Keywords

1 Introduction

The escalation of violent attacks from Non-State Armed Groups (NSAGs), in frequency and number of casualties, is a central threat to international security today. In 2017, while we saw a decrease in the overall number of inter-state armed conflicts, the number of armed actors engaged in one-sided violence increased noticeably (Pettersson and Eck, 2018). Understanding the dynamics of violent attack execution better is essential for both scholarly research and policy-making. Efforts to effectively counter these threats would benefit from a more detailed understanding of the dynamics of their execution.

NSAGs do not operate in isolation. Despite widespread assumptions made by theories of violence (e.g., in civil war research), armed conflict is rarely dyadic (Jentzsch, 2014). The portrayal of conflict both as combat between an incumbent state and a rebel organization, and of armed groups operating and making decisions in isolation, obscures the fact that multiple armed organizations commonly operate in the same conflict settings. To cite just one dramatic example, during the peak of the Syrian civil war, it was believed that as many as 1000 non-state armed groups were commanding about 100,000 fighters (BBC, 2013).

Given the prevalence of conflict settings where multiple NSAGs operate, cooperating and creating alliances (Christia, 2012; Horowitz and Potter, 2014; Gade et al., 2019) and/or competing against each other (Phillips, 2015; Gade et al., 2019), there are good reasons to believe that the behavior of a given group is not (or at least not entirely) independent from the behavior of other groups operating in the same environment. This interdependence might involve, for example, decisions of whether and/or when to commit a violent attack (either as a first mover or in response to others’ attacks), as well as decisions to declare a ceasefire and/or sit down in the negotiation table with the government. Nevertheless, as Phillips (2014, p. 336) notes, research often ignores the possibility that armed groups can affect each other in nontrivial ways. We contend that exploring these potential interdependencies in the behavior of Non-State Armed Group (NSAG) in multi-party conflicts is a proper avenue of research to understand various conflict dynamics. Moreover, recognizing and identifying this interdependence might have important implications for both security and peace policy. This is exemplified by the conflict trajectories in Eastern Congo where the enthusiasm that followed the military defeat of the M23 rebel group in 2015 was doomed by the fact that 69 other NSAGs were also operating in the region (Stearns and Vogel, 2015). Similarly, violence has persisted in Colombia after sealing a historic peace deal with the FARC—the most extensive and powerful rebel group in the country’s long-standing civil war—as other NSAGs have been fighting to fill in the power voids left by the rebels (Idler and Masullo, 2019).

Does the behavior of one NSAG affect the behavior of other armed groups operating in the same environment? Furthermore, is behavior only affected by the more formal relationships that have captured the attention of the literature, or can it also be affected by the mere fact of operating in the same environment or fighting in the same conflict? In this paper we provide a preliminary exploration of these questions, focusing exclusively on the execution of one-sided violent attacks. To understand violent dynamics, instead of looking within armed organizations (see, e.g. Weinstein, 2007) or at the interactions of armed groups with civilian populations (see, e.g. Kalyvas, 2006) or with the government (see, e.g. Hultman, 2007), we focus on the relational environment in which NSAGs operate and examine how they might influence each other’s actions—something that has received relatively less attention in the conflict literature.

Our core contention is that the behavior of a given group is not independent of the behavior of other groups operating in the same environment. Specifically, we explore whether there is evidence suggesting that the timing of an attack by a given NSAG is affected by the attacks executed by others. If there is some sort of interdependence between attacks, in this preliminary exploration we should at least observe that once an armed organization commits an attack, the probability that another attack will take place increases. Moreover, if what is taking place is in some way related to this form of interdependence, we expect the impact of this additive effect to decay over time.

We are not the first to explore how interorganizational relationships are related to armed group behavior. For example, Asal and Rethemeyer (2008) and Phillips (2014) have looked at how the number of alliances affect group behavior, while others have emphasized on whom the group is connected to, noting that what matters is the quality of the partners and the location of the tie within the overall network (Horowitz and Potter, 2014). In this paper, we consider all the possible connections between all the groups that are present in a given environment (what in social network language would be a “fully connected network” or a “complete graph”) and differentiate between actual ties (groups with a relationship as defined by the Big, Allied, and Dangerous datasetFootnote 1) and environmental ties (groups simply operating in the same country). This allows us to explore not only whether there are some interdependent dynamics in the timing of violent attacks, but also whether different types of ties have different effects.

