJNG and Sinaloa, despite their low degree and betweenness centralities.

 

Table 2 — Centrality Measures

 

 

Finally, the degree rank plot and the degree histogram (see Figure 2) allow us to observe a degree distribution similar to that of power law distributions. This means that the network is highly centralized, with a few nodes monopolizing the majority of the connections. This characteristic is consistent with research showing that drug trafficking networks have higher centralization and density than other criminal networks, specifically terrorist networks.[60] Other studies also show that this centralization increases with the threat of law enforcement targeting.[61]

 

Figure 2 — A Highly Centralized Criminal Network

 

 

After describing the network structure, we tested four node similarity-based algorithms on this network to see which is better for making predictions about future connections: the resource allocation index, the Adamic-Adar index, the Jaccard index, and the preferential attachment score. We split the data into test and training sets, ran 100 independent runs, and stored the highest “area under the curve” (AUC) scores achieved with each algorithm. Following the methodology proposed by Zhou et al. (2009),[62] our training set contained 90% of the links, and the test set the remaining 10%. We evaluated and compared the accuracy scores of each predictive algorithm by computing the AUC score. The AUC score can be interpreted as the probability that a randomly chosen missing link is given a higher score than a randomly chosen nonexistent link. Any score that exceeds 0.5 indicates how much better the algorithm performs than pure chance.[63]

Results

The similarity-based index with the highest AUC was the preferential attachment score (see Figure 3). This algorithm assumes that networks behave in such a way that well-connected nodes will prefer to connect to each other, while sparsely connected nodes will also prefer to connect to each other. This is also known as the “rich-club phenomenon.” Given the centrality measures of this network, it makes sense that this algorithm performs relatively better than the rest.

The Adamic-Adar index and the resource allocation index behave similarly and achieve lower AUC scores than the preferential attachment algorithm. The resource allocation index considers that each node can send a fraction of a resource (any form of social capital, for instance) through its neighbors. The difference between this algorithm and the Adamic-Adar index is that the latter penalizes neighbors that are more densely connected. In criminal networks, forms of social capital-like information, innovative ideas, and trust are key to understanding the network structure.[64] For this reason, we argue that both algorithms can be particularly useful in detecting potential new connections in this network.

Finally, the Jaccard coefficient predicts the formation of 414 new edges between 82 nodes from the original network, with a probability of 1. This approach assumes that criminal organizations are inclined to create new alliances among themselves given the shared allies they already have. It is a metric that can be related to the notion of trust and shared expectations: The more shared friends you have, the more likely you are to trust someone. An advantage of the Jaccard index is that it may be more intuitively understood than the other algorithms because it yields probabilities; interestingly, however, this index had the lowest AUC score. Figure 4 provides a visual tool to observe how each algorithm makes predictions based on different metrics, resulting in different networks.

 

Figure 3 — Comparison of AUC Scores

 

 

Figure 4 — Predicted Connections Using Four Different Algorithms

 

 

Qualitative Analysis of Predicted Connections

In the final step of our analysis, we chose the top 20 predictions from the three best performing algorithms (the preferential attachment index, resource allocation index, and Adamic-Adar index) ranked by their respective score (Table 3). Because each score is not comparable across algorithms, we focused on the predicted connections and not their scores. If any connection in this list is predicted by two or more algorithms, we assume that the new connection is likely to happen or already exists even though the original dataset does not include it.

 

Table 3 — Top 20 Predicted Alliances Across Three Algorithms

 

 

One of the edges that appeared among the top 20 Adamic-Adar and resource allocation predicted alliances was between the CSRL and La Unión León. Both of these organized crime groups operate in the state of Guanajuato, where León, the namesake of La Unión León, is a major city.

La Unión León (which since mid-2022 has called itself “Gente de León,” or People of León),[65] formed in recent years to combat the encroaching CJNG. According to La Silla Rota, it is composed of 10 small gangs that unite to oppose the Jalisco cartel.[66] The CSRL also combats the CJNG and is also operating in Guanajuato; thus, both the CSRL and La Unión León are on the same side of the bipolar conflict against the CJNG. It strains credulity that the two groups would not have already come to some arrangement to combat the CJNG, or at least established a nonaggression pact so that they could focus their resources on battling the Jalisco cartel.

