Come at the king, you best not miss: criminal network adaptation after law enforcement targeting of key players

ABSTRACT This paper investigates the impact of the targeting of key players by law enforcement on the structure, communication strategies, and activities of a drug trafficking network. Data are extracted from judicial court documents. The unique nature of the investigation – which saw a key player being arrested mid-investigation but police monitoring continuing for another year – allows to compare the network before and after targeting. This paper combines a quantitative element where network statistics and exponential random graph models are used to describe and explain structural changes over time, and a qualitative element where the content of wiretapped conversations is analysed. After law enforcement targeting, network members favoured security over efficiency, although criminal collaboration continued after the arrest of the key player. This paper contributes to the growing literature on the efficiency-security trade-off in criminal networks, and discusses policy implications for repressive policies in illegal drug markets.


Introduction
More than ten years after Morselli and Petit's article on law enforcement disruption of a drug importation network 1 , our understanding of network recovery and adaptation after law enforcement targeting is still based on a limited number of empirical studies, and even fewer focusing on drug trafficking networks 2 . Simulation studies have attempted to fill this gap by comparing different targeting strategies, and considering various ways in which network members may adapt to new conditions and continue their illicit activities 3 . There remains, however, a need for further research on the adaptive capacities of criminal networks to further our understanding of the drivers of network structure, and to inform law enforcement policy and practice 4 .
Inspired by Morselli and Petit's original study, this paper investigates how a drug trafficking network recovers and adapts after one of his key players is arrested by law enforcement agencies. It focuses on criminal collaboration patterns in a context of increased law enforcement risk, and on the impact of law enforcement targeting on communication strategies and illegal activities of network members. It combines a quantitative analysis of the main drivers of criminal collaboration -using social network Since Sparrow's seminal article on criminal network vulnerabilities, scholars have put forward a variety of strategies to identify actors whose removal is likely to lead to network disruption 6 . While suggestions range from focusing on actors' positioning within the network to targeting individuals who possess certain attributes or resources (e.g., money or specialised skills), there seems to be agreement on the value of adopting a key player strategy 7 . Simulation studies have proven that targeting central actors could indeed be effective, especially when law enforcement efforts are concentrated on those with a brokerage position within the network 8 . However, the effectiveness of this approach depends on whether and how criminal networks adapt to disruption 9 .
Most research on key players and their removal has focused on network robustness (i.e., how to increase network vulnerability via targeted interventions) rather than network recovery and adaptation after law enforcement intervention 10 . The aftermath of disruption has seldom been considered in criminal network research, leaving us with little information on how network members respond to variation in law enforcement activity 11 . This is particularly surprising given that criminal networks are often described as flexible and able to quickly adapt to new conditions and re-organise beyond node replacement 12 . Criminal networks need to constantly balance 'the need to act collectively and the need to assure trust and secrecy in these risky collaborative settings' 13 . In the context of increased law enforcement risk, it may be reasonable to assume that the efficiency-security dilemma becomes even more acute.

Data and methods
Empirical analyses of the impact of targeting of key players on the structure, activities, and communication strategies of criminal networks require longitudinal data to observe cooffending patterns both before and after the intervention. Accessing data of this kind can be challenging given that law enforcement agencies rarely gather relevant information after a key actor is removed from the network 29 . The current study focuses on Operation Cicala, a two-year investigation of a criminal network trafficking drugs from Colombia and Morocco to Italy via Spain. The unique nature of the investigation -which saw a key player being arrested mid-investigation, but police monitoring continuing for another yearallows to compare the network before and after targeting, unlike previous research on criminal network dynamics.
While the context of law enforcement control is peculiar to this investigation, the type of data used is common to other analyses of criminal networks 30 . The data for the study were extracted from criminal justice records, more specifically, from the request for remanding the suspects in custody. The document was drafted by the state prosecutor at the end of the investigation, and includes relevant evidence against the suspects which was gathered via an extensive use of electronic surveillance, as well as more traditional methods such as covert observation. It contains not only relational data on criminal collaborations, but also information on other types of ties (e.g., kinship and formal organisational ties) and on the persons involved (e.g., their role in the network). The transcripts of wiretapped telephone conversations provide rich information on the suspects' interactions with other network members, their illegal activities, and any protection methods against law enforcement surveillance.
