Background

In this paper we consider two weighted and undirected criminal networks or graphs. For convenience, we first summarise some key concepts of network theory [37] and formalize the problem at hand.

An unweighted graph G = (V, E) consists of a finite set V of n vertices (also called nodes or actors), and a set E ⊆ V × V of edges (also called links or ties).

A weighted graph is defined as a triplet G = (V, E, W), consisting of a finite set of vertices V, a set of edges E ⊆ V × V between nodes, and a set of positive weights W: E → R₊₊ defined on each edge.

When all the edges are bidirectional, the graph is called undirected.

A path from node u to v is a sequence of nodes starting with u and ending with v, such that between any consecutive nodes there is a link. The path cost is the sum of the weights of all links along the path. A shortest path from u to v is a path along which the path cost is minimal (there may exist multiple shortest paths). In weighted graphs, the path cost equals is sum of the weights along the path. For unweighted graphs, a shortest path is that (or those) consisting of the fewest number of links.

A connected component [38] of an undirected graph is a subgraph in which any two vertices are connected to each other by paths, and which is connected to no additional vertices outside of this component (i.e., the connected components represent a partition of the whole graph, sometimes called supergraph). The LCC is the biggest one among all the connected components in a graph.

The adjacency matrix of a graph G defined over the set of vertices V = {1, …, n}, is an n × n square matrix denoted by A = (a_ij), 1 ≤ i, j ≤ n, where a_ij = 1 if there exists an edge joining vertices i and j, and a_ij = 0 otherwise. Moreover, if the element (i, j) of the matrix A^k (k ≥ 2) is one, then the nodes i and j are connected through some walk of length exactly k. The weighted networks can be represented by giving the elements of the adjacency matrix values equal to the weights of the corresponding connections.

Centrality is a key concept in network analysis, and refers to the importance of a node in a network. There are multiple measures for network centrality in use within SNA, but the two most common centrality measures relating to strategic positions are Degree centrality and Betweenness centrality [11, 16].

Degree centrality [39] is a measure which evaluates the local importance of a node within the graph; given a node i, the Degree centrality C_D(i) of i is defined by: (1) where A = (a_ij) is the adjacency matrix of the graph.

The node degree represents the number of edges adjacent to the node, while the weighted node degree is the sum of the edge weights, for edges incident to that node. This measure has been formalized as follows [40]: (2) where w is the weighted adjacency matrix, in which w_ij is greater than 0 if the node i is connected to node j, and the value represents the weight of the edge.

Some nodes may play a particularly important role in propagating information because they act as bridges between separate regions of a graph and so they have the potential to slow down (or magnify) the information flow from one region to another. Such nodes are said to have a high value of Betweenness centrality [41]. Specifically, the (shortest-path) betweenness C_B(i) of a node i is defined as follows: (3) where σ(s, t) is the number of shortest paths between an arbitrary pair of nodes s and t, while σ(s, t ∣ i) denotes those shortest paths passing through the node i.

Betweenness centrality is a measure based on shortest paths for both unweighted and weighted networks. For our algorithm, we use Breadth-First Search (BFS) for unweighted and Dijkstra’s algorithm for weighted graphs.

Katz centrality [42] is another centrality measure, which defines the centrality for a node based on the centrality of its neighbours. For a node i this is defined as: (4) where α and β are positive constants, A = (a_ij) is the adjacency matrix of the graph, whose eigenvalues are denoted by λ_i, i = 1, …, n. The parameter β controls the initial centrality, while the parameter α satisfies the inequality:

The Katz centrality for weighted networks can be computed in a similar way, but in this case we have to use the weighted adjacency matrix instead.

Another useful network metric is the Collective Influence (CI) [43], which computes the centrality (or influence) of a node i of a network according to the formula: (5) where k_i is the degree of node i, B(i, ℓ) is the ball of radius ℓ centered on node i, and δB(i, ℓ) is the frontier of the ball, that is, the set of nodes at distance ℓ from i (the distance between two nodes is defined as the number of edges of the shortest path connecting them). To compute CI_#x2113;(i), we first find the nodes on the frontier δB(i, ℓ). To compute the CI in a weighted network, we have to substitute the degree k of a node by his weighted degree given by formula (2).

