Mapping terrorist groups using network analysis: Egypt case study

Abstract

Purpose

The purpose of this study is twofold; first, it aims to understand the underlying dynamics of the organizations behind the terrorist attacks, and second, to investigate the dynamics of terrorist organizations in relation to one another to detect whether there exist shared patterns of terror between different organizations.

Design/methodology/approach

To achieve this purpose, the researcher proposes a computational algorithm that extracts data from global terrorism database (GTD); calculates similarity indices between different terrorist groups; generates a network data file from the calculated indices; and apply network analysis techniques to the extracted data. The proposed algorithm includes applying SQL database codes for data extraction, building a tailored C# computer software to calculate similarity indices and generate similarity networks and using GEPHI software to visualize the generated network and calculate network metrics and measures.

Findings

Applying the proposed algorithm to Egypt, the results reveal different shared patterns of terror among different terrorist groups. This helps us in creating a terror landscape for terrorist groups playing in Egypt.

Originality/value

The importance of the study lies in that it proposes a new algorithm that combines network analysis with other data-manipulation techniques to generate a network of similar terror groups.

Citation

Tawadros, A.S.N. (2020), "Mapping terrorist groups using network analysis: Egypt case study", Journal of Humanities and Applied Social Sciences, Vol. 2 No. 2, pp. 141-159. https://doi.org/10.1108/JHASS-09-2019-0050

1. Introduction

Terrorism is one of the most challenging issues facing the overall world. Due to the increasing advancement in information and communication technologies, international terrorism becomes more and more a complex phenomenon. To study that complex phenomenon such as international terrorism, we need new ways of analysis. Network analysis is one of the recent ways used to analyze terrorist organizations from within.

Network analysis enables the researcher to understand the internal structure of the terrorist organization, the pattern of communication, the flow and path of information sharing, the path of the command, the sub-groups or main components of this network, the most important actors in the network and the vulnerabilities of this network. Hence, network analysis has been used in counter-terrorism research as well.

However, a few numbers of studies used network analysis in mapping different terrorist groups together. This is because of the scarcity of data about relationships between different terrorist groups on one hand, and because there is also very few studies who tend to classify terrorist groups on the other hand.

Some studies tend to classify terrorist groups based on ideology, group size, location, etc. However, in this study, the researcher is interested to classify terrorist organizations or groups based on the way they perform the terrorist incident.

The main research question of this study is whether there exist patterns in terrorism incidents. In other words, can we classify terrorist groups based on the pattern they share in perpetuating their incidents?

To examine this question, the researcher used network analysis methodology in addition to database management using SQL language codes, and an algorithm to calculate similarity and generate network data from regular incidents' data. The researcher developed a C# computer software to extract data from SQL database, and apply the proposed algorithm.

2. Literature review

2.1 Terrorism

Terrorism is such a complex phenomenon that lacks a concise agreed-upon definition. More than three decades ago, Alex Schmid (1983) recognized more than 100 definitions of the term terrorism in both the official and the academic fields.

For example, In the USA, the annual country reports on terrorism in the US Code Title 22 Chapter 38 Section 2656f discussed the concepts of international terrorism, terrorism and the terrorist group as follows.

The term “international terrorism” means terrorism involving citizens or the territory of more than one country. The term “terrorism” means premeditated, politically motivated violence perpetrated against noncombatant targets by subnational groups or clandestine agents. The term “terrorist group” means any group practicing or which has significant subgroups, which practice, international terrorism” (22 U.S.C. 38 §2656f).

In Canada, terrorism is essentially defined as “acts of violence or threats of violence motivated by ideology and intended to intimidate the public or a segment of the public” (Criminal Code of Canada S83.01).

However, The Office of the United Nations High Commissioner for Human Rights in factsheet 32 states that terrorism refers to “acts of violence that target civilians in the pursuit of political or ideological aims” (UN Office of the High Commissioner for Human Rights (OHCHR), Fact Sheet No. 32, 2019).

Finally, The UN general assembly stated a consensus definition of terrorism, in which it describes terrorism as:

[…] any action […] that is intended to cause death or serious bodily harm to civilians or non-combatants, when the purpose of such an act, by its nature or context, is to intimidate a population, or to compel a Government or an international organization to do or to abstain from doing any act” (United Nations, 2019).

However, even this definition did not gain international consensus.

A huge sum of research connects terrorism to crime, especially organized crime. This is based on the fact that terror acts usually inflict damage of some sort on a given target. Therefore, the element of using violence in an illegal form in terrorism is the main cause of why many studies connect terrorism to criminal acts. However, the illegal use of violence is only one dimension of terrorism, but not the only one. This clarifies why mafia crimes, for instance, are not considered as terrorism.

A second, and important, dimension of terrorism is politics:

Differently from criminal activities, terrorism is defined by a clear political orientation and/or relevance. Such a political dimension reminds us that terrorists usually (although not always) have a political goal (Locatelli, 2014, p. 6).

“As terrorists generally challenge the monopoly of violence of the state and its ability to protect its citizens, terrorist acts obtain political significance even when the motivation for them is not primarily political” (Schmid, 2004, p. 200).

In addition, Locatelli (2014) highlighted five main elements of terrorism from literature; these elements are as follows:

1. The use of violence.

2. Political goal and/or effect.

3. Indirect approach.

4. Patent breach of accepted rules.

5. The relative strength of offense over defense.

Summing up, he defined terrorism as “a peculiar form of political violence based on an indirect approach. It implies a patent breach of accepted rules and enjoys a tactical advantage over defense” (Locatelli, 2014, p. 10).