Despite undeniable advances in our knowledge of how NSAGs operate, the study of interdependence between multiple groups operating in the same environment and its consequences on an armed group’s violent behavior still requires more sophisticated empirical analysis and better theorization. By combining different methods to generate, analyze, and compare simulation and empirical data, this paper aims to make an empirical contribution to this task. Supportive evidence for interdependent behavior in the timing of violence attacks would constitute a necessary first step to begin exploring these dynamics more deeply, disaggregating data further (e.g., spatially, by the type of attack, armed group, and/or conflict type) and exploring—theoretically and empirically—potential mechanisms.

This paper is structured as follows. In the next section, we present the empirical data that we used and the three cases that we chose to begin exploring whether NSAGs influence each other in attack timing and frequency. In Sect. 3 we introduce the methods detailing the fundamentals of both the analytical estimation from the empirical data and the generative model and simulation. Section 4 presents the main results and, to conclude, Sect. 5 briefly discusses the results, identifying some limitations of this study and delineating a road ahead.

2 Data and Case Settings

The empirical data for our study comes from the Global Terrorism Database (GTD). With information on over 180,000 domestic and international attacks between 1970 and 2017, including kidnappings, assassinations, and bombings, this is the most comprehensive open-source database on terrorist attacks. While including more events than any other available dataset, it rests on clear inclusion/exclusion criteria. It excludes criminal incidents devoid of political or ideological motivations, incidents arising from clashes between opposing armed groups, and incidents perpetrated by the state. In this sense, it allows us to focus specifically on the outcome we are interested in: one-sided violent attacks by NSAGs.Footnote 2

In addition, we use data on ties between armed organizations. These data come from Phillips (2015),Footnote 3 which is an extension of the Big, Allied, and Dangerous (BAAD) dataset (Asal and Rethemeyer, 2015). These ties are manually curated based on the Terrorism Knowledge Database, media reports, and legal documents and represent a variety of known incidents of activity between two groups, such as training another group’s members, providing safe harbor, or collaborating on attacks together.Footnote 4 In this work, we treat the ties between organizations in an undirected manner (i.e., groups in the relationships are coded regardless of who is addressing whom).

For this exploratory analysis, we use three conflicts as our case studies—Afghanistan, Colombia, and Iraq—and restrict the period to 2001–2005. Multiple armed groups were active in each of these conflicts for the period under study, all executed a considerable number of violent attacks, and at least one actual tie was observed between two of them. In addition, these three conflicts provide us with variation in dimensions that can prove theoretically relevant: e.g., the macro-cleavage and the stage of the conflict, as well as the profile of the armed group. First, Colombia constitutes a clear example of an irregular, guerrilla type of war that started in the mid-1960s (four decades before our time frame) and pits left-wing rebel groups with Marxist-Leninist ideals against right-wing paramilitaries and the forces of the state. Then, Afghanistan, starting in 2001 (the first year of our time frame), shortly after the 9/11 attacks. Here a coalition of international forces and a new Afghan government faced a local insurgency and multiple armed groups, with fundamentalist, sectarian, and sometimes ethnicity-driven characteristics. Finally, the war in Iraq started in 2003 and ended the Baathist regime in Baghdad. Here, like in Afghanistan, US-led forces were faced with a large-scale insurgency and a number of terrorist organizations targeting the international military presence, civilian population, and aiming to disrupt the ongoing nation-building efforts.

For each of these countries, we carefully cleaned the data to make sure it included a meaningful and internally valid set of NSAGs and ties between them. Based on historical records, secondary sources and first-hand knowledge of each of these conflicts, we excluded organizations that we knew were not operating in the same environment and/or were mostly inactive during the time frame under analysis.Footnote 5 Additionally, we merged observations when the same organization was coded as two or three different ones given the use of various names in the sources used to build the original dataset.Footnote 6 This process considerably reduced the number of organizations we are working with and explains the difference in the number of observations (both organizations and attacks) relative to GTD and Phillips (2014).