Clustering Coefficient (CC) is a measure of the degree to which nodes in a graph tend to cluster together. For unweighted graphs, the clustering of a node i, denoted by CC(i), is the fraction of possible triangles through that node that exist, given by (6) where T(i) is the number of triangles through node i and k_i is the degree of i. For weighted graphs, the clustering is defined as the geometric average of the subgraph edge weights [44], obtained from the formula (7) where are the edge weights normalized by the maximum weight in the network .

The Average Path Length (APL) [45] is a useful metric for assessing the connectivity of a graph. It is the average number of steps along the shortest paths for all possible pairs of network nodes. The average path length is defined as follows: (8) where V = {1, …, n} is the set of nodes in the graph G, d(i, j) is the length of the shortest path from node i to node j, and n is the number of nodes in G.

Dataset collection

In this section we describe how the datasets have been collected. Our datasets were derived from the pre-trial detention order, issued by the Court of Messina’s preliminary investigation judge on March 14, 2007, which was towards the end of the major anti-mafia operation referred to as the “Montagna Operation”.

We have chosen the court order associated with the operation Montagna because it contained the largest number of wiretaps and stakeout instances among all court orders we had access to, which allowed us to maximise the size of the dataset.

This operation was concluded in 2007 by the Public Prosecutor’s Office of Messina (Sicily) and was conducted by the Special Operations Unit of the Italian Police (Reparto Operativo Speciale (R.O.S.) of the Carabinieri, specialized in anti-Mafia investigations).

This particular investigation was a prominent operation focused on two Mafia clans, known as the “Mistretta” family and the “Batanesi” clan. From 2003 to 2007, these families were found to had infiltrated several economic activities including major infrastructure works, through a cartel of entrepreneurs close to the Sicilian Mafia.

According to the Italian Code of Criminal Procedure, the pre-trial detention order begins with the crimes alleged against individuals. The same individual can be mentioned multiple times in the order: for example, an individual A could appear for the first time because she/he is accused of theft; furthermore, A could appear together with an individual B because both A and B could be jointly accused of extortion.

Information available in the pre-trial detention order is relevant to the construction of a graph, which falls within the class of the so-called of co-offending networks [46]: in a co-offending network, nodes are associated with individuals while edges specify that two individuals (corresponding to the endpoints of that edge) co-participated in perpetrating a crime. The construction of a co-offending network highly depends on the assessments of the public prosecutor, who could classify some activities as criminal ones, while considering other activities as not criminally relevant.

In the light of these reasons, we preferred to focus on graphs that store meetings and phone calls between individuals: these graphs, in fact, are built starting from the observation of individual behaviors and, thus, they do not rely on the legal value that these behaviors could have according to the personal view of the public prosecutor.

The pre-trial detention order reported the composition of both the Mistretta family and the Batanesi clan; judicial proceedings followed a chronological narrative scheme which detailed the illicit activities pursued by the members of the Mistretta clan before the imprisonement of a boss; to preserve anonymity, we will denote such a boss as x. The boss x has been selected by the most influential Mafia syndicates to settle the conflicts between the Mistretta and the Batanesi families. The conflicts were unleashed from the extortion imposed on local entrepreneurs in the construction of the highway that connects the city of Messina to Palermo.

LEAs relied on the depositions of collaborators of justice, stakeouts and wiretapping.

