The shaping of covert social networks: isolating the effects of secrecy

Secrecy amongst participants is widely regarded as a hallmark of organized crime. Accordingly, covertness is treated as an essential feature of organized crime networks and as one of the distinctive characteristics differentiating such networks from others. In other respects contemporary understandings of organized crime networks based on routine activities theory see strong parallels between criminal organizations and legitimate business organizations. Noting the scarcity of empirical evidence about covert networks and flaws in the conceptualization of how such networks form and operate, this article questions the basis for the assumption that covertness is a distinctive feature of organized crime networks.

own terms and seeks to re-assess the role of covertness in criminal organizations. The article profiles the principal models of organized crime and differentiates models concerned with 'organization for activities' from models concerned with 'organization for social relations'. It then considers the role of covertness in the core business of organized crime and the implications this has for law enforcement. Empirical evidence about covert networks is scarce, conceptualisations of the effects of covertness on how networks form and are organised are contradictory, and systematic comparative analysis of covert and overt networks is lacking. Noting these issues, the article closes by observing that if covertness is not a unique feature of organized crime networks we can leverage our understanding of crime networks by exploring covertness in other kinds of network.
The United Nations defines organised crime as 'crime that involves three or more people who come together in committing criminal offences over a sustained period of time'. As McIntosh observed, criminology was slow to approach crime as a collective activity. It was preoccupied with why individuals commit crime (McIntosh 1975: 7). Rather than address crime as a collective activity it has asked how the collective dimension influences individual activity. This approach, emulating the correctional agenda of criminal justice, differs from that of journalists and police, who have long emphasised the 'criminal confederacy'. Social Network Analysis ('SNA') is an important antidote to criminology's failure to engage with the social dimension. It treats professional criminal networks as 'rationally geared to the conduct of the criminal activities in question' (McIntosh: 9), one rationality being secrecy.

Models of organized crime
Donald Cressey (1972) was a pioneer in dealing systematically with variations in organisation as they related to particular types of crime. Unlike earlier figures in the study of professional crime, such as Sutherland (1937) and Lemert (1951), Cressey started with what would be needed to carry out the criminal task at hand, deriving functional role specialisations and how individuals would need to interact from the task. This approach is still manifested in the Organised Crime Threat Assessments issued by Europol on behalf of the European Union.
Social Network Analysis (SNA) take on organised crime derives from its generic interest in patterns of interaction within networks. Some networks are hierarchical while others are flat, some are marked by one-way communications from many individuals while others involve dense and iterative communication flows, and so on. Patterns of criminal behaviour involving part-time opportunistic criminals are more intermittent, more dissimilar from one occasion to the next, and episodes are affected by events unconnected to the dictates of the crime being committed, whereas professional criminals tend to specialise and show steadier, more uniform patterns.
Organised crime is not distinguished by its scale or efficiency, but by its organisational differentiation from other activities. It is more autonomous in that the elements explaining its organisation are found within the criminal activity and the particular problems that activity poses, rather than within the other institutions in which it is embedded. Thus, the code of omerta that is part of the archetypal Mafia exists because of the purpose it serves rather than the culture from which it emerged.
The characteristic technical problems that such organisations confront are handling internal discipline, protecting assets, and neutralising law enforcement, and their principal imperatives concern the technology of production and the negotiation of market conditions. So the key assumptions are: that a given criminal activity presents specific technical problems that must be solved; an observer can specify the most efficient kind of organisation for dealing with these technical problems; the existence of that kind of organisation is explained by its technical efficiency in delivering the activity.
This approach predicated on the rational economic criminal is an improvement on the individual psychopathology approach dominant in the early years of criminology, but it is one thing to hypothesise an organisational rationality and another to explain how individuals in the organisation pursue such objectives. Cressey approached this explanation using a heuristic that partly related to the rational economic frame of reference and partly to his empirical understanding based largely on journalistic accounts of the American rackets of his day and the gangland memoirs of former mobsters and police informers.
Cressey's types of crime organization were distinguished by functional differentiation. His typology of criminal organisations assumed that the most highly developed organisation ('Variety A') subsumed the characteristics and activities of those that were less highly developed. Variety A had 'commissioners' who coordinated its subunits. Variety B had an 'enforcer' to maintain internal discipline, as in the Cosa Nostra 'family'. Variety C had positions for 'corrupters', who bribed public officials, while the characteristic role of Variety D was the 'strategic planner' who developed contacts relevant to future activities. Variety E had a 'tactician' who could act on such contacts but lacked its own strategic capacity, and Variety F simply had a 'task force guide' who organised the immediate act of crime.