Indeed, as we qualitatively assessed the data, we began to suspect that this edge could tell us something more fundamental about these edge prediction models and, more broadly, their application to dark networks. We argue here that this edge may not predict a future connection but may instead indicate an existing alliance that, due to the clandestine nature of dark networks, has not yet been observed. This is a key point. These models may not just predict future edges (in this case, alliances), but may point intelligence analysts to potential missing dark network data. This could lead to non-kinetic surveillance strategies to better understand the network and create new intelligence requirements, which could in turn generate better understandings of dark networks. Accordingly, better dark network data would allow analysts to craft better strategies to combat them.

The preferential attachment algorithm predicted an alliance between the CJNG and the Sinaloa cartel. Qualitatively this is illogical, given the bipolar conflict between the groups and the previous academic work of Irina Chindea, which discusses balancing behavior in illicit networks.[67] However, it is not surprising that an algorithm would predict this relationship between the Sinaloa cartel and the CJNG. As previous research has shown, these rivals are at war but share alliances with four organized crime groups in Mexico between them, two of which are Chinese money launderers.[68] Further, that analysis also showed that a Girvan-Newman community detection algorithm on the main component showed two subgroups that lumped the CJNG and Sinaloa cartel together. Thus, this exemplifies Kenney and Coulthart’s suggestion that automated data entry — or in this case, the automated analysis of dark networks — must be checked on some level using ethnographic methods, a form of qualitative analysis which we perform here.[69]

The alliance predicted by the preferential attachment algorithm between the Sinaloa cartel and the CSRL, meanwhile, is highly logical and may be an example of one that exists de facto if not de jure. The Sinaloa cartel and the CSRL share the same enemy — the CJNG. There has long been speculation about whether an alliance between the groups existed or was in the process of being negotiated. Nonetheless, due to their mutual enemies, it is clear that the Sinaloa cartel supports allies of the CSRL. Thus, it is highly likely that there may also be clandestine contacts and support between the groups already. If this is the case, this is another data point suggesting that these algorithms may be useful as indicators of current cartel alliances and not just of possible future connections.

Further, an alliance predicted by the Adar-Adamic and resource allocation algorithms was between Cárteles Unidos and Los Viagras — an example of an alliance we were surprised did not already exist and that, indeed, may already exist clandestinely. These groups both combat the CJNG in the Tierra Caliente region, where previous research has demonstrated a dense alliance structure.[70]

Discussion and Conclusions

Mexico finds itself in a difficult situation wherein its security forces have proven capable of kingpin strikes that can disaggregate large criminal hierarchies, but its local and state institutions lack the ability to address the many smaller predatory networks that have proven highly resilient in the overall criminal structure.[71] In this context, network analysis of the macro-organized crime structure is increasingly important. Because network analysis and machine-learning algorithms can forecast illicit network alliances, they are a valuable tool for public and private sector security services.

Our analysis demonstrates that, when applied to dark networks, predictive algorithms such as the Adar-Adamic, preferential attachment, and resource allocation indices may have impressive properties from an intelligence perspective. These algorithms may not just predict future alliances or edges within dark networks: They may also point intelligence analysts toward missing data that exists, but is not available to them due to the clandestine nature of organized crime networks. They could also improve the quality of data analytics by intelligence analysts tasked with fighting these illicit groups. As organized crime networks become increasingly enmeshed as a mechanism to expand their resilience, this type of analysis will play a critical role in combating them.

We thus recommend that policymakers and intelligence agencies incorporate these machine-learning techniques into their analysis of illicit networks. A key contribution from this analysis is the ability of predicted alliances to point us toward what is likely missing data on dark networks. This information could next be used in non-kinetic intelligence gathering strategies to confirm likely relationships, or as part of other kinetic options.[72] This important policy recommendation is based on a simple and intuitive finding, and means that these algorithms can help us to design better strategies to address complex illicit network structures. This also serves as a reminder to analysts to be aware of this acute missing data problem and to remember that dark networks are almost inevitably denser than our data suggests.

Acknowledgements

The authors would like to thank Eduardo Guerrero Gutiérrez and Roberto Valladares of Lantia Consultores for data access and Tony Payan and Lisa Guáqueta of Rice University’s Baker Institute for Public Policy for research support and data access funding. We would also like to thank the Baker Institute staff for their publishing support, including copyediting and graphics.