Meetings involving suspected individuals can be broadly classified as follows: (a) meetings which aim to define the organizational structure of the Mafia syndicate along with its relationships with entrepreneurs and other Mafia syndicates operating in surrounding areas. The boss x always attended these meetings and has always been accompanied by at least two trusted men. (b) Meetings involving people who occupied the lowest levels of the Mafia syndicate hierarchy; the purpose of these meetings was, in general, to design illicit activities and, usually, only two people were involved in these meetings. For each one the date of the meeting, the place, and the participants were recorded. Participants to a meeting were identified by a unique identification code. The procedure to build the Meetings network was as follows: (a) each person who participated in at least one meeting corresponds to a node in the network; (b) two subjects in the Meetings network are connected by an edge if both of them attended at least one meeting; (c) edge weights reflect the number of meetings that two individuals jointly attended. Analogously, judicial proceedings recorded phone calls between the individuals under investigation. For each call, the ID of the caller (resp., the ID of the receiver), the time of the call, the duration, and content of the conversation were reported. The procedure to build the Phone Calls network was as follows: (a) each person who made or received at least one call was associated with a node in the network; (b) two nodes in the phone call are connected by an edge if the associated individuals had at least one call; (c) the weight attached to an edge specifies the number of phone calls between the individuals connected by that edge. Observe that we used only text data (from pre-trial detention order) to derive links in both the Meetings and the Phone Calls networks. In addition, we included all actors found in the investigation records, independently of the fact that an actor is actually a member of a Mafia syndicate or not.

Dataset description

In this section we explain how we have created the datasets (which is fully available on GitHub repository https://github.com/lcucav/criminal-nets/tree/master/disruption) and on Zenodo (https://doi.org/10.5281/zenodo.3938818), generating two criminal networks, directly from Court data. We have previously reported a visual representation of both datasets as undirected and weighted graphs in [35]. In our datasets, each node represents an individual, whereas links show mutual interactions among the individuals. The Meetings dataset, captures the physical meetings among suspects. the Phone Calls dataset refers to phone calls among individuals.

In [35], we introduced a preliminary characterization, whereby we defined the weight distributions and conducted the shortest path length analysis. The weights distribution analysis unveiled a long tail of nodes, with just a few dominating ones. We could observe that a predominant number of links had similar weight (w = 1), thus making the distinction between weighted and unweighted graphs negligible after the removal of the better connected nodes. As also confirmed through the shortest path length analysis, the study demonstrated that just a few affiliates tend to be responsible for the highest interaction frequency with a balanced number of intermediates. This is because the clans aim to avoid an overexposure of the bosses (and other prominent affiliates), to minimize police interceptions.

Encouraged by those early results, in the present paper we have moved our attention to understand how LCC varies as a result of police interventions (i.e., the nodes removal process).

The key features of our datasets are summarized in Table 1, including the number of nodes and edges, the maximum weight, the maximum frequency in the affiliates’ interactions, the average degree (neighbours per node), and the highest number of individuals required to connect mobsters (based on all shortest paths in both datasets). We also calculated the APL and the CC of the Meetings and the Phone Calls networks. It is worth noticing that the two datasets have 47 nodes in common and a comment on this overlap is extensively discussed in Subsect. Main limiting factors of our study.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Characteristics of meetings and phone calls networks.

https://doi.org/10.1371/journal.pone.0236476.t001

Indeed, both networks can be treated as either unweighted and weighted networks since, for each pair of individuals, we recorded a coefficient representing the number of times the pair had a meeting (as reported by the police surveillance logs), and made a phone call (reported in police interceptions logs). In SNA terms, these coefficients are known as the strength of the connection between two individuals.

Nodes may belong to different categories. Some nodes represent the leaders (i.e., “bosses”) or the soldiers (i.e., “picciotti”, a Sicilian word which refers to the lowest rank of the Mafia hierarchy) of the criminal organization. Other nodes are associated with individuals (e.g., a fruit seller or a baker) who had one or more calls with members of a Mafia syndicate but are not affiliated with any criminal organization.

The APL and CC values in the Meetings network were then compared with the average values of APL and CC of a random graph G^⋆; in our tests, G^⋆ had the same number of nodes and the same average degree of the Meetings network. In the Meetings network, the APL and CC are equal to 3.308 and 0.656, respectively; in the random graph associated with the Meetings network, we measured an APL and a CC equal to 4.342 and 0.0018, respectively.