Another branch of literature connects terrorism with psychology, specifically in studying the psychology of a terrorist. This is based on the idea of connecting terrorist behavior with some psychopathologies.

As Pearlstein (1991, p. 9) claims, “the individual who becomes and remains a political terrorist generally appears to be psychologically molded by certain narcissistic personality disturbances.” In addition, many studies also claim the presence of the psychological mechanisms of externalizations and splitting, which are also found in individuals with borderline and narcissistic disturbances (Ferracuti, 1982; Ferracuti and Bruno, 1981; Laquer, 1987; Post, 1986a, 1986b).

However, other studies rejected this idea, claiming that terrorism is a group activity, and therefore, psychopathology or a single personality type cannot solely result in terrorism. The proponents of this idea claim that shared values and ideological commitment and group solidarity are much more important than psychological factors in understanding terrorism (Crenshaw, 2000).

Based on this collective view of terrorism, another line of research emerged adopting the idea of the strategic logic of terrorist organizations. In other words, terrorist organizations follow a strategic logic in their activities and their planning of the attacks with the aim to pursue a political goal (Caruso and Locatelli, 2008; Della Porta, 1995; Della Porta and Diani, 2006; Tarrow, 1994; Zald and McCarthy, 1980).

“In contemporary studies on terrorism, three different analytical levels are usually considered:

1. the individual level;

2. the organizational level; and

3. the systemic level” (Palano, 2014, p. 142).

This study is more concerned with the organizational or group level.

2.1.1 Classifying terrorist groups.

Different terrorist groups differ in many aspects, including terms of membership, political goal and ideological foundations. However, few studies aimed at finding a metric upon which we can classify terrorist groups.

In this regard, Blomberg et al. (2011) – in attempting to answer the question of what determines the survival or demise of a terrorist group – classified terrorist groups based on several variables, which are groups' peak sizes, tactics, ideologies and base locations.

Later on, Locatelli (2014) considered three main criteria for classification:

1. The nature of actors involved:

   • State Terrorism.

   • State-sponsored Terrorism.

   • Terrorism perpetrated by private actors.

2. The final goal or ultimate objective they are fighting for:

   • a) Regime Change.

   • b) Policy Change.

   • c) Territorial Change.

   • d) Social Control.

   • e) Status quo maintenance.

3. The type of actor:

   • a) Single terrorists (Lone Wolves).

   • b) Small groups of terrorists (Cliques).

   • c) Movements.

   • d) Organizations.

In this study, the researcher does not intend to classify terrorist groups based on a set of group properties or features, however, the main aim is to test whether there is a specific pattern that can be shared by different terrorist groups or not, and map the groups that share the same pattern together.

2.2 Network analysis to study terrorism

A network is a collection of actors (e.g. persons, groups, organizations) – represented by nodes – and relations between actors (connections, activities) – represented by links (Wasserman and Faust, 1994).

Network analysis has been a core technique of criminal intelligence analysis since the early 1970s, primarily in the form of link analysis, a specific adaptation of network analysis to criminal intelligence and investigation.

However, the tendency to regard terrorist organizations as networks (i.e. cellular structures rather than hierarchies) is relatively new. Terrorist groups or organizations can be viewed as “hub-and-spoke” networks – i.e. efficiently organized structures of connected cells that are resilient to disruption (van der Hulst, 2014).

Each terrorist group is also a network inside a wider network of supporters, suppliers, audiences and opponents. Network analysis concepts of particular value to the analysis of terrorism include:

1. Centrality. Centrality describes the relative importance of an individual in a network. We can measure centrality in several ways, including:

   • Degree Centrality is the number of other people adjacent to the individual. The higher this measure is, the more direct associates the individual has in the known network. The person may be a formal leader, a skilled networker or poor at keeping his connections secret (Strang, 2014).

   • Betweenness Centrality is the number of geodesics the individual is on. The higher this measure is, the more indirect associates the individual has. He or she may be a central actor in the communications or exchange network and maybe a key individual in holding the network together (Strang, 2014).

   • Eigenvector Centrality is the degree to which an actor is connected to highly connected peers, and it takes all direct and indirect network paths from the focal actor into account (Torfason and Kitts, 2011).

2. Components and cliques. Components (sub-graphs) are those that divide the network into separate parts with each having several actors. Cliques are the (maximal) sub-graphs of nodes that have all possible ties present among themselves. That is, a clique is the largest possible collection of nodes (more than two) in which all actors are directly connected to all others (Hanneman and Riddle, 2014).

3. Cutpoints and bridges. A Cutpoint is a single node connecting two or more components of a network. Removing that node should disconnect those components. A bridge is a link between two nodes in different networks or network components, so this relationship is also the connection between the two networks or sub-networks (Strang, 2014).

4. Clustering. One common way of measuring the extent to which a network displays clustering is to examine the local neighborhood of an actor (that is, all the actors who are directly connected to it), and to calculate the density in this neighborhood. After doing this for all actors in the whole network, we can characterize the degree of clustering as an average of all the neighborhoods in the whole network (Hanneman and Riddle, 2014).

Network analysis has been widely used in literature to study either the internal structure of a terrorist organization or the flow of information within it. In both cases, the main aim behind using network analysis is to find the most important elements in a network from the pattern of communication within this network, and therefore, detect the weak points in any terrorist network.