Endnotes

---

[1] A power law-like distribution is a type of distribution where a small number of events or values occur very frequently, and a large number of events or values occur infrequently.

[2] These figures are sourced from Lantia Consultores, a prestigious Mexican analytical firm. See Nathan P. Jones, Irina Chindea, Daniel Weisz Argomedo, and John P. Sullivan, “Mexico’s 2021 Dark Network Alliance Structure: An Exploratory Social Network Analysis of Lantia Consultores’ Illicit Network Alliance and Subgroup Data,” Research Paper (Houston: Rice University’s Baker Institute, April 11, 2022), https://doi.org/10.25613/KMGB-NC83; Nathan P. Jones, Irina Chindea, Daniel Weisz Argomedo, and John P. Sullivan, “A Social Network Analysis of Mexico’s Dark Network Alliance Structure,” Journal of Strategic Security 15(4) (2022): 76–105, https://doi.org/10.5038/1944-0472.15.4.2046; Nathan P. Jones, W. Layne Dittmann, Jun Wu, and Tyler Reese, “A Mixed Methods Social Network Analysis of a Cross-Border Drug Network: The Fernando Sanchez Organization (FSO),” Trends in Organized Crime 23(2) (2020): 154–82, https://doi.org/10.1007/s12117-018-9352-9; June S. Beittel, “Mexico: Organized Crime and Drug Trafficking Organizations” (Washington, D.C.: Congressional Research Service, June 7, 2022), https://sgp.fas.org/crs/row/R41576.pdf.

[3] Laura H. Atuesta and Yocelyn Samantha Pérez-Dávila, “Fragmentation and Cooperation: The Evolution of Organized Crime in Mexico,” Trends in Organized Crime 21(3) (2018): 235–61, https://doi.org/10.1007/s12117-017-9301-z.

[4] Joel Salvador Herrera, “The Limits of Resistance to Criminal Governance: Cyclical Violence and the Aftermath of the Autodefensa Movement in Michoacán, Mexico,” Global Crime, 2022, 1–25, https://doi.org/10.1080/17440572.2021.2024805; Viridiana Rios Contreras, “How Government Structure Encourages Criminal Violence: The Causes of Mexico’s Drug War” (Ph.D. thesis, Harvard University, 2012), http://search.proquest.com/docview/1417075396?accountid=7064.

[5] Jones et al., “A Social Network Analysis of Mexico’s Dark Network Alliance Structure.”

[6] Marcus Lim, Azween Abdullah, and NZ Jhanjhi, “Performance optimization of criminal network hidden link prediction model with deep reinforced learning,” Journal of King Saud University 33(10) (2021): 1202–1210, . https://doi.org/10.1016/j.jksuci.2019.07.010.

[7] Lim et al., “Performance optimization,” 1202.

[8] Renée C. van der Hulst, “Introduction to Social Network Analysis (SNA) as an investigative tool,” Trends in Organized Crime 12 (2009): 103, https://doi.org/10.1007/s12117-008-9057-6.

[9] Malcolm K. Sparrow, “The Application of Network Analysis to Criminal Intelligence: An Assessment of the Prospects,” Social Networks 13(3) (1991): 251–74; Sean F. Everton, Disrupting Dark Networks (New York: Cambridge University Press, 2012), https://doi.org/10.1017/CBO9781139136877; Carlo Morselli, Inside Criminal Networks (New York: Springer, 2009); Carlo Morselli, Crime and Networks (New York: Routledge, 2014), chap. Introduction.

[10] Paul A.C. Duijn and Peter P.H.M. Klerks, “Social Network Analysis Applied to Criminal Networks: Recent Developments in Dutch Law Enforcement,” Networks and Network Analysis for Defence and Security (2014): 121–159, https://doi.org/10.1007/978-3-319-04147-6_6. For example, the use of mixed methods SNA was able to reveal a new mechanism for increased violence after kingpin strikes in which the Tijuana Cartel was pressured to use non-violent business operators as violent enforcers. See Nathan P. Jones, W. Layne Dittmann, Jun Wu, and Tyler Reese, “A mixed-methods social network analysis of a cross-border drug network: the Fernando Sanchez organization (FSO),” Trends in Organized Crime 23 (2018): 154–182, https://doi.org/10.1007/s12117-018-9352-9.

[11] Jones et al., “A Social Network Analysis of Mexico’s Dark Network Alliance Structure.”