We repeated the procedure above for the Phone Call graph and, thus, we generated a random graph with the same number of nodes of the same average degree of the Phone Call graph and we calculated its APL and CC. We observe that the APL and the CC for the Phone Calls network are equal to 3.378 and 0.105, respectively; in the random graph associated with the Phone Calls network, we measured an APL equal to 5.593 and a CC equal to 0.0039. We can therefore conclude that both in the Meetings and Phone Calls networks the CC values are considerably bigger than those found in the corresponding random graph; in contrast, APL values are moderately lower than those found in the corresponding random graph.

In the light of our analysis, both the Meetings and the Phone Calls networks can be regarded as small world networks [47]. The high CC coupled with a low average path length favour the information flow among the individuals in the criminal organization and promote their coordination, thus making the organization more effective.

Experimental method

This section briefly describes the experimental process employed to disrupt the two networks and evaluate the effects of node removal, under different conditions and strategies. Both datasets were used, under both unweighted and weighted conditions. Two node removal strategies have been studied. These are iterative procedures in which the nodes have been removed in decreasing order of their centrality score. After the node removal stage, the LCC size is updated and the process resumes.

Let us denote by LCC(G) the size of the LCC of a graph G. Denote by G_i the graph resulting after the i-th iteration of the node removal algorithm, whose size of the LCC is LCC(G_i). Clearly, the unperturbed graph is G₀, for which we have LCC(G₀).

The relative difference between the size of the LCC at the start of the simulation and after the i-th iteration (i.e., i-th node removal) is given by ρ_i ∈ [0, 1]: (9)

Note that ρ₀ = 1 and ρ_n = 0, where n is the last iteration (sequential removal).

Both strategies (sequential and block removal) may be summarized as follows:

1. We first compute LCC(G₀), i.e., the LCC size for the initial graph G₀.
2. This step depends on the removal strategy. Either the the highest ranking of the remaining nodes (in the sequential strategy), or the the set of the five most influential nodes of the remaining ones (in the block strategy) are removed. Ranks are computed with the current centrality score. The new graph G_i, with i = 1, 2, …, n is obtained (for block removal we have fewer iterations).
3. Compute LCC(G_i), and calculate ρ_i.
4. Steps 2 and 3 are repeated until the graph size can no longer be reduced.

Comparison to our earlier works

It is worth highlighting the most significant contributions of the present paper, compared the preliminary data published earlier on [26]. The main differences are as follows:

1. In [26], we introduced a different set of datasets. The first one depicted phone calls among suspected criminals. This was then refined through a different investigative method, i.e., the stakeout, which refers to searching private residences and personal bank information according to a formal search warrant. In this way, we were able to build a second dataset that included crime relationships among mobsters. This second dataset may be considered to be a subset of the first one, including only actual criminals, as classified by the LEAs based on criminal evidence.
   By contrast, the datasets introduced herein have been derived from different investigation methods, namely wiretapping and stakeouts. This comes with the benefit of having two datasets that are only loosely related. In fact, only a fraction of wiretapped individuals also attended face-to-face meetings with other suspects (and vice versa).
   The output of wiretapping and stakeout activities generated two graphs (the Meetings and the Phone Calls networks) with different topological features and with a smaller than expected degree of overlap (i.e., the Meetings and the Phone Calls networks had 100 and 101 subjects respectively, of which only 47 were common to both). The structural analysis of the Meetings and the Phone Calls networks is therefore relevant for identifying which specific features of a Mafia syndicate are properly caught by wiretapping, but are overlooked from stakeout (and vice versa). This kind of analysis was not possible in our previous contribution.
2. Beyond the introduction of new experimental datasets, the present paper has different aims. While in [26], we aimed at disrupting the network (e.g., by enlarging the average path length), herein we seek what may cause the largest drop in LCC size.
3. Unlike our previous work, herein we introduce weighted graphs to describe ties between suspect individuals. Weights attached to graph edges measure the intensity of the tie between two suspects and this information was useful to perform new studies (e.g., the effects due to targeted attacks on weighted graphs), which were missing in [26].
4. In this paper we consider two more centrality measures, the Katz centrality and the Collective Influence, to identify the nodes which should be targeted. For example, the Katz centrality uses the contribution of all paths converging to a node in order to calculate the centrality of that node. Therefore, this provides a substantially different approach to computing node centrality from that provided by Betwenneess and Closeness centrality (exploited in our previous paper), which are based only on the shortest paths.