One of the first studies to apply network analysis on criminal organizations, in general, was that of Sutherland (1937), which highlighted the role played by the structure of the network, and the system of relations within it, in facilitating its criminal activities. Later on, Albini (1971) used network analysis to study the linkages between organized criminal Sicilian and Italian-American families.

Arquilla and Ronfeldt (2001) highlighted the role of network structure in the performance and cohesion of terrorist organizations. They claimed that if we model and analyze the structure of terrorist networks, we could predict the future of transnational organized crime in general and terrorist organizations in particular.

Directly after 9/11, Krebs (2002) used publicly available information about the 19 hijackers to construct a network of weak and strong ties based on the nature of their relationships with one another. By computing several centrality measures, this paper depicts a sketch of the covert network behind the scenes, which allowed identifying the clear leader among the hijackers.

Moreover, Yang et al. (2006) explained the importance of visualizing the structure of the social network. They argue that if the structure of relationships and the dynamics of information circulation within the network are accurately defined, we can detect:

• the most important actors in the network,

• information flow and how to track and disable them and

• know the weaknesses inside criminal networks.

Recently, network analysis is mainly used to serve counter-terrorism by identifying the strengths of the network to target them, and its vulnerabilities to penetrate them. Among these studies, we find Moon et al. (2007), Clauset et al. (2008), Everton (2009), Bakker et al. (2012), and Lauchs et al. (2012).

3. Methodology

To understand the international terrorist landscape that performs attacks in Egypt, we have to construct a network of terrorist groups. However, we need first to extract network data from the GTD data. To achieve this task, the researcher used a modified version of the algorithm proposed by Alison et al. (2017) to calculate a similarity matrix between different terrorist groups.

In addition, the researcher designed and implemented a computer program using C# programming language to perform the following tasks:

• Extract data from the database using SQL Database codes.

• Calculate the similarity matrix using the proposed algorithm (that will be discussed in detail in the next section).

• Generate a network data file using the calculated similarity matrix and export it to an Excel file.

Having groups similarity matrix calculated from the dataset, social network analysis is then used to understand the relationships between different terrorist groups and to test whether there are similar patterns among terrorist groups or no. In this regard, Gephi software (version 0.9.2) is used to visualize the network and to calculate some useful measures for the analysis – these measures will be discussed in the next section.

The results of the network analysis are then compared to the results of a two-step cluster analysis, to validate the proposed methodology.

4. Analysis

4.1 Data

The global terrorism database (GTD) is an open-source database including data on terrorist events around the world, from 1970 until 2017. The National Consortium for the Study of Terrorism and Responses to Terrorism (START) makes GTD available online, with systematic data on domestic, as well as transnational and international terrorist incidents. GTD is currently considered as the most comprehensive unclassified database on terrorist attacks in the world.

GTD now includes more than 190,000 cases; for each incident, it includes data on more than 12 variables. Examples include the date and location of the incident, the weapons used and nature of the target, the number of casualties, and – when identifiable – the group or individual responsible.

GTD defines terrorism as “the threatened or actual use of illegal force and violence by a non-state actor to attain a political, economic, religious or social goal through fear, coercion or intimidation” (GTD Codebook, 2018). To consider an incident for inclusion in the GTD, all three of the following attributes must be present:

1. The incident must be intentional – the result of a conscious calculation on the part of a perpetrator.

2. The incident must entail some level of violence or immediate threat of violence, including property violence, as well as violence against people.

3. The perpetrators of the incidents must be sub-national actors. The database does not include acts of state terrorism.

4.2 Data pre-processing

As previously mentioned, the study applies a modified version of Alison et al. (2017) algorithm, which is based on some features of the GTD data. However, in this study, we are interested in some more features that were not included in Alison et al. (2017) study.

This study is interested in the following selected features for each terrorist incident in the GTD:

1. Year: The year in which the incident occurred.

2. Latitude and longitude: The location of the terrorist incident.

3. Group name: The name of the perpetrator group that carried out the attack. To ensure consistency in the usage of group names for the database, the GTD database uses a standardized list of group names that have been established by project staff to serve as a reference for all subsequent entries. If no information about the perpetrator group is available, this field is coded as “Unknown”.

4. Inclusion criteria: These are three categorical variables, namely: Criterion 1, Criterion 2 and Criterion 3. For each variable, a case is coded as “1” if the criterion is met and “0” if the criterion is not met or that there is no indication that it is met.

   • Criterion 1: The violent act aims at attaining a political, economic, religious or social goal.

   • Criterion 2: There is evidence of an intention to coerce, intimidate or publicize some messages to a larger audience(s).

   • Criterion 3: The act is outside the context of legitimate warfare activities (against the International Humanitarian Law) as reflected in the Additional Protocol to the Geneva Conventions of 12 August 1949 and elsewhere.

5. Attack type: The general method of attack and often reflects the broad class of tactics used. It consists of nine categories, which are: Assassination, Hijacking, Kidnapping, Barricade Incident, Bombing/Explosion, Armed Assault, Unarmed Assault, Facility/Infrastructure Attack, Unknown.

6. Target type: The general type of target/victim. This consists of the following 22 categories: Business, Government (General), Police, Military, Abortion related, Airports and Aircraft, Government (Diplomatic), Educational Institution, Food or water supply, Journalists and Media, Maritime, NGOs, Private Citizens and Property, Religious Figures/Institutions, Telecommunication, Terrorists/Non-State Militias, Tourists, Transportation, Utilities, Violent Political Parties, Unknown, Other.