Datasets against which to systematically test which roles were essential or irrelevant using a randomized control research design were lacking and remain so. Cressey's model is sketchy and is very much tied to its historical period. Its empirical basis is controversial and of uncertain reliability, but it does give some idea of the activities that should be reflected in network interaction. His highest level organization can engage in any kind of criminal activity. As well as conducting syndicated crime, it licenses subordinates' own shadow franchises, using reputational assets flowing from their association with the organization, provided they do not directly compete with it.
On the basis of more recent studies, a looser typology associated with less elaborate criminal organisations emerges. If we divide the four phases of an extortionate relationship into Contact, Negotiation, Pressure, and Escalation, at these various stages different roles will be in play in the network. They include the contact-maker, the confidant, the negotiator/mediator, the controller, the aggressor, and the director. Incumbents of these roles employ a range of interpersonal techniques, including deceit, manipulation (such as hinting at consequences for relatives if there is a lack of cooperation or if they consider informing the police), intimidation, insinuation (threats of violence) and later, the use of violence. Semiotic cues may be provided by enculturated knowledge, for example, simply leaving a can of gasoline outside a shop door overnight to be found in the morning by the shopkeeper. Pressure is often applied on a Friday as there are fewer police on duty and the target will worry all weekend. Initial contact tactics often include a two man team combining a well-built 'gorilla' and a suit-wearing 'diplomat'. The diplomat acts as the negotiator and uses business language with reference to interest rates and a payment plan, while the gorilla simply acts menacing. In addition to extortion, the diplomat will offer other services, such as debt collection, or intimidating business competitors.
Swedish research based on 1,100 police reports and on interviews with investigators, offenders and victims found that up to a third of the criminal network were professional debt collectors operating in a more or less legal way, but there were also lessestablished people collecting 'dirty debts' (Skinnari and Stenstrom 2012). The third major group were territorially based perpetrators using extortion and also driving clients' competitors out of business or forcing them to change the products or services they sold. As Gambetta and Reuters' (1995) work on the protection rackets regulating the New York garbage haulage business found, the most effective, experienced extortionists were subtle in their use of threats, sought relatively low interest rates, and were self-disciplining. Those in the same network would 'fine' each other for mistakes or to resolve personal disputes.
The roles and associated behaviours considered in the previous paragraph were derived from cases discussed at professional meetings by police, judges and other criminal justice officials. They give an idea of the refinements to a broad typology like Cressey's that can be made using empirical information from specific jurisdictions. The scenarios based on predominant syndicated crimes in a specific jurisdiction, like Sweden, may not apply elsewhere. Whether from direct (and dangerous) fieldwork or from prosecuted cases, the robustness of a typology or more elaborate conceptualizations is only as good as the range and depth of the empirical information on which it draws. An EU-funded project on extortion racket systems (GLODERS 2015) prepared a database from syndicated crime trials held in Sicily and Calabria. The variables that were derived included the following features: 'whether the extortion was only attempted (and unsuccessful …) or completed, i.e., the victim actually paid; whether the request was for a periodic or a one-off payment or both and what the amount was …; whether there was an intimidation and whether it was directed to a person or to property; whether the extortion request was brought forward by direct personal contact or by some indirect communication; whether there was some negotiation between extorter and victim, and if so, what it was like, and whether a mediator interfered; how the victim reacted (acquiescent, conniving or refusing); how the law enforcement agencies got to know about the case (own observation, denunciation, etc.); whether the extorter was caught, brought to investigation custody or finally sentenced' (Militello et al. 2015: 1). These features may all involve a covert dimension but in some cases the broader objectives of the extortionate relationship may be served by intentional disclosure. For instance, an extortionist may wish to cow not only the direct victim on a given occasion but others like the direct victim, such as other competing retailers who will later be subject of extortionate pressure. The extortionist will therefore let some details be known of the pressure they are applying to a given target.