Weighted graphs

Fig 1 shows the results obtained for the cases of sequential and block node removal, for both datasets, and including all four centrality metrics. Remarkably, the Katz coefficient (tuned to the default values of α = 0.1 and β = 1.0) is the least effective one (i.e, the slowest one) at causing the faster LCC size drop, in all eight cases, that are: two datsets (Meetings and Phone Calls), two strategies (sequential and block) and two graph structures (weighted and unweighted).

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 1. Weighted networks.

A: Meetings dataset, sequential node removal strategy. B: Meetings dataset, block node removal strategy. C: Phone Calls dataset, sequential node removal strategy. D: Phone Calls dataset, block node removal strategy.

https://doi.org/10.1371/journal.pone.0236476.g001

To understand this result intuitively, we need to look at the way this centrality metric operates. Katz determines the importance of each node based on the number of walks that pass through it; but it does not consider their length. Furthermore, shortest path are not considered, hence a walk may visit the same node multiple times. Yet, this is in contrast to how criminals would operate in practice. Affiliates typically prefer to spread the information through a number of intermediaries, to minimize the risk of interception by non-family members. This is consistent with our earlier findings [35]. Ultimately, it would not make sense (and would be unwise) to send the same message multiple times through the same path, which is what Katz would help identifying. Therefore, removing nodes by the highest Katz score would not be a winning strategy.

All the other metrics act better than Katz centrality, and comparably among each other. This happens because of the weights distribution shape [35], which exhibits a long tail of nodes, with just a few dominating ones (Sect. Dataset Description). Thus, after removing the most central nodes (i.e., the first five iterations), the network gets almost totally disconnected and the remaining nodes have the same weight (w = 1). Hence, all the metrics focused on either degree (i.e., Degree and Collective Influence) or shortest paths (i.e., Betweenness) follow the same ρ drop speed. On the other hand, Katz centrality with its default parameters focuses on walks of undefined lengths, thus producing a slower ρ drop.

Sequential vs block removal

Looking at Fig 1, with the exception of Katz, no significant differences are visible between the two node-removal strategies (i.e., sequential and block). This is somewhat counter-intuitive, since in real life police raids are typically aimed at breaking up the network more effectively. In our case, this result originates from the particular type of the datasets at hand. When constructing the datasets, we did not have access to information about the way criminals reconstructed their communication channels following arrests. Hence, our network is static (i.e., it misses the network reconfiguration data), which is why our analysis is not fully capturing the dynamic aspects that differentiate sequential and block strategies. In network terms, this translates into no differences in terms of LCC size drop as the network is static. On the other hand, significant network re-tuning of nodes importance, due to internal re-organisation of trusted affiliates used to spread messages within and outside the criminal network, would be expected in the case of dynamic graphs (i.e., graph snapshots before and after police operations).

Weighted vs Unweighted

Considering now the differences between weighted and unweighted graph analysis, we notice that the majority of cases do not pinpoint major differences. This was due to the peculiar way in which weights are distributed in criminal networks (as noted in the Weighted Graphs paragraph).

Nevertheless, interesting differences are visible in the Meetings dataset—sequential node removal (Fig 2). The unweighted case is mostly faster than (although occasionally equivalent to) the weighted case. This is because the weights (i.e., the affiliates’ interaction frequency) are concentrated in very few individuals, with most other weights having w = 1. This is also why, with the exception of the initial transient period (involving very few interactions), most algorithms converge to similar values.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. First 30 iterations of the sequential node removal strategy, Meetings dataset.

A: Unweighted Graph. B: Weighted Graph.

https://doi.org/10.1371/journal.pone.0236476.g002

The best centrality metric

Comparing the algorithms in Fig 2, it emerges that Betweeness centrality is by far the most effective centrality index for reducing the size of the LCC of a criminal network.