7. Weapon type: The general type of weapon used in the incident. Information on up to four general types of weapons are recorded, this includes: biological, chemical, radiological, nuclear, firearms, explosives, fake weapons, incendiary, Melee, vehicle, Sabotage equipment, other, unknown.

8. Number killed: The number of total confirmed fatalities for the incident.

9. Number wounded: The number of confirmed non-fatal injuries.

In addition to the previously selected features, the researcher calculates the incident severity for each incident, using the following equation [Alison et al. (2017)]:

Severitye= α×Ndeath+Nwounded

where α is a parameter indicating how many wounds are equivalent to one death in terms of severity. Here, we use α = 3 as defined by Alison et al. (2017).

4.3 Algorithm

Step 1: Calculate Group Attributes: For each terrorist group, calculate the following attributes:

• Lethality: this represents the sum of the severity of all incidents performed by this group.

• Average Lethality: The average value of the severity of all incidents performed by this group.

• Peak year: The year with the largest number of attacks by this group.

• Average longitude and latitude: The average values of longitude and latitude of all incidents performed by the group.

• Average inclusion criteria: Average value of criteria 1, 2 and 3 of all incidents performed by the group.

• Target type: The target type that the group attacked most.

• Attack type: The attack type that the group used most.

• Weapon type: The weapon type that the group most commonly used.

Step 2: Calculate Similarity Matrix: For each two groups included in the data, calculate their similarity value as follows:

• For each numeric feature (i):

Si=Minv1, v2Maxv1, v2, where v₁ is the value of feature (i) in group 1, and v₁ is the value of feature (i) in group 2.

• For categorical feature (i):  Si=1v1=v20v1≠v2.

• For Longitude and Latitude: S_i = exp^−distance, where distance is the geographical distance between two locations coordinates using the Haversine Formula:

  d=2r sin-1sin2Φ2-Φ12+cos⁡(Φ1)cos⁡(Φ2)sin2λ2-λ12

where:

r = radius of earth (6371 km);

d = distance between two points;

Φ1, Φ2 = latitude of the two points; and

λ1, λ2 = longitude of the two points, respectively.

Now, the similarity value between two terrorist groups is the sum of similarities between these two groups overall selected features as in the following equation:

Similarity= ∑iSi

Step 3: Generate a Network Data File: Create a weighted undirected network between terrorist groups as follows:

• The nodes of the network represent the terrorist groups included in the data.

• The edges (linking two nodes) of the network represent whether these two nodes or groups are similar or not. In this study, an edge is drawn between two nodes if the similarity value between these two groups exceeds a threshold value θ.

• The weights of the edges represent the similarity value between the nodes linked by these edges.

Using the generated network data file, the researcher uses Gephi Software to visualize the network, and calculate the following measures:

• Number of Components (Communities) and Cliques in the network.

• Degree and Weighted Degree Centrality of each group.

• Betweenness Centrality of each group.

• Eigenvector Centrality of each group.

• Clustering Coefficient of each group.

5. Results

In this study, the researcher applies the algorithm proposed in the previous section on a sample of the GTD for Egypt only, and from the year 2011 until the year 2017. In the following paragraphs, the main results are highlighted.

Using the C# tailored application to extract data from a SQL Database including the original GTD data; the program extracted 22 groups performing terrorist incidents in Egypt from 2011 until 2017. Table I shows the names of these 22 terrorist groups sorted alphabetically.

Applying Step 1 of our algorithm, the proposed computer program calculated the needed group attributes for each terrorist group. Table II shows the calculated categorical attributes – peak year, attack type, weapon type and target type – for each group and Table III shows the calculated numerical attributes of these 22 groups – inclusion criteria, location, lethality and average lethality.

Table II shows that there are differences between terrorist groups in terms of the peak year, the most common attack type, the most commonly used weapon type, and the most common target type. For instance, it is obvious here that:

• The Peak years in terrorism activities are 2014 and 2015. The year 2014 was the peak year for Ajnad Misr, Ansar Bayt al-Maqdis (Ansar Jerusalem), Muslim Brotherhood, Islamic State of Iraq and the Levant (ISIL), Youth of the Land of Egypt and Orfei Harsha'am. While, the year 2015 was the peak year for Hamas (Islamic Resistance Movement), Popular Resistance Movement (Egypt), Sinai Province of the Islamic State, Unknown and Revolutionary Punishment Movement.

• “Explosives” are the most commonly used weapon by Ajnad Misr, Al-Furqan BrigadesAnsar al-Islam (Egypt); Ansar Bayt al-Maqdis (Ansar Jerusalem); Army of Islam; Hamas (Islamic Resistance Movement); Islamic State in Egypt; Jaljala Army; Muslim Brotherhood; Muslim extremists; Popular Resistance Movement (Egypt); Sinai Province of the Islamic State; Takfir wal-Hijra (Excommunication and Exodus); and the Unknown groups.

• “Firearms” are the most commonly used weapon type by Bedouin tribesmen, Egyptian Tawhid and Jihad, Hasam Movement, Islamic State of Iraq and the Levant (ISIL), Revolutionary Punishment Movement, Revolution's Brigade and Youth of the Land of Egypt.