All coding was done manually given the informal style of conversation and the frequent use of jargon 31 . Relational data comprise criminal cooperation -which derives from both telephone and face-to-face conversations between any two suspects -, kinship ties, and formal organisational ties -which are based on the suspects' affiliation to the 'Ndrangheta as well as other ethnic criminal organisations 32,33 . Attribute data include details on the suspects' nationality, affiliation to the 'Ndrangheta, main task, role in the drug supply chain, and status 34 . Tasks are based on previous research on drug trafficking, and consider the main activity each individual was involved in (e.g., trafficker, support, courier) 35 . Roles instead represent the position of each individual in the drug supply chain -supply, importation, or distribution. Both were often immediately apparent from the wiretapped conversations in the criminal justice records and, following Bright and Delaney's example, were kept separate 36 . The actors' status was identified based on their formal role within the criminal organisation, and their tendency to give or receive orders in the wiretapped communications reported in the criminal justice records. A dummy variable was also created to identify whether network members were targeted by the Italian law enforcement agencies during the investigation, as it may affect individual connectivity.
The criminal collaboration network is the main focus of the analyses. Three binary, undirected matrices were created for each investigative phase. A combination of 'eventbased' split and 'time-based' split was used to identify the three phases 37 . The first investigative phase starts in November 2008 and ends in June 2009, when N3 -a key player in the trafficking network -was arrested. Given the length of the investigation after N3's arrest, two more phases were identified after June 2009. They both last 197 days (against the 217 days of the first one), and the third one ends in July 2010, together with the end of the investigation. The two investigative phases after N3's arrest allow to assess its short-and long-term impact, as well as consider the network's recovery time 38 . Each network has its own set of attributes to account for changes in the actors' task and role over time 39 . Separate kinship and formal organisation networks were also created for each phase. Table 1 includes descriptive statistics for the criminal collaboration network in each phase, and the suspects' main attributes.
The analysis combines a quantitative element where Exponential Random Graph Models (ERGMs) are used to identify the main drivers of criminal collaboration in each investigative phase, and a qualitative element where the content of the wiretapped conversations is analysed to make sense of the quantitative results, and add to our understanding of network structure and processes 40 . The content analysis helps assess levels of criminal activity in the aftermath of law enforcement targeting, the actors' perception of risk, and any changes in communication strategies and protection methods against law enforcement surveillance 41 . Figure 1 shows the criminal collaboration network in each investigative phase, while Table 2 identifies changes in observed actors and ties across phases. Temporal models for social networks such as Stochastic Actor-Oriented Models (SAOMs) and Temporal Exponential Random Graph Models (TERGMs) require relative stability of actors across phases, which is not present in the Cicala network. Following the approach taken in prior studies, this paper therefore uses separate ERGMs at each investigative stage 42 . ERGMs are a class of statistical models that assess the probability of a tie between two network actors based on node-level attributes (e.g., status), dyad-level attributes (e.g., homophily by task), and network properties (e.g., triad closure) 43 . Each ERGM allows to identify the processes that, in each investigative phase, led to tie formation, and whether network members favoured security over efficiency, or vice versa (or a combination of the two). While the ERGMs are not able to explain change in network structure over time, differences across phases may suggest the network adapted after law enforcement intervention. Table 3 lists the set of parameters included in the models, their statnet name, and their interpretation. In addition to these, two controls were added to account for law enforcement targeting and homophily by nationality 44 . The network analyses were performed using the statnet suite of packages for R 45 . For all dyad dependence models, the maximum likelihood was approximated using Markov Chain Monte Carlo simulation methods 46 . The goodness of fit was assessed by comparing the observed networks with simulated ones, and goodness-of-fit plots are reported in the Appendix 47

Results
Between November 2008 and June 2009, the criminal network organised nine consignments of cocaine (ranging between 5.2-14.6 kilos), and one consignment of hashish (225 kilos). The drugs were purchased in Spain from suppliers who had contacts with Colombian producers (for cocaine) and Moroccan traffickers (for hashish). The drugs were often hidden in the trucks of N3's transport company, and smuggled to Italy by one of his couriers together with licit goods. New arrangements continued despite half of the consignments were seized by the Italian law enforcement agencies, suggesting that the group was fairly resilient to drug seizures, and managed to involve new buyers that would finance the purchase of drug in exchange for a share.
