MILNET Brief
  Sample Association Graphic

Graphic Showing Associations Between
Abu Sayyaf, Jemaah Islamiyah, and the National Liberation Front
European News Monitor's Online Explorer Association Program

What follows is a demonstration of data mining technology.  Like much of the tools in the industry, the quality of your results depends almost entirely on the quality of your database.  For instance, if your database has gleaned unverified or specifically erroneous data, then what you will see may lead you to make assumptions that are patently wrong as well.  However, if your data is pretty clean, with multiple sources gathered and also available in the database, then not only will your output be of high quality and useful in the life and death world of intelligence, but you will also be able to see those very same multiple sources as lines from those sources to the subject.  This is critical.

In our example, the European News Monitor provides an online data fusion and data mining application to anyone who cares to browse their service.  It basically looks up things in their giant database, and then places the data mining application on top  of that, allowing their website visitor to take a peek at the associations attributable to the topic at hand.  For instance, if you go to the site and type "Abu Sayyaf" in the search box, you will get a list of matching entries, and then if you click on the Abu Sayyaf entry you'll get a list of headlines in the left column and a little graphic in the right that looks like this.  When you click on the graphic you are automatically routed into the News Explorer Online Association program.  This allows the user to graphically play with the data to drill down or expand upon items of interest shown.  For instance, the chart shown below demonstrates a rather busy expansion of the Abu Sayyaf associations in the ENM news database. 

Of course not everything in the database implies a nefarious connection.  However the application does allow the user to poke around and if the data were clean enough, allows the user to make valid assumptions about the associations found.  A news database, of course, would first need to be gone over carefully removing any extraneous data...for instance news articles that cover five topics on the same page might create a false impression that associates people, places and things from one article into another even when they have absolutely nothing to do with each other.  Or the newpaper or TV/Radio station itself might be the only link -- it covers a variety of subjects and as a link, the media is only good for the content, not the actual linkage itself.


Abu Sayyaf Linkages
Click on the image to see a blown up version that is a little easier to read

Here is a simplified association chart that show's labels for a number of interesting links to Abu Sayyaf...note we left out the White House...don't worry it will come back later.


Abu Sayyaf Chart with Labels Pasted In

In the Online News Explorer program, if you double clicked on the James Linn silhouette, you'd then see a blowup of the associations for that person...in this case it ranges as far as the U.N. Security Council, George Bush, and of course, the New York Times.  This of course does not mean James Linn has a nefarious relationship with the NYT or George Bush, but simply shows there is some sort of association.  The intelligence analyst needs to drill down further to see just exactly what those relationships are. 

Suppose for instance you were confused and thought James Linn was John Walker Lindh, also known as Johhny Jihad, the American caught fighting for the Taliban in Afghanistan.  For instance it could be that George W. Bush made a determination to order the Justice Department to treat Linn as an enemy combatant, or that the New York Times (along with the China Daily and the Xingua News Agency) covered the Linn story.  Or perhaps this is a totally different James Linn.  Which of course is the actual case, Linn has no relationship to John Walker Lindh, and poking around quickly establishes that.  We do find a nice link to the New York Times, and that is the connection.  James Linn turns out to be the lawyer for a case involving Imelda Marcos (wife of the former Dictator in the Philippines).  His connection is that he is a lawyer and the connection is only via the New York Times and the fact Mrs. Marcos was from the Philippines where Abu Sayyaf is notorious.

The leaders of Abu Sayaff have been "pulled out" by the author...in order to highlight them at the center right, right below the name of what would be familiar to those studying terrorism, Ramzi Youseff who is linked to both the World Trade Center bombing and lived with Khalid Shaikh Mohammed, the mastermind of 9/11, while they both roomed in the Philippines.  The leaders are the Janjatanis, one of whom was killed by Philippines police while hunting down several missionaries who were kidnapped.  The links do go on...


James Linn Association Expansion

Now if you wanted to see more about the New York Times, you could click on the New York Times silhouette and it would also expand.  Double clicking on the enlarged figurehead would open the News Explorer's text interface and go look up the New York Times. We will skip that step, and instead focus on the links shown for the New York Times.



Note the names Robert D. Novak, Lewis Libby and Valerie Plame at the lower right.  This is the case where allegedly Libby about the outing of the identity of CIA WMD specialist Valirie Plame to Robert D. Novak who then told the world of the CIA agent's identity. Libby was on trial as this briefing was being written.  So in this situation, the associations are real...we know these are at least three of the players involved.