• Police and Military forces were the most common targets. Police forces were the most common targets for Takfir wal-Hijra, Egyptian Tawhid and Jihad, Ajnad Misr, Muslim Brotherhood, Islamic State of Iraq and the Levant (ISIL), Revolutionary Punishment Movement, Hasam Movement, Revolution's Brigade, Ansar al-Islam (Egypt), and Islamic State in Egypt. However, Military forces were the most common target for Jaljala Army, Muslim extremists, Ansar Bayt al-Maqdis (Ansar Jerusalem), Youth of the Land of Egypt, Hamas (Islamic Resistance Movement), Sinai Province of the Islamic State and Unknown.

Applying Step 2 of our algorithm on the selected data using the proposed computer program, we get the similarity matrix between the 22 groups with (22 × 22 = 484) cells. Figure (1) shows this similarity matrix with 484 cells, each cell shows the similarity value between the two groups shown in the row and column of this cell. Cells are highlighted with colors; the darker the color of the cell the greater the similarity between the two groups, and the lighter the color of the cell the less similar they are.

Applying Step 3 of our algorithm, and setting a threshold value θ = 0.6, i.e. to draw a link between two groups they must share a similarity value that exceeds 60 per cent, the proposed computer program generated a network data file, as shown in Table IV.

It is obvious from Table IV that:

• The most powerful link in the network lies between “Ajnad Misr” and “Muslim Brotherhood” with weight 8.41, meaning that there is more than 84 per cent similarity between the violent acts performed by these two groups in terms of the features selected in this study.

• The second most powerful link lies between “Sinai Province of the Islamic State” and the “Unknown” group with weight 7.65, i.e. with similarity exceeding 76 per cent.

• The third most powerful link lies between “Hasam Movement” and “Revolution's Brigade” with weight 7.53, i.e. with similarity exceeding 75 per cent.

• The fourth most powerful links lie between “ISIL” and “Revolution's Brigade” with weight 7.3, and “ISIL” and “Revolutionary Punishment Movement” with weight 7.1, i.e., with similarity exceeding 70 per cent in both links.

• The huge similarity between “Ajnad Misr” and “Muslim Brotherhood” can be justified by the fact that “Ajnad Misr” is an active Salafist Islamist militant terrorist group founded in 2013 directly after the removal of Mohamed Morsi from his office after 30 June revolution. In addition, it claims that its attacks are retribution for the break of sit-in of Muslim Brotherhood in Raba'a Square in August 2013, which leaded to an armed conflict between the Muslim Brotherhood and the military and police forces.

Corollary 1: From the huge similarity between “Ajnad Misr” terrorist group and “Mulsim Brotherhood” in terms of the way they perform their violent acts (incidents), we can, therefore, reach a conclusion that “Ajnad Misr” is just a militant group formed from members of the “Muslim Brotherhood” organization. In other words, “Ajnad Misr” can be viewed as a military wing of “Muslim Brotherhood”.

Our generated network is a weighted undirected network that contains 17 nodes and 23 edges. Visualizing the network using Gephi software, we find that there are three components or communities within this network. The average clustering coefficient of the network is 0.792, and the graph density is 0.169. Figure (2) shows the network with three components with three different colors with line thickness represent the weight of the link.

The groups within a certain community reveal more similarities with each other. This means that there are three different communities of terrorist groups, the groups within each community share a specific pattern of terrorism. These three communities are as follows:

1. Community 1: {Hamas, Jaljala Army}.

2. Community 2: {Hasam Movement, Islamic State in Iraq and Levant (ISIL), Revolution's Brigade, Revolutionary Punishment Movement}.

3. Community 3: {Ansar Bayt al-Maqdis (Ansar Jerusalem), Muslim extremists, Sinai Province of the Islamic State, Unknown, Popular Resistance Movement (Egypt), Ajnad Misr, Muslim Brotherhood, Islamic State in Egypt, Ansar al-Islam (Egypt), Takfir wal-Hijra (Excommunication and Exodus), Army of Islam}.

Now, we will filter the network based on degree centrality, so that the nodes that will be included in the network are only the nodes with degree centrality greater than or equal to (2). In other words, we will exclude any node that has less than two links (having only one link) from the visualization of the network. Figure (3) shows this filtered network.

In the filtered network, we can recognize the two most central (important) components or communities in our terrorist-groups' network. These two communities are:

1. Community 1: {Hasam Movement, Islamic State in Iraq and Levant (ISIL), Revolution's Brigade, Revolutionary Punishment Movement}.

2. Community 2: {Ansar Bayt al-Maqdis (Ansar Jerusalem), Muslim extremists, Sinai Province of the Islamic State, Unknown, Ajnad Misr, Muslim Brotherhood, Islamic State in Egypt, Takfir wal-Hijra (Excommunication and Exodus)}.

In addition, we also notice from both Figures (2) and (3) that there are three cliques in the network with two cliques connected through a link between “Ajnad Misr” and “Ansar Bayt al-Maqdis (Ansar Jerusalem)”, these three cliques are:

1. Clique 1: {Hasam Movement, Islamic State in Iraq and Levant (ISIL), Revolution's Brigade, Revolutionary Punishment Movement}.

2. Clique 2: {Ansar Bayt al-Maqdis (Ansar Jerusalem), Muslim extremists, Sinai Province of the Islamic State, Unknown}.

3. Clique 3: {Ajnad Misr, Muslim Brotherhood, Islamic State in Egypt, Takfir wal-Hijra (Excommunication and Exodus)}.

The connection of Clique 2 and Cliques 3 – through the link between “Ajnad Misr” and “Ansar Bayt al-Maqdis (Ansar Jerusalem)” – can be justified by the fact that the founder of “Ajnad Misr”, Humam Muhammed, was a member of “Ansar Bayt al-Maqdis” militant group and then split away from it.