When N3 was arrested in June 2009, he had the highest degree centrality score in the network, which was a consequence of his many direct contacts with suppliers in Spainincluding a small group of Romanian citizens -and with the employers of his transport company, many of whom were also members of the criminal group. The company was used as a front for the smuggling activities, and the drug was often hidden in trucks to cross the border. N3 also had the highest betweenness centrality score, and acted as a broker between several other network members, such as the suppliers based in Spain, and the wholesale dealers in Italy. The criminal network thus relied on N3, as well as a few other traffickers, to purchase the drug in Spain, and transport it to Italy.
With his high degree and betweenness centrality scores, N3 fits the definition of key player found in the literature on criminal network vulnerabilities. His arrest, however, was not the consequence of a well-thought law enforcement strategy, but rather the result of miscommunication between police forces. In the months approaching his arrest, N3 had been under surveillance by both the Anti-mafia District Directorate of Reggio Calabriawho ran Operation Cicala -and the Anti-mafia District Directorate of Trento. In June 2009, the latter decided to wrap up the evidence and formulate the request for remanding the    suspects in custody, including N3. Meanwhile, Operation Cicala was carried on, allowing law enforcement agencies to continue monitoring all remaining suspects and collecting evidence (and network data) for another year. The descriptive statistics of the criminal collaboration network in Table 1 show some of the changes in network structure after N3's arrest. Both the overall network density and the actors' mean degree dropped in the second investigative phase (from 0.07 to 0.05, and from 4.63 to 3.24, respectively), and only slightly increased towards the end of the investigation. Degree centralisation and the clustering coefficient also decreased after the first investigative phase. After law enforcement intervention, the network became sparser and more decentralised, with fewer dense, local groups, suggesting a stronger focus on security over efficiency. The ERGMs for each investigative phase in Table 4 offer a better understanding of the drivers of criminal collaboration before and after law enforcement intervention. The interpretation of the parameters is similar to logistic regression coefficients. Positive parameters indicate that the probability of a tie increases if the new tie increases the corresponding network statistic, conditional on the rest of the network 49 .
Before N3's arrest, actors with high status were more likely to form direct ties than those with medium or low status, suggesting an involvement in day-to-day operations rather than a tendency to delegate. The parameter for homophily by role is also positive and significant, indicating that two actors who have the same role in the drug supply chain are more likely to share a tie than any other pair of actors with different roles. In the second investigative phase, the two parameters are no longer statistically significant. This may suggest that high-status actors limited their direct involvement in trafficking operations and were as likely to form ties as other co-offenders, and that network members reduced their collaboration with those at the same stage of the supply chain, thus reducing the efficiency of the network. The activity spread parameter for high-status actors regains statistical significance in the third and final investigative phase, suggesting an attempt of high-status individuals to bounce back to pre-disruption activity levels. The parameter for indirect connections is not significant before N3's arrest. In contrast, chain-like patterns of connection are likely to exist in the third investigative phase, hinting at an increased focus on security after law enforcement intervention. Taken together, these findings suggest a preference for security over efficiency after N3's arrest, with highstatus actors avoiding direct involvement in day-to-day operations in the shorter term, and network members favouring longer communication chains in the longer term. N2a trafficker belonging to the same 'Ndrangheta family as N3 -provides a good example of this behaviour in the phases after law enforcement intervention. Instead of communicating directly with some of the buyers based in Calabria, he sent and received messages via N1, who was also in Calabria and thus able to arrange meetings with them.