Organization for activities and organization for social relations
While covertness is an element of Cressey's model, it is a supporting condition rather than a distinctive feature of his hierarchical typology. Covertness is a generic feature of syndicated crime for the obvious reason that, generally, criminals do not wish to be caught. Covertness of this kind is required by both the lowest and the highest level types in the Cressey model. Breach of secrecy is a problem however mundane or sophisticated the criminal organization, but the organizations have different resources. The higher level organizations can buy secrecy by corrupting public officials but the lower level gangs cannot.
Cressey's point that the high level organizations can perform any criminal activity regardless of their context has been challenged. Surely different social contexts present distinctive challenges, and the appropriate organizational solution therefore varies? In this approach the organisation of professional crime is in practice associated with variations in the conditions of social control. This allows the importance of covertness to vary according to context. Blok's (1974) history of the Mafia takes this approach. Urban underworlds nurture stable patterns of professional crime through a social milieu that is relatively segregated and autonomous rather than having links that overlap into noncriminal networks. This brings culture in, namely that of the underworld. In Blok's analysis medieval banditry was risky because it existed within the peasant community, which was tied to relationships with the estate owners. In later English history the 'rookeries' were geographical areas where the King's writ did not run and officers of law were reluctant to enter. The State pursued a strategy of opening them up by driving new streets through them, so by the 20th century the criminal underworld had largely moved from being a geographical area to being a social network, with criminals physically scattered about the cities and suburbs.
The values of the criminal underworld derive from the nature of the work and serve the same broad functions as are served by legitimate occupational communities. The criminal underworld establishes norms of working behaviour; provides contacts, and referees who can vouch for skills; transmits information about new problems and techniques; helps members in hard times; keeps trade secrets and does not betray members to outsiders; and offers social support to members whose hours of work, income and periods of liberty are irregular. The important point here is that there are legitimate occupational cultures that major on secrecy; commercial confidentiality amongst legitimate businesses is an example. Secrecy is not a value but an instrumentality, an operating condition. So in modelling a network operating a protection racket, the number of actors would be larger than a wholesale illegal drugs operation and their interactions more frequent, not because of secrecy but because of what it takes to do protection. Like overt networks, covert networks are structured by the practical problems and interests they seek to address, rather than directly by the demands of secrecy. Varese (2011) has shown that mafias find it hard to transplant their core business of governance and protection into new locations. This is partly to do with the lack of the cultural embeddedness associated with their territory of origin. But it is also to do with the regulatory environment. The higher the efficiency of the State and its regulatory apparatus in the new target territory, the costlier it is to move from diversification to a fully-fledged replication. The violence associated with establishing a protection racket monopoly not only increases penalties on individuals that are caught but the chances that trading activities associated with diversification will be shut down by the authorities. Campana's (2013) study of the Neapolitan 'La Torre' clan, which established offshoots in Amsterdam and Aberdeen, demonstrates a 'functional diversification' where criminal organizations can govern markets as well as trade on them. This is also apparent in the similar case of the Moscow-based 'Solntsevskaya' group's expansion into Italy. The governance function involves ordering market exchanges by controlling prices amongst ostensible competitors (Bandiera 2003). To do this effectively, the organization needs to establish a monopoly, as in Gambetta's (1993) classic treatment of the Sicilian Mafia. This core business does not mark their activities outside their territory of origin, where they may simply trade on markets like any other economic actor, e.g., due to a tougher regulatory environment. So organized crime groups do not operate the same way in every territory. Accordingly we can predict that the networks associated with the core territory and those associated with the offshoots would differ. Social relations in the form of culture, such as norms of secrecy, are not needed to explain variations in organizational form over time. Such variation is explicable by activities and the regulatory context forming the organization's environment.

Covertness and core business
So what are the key things that a criminal network needs to exchange? The rational organisation model suggests they are (i) information about suitable targets; (ii) contacts with potential associates; (iii) somewhere to sell illegally obtained commodities or illegal services; (iv) protection from detection and law enforcement. Looking at it another way, we can state some working assumptions in accord with the rational organisation model: -To develop and endure, a covert social network must meet a sustained need (inelastic demand) -To develop and endure, a covert social network must be adaptive to the regulatory environment -Interactions between motivated offenders, suitable targets, and absent or incapable guardians are necessary to commit crimes (Felson 2006).