Merging the cliques appearing in Figure (2) with the groups' attributes shown in Tables II and III, we can find that:

• Clique 1 {Groups 9, 11, 17, 18}: The most common attack type is “Armed Assault”, the most common weapon type is “Firearms”, the most common target type is “Police”, the peak years are 2014, 2015 and 2016, and the main inclusion criteria are criteria 1 and 2 only.

• Clique 2 {Groups 4, 14, 19, 21}: The most common attack type is “Bombing/Explosion”, the most common weapon type is “Explosives”, the most common target type is “Military”, the peak years are 2013, 2014 and 2015, and the main inclusion criteria are criteria 1 and 2 only.

• Clique 3 {Groups 1, 10, 13, 20}: The most common attack type is “Bombing/Explosion”, the most common weapon type is “Explosives”, the most common target type is “Police”, the peak years are 2011, 2014 and 2017, and the main inclusion criteria are criteria 1, 2 and 3.

Corollary 2: There are two basic communities of terrorist groups in Egypt. Each group has its own pattern of attacks. The first community tends to make armed assault using firearms attacking mainly Police officers. However, the second community tends to make explosions using explosives attacking both Police and Military officers.

Corollary 3: The Egyptian terrorism network reveals three cliques, one of them constitute a community in itself, which is the first community in Corollary 2. However, the second two cliques are different in the pattern of attacks, but in the same time, the two cliques are connected through a link between “Ajnad Misr” and “Ansar Bayt al-Maqdis (Ansar Jerusalem).” Cliques 2 and 3 share the same pattern of using explosives but differ in their targets, where Clique 2 mainly attacks Military forces, while Clique 3 mainly attacks Police forces. They also differ in the inclusion criteria and peak years.

In addition to the network visualization, Gephi calculates some measures of centrality for each node in the network – degree, weighted degree, betweenness, clustering coefficient and eigenvector centrality. These centrality measures give us a notion about the importance of each node in the network. Table V shows the five centrality-measures for the 17 nodes of the network sorted in alphabetic order.

Table VI shows the top five nodes in each centrality measure.

The results, shown in Tables V and VI, can be summarized as follows:

• The groups with the highest degree, as well as weighted degree centrality are Ajnad Misr, Ansar Bayt al-Maqdis (Ansar Jerusalem), Islamic State in Egypt, Takfir wal-Hijra (Excommunication and Exodus), and Unknown. The groups with the second highest degree and weighted degree centrality are Muslim Brotherhood, Sinai Province of the Islamic State, Muslim extremists, Revolution's Brigade, Islamic State of Iraq and the Levant (ISIL), Hasam Movement and Revolutionary Punishment Movement.

• The groups with the highest betweenness centrality are Ajnad Misr, Ansar Bayt al-Maqdis (Ansar Jerusalem), Islamic State in Egypt, Takfir wal-Hijra (Excommunication and Exodus) and Unknown, resp.

• The groups with the highest clustering coefficient are Muslim Brotherhood, Sinai Province of the Islamic State, Muslim extremists, Revolution's Brigade, Islamic State of Iraq and the Levant (ISIL), Hasam Movement and Revolutionary Punishment Movement, resp.

• The groups with the highest eigenvector centrality are Ajnad Misr, Ansar Bayt al-Maqdis (Ansar Jerusalem), Islamic State in Egypt, Takfir wal-Hijra (Excommunication and Exodus), Muslim Brotherhood, Unknown, Sinai Province of the Islamic State and Muslim extremists, resp.

Finally, to validate the proposed algorithm, the researcher conducted a cluster analysis of the original GTD data without any processing. Using SPSS software, the cluster analysis with both Akaike's Information Criterion (AIC) and Shwarz's Bayesian Criterion (BIC) shows that the incidents can be clustered into two clusters as follows:

1. Cluster 1: Ajnad Misr, Al-Furqan Brigades, Ansar al-Islam (Egypt), Ansar Bayt al-Maqdis (Ansar Jerusalem), Army of Islam, Hamas (Islamic Resistance Movement), Islamic State in Egypt, Jaljala Army, Muslim Brotherhood, Muslim extremists, Popular Resistance Movement (Egypt), Sinai Province of the Islamic State, Takfir wal-Hijra (Excommunication and Exodus) and Unknown.

2. Cluster 2: Bedouin tribesmen, Egyptian Tawhid and Jihad, Hasam Movement, Islamic State of Iraq and the Levant (ISIL), Orfei Harsha'am, Revolution's Brigade, Revolutionary Punishment Movement and Youth of the Land of Egypt.

Removing the groups that are not included in the network analysis, we find a big resemblance between the clusters created by the cluster analysis and the communities created by the network analysis; however, network analysis gives the researcher far more detailed and accurate results including centrality measures and weights of linkages between groups.

6. Conclusion and future research

From the previous analysis and results, we can conclude that there are shared patterns of violence acts among different terrorist groups. Data about terrorism incidents reveal different levels of similarity between terrorist groups in terms of the ways they perform their acts.

Using network analysis proved to be beneficial not only in studying the relationships between an individual actor inside a group and the rest of the group members but also in studying the mapping of terrorist groups and organizations themselves.

