ATP 2-33.4, page 68

Chapter 5 5-14 ATP 2-33.4 18 August 2014 NETWORK ANALYSIS 5-48. As performed by intelligence analysts, network analysis is the examination of dynamic, multi-link human networks characterized by varying degrees of uncertainty, such as terrorist and other irregular threat organizations usually encountered in a counterinsurgency mission. Unlike conventional hierarchical military organizations, these types of organizations are cellular and distributed. Part of the difficulty in countering these types of organizations is to understand how they evolve, change, adapt, and can be destabilized. Network analysis involves knowledge management, research, and modeling techniques to extrapolate the structure, locations, members, goals and objectives, activities, and the defeat mechanism for these types of organizations. LINK ANALYSIS OR NETWORK ANALYSIS 5-49. These two analytic techniques are very close and often the names are used interchangeably. Facts 5-50. Both techniques use visualization tools to depict enemy networks; superficially, they may look very similar. But there are some differences the analyst should understand.  Link analysis is a quicker, more superficial look at the connections and associations between individuals, organizations, events, and activities. Link analysis is the technique most often employed at the tactical level, especially at brigade and battalion analytic elements.  Network analysis takes the analytic effort to the next level. Network analysis examines the structure and types of associations, the centrality of entities within a network, and the organization of the network. It is more time and resource intensive than link analysis. Network analysis is the technique employed at the operational and strategic levels. 5-51. This is not to imply both techniques cannot be used at all levels of intelligence operations. Analysts understand the limitations of their intelligence elements and choose the best analytic technique or techniques to meet the commander’s requirements. The Method 5-52. Conducting network analysis involves eight steps:  Step 1. Construct a network chart or diagram. Extract entities and the information about their relationships from association and activities matrices, imagery, SIGINT intercepts, and message traffic. Place entity associations into a network diagram by using a software tool or spreadsheet. Each element is represented by an icon (such as a picture, figure of a person, figure of a building). The more accurate the icon, the more informative the network diagram will be to analysts. Draw connections between elements.  Step 2. Identify, combine, or separate nodal components. List each node in a database or software program. Delineate each node and interaction by criteria meaningful to your analysis. These criteria may include frequency of contact, type of contact, type of activity, and source of information. The network diagram may be made more informative by re-coloring connections to present each criterion in a different color or style.  Step 3. Identify the functions of each node, as possible. Determine centrality; examine network density and distance:  What is the centrality of each node within the network?  What role is each entity involved in the network?  Who or what forms a bridge or liaison between groups or subgroups?  How have the interactions changed over time?  Which nodes should be targeted for collection or defeated? Note. Organizational structure, centrality, and network density and distance are fundamental concepts to network analysis. These concepts are explained beginning at paragraph 5-62.