A crime requires technical and human resources dictated by the specifics of the crime type. Secrecy requires that we disclose our plans to as few actors as possible. The minimal disclosure rule can be suspended where the practical and technical requirements necessitate a confidant. For instance, this might be a quartermaster who can grant access to specialised equipment. Others involved need only know their part of the operation; some may explicitly not want to know more than that, or be indifferent. If we use a simple activity-by-temporal-stage model for our criminal act we need to model exactly what activities are subject to secrecy, by whom, and from whom. We assume that the disclosure rule works on a parsimonious basis, as little disclosure to as few people at each stage. The main driver for acts and activities remains the technical and practical requirements of the crime. So we can model the organization of crime through routine activities, or through social relations. The former gives us differentiated roles as in Cressey's model. The latter asks 'how are these various people related?' That is, to what extent is the organisation around activities a segmented one of individuals and teams in symmetrical economic relations or one with some degree of centralisation, with people in particular positions establishing control in some degree or another over other activities? This second question also speaks to the role of covertness in criminal social networks, and, as we will see, to matters of competency.
Despite Cressey's model, there is no simple tendency towards a business type of organisation. For many kinds of crime it is neither the most efficient nor the safest approach. The only condition in which continuous and large-scale organisation can operate is when the agents of law enforcement are neutralised in some way, such as corruption, and activities do not damage the interest of dominant groups in the society. We know there are interdependencies between licit and illicit markets, such as the use of criminal enterprises by legitimate companies to dispose of toxic waste. Surveys conducted by Transparency International report the worldwide extent of bribery, with public officials and businesses mixing corrupt and honest dealings in providing access to services (Rose and Peiffer 2012). In Tilley and Hopkins' (2008) study of business victimization 44 % of businesses reported being offered stolen, counterfeit or contraband goods. Almost none of this was reported to police, despite 20 % receiving weekly offers. Criminals focus on particularly vulnerable or compliant businesses; 20 out of the 420 businesses received offers every day. Not informing police suggests collusion. Proprietors claimed that profits from participating helped small traders stay in business providing a service to deprived neighbourhoods.
Once criminal organisations and systems of corruption have been built up for extortion or supplying illegal goods and services there may be regulatory crackdowns but they do not alter the fundamental problems presented by the criminal activities, just their degree, and are therefore reversible. The implication for covert social networks is that they are project-oriented, configured to the specifics of the project, and ephemeral, but that the individuals in them come together periodically such that over time they form dynamic chains, with some individuals repeatedly connected and others only on occasion. The syndicated crime organisation is a kind of holding company and provider of supplementary services such as welfare for retired members or introductions for new entrants, as well as a mechanism for assembling crime teams.
While our starting point may be what constitutes the necessary relations to commit crimes for profit, we also need to understand their contingent concentration in certain places and times amongst particular populations (Edwards and Levi 2008). This brings rational activities and social relations together. To put it in the form of a question, 'what overlaps exist between the offences and those who commit them?' (Levi 2007). The concept of a network provides a better dynamic depiction of how criminals operate than the solidary criminal organization. As Ronn (2013) observes, threat and harm assessments based on the solidary model display conceptual vagueness, inherent subjectivity, and incommensurability. But a network can mean different things. It may be a way to describe how criminals construct the structure and everyday workings of the market for criminal goods and services; or it may be a way to describe the nature of the independent small groups and individuals involved, emphasising its dynamic and ephemeral nature; or it may refer to the durability or volatility of criminals' organisational arrangements, as in work showing them to be ad hoc and unsophisticated in international collaboration and money laundering (Matrix Knowledge Group 2007).
If we frame covert networks as typically involving interconnected actors engaged in activities that they wish to keep hidden, with the consequence that their links to one another are also typically hidden (Baker and Faulkner 1993;Enders and Su 2007;Krebs 2001;Morselli et al. 2007;Morselli 2009;Raab and Milward 2003;Lindelauf et al. 2009) this frame also applies to other networks whose activities and connections are kept secret without being illegal, for instance, freemasonry, those engaged in nonnormative sexual pursuits, and registered heroin users who are 'needle buddies'. Moreover, some elements of extortion are present in legal interaction, such as coercion. For instance, an employee may fall in with pressure from their manager to put aside priorities dictated by their job description to cover work others have failed to do. The surveys conducted by Transparency International that report 500,000 business people worldwide as having paid bribes indicate the haziness of boundaries between the legal and illegal, where public officials and businesses mix corrupt and honest dealings with the public in the provision of access to services (Rose and Peiffer 2012).