Finally, to account for variation in NSAGs’ capacity to execute violent attacks, and inform the parameters in our simulated data with empirical priors (see Sect. 3.2), we estimated the capacity to commit a violent attack for each armed group that made it into our final list. Given that the measurement of our outcome of interest directly involves the number of attacks by each organization, we did not use this information to estimate capacity. Therefore, we relied on two different variables to proxy capacity, both from the GTD data: the number of attack types that each group has engaged in and the number of deaths caused by their attacks.Footnote 7

Table 1 summarizes the basic data for the three cases under study after we construct a fully connected network for each country.

Table 1 Descriptives
Full size table

3 Methods

To better understand the potential impact of all NSAGs’ actions within a country on the timing of the execution of attacks by specific NSAGs, we approached the problem with two distinct methodological strategies. The first consists of using empirical data to estimate the extent to which any NSAG’s action is reactive to any and all other NSAGs’ actions within the same environment. The second consists of constructing a generative model that implements a basic model of action to explore how much of an impact environmental ties could have and still produce an attack time series that is statistically indistinguishable from the actual historical record. These two tracks combined allow for an exploration of any evidence for latent influence of NSAG’s actions on another’s actions in the same setting.Footnote 8

3.1 Analytical Estimation

From the empirical data, we analytically estimated possible latent influences from one NSAG’s attacks on the timing to another NSAG with a Hawkes process (Hawkes, 1971). A Hawkes process is a self-exciting point process that takes the form of

$$\displaystyle \begin{aligned} \lambda^*_g(t) = \mu_g + \sum_{j:t_{g,j}<t}{ \alpha_g e^{-\beta_g(t-t_{g,j})} } {} \end{aligned} $$
(1)

where μ g is the base rate of “attacking” for a given NSAG; g, α g is the additive effect that a prior attack has; β g is how quickly the additive effect from a prior attack decays; t g,j is how long ago the attack was carried out; and \(\lambda ^*_g\) is the resultant rate for NSAG g at time t. Without the additive term that accounts for the influence of prior attacks on the future attack probability, a Hawkes process reduces to a Poisson process. Empirically \(\lambda ^*_g(t)\) is the attack rate for an individual group during the interval of interest.

The mathematical extension of a Hawkes process from a single NSAG reacting to its own past actions (univariate Hawkes) to a NSAG incorporating signals from non-self actors (multivariate Hawkes) is relatively straightforward. We model the multivariate Hawkes process as

$$\displaystyle \begin{aligned} \lambda^*_{g_i}(t) = \mu_{g_i} + \sum_{g_k \in G}\:{ \sum_{j:t_{g_k,j}<t}{ \alpha_{g_k} e^{ -\beta_{g_i}(t-t_{g_k,j}) } } } \end{aligned} $$
(2)

where the impact of each attack \(t_{g_k}\) is integrated with an individual \(\alpha _{g_k}\) for each NSAG g k when we calculate the rate λ ∗ for a single NSAG g i at time t. We use the pyhawkes package to estimate the parameters for this function, which uses Markov Chain Monte Carlo (MCMC) for the estimation (Linderman and Adams, 2014).

A difficulty with a MCMC approach is with identifying when the parameters have converged. To ensure that our parameter estimation is robust we use the scale reduction factor (Rubin and Gelman, 1992) and continue sampling on all chains until the variation is less than 0.01 on all μ parameters.

The only empirical information that the multivariate Hawkes process requires is the attack time series for each NSAG within a setting. Since all parameters are estimated, there is no reason for the α parameter that controls how much a NSAG reacts to the recent attacks of another NSAG to be larger (or smaller) for actual than environmental ties.

3.2 Generative Model and Simulation

Our generative model implements a modified form of the multivariate Hawkes process (Equation 2) in order to theoretically explore the possible amount of influence of environmental information (attacks by NSAGs with no actual ties) on a NSAG’s future attacks in comparison to the influence of the attacks of known NSAGs with which they have an actual tie. Our modified version of the multivariate Hawkes process for the generative model is

$$\displaystyle \begin{aligned} \lambda^*_{g_i} \gets \mu_{g_i} + \sum_{g_k \in G}\: \sum_{j:t_{g_k,j}<t}{w_{g_k}\alpha e^{-\beta(t-t_{g_k,j})}}, \end{aligned} $$
(3)

where α (the additive impact of past attacks), β (the decay of influence over time), and ω (the edge weight between two NSAGs) are general parameters of the simulation (see Table 2 for simulation parameter ranges).