Other ERGM parameters are relevant to understand criminal collaboration patterns both before and after N3's arrest. Sharing kinship ties or formal organisational ties was associated with criminal collaboration in all three investigative phases, suggesting that network members resorted to pre-existing relations to reduce uncertainty and increase trust. For example, in the first investigative phase, N3's wife and two sons were actively involved in the group's illicit activities. Kinship ties were also valued among the members of the Moroccan and the Romanian clans, reflecting the importance of trusted relations in criminal contexts and beyond mafia-type organisations. Another similarity across investigative phases is the positive parameter for preferential attachment, which indicates that highly connected actors are more likely to form new ties than peripheral ones. Highly connected actors, however, seem to have changed over time, with traffickers being particularly active in the second investigative phase, and 'Ndrangheta members being exceptionally careful in the final stages of the investigation, as suggested by the negative and statistically significant parameter for activity spread.
This tendency towards centralisation is paired with a tendency to triadic closure across all investigative phases. Transitivity can lead to highly cohesive networks characterised by quick information sharing and thus efficiency, but can equally foster security by ensuring incriminating or sensitive information does not spread too far in the network. Assortative mixing (i.e., the interaction with similar others) can induce transitivity, since a tie is more likely to form when two actors not only share an indirect tie, but also the same attribute 50 . In the criminal network under investigation, kinship and formal organisational ties likely contribute to the observed tendency to triadic closure. As noted earlier, these types of ties are particularly relevant for criminal collaboration, because they build trust among network members and maintain some level of security while simultaneously favouring efficiency 51 .
Changes in network structure after N3's arrest suggest an increased focus on security by reducing the direct involvement of high-status actors in the aftermath of law enforcement intervention and, in the longer term, by lengthening the distance between any two actors through indirect connections. Despite a reduction in centralisation and clustering scores after the first investigative phase, the network maintained a tendency towards them, while often basing criminal collaboration on pre-existing kinship or formal organisational ties. The observed changes in network structure may be a consequence of a heightened perception of risk after N3's arrest, which may have contributed to network members modifying their communication strategies and altering their security measures. They might have also been affected by the broader context of law enforcement control. In addition to N3's arrest, throughout the investigation network members suffered from a series of drug seizures which imposed losses on the criminal network. This led to the creation of subsequent importations to compensate from previous losses, and to the involvement of new buyers to finance these new importations.
The observed changes in network structure may also be, at least partly, a consequence of the data collection strategy and boundary specification criteria. ERGMs assume that network data are complete -which is unlikely to be the case in the context of illicit networks drawn from criminal justice records -and are particularly sensitive to missing data in relatively small networks 52 . We also do not have any information about the 'master network', that is, the pool of potential co-offenders from which new members are recruited 53 . This is particularly relevant in light of the high turnover between investigative phases observed in the Cicala network, and results in little information on the way in which criminal opportunities arise and new collaborations are formed. With this in mind, the qualitative element of the analyses helps provide some context for the changes observed in the network structure.
The content analysis of wiretapped telephone conversations suggests that criminal network members were aware of the risk of law enforcement control since the beginning of the investigation in November 2008. N3 himself told another member of the group that 'these phones are tapped . . . I tell you' 54 . Network members therefore used a series of protective measures against surveillance even before N3's arrest. Most protection methods were specifically intended to counter electronic surveillance and prevent law enforcement agencies from obtaining evidence. While some measures were constantly used by network members, others were adopted after specific events, such as the seizure of a drug consignment or the discovery of bugs in their houses or cars. Changing SIM cards or avoiding telephone communications for a limited period of time was a common measure, as evidenced by the following conversation between N2 and N65 in the aftermath of discovering a bug: The replacement of SIM cards or mobile phones used to communicate with other network members was relatively frequent. The majority of wiretapped telephone lines were used by a small group of 38 actors who frequently changed their SIM cards to avoid law enforcement surveillance. Before his arrest, N3 was particularly careful in his use of mobile phones, and at times scolded his co-offenders for not paying enough attention ('if you bought two new phones to talk . . . and we don't use them . . . why did you spend money on them?'). The transcripts of wiretapped conversations include a few mentions of alternative communication devices that the police are unable to wiretap, such as Skype and Msn, and of public phones. However, evidence of their use is limited, and the actors who adopted these solutions continued to discuss illegal activities on the telephone, too.