This result is consistent with literature reports upon criminal networks’ SNA shown in the Introduction, and has an intuitive explanation. Indeed, to avoid being intercepted, members of a criminal networks build their relationships to assure that information flows along the shortest possible paths. In this way, both the Meetings and the Phone Calls network configure themselves as small-world networks with a low average path length and a large CC. The nodes that intercept most of these shortest paths are those having the largest values of Betweenness centrality, and act as intermediaries to assure the quick flow of information from any source to any target in the graph.

To confirm this intuition, we progressively removed nodes according to their Betweenness centrality and we measured the corresponding variation of APL and the number n_c of connected components (see Fig 3). These plots indicate that the selected removal of nodes amplifies the average distance between any pair of nodes in the Meetings/Phone Calls networks and, simultaneously, it creates an increasing number of disjoint components. A repressive action aimed at removing high Betweenness nodes has, therefore, a devastating impact on network topology because it causes an LCC size drop, as we observed a fast drop in ρ. Also, since the Katz centrality prioritizes those nodes crossed by a large number of walks of arbitrary length, it is less effective in detecting the nodes acting as intermediaries, and whose removal reduces the LCC size the most.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 3. Function variations of the number of removed nodes in the Meetings and phone calls networks.

Nodes are prioritized on the basis of their Betweenness centrality. A: Variation of the APL. B: Variation of the number of connected components.

https://doi.org/10.1371/journal.pone.0236476.g003

Intuitively, Betweenness centrality outperforms the other metrics, thanks to its operation on paths, rather than on individual nodes degree. This is particularly effective in criminal networks that are devised in such a way as to minimize the path length, in order to reduce the risk of police interceptions. Betweeness centrality compromises the most influential paths, leading to a faster drop in ρ. This feature is what makes Betweeness somehow opposite to Katz centrality (whose goal is to explore walks).

Collective Influence was the second worst performer after Katz. This is, again, due to its emphasis on node degree instead of path length. Collective Influence is also showing some differences between the weighted and the unweighted processes, exhibiting a lower ρ drop in the weighed graph. A possible explanation is that the weighted case identifies as influential nodes not only those with higher weights on the incident links, but also the nodes having high-weight only on immediate neighbours. This could reflect a typical situation in criminal networks, whereby the top-leaders avoid direct exposure and mediate all communications through a single trusted individual (or very few of them). On the other hand, this particular aspect is not detectable in the unweighted analysis.

Correlation between social capital and human capital

Inspired by the work of [36], we analyzed the correlation between the social capital and the human capital in the criminal organization we are considering.

In Sociology, the social capital denotes a group of tangible and intangible resources such as interpersonal relationships, a shared sense of identity, shared norms and values, trust, cooperation, and reciprocity which are fundamental to assure the functioning of human communities. From our experiments, individuals with high Betweennees contribute significantly to the social capital associated with a criminal organization because they connect the various subgroups composing the criminal organization itself and enable efficient information flow within the organization.

Thereby, the removal of high Betweenness individuals induces a strong reduction in the social capital but is not, however, the greatest loss that a criminal network might suffer from. For instance, in a drug-trafficking organization, individuals with specialized knowledge in chemistry play a pivotal role to carry out the illicit affairs of the organization. Thus, their removal seriously affects the organization. even if those individuals had low Betweenness.

Broadly speaking, the human capital refers to the skills and resources that some components of the organizations have and which play a key role in the functioning and long-term sustainability of the organization. As noted in [36], the most effective repressive actions should simultaneously aim at weakening both the social and human capital of a criminal organization. To this purpose, Villani et al. [36] suggested a new index (called CNR—Criminal Network Resilience) to assess the resilience of criminal networks, which combines parameters related to social capital, as well as parameters associated with the human capital.