Note also the name Lynn Stewart at bottom center.  Perhaps this is the civil rights lawyer for the blind Shiek, Omar Abdel Rahman.  Actually Lynne Stewart (note the different first name) is THAT lawyer who was convicted of conspiring to deliver messages from Rahman while he was serving a life sentence for masterminding the first World Trade Center bombing.  So some associations COULD be nefarious. If the database linkages were set up correctly, clicking on Stewart would lead to a line leading back to an actual news story linkage to Sheik Omar Rahman.  Unfortunately, the Lynn Stewart in this case just might be on the reporting or editorial staff at the New York Times. Or perhaps it IS the Lynne Stewart...we found several news articles that had both spellings in the same article.  An interesting coincidence is that Youseff was also convicted for his part in the first World Trade Center bombing and is also serving life in prison.  It leads one to wonder if he too was represented at some point by Lynne Stewart.

We have gone from Abu Sayyaf to Lynne Stewart who represented Rahman.  Since there is no direct line leading from Rahman and Stewart to Abu Sayyaf, we are led to believe (rightly so) that the only association between Stewart/Rahman and Abu Sayyaf is through a newspaper, the New York Times.  AND that connection is only through the intermediary James Linn.  A little more poking around with the tool might establish that Ramzi Youseff too has no connection to Abu Sayyaf and is also linked only by the fact that the New York Times has written stories about Linn (Ambled Marcos' lawyer) and Youseff.  However that is unlikely, he lived in the Philippines and may have gotten connected to Al Qaeda through Abu Sayyaf.   Similarly we might find that the White House and George W. Bush are also honored by the same type of linkage - the New York Times story on the I. Lewis "Scooter" Libby indictment and trial makes it appear that George W. Bush is connected in some way to Abu Sayyaf, again via Linn.  We have to look further to see if some case Linn is involved in also mentions George W. Bush...perhaps something to do with the State Department or a Free Trade Agreement.

In any case, the power of the tool is real, and if used correctly and with a modicum of intelligence, can prevent embarrassing mistakes...for instance, a certain Senator's stock purchase that makes him or her look like they are connected to the nation of China. The real power is seeing lots of linkages between multiple groups as in the large expanded version. 


Abu Sayyaf Linkages
(Click on Image to see a blowup of the upper left corner)

This shows some names which are common linkages between Abu Sayyaf (upper left "sphere"), the National Liberation Front (upper right) and Jemaah Islamiyah (lower right corner).  Note too an interesting relationship between a centrex of ten names linking all three terrorist groups to the Organization of the Islamic Conference (upper center of the image).  Also there are two important clusters of folks in the lower left who link Abu Sayyaf to Jemaah Islamiyah, and another cluster just to the right of the Abu Sayyaf cluster that links that organization to the National Liberation Front.  In a later expansion we find Osama bin Laden and Al-Qaeda, a notorious link for sure.  And of course, once again there appears to be a link between Al Qaeda's link to Abu Sayyaf and poor Mister Linn whose only fault is being a lawyer :).

Of course, since this is from a News database, the linkage might only be that someone postulated a connection between Abu Sayyaf and Al-Qaeda in a news story.  However, we know from other evidence (we could easily have been led by the link shown here to start an investigation...but we already have the data in hand), that Al-Qaeda and Abu Sayyaf have traded people and training.  There is also evidence that Al-Qaeda also provided weapons and explosives, and perhaps even targets and/or planning.  The power of the tool to inspire investigation can be a big plus -- it may lead to discovery of important tactical or strategic information, or on the downside, send us off on a wild goose chase. 

This is all part of the intelligence business -- we go where the intelligence leads us.  If we wound up wasting time, then perhaps we clean the data a little better or recognize patterns that will lead us astray -- like deleting the linkages that are purely due to unrelated connections...i.e. the New York Times did a story on two unrelated people -- perhaps on one page or in two separate articles.  However, we always follow the path...not to do so could be criminally negligent.

Sources:
  1. Abu Sayyaf, MIPT Terrorism Database, 01/16/2007
  2. Abu Sayyaf, European News Monitor's  JRT News Explorer  (May be slow on your datacomm connection - we recommend DSL or better to receive data, also requires FLASH Player 9 © or better). Flash Player is a trademarked application, trademark by Adobe.
  3. John Walker Lindh Profile, CNN, undated
  4. Lynne Stewart, Discover The Networks.com, updated in October of 2006
  5. Woodward Tapes Reveal Official Outing Agent, New York Times, 02/12/2007
  6. Jemaah Islamiya Association Graph, MIPT Terrorism Database, 11/23/2007
  7. Abu Sayyaf Association Graph, MIPT Terrorism Database, 11/23/2007



© Copyright 2007, Michael G. Crawford