Table 2 Parameters of the ABM
Full size table

With Eq. 3, we simulate the multivariate Hawkes process for the set G of NSAGs in the country of interest. Unlike the analytical estimation, here we specify that all NSAGs in G are connected in a fully connected network with weight \(w_{g_k}\) for each tie that NSAG g i has. We set \(w_{g_k}=1\) when g i = g k or there is an actual tie between NSAG g i and g k from prior work (Phillips, 2015). If there is no actual tie between NSAG g i and g k then we set \(w_{g_k}=\omega \). Since the magnitude of \(w_{g_k}\) is fixed at 1 for actual ties, this allows us to systematically simulate the potential impact of environmental ties on the timing of a NSAG’s attacks.

To restrict the potential parameter space, we estimate μ g for each NSAG from the empirical data. Since μ g is the inherent rate of attacking for a NSAG it could be, roughly, estimated from the attack time series directly. However, we do not use a NSAG’s empirical attack rate so that no direct information about the attacking rate is incorporated into the simulation. Instead, we regress the number of attack types that a group engages in against the log total of casualties that the NSAG inflicts as a proxy for a NSAG’s capability to successfully launch attacks. To operationalize this relationship as a rate (μ g) for each group, we scale the calculated value for each NSAG by the average number of attacks per casualty across all NSAGs and reduce that rate by 20% to account for possible latent influences.Footnote 9

We simulate each run of our model for steps t ∈ [0..1865], where each step is a day to match the time span in the empirical setting. At each time step t, we enumerate all attacks for each NSAG up to time t and recalculate \(\lambda ^*_g\) for each group. For each group, we make a random draw from a Poisson distribution with \(\lambda ^*_g\) as the mean and record that random value as the number of attacks at time step t.

To assess whether a set of simulation parameters generate realistic time series for a setting, we perform 500 independent runs for each unique set of simulation parameter values. To statistically test if the simulated data differ from the empirical data, we test if the inter-event time distribution for each NSAG differs from the empirical inter-event time distribution with the Kolmogorov-Smirnov test. Across all runs for a simulation parameter set with a typical threshold of p = 0.05, we would expect 5% of the inter-attack time series to differ by chance alone. Thus, if more than 5% of the inter-event series are significantly different, we conclude that the given simulation parameter set fails to reproduce the empirical data.

4 Results

4.1 Analytical Estimation of Basal and Additive Rates

After estimating Eq. (2) from the empirical data, we can establish the baseline differences between individual NSAGs. Primarily, we aim to further clarify how μ, which represents an individual NSAG’s basal rate and capacity to attack, compares to the additive component α, the reactionary attacks in response to attacks from others.

We find a dramatic difference between the magnitude and proportionality of α and μ in our case studies (Fig. 1). In Colombia, the additive effect of another group’s attack on a group’s own attacking rate is small in comparison to its basal attack rate. FARC stands as a stark outlier in comparison to all groups, with its μ more than two orders of magnitude larger than the additive α effect. This would suggest that the timing of FARC attacks has almost no relationship or influence from prior attacks by any group within the region.

Fig. 1
figure 1

Comparison of the estimated μ for each NSAG against the α coefficient it has for every other NSAG in the same country. The plotted line is for μ = α

Full size image

In contrast, in both Iraq and Afghanistan the additive effect α is larger than μ for a majority of NSAGs—with multiple groups having an α value that is two or nearly three magnitudes larger than μ. Under the assumptions of the Hawkes process, this means that the timing for the majority of attacks that NSAGs commit are more in response to the actions of other NSAGs in the region than an independently timed attack.

However, if we examine the difference between actual and environmental ties amongst these three settings, we find no significant differences (p = 0.24, t-test). If we exclude all ties that originate from Colombia, this result still holds (p = 0.41, t-test). This suggests that despite the differences found in the settings in terms of the impact of the additive effect α, whether a tie is actual or environmental is not a major contributing factor.

As a check for the initialization parameters for the generative model, we also compare the analytically estimated μ values with the estimated μ priors for the generative model and find a good agreement overall (Fig. 2, R 2 = 0.49). The notable outlier is again FARC, which has an analytically estimated value that is approximately 150% of its calculated prior. This suggests that the estimation strategy is a good, general approximation of a NSAG’s μ without the usage of empirical rate-related information.