In addition, the results of mapping terrorist groups using network analysis were similar to the results of cluster analysis, which gives validation to the proposed algorithm. Moreover, network analysis outperforms cluster analysis because it promotes the analyst with much more details than just classification. For instance, it enables the analyst to visualize the linkages between different terrorist groups; it calculates several measures of centrality or prestige, or detect the most important groups in the network; it weights the linkages between different groups by the similarity measure, which enables more in-depth analysis.

Applying the proposed algorithm on a sample of terrorism incidents that happened in Egypt from 2011 till 2017, we found that the network of terrorist groups can be decomposed into two important components and three cliques. This means that in spite of the fact that there are 22 terrorist groups registered in the GTD data for this sample, there are only two to three main shared patterns of terrorism exist. In other words, we have many group names for the same pattern. This result needs to be studied in further detail in future research.

“Ajnad Misr” is the most central terrorist group in terms of the number of links it has, the betweenness of its location in the network, and its connectedness to other central and powerful groups. In addition, the linkage between “Ajnad Misr” and “Ansar Bayt al-Maqdis (Ansar Jerusalem)” is the most important link in the network, as it acts as a bridge between two cliques (cliques 2 and 3 in the results).

The highest similarity measure lies between “Ajnad Misr” and “Muslim Brotherhood,” which gives an indicator that both groups are two sides of the same coin. This claim is validated by “Ajnad Misr” claim that their acts are considered as retribution for the isolation of Mohamed Morsi. However, “Muslim Brotherhood” has a 100 per cent clustering coefficient, meaning that it has the densest relationships with other groups in the network.

The second highest similarity measure lies between the “Unknown” group and “Sinai Province of the Islamic State,” which, in turn, reveals the high similarity with “Ansar Bayt al-Maqdis (Ansar Jerusalem)” creating a powerful triangle between these three terrorist groups. This means that the terrorism incidents that were perpetrated by unknown groups reveal high similarity with the terrorism incident that was perpetrated by “Sinai Province of the Islamic State” and “Ansar Bayt al-Maqdis (Ansar Jerusalem)”.

Finally, this study proposes a new way of analysis of terrorism data that can be useful in understanding the landscape of terrorism.

Figures

Figure 1.

The calculated similarity matrix of the 22 terrorist groups

Figure 2.

The generated undirected weighted network of terrorist groups

Figure 3.

The filtered network

Table I.

The list of terrorist groups extracted from GTD

Group ID	Group name
1	Ajnad Misr
2	Al-Furqan Brigades
3	Ansar al-Islam (Egypt)
4	Ansar Bayt al-Maqdis (Ansar Jerusalem)
5	Army of Islam
6	Bedouin tribesmen
7	Egyptian Tawhid and Jihad
8	Hamas (Islamic Resistance Movement)
9	Hasam Movement
10	Islamic State in Egypt
11	Islamic State of Iraq and the Levant (ISIL)
12	Jaljala Army
13	Muslim Brotherhood
14	Muslim extremists
15	Orfei Harsha'am
16	Popular Resistance Movement (Egypt)
17	Revolutionary Punishment Movement
18	Revolution's Brigade
19	Sinai Province of the Islamic State
20	Takfir wal-Hijra (Excommunication and Exodus)
21	Unknown
22	Youth of the Land of Egypt

Table II.

Peak years, attack type, weapon type and target type of terrorist groups

ID	Peak year	Attack type	Weapon type	Target type
1	2014	Bombing/Explosion	Explosives	Police
2	2013	Armed Assault	Explosives	Maritime
3	2017	Armed Assault	Explosives	Police
4	2014	Bombing/Explosion	Explosives	Military
5	2011	Bombing/Explosion	Explosives	Private Citizens and Property
6	2012	Hostage Taking (Kidnapping)	Firearms	Tourists
7	2013	Hostage Taking (Kidnapping)	Firearms	Police
8	2015	Bombing/Explosion	Explosives	Military
9	2016	Armed Assault	Firearms	Police
10	2017	Bombing/Explosion	Explosives	Police
11	2014	Armed Assault	Firearms	Police
12	2012	Armed Assault	Explosives	Military
13	2014	Bombing/Explosion	Explosives	Police
14	2013	Bombing/Explosion	Explosives	Military
15	2014	Hostage Taking (Kidnapping)	Melee	Private Citizens and Property
16	2015	Bombing/Explosion	Explosives	Business
17	2015	Armed Assault	Firearms	Police
18	2016	Armed Assault	Firearms	Police
19	2015	Bombing/Explosion	Explosives	Military
20	2011	Bombing/Explosion	Explosives	Police
21	2015	Bombing/Explosion	Explosives	Military
22	2014	Armed Assault	Firearms	Military

Table III.

Inclusion criteria, location, lethality and average lethality of terrorist groups