Routine Activities Theory has focussed research on substantial relations of connection, both necessary and contingent, in the interactions between motivated offenders, suitable targets, and incapable guardians (Felson 2006). Rather than asking if crime is organized in a particular way, we must ask what factors over time shape the ways in which crimes of certain types are organized (Levi 2007: 779). The simplistic focus on organised crime framed as illicit business activity diverts attention from the interdependencies between licit and illicit markets noted above, another example being the profits earned by legitimate financial services from laundering money from crime. This may be a point of information leakage and a challenge to covertness.

Law enforcement
Law enforcement interventions against organized crime often focus on disruption, on the basis that successful prosecutions do not deter the 'wannabe' extortionists who will appear when a dominant extortionist group is convicted. Disruption generally also takes less effort than prosecution, which makes large evidence-gathering demands. Moreover, disruption scores over the other main law enforcement response, 'situational crime prevention', because the difficulty of defining what constitutes the 'situation' in organized crime renders that framework unconvincing when applied to organized crime (von Lampe 2011). This is so even with the addition of an 'outer triangle' of roles to the standard Crime Triangle (Offender, Place, Target/Victim). Occupants of outer triangle roles are in a position to deter a crime, such that 'handlers' influence potential offenders who are motivated to commit the crime, 'guardians' handle particular potential targets, and 'managers' are responsible for the premises on which a crime may occur (Felson 1995). Situational crime prevention still proves inadequate with the addition of 'super controllers' -people or organizations that influence the immediate handlers, guardians and managers (Sampson et al. 2010). This is both because super controllers relevant to organized crime have only a diffuse responsibility rather than one focussed on the offenders, target and place in question, and because understandings of the stages and activities that inform the Crime Triangle in respect of organized crime lack sufficient granularity (Ekblom 2012).
The most sophisticated analyses draw on ecology, identifying 'ecological niches' rather than specific localized crime settings (Ekblom 2003), but, in doing so, they stretch the 'situational' in 'situational crime prevention' to the point where the heuristic loses its practical utility (von Lampe 2011). For example, the situational crime prevention model as extended to organized crime allows incumbents of the outer triangle roles to be 'flexible' and subject to offender influence. While this accommodates corruption and the blurred interface between licit and illicit businesses, it renders the outer triangle roles non-predictable in effects and therefore analytically irrelevant.
All this leaves little scope for law enforcement interventions except disruption. Yet the research literature on disruption remains sorely underdeveloped, inhibiting attempts to design and deliver evidence-based disruption strategies. Targeting, methods and outcomes are thinly documented, a landmark corrective to this being Tilley's work with Durham Constabulary in the UK (Tilley 2013), which provides a step towards understanding the active ingredients and causal mechanisms that lead to effective disruption while taking some account of unintended as well as intended consequences.
A disrupted network can be defined as 'the state of a network that cannot efficiently diffuse information, goods and knowledge' (Duijn et al. 2014: 5). Network typology and network resilience are important factors in assessing the effectiveness of disruption strategies but secrecy restricts what is known about the criminal enterprise being targeted. Duijn et al. combined computational modelling and social network analysis with Dutch Police intelligence about a criminal network. This revealed that criminal networks can actually be made stronger by targeted interventions. However, it also revealed that increased efficiency within the network decreases its internal security, providing law enforcement with openings for more deliberate network targeting. There was also a temporal dimension, in that an intervention provides a time-limited period before the network reorganises itself to maximise resilience. Disruption forces networks to become more exposed. Network destabilization can involve a reduced rate of information flow in the network, a reduced ability to conduct necessary tasks, and/or a slowing down of decision making processes. Over time, replacements for compromised actors are found and these individuals introduce new shortcuts that reduce the numbers required to conduct the criminal activity, thus reducing exposure to disruption. Therefore, in accord with Wilkins' (1964) feedback loop model of social control interventions, disruption can actually lead to greater efficiency of the criminal network.