The use of code words was one of the main protective measures adopted by network members since the beginning of the investigation. Co-offenders often used nicknames or 'network-based paraphrases' (i.e., paraphrases that represent a feature of the person or kin relations, and that only affiliates can understand) to refer to each other 55 . For example, N6 was 'the blond girl', and N29 was 'the giant'. Code words were also used to discuss illegal activities without openly mentioning them. For example, N5 said that he 'spent the night with a blond woman [drug], but it was not good [poor quality]'. On another occasion, N10 complained that 'the fish from last time is gone bad', that is, the drug was not of good quality. Code words, however, were not necessarily enough to prevent law enforcement agencies from building a case against many network members, especially when their use was inconsistent: N65: The shoes [drug] are not good quality ones . . . quality is only 70%.
While neither protective measures nor the content of telephone conversations changed after law enforcement intervention, the number of calls dropped since May 2009, possibly reflecting a stronger focus on security by network members. After N3's arrest, the number of drug consignments also decreased. In the second investigative phase, the traffickers managed to organise and complete only one importation of 6.8 kilos of cocaine. In March 2010, 12 kilos of cocaine were smuggled to Italy, followed by another importation of cocaine in May, and the importation of 61 kilos of hashish in June, which were seized by law enforcement. The constant increase in the number of wiretapped telephone lines throughout the investigation, and the fact that only in rare occasions network members discussed telephone conversations that had not already been intercepted, may indicate that the investigators were able to identify most new members recruited after law enforcement intervention. However, the opposite conclusion -that is, new network members and trafficking activities remained outside of the investigation's scope -cannot be completely ruled out.
Law enforcement targeting seems to have impacted on both the internal structure and the trafficking activities of the Cicala network. After N3's arrest, network members seemed to favour security over efficiency, although criminal collaboration continued. While the remaining network members lost both their contacts with the group of Romanian suppliers, and the possibility to use N3's transport company to smuggle drugs to Italy, they managed to keep contacts with the suppliers in Spain, and to adapt their modus operandi by smuggling the drug by car. The three drug consignments organised in early 2010 suggest that, after a period of reorganisation, the network adapted and maintained, at least in part, its operational activity before being eventually dismantled by law enforcement following the arrest of most of its members in July 2010.

Discussion
As Morselli notes, 'criminal networks are not simply social networks operating in criminal contexts' 56 . Maximising security and minimising exposure to law enforcement is fundamental to their survival. It is therefore not surprising that, in the aftermath of law enforcement intervention, network members showed a greater tendency to maximise security over efficiency than before N3's arrest. While the separate ERGMs for each investigative phase could not explain change in network structure over time, they helped identify a reduction in high-status actors' direct involvement in illicit activities immediately after the arrest of one of the key players, and a preference for indirect ties in the final stage of the investigation 57 .
Kinship was confirmed as the 'hidden glue' maintaining collaboration in criminal contexts 58 . These findings speak to a long and well-established body of knowledge on the importance of familial ties as the foundation of various criminal enterprises 59 . The overlap between kinship and co-offending ties (and formal organisational ties) may have contributed to the adaptive capacities of the Cicala network. Multiplexity and, more specifically, the overlap between personal and criminal connections, has indeed been identified as a source of network resilience 60 . In a context where reciprocal distrust and recourse to violence are common, social relations -including, but not restricted to, kinship ties -contribute to increasing the levels of trust and favour criminal cooperation 61 .
In line with previous empirical research, the network favoured efficiency in the first investigative phase, when law enforcement risk was lower, and later decentralised under the pressure of police targeting 62 . For example, terrorist networks have been found to increase density and cohesion as they approach the attack stage and need to coordinate the attack 63 . These findings, however, are in contrast with Duijn et al.'s simulation results, which predicted a greater focus on efficiency after law enforcement intervention 64 . They also describe dynamics that are opposite to those of Bright and Delaney's network, which was under continual surveillance but never directly targeted, and over time moved away from a focus on security to prioritise efficiency and increase its profits 65 .