[12] Harry Surden, “Machine Learning and Law,” Washington Law Review 89(1) (2014): 87–116.

[13] Javier Martínez Torres, Carla Iglesias Comesaña and Paulino J. García-Nieto, “Review: machine learning techniques applied to cybersecurity,” International Journal of Machine Learning and Cybernetics 10 (2019): 2823–2836, https://doi.org/10.1007/s13042-018-00906-1.

[14] Sendhil Mullainathan and Jann Spiess, “Machine Learning: An Applied Econometric Approach,” Journal of Economic Perspectives 31(2)(2017): 87–106, https://pubs.aeaweb.org/doi/pdf/10.1257/jep.31.2.87.

[15] Surden, “Machine Learning and Law.”

[16] Surden, “Machine Learning and Law.”

[17] Shahadat Uddin, Arif Khan, Md Ekramul Hossain, and Mohammad Ali Moni, “Comparing different supervised machine learning algorithms for disease prediction,” BMC Medical Informatics and Decision Making 19(281) (2019), https://doi.org/10.1186/s12911-019-1004-8.

[18] Uddin et al., “Comparing machine learning algorithms.”

[19] Mohssen Mohammed, Muhammad Badruddin Khan, Eihab Bashier Mohammed Bashier, Machine Learning (Boca Raton: CRC Press, 2016), https://doi.org/10.1201/9781315371658.

[20] Emily Berman, “A Government of Laws and Not of Machines,” Boston University Law Review 98(5) (2018): 1277–1356, https://dx.doi.org/10.2139/ssrn.3098995.

[21] Berman, “A Government of Laws,” 1293.

[22] Ashley Deeks, Noam Lubell, and Daragh Murray, “Machine Learning, Artificial Intelligence, and the Use of Force by States,” Journal of National Security Law and Policy 10(1) (2019): 1–26, https://ssrn.com/abstract=3285879.

[23] Torres et al., “Review: machine learning techniques applied to cybersecurity.”

[24] Mohammed et al., Machine Learning.

[25] Mohammed et al., Machine Learning.

[26] Michael C. Horowitz, Gregory C. Allen, Edoardo Saravalle, Anthony Cho, Kara Frederick, and Paul Scharre, “Artificial Intelligence and International Security,” Center for a New American Security, July 2018, https://csdsafrica.org/wp-content/uploads/2020/06/CNAS_AI-and-International-Security.pdf.

[27] John P. Sullivan, “From Drug Wars to Criminal Insurgency: Mexican Cartels, Criminal Enclaves and Criminal Insurgency in Mexico and Central America. Implications for Global Security,” Working Paper No. 9 (Paris: Fondation Maison des sciences de l’homme, April 2012), https://shs.hal.science/halshs-00694083/document; John P. Sullivan, “The Information Age: Transnational Organized Crime, Networks, and Illicit Markets,” Journal of Strategic Security 16(1) (2023): 51–71, https://digitalcommons.usf.edu/jss/vol16/iss1/4.

[28] Jones et al., “A Social Network Analysis of Mexico’s Dark Network Alliance Structure.”

[29] Oswaldo Zavala, Drug Cartels Do Not Exist: Narcotrafficking in US and Mexican Culture, trans. William Savinar (Nashville: Vanderbilt University Press, 2022), https://doi.org/10.2307/j.ctv2kcwn8w; Guadalupe Correa-Cabrera, “Perspective: The Myth of the ‘Cartels’,” Small Wars Journal, April 17, 2023, https://smallwarsjournal.com/jrnl/art/perspective-myth-mexican-cartels; Sullivan, “From Drug Wars to Criminal Insurgency.”