Fig. 2
figure 2

Comparison of the calculated prior μ to the analytically estimated μ for NSAGs in all three countries

Full size image

4.2 Comparison of Inferred Networks to the Network of Actual Ties

To better understand the implications of the inferred α parameters on the entire network of relationships within a country, we explicitly construct an inferred network where α serves as tie strength and compare it to the network of actual ties amongst NSAGs (Fig. 3).Footnote 10

Fig. 3
figure 3

Actual and inferred networks. Circles indicate NSAGs and lines indicate ties. Lines colored in red indicate the ties present in both the actual and inferred networks

Full size image

As we would expect from the previous results, the inferred networks for Afghanistan and Iraq are densely connected. Interestingly, we infer no relationship for almost half of the actual ties in Iraq and Colombia, while we capture both of the actual ties in Afghanistan. These results suggest that groups react to a number of other NSAGs within the same country that are not captured through formal known ties and that not all formal known ties are equivalent in nature.

To better quantify how different the inferred network is in each country, we compute the normalized degree and transitivity statistics (Table 3). The normalized degree accounts for the number of ties that a NSAG has given the number of possible ties in the network, which allows for a comparison between countries. We find that in Colombia the normalized degree grows 150% from the network of actual ties to the inferred network, while the growth in degree in Afghanistan and Iraq is over 1000%. This again highlights the difference in countries, with the inferred network of groups that react to one another barely differing from the known network in Colombia and these two networks drastically diverging in the emerging conflicts in Afghanistan and Iraq.

Table 3 Descriptive statistics for observed and estimated networks
Full size table

Transitivity measures the amount of triadic closures, that is, if A is connected to B and B is connected to C, then A is also connected C. In this context, it would imply that if group A reacts to actions taken by group B, then it would also react to actions taken by group C so long as group B also reacts to C. A larger transitivity value in this context would imply that the total volume of attacks in a country is more dynamic since an attack made by one group could start a chain of reactionary attacks from its connected neighbors (given a sufficiently large α). Surprisingly, despite the difference in transitivity for the actual ties networks, all three countries have similar levels of transitivity—meaning that for groups that we have inferred ties for, those ties are closed into triads. In terms of the change from the actual ties network to the inferred ties network, the increase is most notable in Afghanistan. In the observed network, only the Taliban is connected to Jaysh al-Muslimin and Al-Qaeda producing a transitivity of 0, while the inferred network transitivity is 0.93. In Colombia, the magnitude change in transitivity is not as dramatic as in Afghanistan, but it is notable that FARC is isolated from the inferred network which is a contrast to its known ties to the ELN (the second largest left-wing rebel group).

These statistics correspond to the stark visual discrepancies between the actual and inferred network structures. Despite the fact that the actual ties are records of known, shared activities (whether that be training recruits, planning attacks, etc.), we find that the actual network lacks the majority of ties, and the resulting structure, identified in the inferred network. Given our focus on the timing of attacks, this suggests that the “strategic” actual ties do not capture the range of actors and actions that a NSAG may take into account when choosing exactly when to execute an attack.

4.3 Generative Model Results and Correspondence to Analytical Findings

To better interpret our generative model, we plot our sweep through the three parameter ranges for each country, focusing on the parameter region where the model successfully replicates the empirical data (Fig. 4). Once again, Colombia stands out since no parameter combination was able to produce NSAGs time series similar to the empirical data. This is in general agreement with the analytical findings, since FARC has a μ value that is nearly three orders of magnitude larger than any additive effect from another NSAG’s actions and conducted more than 50% of the attacks during the study period. Even the ELN, the second most active rebel/insurgent group and the one that conducted nearly 20% of the attacks during the period of analysis, has an estimated μ value that is roughly one order of magnitude larger than the additive effect from any other NSAG’s actions.