ID	Crit 1	Crit 2	Crit 3	Latitude	Longitude	Lethality	Avg. lethality
1	1.00	1.00	1.00	30.03727341	31.1695385	127	3.97
2	1.00	1.00	1.00	30.49634933	31.82451439	2	1.00
3	1.00	1.00	1.00	29.49774742	29.95863724	61	61.00
4	0.98	1.00	0.73	30.46350861	33.10931778	1,130	17.94
5	1.00	1.00	1.00	30.76229668	29.69626808	166	166.00
6	0.89	1.00	0.89	29.80060005	33.63412094	3	0.38
7	1.00	1.00	1.00	31.12664604	33.80086517	0	0.00
8	1.00	1.00	0.00	31.25019646	34.2412796	0	0.00
9	1.00	1.00	1.00	30.1593132	31.19437981	94	5.88
10	1.00	1.00	1.00	29.59600449	31.4504261	694	33.05
11	1.00	1.00	1.00	30.93447113	29.33753967	31	10.33
12	1.00	1.00	0.00	31.25019646	34.2412796	73	73.00
13	1.00	1.00	0.97	30.27498245	31.29563904	93	2.82
14	1.00	1.00	0.76	30.95872498	33.14603806	500	5.00
15	1.00	1.00	1.00	30.08462906	31.33431435	12	12.00
16	1.00	1.00	1.00	30.10975266	30.92887497	27	1.93
17	1.00	1.00	0.91	29.43771362	30.99611473	35	3.18
18	1.00	1.00	0.67	30.46240807	31.00362587	38	12.67
19	1.00	1.00	0.70	31.05271149	33.86114502	5,977	14.44
20	1.00	1.00	1.00	31.25019646	34.2412796	1	1.00
21	1.00	1.00	0.79	30.64862442	32.90605545	3,417	2.82
22	1.00	1.00	0.00	31.41765022	31.81431198	17	17.00

Table IV.

Generated network data file with threshold = 60% ordered by link weight

Source	Target	Weight
Ajnad Misr	Muslim Brotherhood	8.41
Sinai Province of the Islamic State	Unknown	7.65
Hasam Movement	Revolution's Brigade	7.53
Islamic State of Iraq and the Levant (ISIL)	Revolution's Brigade	7.30
Islamic State of Iraq and the Levant (ISIL)	Revolutionary Punishment Movement	7.10
Ansar Bayt al-Maqdis (Ansar Jerusalem)	Sinai Province of the Islamic State	6.93
Revolutionary Punishment Movement	Revolution's Brigade	6.91
Hasam Movement	Islamic State of Iraq and the Levant (ISIL)	6.90
Hasam Movement	Revolutionary Punishment Movement	6.82
Muslim extremists	Unknown	6.67
Ansar Bayt al-Maqdis (Ansar Jerusalem)	Muslim extremists	6.66
Ansar al-Islam (Egypt)	Islamic State in Egypt	6.63
Popular Resistance Movement (Egypt)	Unknown	6.48
Ansar Bayt al-Maqdis (Ansar Jerusalem)	Unknown	6.40
Muslim extremists	Sinai Province of the Islamic State	6.35
Muslim Brotherhood	Takfir wal-Hijra (Excommunication and Exodus)	6.34
Ajnad Misr	Islamic State in Egypt	6.30
Ajnad Misr	Takfir wal-Hijra (Excommunication and Exodus)	6.26
Islamic State in Egypt	Muslim Brotherhood	6.19
Ajnad Misr	Ansar Bayt al-Maqdis (Ansar Jerusalem)	6.05
Islamic State in Egypt	Takfir wal-Hijra (Excommunication and Exodus)	6.03
Army of Islam	Takfir wal-Hijra (Excommunication and Exodus)	6.01
Hamas (Islamic Resistance Movement)	Jaljala Army	6.00

Table V.

The calculated centrality measures for network nodes

Group name	Degree	Weighted degree	Betweeness	Clustering	Eigen-vector
Ajnad Misr	4	27.02	0.208	0.5	1
Ansar al-Islam (Egypt)	1	6.63	0.000	0	0.25
Ansar Bayt al-Maqdis (Ansar Jerusalem)	4	26.04	0.200	0.5	0.94
Army of Islam	1	6.01	0.000	0	0.25
Hamas (Islamic Resistance Movement)	1	6.00	0.000	0	0.01
Hasam Movement	3	21.26	0.000	1	0.42
Islamic State in Egypt	4	25.15	0.075	0.5	0.84
Islamic State of Iraq and the Levant (ISIL)	3	21.30	0.000	1	0.42
Jaljala Army	1	6.00	0.000	0	0.01
Muslim Brotherhood	3	20.94	0.000	1	0.79
Muslim extremists	3	19.68	0.000	1	0.71
Popular Resistance Movement (Egypt)	1	6.48	0.000	0	0.23
Revolutionary Punishment Movement	3	20.83	0.000	1	0.42
Revolution's Brigade	3	21.74	0.00	1	0.42
Sinai Province of the Islamic State	3	20.93	0.29	1	0.71
Takfir wal-Hijra (Excommunication and Exodus)	4	24.64	0.36	0.5	0.84
Unknown	4	27.19	0.31	0.5	0.77

Table VI.

The top 5 nodes in each centrality measure

Rank	Degree	Weighted degree	Betweeness	Clustering	Eigenvector
1	Ajnad Misr	Unknown	Ajnad Misr	Muslim Brotherhood	Ajnad Misr
2	Ansar Bayt al-Maqdis (Ansar Jerusalem)	Ajnad Misr	Ansar Bayt al-Maqdis (Ansar Jerusalem)	Sinai Province of the Islamic State	Ansar Bayt al-Maqdis (Ansar Jerusalem)
3	Islamic State in Egypt	Ansar Bayt al-Maqdis (Ansar Jerusalem)	Islamic State in Egypt	Muslim extremists	Islamic State in Egypt
4	Takfir wal-Hijra (Excommunication and Exodus)	Islamic State in Egypt	Takfir wal-Hijra (Excommunication and Exodus)	Revolution's Brigade	Takfir wal-Hijra (Excommunication and Exodus)
5	Unknown	Takfir wal-Hijra (Excommunication and Exodus)	Unknown	Islamic State of Iraq and the Levant (ISIL)	Muslim Brotherhood