[30] Sullivan, “From Drug Wars to Criminal Insurgency”; John P. Sullivan, “Crime wars: Operational perspectives on criminal armed groups in Mexico and Brazil,” International Review of the Red Cross 105(923) (2022): 849–875, https://www.cambridge.org/core/journals/international-review-of-the-red-cross/article/crime-wars-operational-perspectives-on-criminal-armed-groups-in-mexico-and-brazil/2A788ED54A033AA299C5A473721F8716; John P. Sullivan and Adam Elkus, “State of Siege: Mexico’s Criminal Insurgency,” Small Wars Journal, August 19, 2008, https://smallwarsjournal.com/jrnl/art/state-siege-mexicos-criminal-insurgency; John P. Sullivan, “How Illicit Networks Impact Sovereignty,” in Convergence: Illicit Networks and National Security in the Age of Globalization, edited by Michael Miklaucic and Jacqueline Brewer (Washington, DC: National Defense University Press, 2013), 171–187, https://www.academia.edu/3245714/How_Illicit_Networks_Impact_Sovereignty; Charles Tilly, “War Making and State Making as Organized Crime," in Bringing the State Back In, edited by Peter Evans, Dietrich Rueschemeywer, and Theda Skocpol, (Cambridge: Cambridge University Press, 1985), 169–191, https://doi.org/10.1017/CBO9780511628283.

[31] Sullivan, “From Drug Wars to Criminal Insurgency”; Sullivan, “How Illicit Networks Impact Sovereignty.”

[32] “Plaza” refers to a specific city or geographic location along the U.S.-Mexico border that is used to smuggle illicit drugs from Mexico into the United States: https://www.justice.gov/archive/ndic/pubs32/32781/dtos.htm (note 9).

[33] John P. Sullivan, “Criminal Enclaves: When Gangs, Cartels or Kingpins Try to Take Control,” Stratfor Threat Lens, July 10, 2019, https://bit.ly/3YLHSgo; John P. Sullivan, “The Challenges of Territorial Gangs: Civil Strife, Criminal Insurgencies and Crime Wars,” Revista do Ministério Público Militar 31(44) (2019), https://bit.ly/3P9lQRl; Benjamin J. Mackey, “A State of Illegitimacy: The Dynamics of Criminal and State Legitimacy in Mexico,” Inquiries 10(10) (2018), http://www.inquiriesjournal.com/articles/1742/a-state-of-illegitimacy-the-dynamics-of-criminal-and-state-legitimacy-in-mexico

[34] Robert J. Bunker, Alma Keshavarz, and John P. Sullivan, “Mexican Cartel Tactical Note #39: GoPro Video Social Media Posting of Cártel Santa Rosa de Lima (CSRL) Tactical Action against Cártel Jalisco Nueva Generación (CJNG) in Guanajuato - Indications & Warning (I&W) Concerns,” Small Wars Journal, March 5, 1019, https://smallwarsjournal.com/jrnl/art/mexican-cartel-tactical-note-39-gopro-video-social-media-posting-cartel-santa-rosa-de-lima; John P. Sullivan and Robert J. Bunker, “Mexican Cartel Strategic Note No. 27: Confronting the State — Explosive Artifacts, Threats, Huachicoleros, and Cartel Competition in Guanajuato, MX,” Small Wars Journal, March 14, 2019, https://smallwarsjournal.com/jrnl/art/mexican-cartel-strategic-note-no-27-confronting-state-explosive-artifacts-threats; Robert J. Bunker, David A. Kuhn, and John P. Sullivan, “Mexican Cartel Tactical Note #42: Car Bomb in Apaseo el Alto, Guanajuato with Remote Detonation IED (‘Papa Bomba’) Payload,” Small Wars Journal, January 7, 2020, https://smallwarsjournal.com/jrnl/art/mexican-cartel-tactical-note-42-car-bomb-apaseo-el-alto-guanajuato-remote-detonation-ied; Nathan P. Jones, John P. Sullivan, and Robert J. Bunker, “Mexican Cartel Strategic Note No. 30: ‘El Marro’ – José Antonio Yépez Ortiz Leader of the Cártel Santa Rosa de Lima (CSRL) Arrested in Guanajuato,” Small Wars Journal, August 17, 2020, https://smallwarsjournal.com/jrnl/art/mexican-cartel-strategic-note-no-30-el-marro-jose-antonio-yepez-ortiz-leader-cartel-santa.

[35] James S. Coleman, “Social Capital in the Creation of Human Capital,” The American Journal of Sociology 94 (1988): S95–120, http://www.jstor.org/stable/2780243.

[36] Ronald S. Burt, “The Network Structure of Social Capital,” Research in Organizational Behavior 22 (2000): 345–423, https://doi.org/10.1016/S0191-3085(00)22009-1; A. Allan Schmid, “Discussion: Social Capital as an Important Lever in Economic Development Policy and Private Strategy,” American Journal of Agricultural Economics 85(3) (2003): 716–19, https://www.jstor.org/stable/1245000.