Fig. 4
figure 4

Generative model results for defined parameter combinations (α, β, ω) in Afghanistan, Colombia, and Iraq. Each cell is the result of comparing the inter-event time series for 500 generative runs against the empirical data with the Kolmogorov-Smirnov (K-S) test. If less than 5% of the runs differ from the empirical data, the cell is marked as ‘Pass,’ otherwise, it is marked as ‘Fail.’ Each grid in a column is a different α value (the additive effect from previous attacks), while β (the rate of decay of previous attack effects) on the horizontal axis of each graph. The vertical axis for each graph is ω, which is the relative strength of environmental to actual ties

Full size image

The results for Afghanistan and Iraq present a different picture, as both cases yielded model parameter combinations that successfully reproduce the empirical data. Since there are only two successful combinations in Afghanistan, the interpretation is straightforward: only when groups react, nearly, as much to the actions of other groups as they do to the actions of their allied groups is the empirical data reproduced. Iraq is similar to Afghanistan in so much as there must be a high additive amount to the rate from each attack in order for the simulation to statistically reproduce the empirical data. There is an expected dependence on the strength of environmental ties—as this link becomes stronger the range of permissible α values grows, to the point that nearly half of the parameter combinations are successful when α = 0.5. The primary difference is that in this case not even a weak dependence on how quickly the impact of prior attacks decays seems to play a role. This could be due to the large number of NSAGs operating in this environment and the limited number of attacks that each group committed during the period of analysis (31 NSAGs operated during this period, committing an average of 5.84 attacks). However, the results for both Afghanistan and Iraq confirm the analytical estimates, with both countries having average α values that are larger than the average μ, suggesting that reactionary attacks play a role in the timing of attacks in these two countries.

5 Conclusion

Our preliminary answer to the guiding question of “does the behavior of one NSAG affect the behavior of other armed groups operating in the same environment?” is nuanced. We find clear support in both Iraq and Afghanistan that the actions of other groups affect the timing of attacks; however, no support is found for this notion in Colombia. This mixed result with only three case studies prevents us from drawing any general conclusions on the notion that previous attacks from other groups affect the future timing, and thus frequency, of NSAG attacks within a region.

Quantitatively, it is necessary to expand the analysis to a larger sample with more, if not all, countries with active NSAGs. There are recorded attacks in over 200 countries (without disambiguation for geographical renaming) in the GTD, which would provide enough statistical power to test this hypothesis exhaustively. If the effect were general across countries, then greater insight could be obtained from the estimated magnitude of the impact that prior actions have on the future timing of attacks.

Qualitatively, our initial analysis would suggest that the general stage of the conflict that NSAGs are engaged in is a contributing factor as to whether or not prior attacks influence future attack timings. During the study period, both Afghanistan and Iraq were severely destabilized with the large-scale introduction of foreign forces and joint political instability. In both settings, this resulted in constantly changing circumstances as insurgents, global jihadi movements, foreign powers, and counterinsurgent forces. In contrast, the conflict in Colombia is one that has had the same dominant actors for years before the study period. This is demonstrated by the fact that between 1980 and 2002, hijacking, hostage taking, and kidnapping totaled 76.3% of attacks conducted by FARC, the most dominant actor in Colombia (Eccarius-Kelly, 2012). On the contrary, hostage taking constitutes only 7.2% of attacks conducted by the Taliban, the most dominant actor in Afghanistan. These differences in attack type underscore the qualitative difference in the nature of the conflicts we study here.

Importantly, we find no difference in the relative importance of actual ties to environmental ties. If we examine the results from the analytical model, the mean tie strength does not differ between actual and environmental ties. From the generative model, we find that only as the strength of the additive effect increases can we successfully replicate the empirical data. In Afghanistan, successful reproductions only occur when environmental ties are weighted nearly as much as actual ties. In Iraq, the space of permissible ω values increases as the additive effect α increases—since an increase in the magnitude of the effect compensates for the weakening tie strength. While alliances and rivalries, the basis of our actual ties, have been shown to have long-term effects on group outcomes (Phillips, 2015; Asal and Rethemeyer, 2008), there does not appear to be any relationship to a short-term effect, specifically one on the timing of attacks. While the actions of cooperation, one group training another group or coordinating attacks, does relate to the timing of individual attacks, it does not appear to rise to a systematic level of how attacks are coordinated and executed.

Without expanding the scale of the study, it is not possible to discern if this study is simply further proof of the empirical limits on predicting the timing of NSAGs’ attacks (as demonstrated by the failure of the approach in Colombia) or if it is only in specific contexts that prior actions can inform future predictions. We can, at least, state that while formal relationships and the position that a group occupies within that formal structure has a long-term impact, these relationships do not have a systematic impact on daily activities and their timing.