In our study, individuals have three different roles, namely leaders, members, and elements close to the gang but not affiliated with it. Leaders contribute more significantly than others to human capital because they are in charge of making decisions, planning and coordinating criminal actions. In turn, the human capital associated with the members of the gang is greater than those who are close but not affiliated with it. In Table 2 (resp. Table 3) we report the top 10 nodes of the Meetings (resp. Phone Calls) graphs, sorted by decreasing Betweenness values, and their role in the organization. Observe that the node with ID 18 is associated with a leader and has the highest Betweenness, both in the Meetings and in the Phone Calls networks.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Betweenness centrality values and role (Meetings network).

https://doi.org/10.1371/journal.pone.0236476.t002

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Betweenness centrality value and role (Phone Calls network).

https://doi.org/10.1371/journal.pone.0236476.t003

In addition, many nodes (18, 27, 29, 36, 47, 68) have high centrality, in both the Meetings and in the Phone Calls networks. We underline that both in the Meetings and in the Phone Calls networks there are only two leaders in the top 10 positions, which indicates that there is a weak correlation between social and human capital, and this agrees well with the results of [36].

Take-home message

In short, our results confirmed the effectiveness of SNA in speeding up the process of reducing the LCC size of criminal networks. Considering our datasets, we could severely affect LCC (with a 70% LCC size drop) by neutralizing less than 5% of the affiliates (either through sequential arrests or police raids). Betweenness centrality performed significantly better than the other three metrics, thanks to its specific focus on paths, rather than simple node degree. This is consistent with the typical operation of criminal networks where information diffuses through the shortest paths and within the organization, to minimize intra-affiliates interactions and, thus, the risk of interception. Therefore, law enforcement interventions should favor path-related centrality metrics (such as Betweenness) instead of other strategies.

Main limiting factors of our study

We conclude this section by describing the main factors that posed some limits to our study.

1. Wiretapping is allowed strictly under well-motivated circumstances and for short periods of time, thus limiting the ability of police forces to gather data on Mafia activities. According to the Italian Code of Criminal Law, LEAs should request the Public Prosecutor an authorization to wiretap conversations, also by means of electronic systems if such an activity is indispensable to prevent crimes. If authorized, LEAs are allowed to wiretap individuals for at most 40 days, which may be extended by up to 20 days. If the Public Prosecutor grants an extension to wiretapping (and, in general, to other surveillance activities), she/he has to produce a written report in which the reasons justifying the prolongation of surveillance activities must be clearly explained. Therefore, LEAs have a limited ability of collecting the data they need to reconstruct the topology of a criminal network and all information produced during non-authorized periods are lost.
2. Collaborators of justice are often the main source of information for the investigators; yet they cannot always be deemed to be reliable. Italian LEAs make an extensive use of the depositions of collaborators of justice, i.e., criminals who abandoned a Mafia syndicate and decided to cooperate with criminal justice authorities in order to reveal the composition and organizational structure of a Mafia syindicate. Collaborators of justice are widely considered as a powerful tool in dismantling Mafia syndicates, but their credibility must be carefully checked. In the Montagna operation, there was a collaborator of justice who provided very accurate and detailed information in the early stages of the investigation tasks. Nevertheless, from a certain point onward, that collaborator was no longer considered to be credible and the information he provided was deemed as unreliable.
3. Mafia leaders avoid using phones to communicate. Investigations show that the affiliates of a Mafia syndicate are highly suspicious of being tailed by police and, thus, they carefully avoid conversations on cell phones, whenever possible. This implies that the Phone Calls network yields a partial reconstruction of the information flow in a Mafia syndicate. A further consequence arising from the low propensity of some subjects to make/receive phone calls is the low degree of overlap between the Phone Calls network and the Meetings network. In practice, criminals prefer alternative means of communication (e.g., they use intermediaries to convey encrypted messages). Consequently, the Meetings network includes individuals who had never been intercepted by the police forces. In contrast, some eavesdropped individuals had no ties with the Mafia syndicate but are acquainted with some Mafia syndicate members (for instance, because of work, or other family reasons) and they had conversations with them. Therefore, these individuals have never attended any meeting and are excluded from the Meetings network.