[37] Tao Zhou, Linyuan Lü, and Yi-Cheng Zhang, “Predicting Missing Links via Local Information,” The European Physical Journal B 71 (2009): 623–30, https://doi.org/10.1140/epjb/e2009-00335-8.

[38] The “degree” refers to the number of edges (or links) connecting the neighbors, so a high degree centrality means a node or actor has a higher number of edges.

[39] Zhou, Lü, and Zhang, “Predicting Missing Links.”

[40] Albert-László Barabási, “Scale-Free Networks: A Decade and Beyond,” Science 325, July 24, 2009, https://barabasi.com/f/303.pdf.

[41] The preferential attachment algorithm says that when a new entity joins the network, it is more likely to make attach to nodes which already have a lot of ties. This algorithm can be used to create and analyze networks that are either static or that keep growing over time.

[42] Juan I. Fuxman Bass, Alos Diallo, Justin Nelson, Juan M Soto, Chad L. Myers, and Albertha J.M. Walhout, “Using Networks to Measure Similarity between Genes: Association Index Selection,” Nature Methods 10 (2013): 1169–1176, https://doi.org/10.1038/nmeth.2728.

[43] The authors received the data from Lantia Consultores in 2021 via a subscription purchased by Rice University’s Baker Institute Center for the U.S. and Mexico.

[44] A directed edge means that the connection flows in one or both directions such as one person initiating a phone call to another. An undirected tie is used when a relationship exists but there is no data on the direction of the relationship. For example, an investigator may know two people talked on the phone but not who started the call. Nathan P. Jones et al., “Mexico’s 2021 Dark Network Alliance Structure.”

[45] Zhou, Lü, and Zhang, “Predicting Missing Links.”

[46] Carlo Morselli, Cynthia Giguère, and Katia Petit, “The Efficiency/Security Trade-off in Criminal Networks,” Social Networks 29(1) (2007): 143–53, https://doi.org/10.1016/j.socnet.2006.05.001.

[47] Path length is the distance between two nodes, measured as the number of edges between them: https://www.futurelearn.com/info/courses/social-media/0/steps/16047.

[48] Morselli, Giguère, and Petit, “The Efficiency/Security Trade-off in Criminal Networks”; Jennifer Xu and Hsinchun Chen, “The Topology of Dark Networks,” Communications of the ACM 51(10) (2008): 58–65, https://doi.org/10.1145/1400181.1400198.

[49] David A. Bright and Jordan J. Delaney, “Evolution of a Drug Trafficking Network: Mapping Changes in Network Structure and Function across Time,” Global Crime 14(2–3) (2013): 238–60, https://doi.org/10.1080/17440572.2013.787927; Morselli, Giguère, and Petit, “The Efficiency/Security Trade-off in Criminal Networks.”

[50] Nicholas Dorn, Michael Levi, and Leslie King, Literature Review on Upper Level Drug Trafficking (London: Home Office, 2005), https://www.ojp.gov/ncjrs/virtual-library/abstracts/literature-review-upper-level-drug-trafficking.

[51] Gisela Bichler, Aili Malm, and Tristen Cooper, “Drug Supply Networks: A Systematic Review of the Organizational Structure of Illicit Drug Trade,” Crime Science 6(2) (2017), https://doi.org/10.1186/s40163-017-0063-3.

[52] Stanley Wasserman and Katherine Faust, Social Network Analysis: Methods and Applications (Cambridge: Cambridge University Press, 1994), https://doi.org/10.1017/CBO9780511815478.

[53] Wasserman and Faust, Social Network Analysis.

[54] Wasserman and Faust, Social Network Analysis.

[55] Graeme Currie, Nicola Burgess, Leroy White, Andy Lockett, John Gladman, and Justin Waring, “A Qualitative Study of the Knowledge-Brokering Role of Middle-Level Managers in Service Innovation: Managing the Translation Gap in Patient Safety for Older Persons’ Care,” Health Services and Delivery Research 2(32) (2014), https://doi.org/10.3310/hsdr02320.

[56] Wasserman and Faust, Social Network Analysis.

[57] Jennifer Golbeck, Analyzing the Social Web (Waltham, MA: Elsevier, 2013).

[58] Nathan P. Jones et al., “Mexico’s 2021 Dark Network Alliance Structure.”