The message for law enforcement is to intervene early and to sustain network disruption over time. If it cannot do this, it may actually be better to let the network run at sub-optimal efficiency until it implodes. The message for researchers is that rather than hierarchical structures where taking out Mr Big will lead the organized crime group to disintegrate, organized crime networks feature flexible and non-hierarchical internal relations (Sparrow 1991;Natarajan 2006;Spapens 2010). This perspective is implicit in referring to these groups as comprising 'networks'. Social theory generally sees the process and structure dimensions of social phenomena as interdependent (Archer 2003). They stand in balance over time, forming what we might call a 'stable tension'. It follows that in networks, processual relationships may on occasion predominate over structural relationships (and vice versa). Where networks are marked by flexibility and adaptability it can make networks more resilient than rigidly structured organizations. For instance, vigorous structural targeting of a drug trafficking network over a sustained and substantial period did not see trafficking operations cease. Trafficking activities continued and its structure adapted (Morselli et al. 2007). Network members have to balance the security gain from restricting direct communication with other participants to the minimum necessary while handling risks that arise by mobilising non-routine communications with participants to whom a higher level of trust is extended than is the norm. The balance between the imperative of efficiency and that of secrecy varies according to the temporal stage of a criminal operation both in normal functioning and under conditions of disruption by external agents.

Covertness within networks
Covert networks thus negotiate a trade-off between efficiency and secrecy. Network analysts say that this tension shapes the features and structural properties of covert networks. These include: Centralisation; Density; Segregation; Strength/Weakness of Ties. The research base on covert social networks is small but growing (Baker and Faulkner 1993;Enders and Su 2007;Krebs 2001;Morselli et al. 2007;Morselli 2009;Raab and Milward 2003;Lindelauf et al. 2009). SNA has been used to analyse networks of violent Islamist militants (Krebs 2002;Sageman 2004); drug trafficking networks (Morselli 2009); fraud networks (Baker and Faulkner 1993); and militant social movements such as the suffragettes and the Provisional IRA (Crossley et al. 2010). This literature makes the central claim that the demands of covertness shape networks in significant ways. However, the accounts offered can be contradictory, the empirical knowledge base remains thin, and some work is purely theoretical (Crossley et al. 2010(Crossley et al. , 2012, being rooted in game theory and pure simulation. Moreover, the evidence base is flawed by incomplete observation (Koskinen et al. 2010). While it would seem an obvious enough comparator, empirical matching of covert networks with comparable overt networks so as to isolate the possible effects of secrecy has not been attempted. Another weakness is the definition of covert networks. Clearly something about or within such networks is subject to secrecy but exactly what, by whom, and from whom is not systematically addressed. Social science has largely neglected secrecy and covertness, the principal substantive discussions being Simmel (1906) and Erikson (1981).
Most argue that covert networks will be decentralised, with relations evenly distributed throughout the network and no bunching around given nodes (Baker and Faulkner 1993;Enders and Su 2007;Krebs 2002;Morselli et al. 2007;Raab and Milward 2003). Covert networks should not have hubs, the argument being that hubs introduce vulnerabilities. If most nodes connect to it, a hub will be easy to find, and if the hub is what holds the network together, it can be dismantled by removing the hub (Carley et al. 2003;Sageman 2004;Tsvetovat and Carley 2005). So covert networks should tend towards cell structures, with each member having ties to few others. But research on criminal networks suggests they are more centralised (Baker and Faulkner 1993;Morselli 2009;Morselli et al. 2007). Simmel (1906) predicted high centralisation, and Lindelauf et al's (2009) work in game theory predicts high centralisation on the grounds that preserving secrecy requires short communication chains. Erikson's (1981) work on secret societies gives the more interesting idea that levels of centralisation are a function of the distribution of resources. If resources are concentrated amongst a few then the network is likely to be centralised; if not, there is little basis upon which it could be.
Regarding the second main feature, density, there is strong agreement that covert networks tend to have low density (Baker and Faulkner 1993;Enders and Su 2007), but without specifying the criteria by which 'low density' has been judged. Moreover, analogous work on social movement networks suggests that these work best when dense. Density is conducive to generating trust, support, self-sacrifice and reinforcement of the deviant worldview necessary to the activities of such networks (Coleman 1988;McAdam 1986;Gould 1993Gould , 1995. Density is the simplest cohesion measure but as an average it does not capture cohesion well when there is a lot of variation; fragmentation and distance-weighted fragmentation are better measures (Borgatti 2006).
