Mapping Terror Networks: Why Metadata Matters

quote:

---

We met every afternoon in the CIA director's conference room at 5. At the FBI director's conference room, we met every morning shortly after 7.

At both agencies, the questions were similar: How best can we clarify the blurry picture of an emerging terror conspiracy overseas or in the United States? How can we identify the key players and the broader network of fundraisers, radicalizers, travel facilitators and others quickly enough so they can't succeed? And how do we ensure that we've mapped the network enough to dismantle—and not merely disrupt—it?

The only way to understand why the NSA collects and needs access to vast amounts of telephone metadata is to keep these questions in mind, especially the last. In ruling on Friday that the data collection is lawful, U.S. District Court Judge William H. Pauley III expressed it well: "The government needs a wide net that could find and isolate gossamer contacts among suspected terrorists in an ocean of seemingly disconnected data."

Mapping a network of people is simple in concept but complex in practice: find the key operators, and then find the support group. The challenge isn't limited to counterterrorism. Any group—from organized-crime enterprises to gangs, drug cartels, or human traffickers—consists of a team of people who interact and are organized for a particular purpose. If an analyst maps that network well enough, then a series of arrests or lethal operations can destroy it.

Map a network poorly, however, and you may miss peripheral players who will recreate a conspiracy after the core conspirators are arrested. The goal is to eliminate the entire spiderweb of a conspiracy; cutting off a piece, like the arm of a starfish, is a poor second choice. The starfish's arm regenerates.

Think of the range of linkages you might find among individuals in these networks. Money, phone calls, email exchanges, travel, social media, chat rooms—the modes constantly expand. How many linkages could a security service monitor electronically even two decades ago? Very few: Many of today's means of communication and interaction didn't exist.

A security service can also use human surveillance teams on the ground to map a network. This is more familiar and comforting, and it might sound less intrusive than the digital mapping programs run by NSA computers. But human surveillance operations are slow, inefficient and costly. And they have a higher risk of missing members of the network. The fastest, most efficient solution to mapping a network of conspirators lies in following digital connections among people. And as digital trails expand, digital network mapping will increase in value.

There is a healthy debate about how far U.S. security services should delve into our digital trails, but emotions too often overcome common sense. Every week I hear someone comment on whether the government is listening to their conversations—as if there's some huge complex of government employees in a mythical Area 51, listening to other Americans. The debates about government intelligence collection should be clearer about distinguishing between what the government collects and what it does with it. They may be collecting my phone number; what I'd worry more about is what they do with what they collect.

For an ongoing investigation, the data might seem relatively straightforward: link cellphones, email contacts, financial transactions, travel and visa information, add in whatever else you can find, and sort through the data using modern network analysis tools. Bingo! Within a day, you can have the beginnings of an understanding of a complex network that might take old-school investigators weeks or more to piece together.

Even so, an analyst has to ask other questions. Where did the conspirators travel a year ago? Five years ago? Who did they live with? Who did they sit next to on an airplane? Who gave them money? And a thousand other questions.

Investigators need an historical pool of data, in other words, that they can access only when they have information that starts with a known or suspected conspirator in the middle of a spiderweb they don't fully understand. Meanwhile, time pressures lurk: If you're late by a day, you lose.

---