[59] Degree centrality refers to the number of connections for a node. Closeness centrality indicates how close a node is to all other nodes. Betweenness centrality measure how many times a node lies on the shortest path between other nodes. See https://cambridge-intelligence.com/keylines-faqs-social-network-analysis/.
Closeness centrality is traditionally a measure that works on fully connected networks. However, the Python library Networkx adapts its closeness centrality algorithm so it can be implemented on disconnected networks. For more information about the implementation of this algorithm you can review the Neworkx documentation: https://bit.ly/44tx1c3.

[60] Jennifer Xu and Hsinchun Chen, “The Topology of Dark Networks”; Morselli, Giguère, and Petit, “The Efficiency/Security Trade-off in Criminal Networks”; Efstathios D Mainas, “The Analysis of Criminal and Terrorist Organisations as Social Network Structures: A Quasi-Experimental Study,” International Journal of Police Science & Management 14, no. 3 (2012): 264–82, https://journals.sagepub.com/doi/abs/10.1350/ijps.2012.14.3.285.

[61] Morselli, Giguère, and Petit, “The Efficiency/Security Trade-off in Criminal Networks.”

[62] Zhou, Lü, and Zhang, “Predicting Missing Links via Local Information.”

[63] Zhou, Lü, and Zhang, 4.

[64] Paolo Campana, “Explaining Criminal Networks: Strategies and Potential Pitfalls,” Methodological Innovations 9 (2016): 2059799115622748, https://doi.org/10.1177/2059799115622748; Paolo Campana, “The Structure of Human Trafficking: Lifting the Bonnet on a Nigerian Transnational Network,” British Journal of Criminology 56(1) (2016): 68–86, https://doi.org/10.1093/bjc/azv027; Paolo Campana and Federico Varese, “Exploitation in Human Trafficking and Smuggling,” European Journal on Criminal Policy and Research 22 (August) (2016): 89–105, https://doi.org/10.1007/s10610-015-9286-6; Carlo Morselli, Inside Criminal Networks, Studies of Organized Crime series (New York: Springer, 2009).

[65] La Silla Rota (the broken chair) Mexican news website: https://lasillarota.com/.

[66] “‘Gente de León’: el nuevo cartel de la ciudad: antes era la Unión León (People of León: the new cartle of the city: before it was the Union of León),” La Silla Rota, July 18, 2022, https://lasillarota.com/guanajuato/local/2022/7/18/gente-de-leon-el-nuevo-cartel-de-la-ciudad-antes-era-la-union-leon-384720.html.

[67] Jones et al., “Mexico’s 2021 Dark Network Alliance Structure”; Irina Chindea, “Fear and Loathing in Mexico: Narco-Alliances and Proxy Wars,” Fletcher Security Review I(II) (2014), http://media.wix.com/ugd/c28a64_4f406b0a66314668aae6a81a4066465a.pdf.

[68] Jones et al., “Mexico’s 2021 Dark Network Alliance Structure.”

[69] Michael Kenney and Stephen Coulthart, “The Methodological Challenges of Extracting Dark Networks: Minimizing False Positives through Ethnography,” in Illuminating Dark Networks: The Study of Clandestine Groups and Organizations, edited by Luke Gerdes (Cambridge: Cambridge University Press, 2015), https://doi.org/10.1017/CBO9781316212639.

[70] Jones et al., “Mexico’s 2021 Dark Network Alliance Structure.”

[71] Falko Ernst, “Mexico’s Hydra-headed Crime War,” International Crisis Group, June 3, 2019, https://www.crisisgroup.org/latin-america-caribbean/mexico/mexicos-hydra-headed-crime-war.

[72] “The kinetic approach involves aggressive and offensive measures to eliminate or capture network members and their supporters, while the non-kinetic approach involves the use of subtle, non-coercive means for combating dark networks:” Nancy Roberts and Sean F. Everton, “Strategies for Combating Dark Networks,” Journal of Social Structure 12, accessed December 22, 2014, http://www.cmu.edu/joss/content/articles/volume12/RobertsEverton.pdf.

 

This material may be quoted or reproduced without prior permission, provided appropriate credit is given to the author and Rice University’s Baker Institute for Public Policy. The views expressed herein are those of the individual author(s), and do not necessarily represent the views of Rice University’s Baker Institute for Public Policy.