Theory says that covert networks progressively segregate themselves from the wider world, as in terrorist networks (e.g. Della Porta 2006). As the group moves into escalating violence it needs more secrecy, leading activists to withdraw not just from wider society but from the broader movement from which they came. But the research base is narrow -the studies supporting this analysis deal either with sleeper cells or with fugitive cells that have committed an intervention and are on the run, such as Della Porta's (2006) work on the Baader-Meinhof Group and the Italian Red Brigades. There is a temporal dimension as the group moves into escalating violence which increasingly necessitates secrecy, leading activist cells to withdraw not just from wider society but from the broader movement from which they originated. However, the case of terrorist networks reads off imperfectly to the case of organized crime networks. The former do not require as high a level of efficiency in their within-network communications. '[E]conomically driven criminal networks need shorter time frames between action (time-to-task) as opposed to ideologically driven terrorist networks. Terrorist networks might achieve their goals by just one successful terrorist attack. Criminal networks are often action oriented, resulting in higher levels of risk of becoming detected' (Duijn et al. 2014: 2).
Theorists see strong ties as important because they involve greater trust and so offset risk. Granovetter (1973) linked transitivity to strong ties -the degree of overlap between the social networks of two individuals varies directly with the strength of their tie to one another, providing pathways for influence and information, and for network organization. Strong ties are marked by duration, emotional intensity, mutual confiding and reciprocal services. They equate to the structural network property of 'closure', which fosters cooperation, and are a good substrate for social influence (Aiello et al. 2012). Aiello et al. showed that link creation played an immediate effect on the alignment of user profiles in an interest-based social network. Most theorists relate strong ties to 'closure' because it fosters trust. However, Sparrow (1991) notes that weak ties can provide 'shortcuts' across a network, boosting efficiency in networks that contain few local bridges and do not exhibit a clear core/periphery structure. For individuals the consequence is that structural holes are rare when compared with more overt networks.
As yet we treat covert ties just as 'connections', with no typology, and lack consensus about tie strength. Analysts have assumed that covert social networks are distinctively characterised by their covertness; that is, their essential characteristics are a function of secrecy. It may be equally plausible that their essential characteristics are determined by the common features that complex social networks (overt or covert) display in pursuing the practical activities for which they exist. There is a need both for better empirical information and for systematic comparison of overt and covert social networks.
It is likely that some traits of social networks are generic features of all networks while others are conditioned by covertness or overtness. With this in mind we should again note that some of the behavioural elements of illegality are present in legal interaction, as in the employee coercion example noted above. Since relevant databases are lacking, the parallel could help anchor speculation empirically via studies of these kinds of occupational pressures in licit organizations. Such studies might consider the conditions under which taking on extra work is kept secret between manager and employee, with a rationale about not undermining the confidence of the colleague whose work is taken on by the complicit employee, that rationale being reinforced by a 'bonus' for undisclosed services.
We might also learn from factors that lead networks to break up. Extortion racketeers can be externally destabilized by new laws, effective law enforcement, and public intolerance, and they can be internally destabilized by competition with other providers of extortion services, ineffective internal discipline or a failure to understand the market leading to the use of an inappropriate strategy.
SNA has certainly identified some of the main features on which we can compare the patterns into which criminal networks self-organize, but we can only get so far with theoretical conceptualizations that lack analytical consensus or a firm empirical underpinning. SNA identifies some features with which to compare criminal networks, but makes debatable assumptions about actors' capacity to shape networks, emphasises instrumentally rational action without equivalent attention to affect or enculturation, and provides little direct evidence for the supposedly transitively structured preferences of actors.
Thus, while a major thread in SNA of organized crime has pursued centrality measures (on the basis that individuals who have high degree centrality and betweenness centrality are 'hubs' who, if subject to effective targeted attack, will bring down the network), it can benefit from another thread that considers individual qualities. The 'human capital' approach, derived from economics, looks at competencies, knowledge and social/personal attributes. This suggests that 'substitutability' is an important consideration (Sparrow (1991). While some individuals occupy roles for which there is sufficient redundancy to readily secure flexibility (reliable, trustworthy replacements can be found via reciprocal trust ties, often of kinship, friendship or affective relationships), others occupy specialised roles for which replacements are less readily found. On the basis that the most highly specialized roles are hardest to replace, intervention is targeted at those with a prime role at a given stage of the business process. This calls for a detailed understanding of the stages required for a given activity, where the 'crime script' approach is used to understand the procedural requirements of the criminal activity at hand (Cornish 1994). These scripts are 'hypothesized knowledge structures' guiding perpetrators in routinized but adaptive goal-oriented behaviour through a sequence of stages to the goal. Combined with SNA, this approach highlights the importance of brokerage roles, where an individual with essential human capital for a given stage is construed as a 'value chain broker' (Spapens 2010).