These differences could reflect variations in opportunity structures, including those deriving from the 'master network' in which the smaller, observed network is embedded in. The Cicala network took time to recover after targeting, suggesting that previous simulations may not have been able to take into account the range of constraints to recruit new members and adapt to increased law enforcement risk 66 . For example, they may have downplayed issues of trust that arise when recruiting from the larger pool of available criminals rather than the smaller network of trusted associates 67 . Furthermore, simulations may not have been able to take into account the full complexity of recovery and adaptation processes, which in the case of the Cicala network entailed the recruitment of new members with specific resources, a change in the modus operandi to smuggle drug from Spain to Italy, and the introduction of new distribution chains 68 .
In addition to providing a quantitative and qualitative account of the adaptive capacities of the Cicala network, this study confirms the need for more research on criminal network recovery and adaptation after law enforcement targeting. First, the data and methods used are not free from limitations, which should be addressed in future studies. Law enforcement data only provide a partial picture of the network and are affected by the criminal justice records used as the main source of information 69 . This is especially problematic when ERGMs are used for modelling, because they assume that network data are complete 70 . Accessing a wider range of data sources on the same criminal network, and adopting alternative modelling strategies that account for actors' high turnover, would help address these issues. Analytical strategies that considered different kinds of law enforcement interventions simultaneously could also improve our understanding of network resilience. While N3's arrest had a considerable impact on the structure and activities of the Cicala network, the economic losses resulting from drug seizures may have also contributed to the observed changes. With little information on the new network members, it also remains difficult to assess whether changes are a consequence of their individual characteristics or of drug seizures and arrests 71 .
Second, a wider range of case studies focusing on different criminal, and drug trafficking, networks in various settings and exposed to various targeting strategies will contribute to a solid knowledge base to produce more realistic simulations. Findings from case studies are limited in their generalisability 72 . While the current study focused on the arrest of one key player, we know little about the impact of, e.g., the subsequent removal of critical nodes 73 . An additional limitation to the generalisability of the current study may be due to the focus on the Italian 'Ndrangheta rather than looser trafficking networks. Calderoni, however, demonstrated how its formal hierarchy does not play a role when its members are involved in drug trafficking operations 74 . Finally, future studies using temporal models for social networks will allow to further test the efficiency-security tradeoff framework, and assess whether it identifies the main determinants of criminal network structure 75 .
Empirical contributions on network recovery and adaptation are not only a way to enhance our theoretical understanding of criminal networks, but also a valuable tool to inform law enforcement policy and practice. Sparrow's rationale for the analysis of criminal network vulnerabilities came from the observation that 'crime levels are not diminishing, despite countless "successes" against individual criminal enterprises.' 76 While law enforcement agencies have gradually embraced the key player strategy, this tend to be based on the 'Mr Big' assumption, and an assessment of its implementation is often missing 77 . Whether we can consider the Cicala network resilient ultimately depends on the expected outcomes of law enforcement intervention. N3's arrest reduced the rate of information flow as well as the ability to organise the purchase, smuggling, and wholesale of drugs, at least temporarily 78 . However, the network remained active for another year after law enforcement intervention, maintained some of its operational activity, and was eventually dismantled only when most of its members were arrested in July 2010 79 .
This study is a small, additional piece of evidence suggesting that law enforcement interventions may not be as effective as expected given the flexibility and resilience of drug trafficking networks. Even when entire networks are dismantled by law enforcement following multiple arrests, drug markets show their resilience as new dealers replace those who are sentenced and imprisoned 80 . If prohibition remains the preferred policy option by governments, research on the impact of repressive policies on criminal networks structure and activities can help identify effective interventions, and avoid any unintended, harmful consequences 81 . Figure A2. Goodness-of-fit plot for Phase 2 model. Figure A3. Goodness-of-fit plot for Phase 3 model.