Network resilience is necessarily something construed with a temporal referent. Over time, redundancy and non-redundancy are both in play, in other words, both are necessary at different stages. Redundancy is necessary to find trustworthy recruits to replace incumbents who are compromised by law enforcement (or rival gang) disruption. But non-redundancy is also needed, because the heightened risks arising from the substitutability search need to be managed by confining the flow of information only to those who need to know, thus minimising the openings for further detection. Such complexity arises because, as Duijn et al. (2014: 7) put it, 'criminal network resilience is a dynamical process that evolves along the tradeoff between efficiency and security'.
Better empirical evidence would help us analyse whether the personal networks or 'ego-nets' of covert network members are different to those of overt networks. The overly abstracted theories of covert networks leave us without a typology of ties in them. Types are easily measured in overt networks but are left undefined simply as 'connections' in covert networks. Constructing covert network data generally involves pooling information on different types of ties, whereas we recognise that ties as a general rule are multiplex (relationships that have multiple contents) and multimodal. In a criminal context a tie may be defined as a combination of evidence on comembership in organisations or activities, as well as direct financial transactions and phone calls. Ferrara et al. (2014) offer an expert system that identifies the underlying structure of criminal networks using metadata from phone calls and online social media transactions. The expert system identifies networks but it employs a 'supervised community detection process'; in other words, police must interact with the system 'incorporating expert knowledge to supervise the results and refine the unveiled community structure' (Ferrara et al. 2014: 5734). This represents at best a handmaiden system, not the automation of criminal detection. It is no doubt useful as a way to visualize possible relationships and perhaps direct information-gathering to particular individuals but it remains only as good as police knowledge of the individuals whose telephonic and online transactions were monitored. So we still need to know more about the co-evolution of events, affiliations and direct actor-to-actor ties. The least developed models in the literature are those of the relational dynamics of events and transactions.
The questions we need to answer are what kinds of relations may reveal most about the network, whether any structural properties distinguish covert networks from more overt networks (where studies of non-criminal deviance, such as involvement in sexual swinger networks may be a useful midway case), whether some covert networks are more sustainable than others and what properties they have, how covert networks change over time, whether structural properties correlate with other changes, and whether the personal networks of members of covert networks differ from the personal networks of members of overt networks. The ego level would be a way in to examining brokerage roles, group centrality, within-group and inter-group cohesion. Asserting that covert networks are distinctive by virtue of their secrecy begins to sound like a mask for speculation rather than a considered finding.

Conclusion
This article has sought to re-assess the role of covertness in criminal organizations. It has done so as a means to address the deficit in our empirical knowledge about criminal organizations, a deficit which is in turn responsible for gaps in our conceptualization of such organizations. Noting that our principal contemporary models of organized crime draw strong parallels between criminal organizations and legitimate businesses, the article suggested there is scope to learn more about the practices and functions of covertness in criminal organizations by making comparisons with the practices and functions of covertness in non-criminal organizations, such as those associated with commercial confidentiality. While our principal contemporary heuristics for understanding criminal organizations are drawn from routine activities theory, the article differentiated models concerned with 'organization for activities' from models concerned with 'organization for social relations' in order to make the point that our explanations need to capture the interaction between the structure of criminal organizations and the processes that take place within that structure. Amongst other things, the article noted that this bears implications for law enforcement. Since it is possible to identify networks that display covertness but are not engaged in criminal activities, the article argued that there may be a useful analytic benefit from exploring covertness in other kinds of network. In doing so it may be possible to differentiate the generic features of covertness from those that are specific to the criminal network.
Compliance with ethical standards This study was funded by the European Union (grant number FP7-ICT-315874 GLODERS).
This article does not contain any studies with human participants performed by any of the authors.