THE ANNUAL REGIONAL WORKSHOP FOR FIREARMS FOCAL POINTS
Criminal Network Analysis
SKOPJE, MARCH 2026
Criminal Network Analysis for Firearms Investigations
From associations to disruption opportunities
01
Core Concepts
Understand criminal networks and social/link analysis fundamentals
02
Chart Types
Recognize key chart types and the questions they answer
03
Apply in Practice
Build and interpret basic network charts in firearms cases
From Individuals to Networks
Firearms crime is rarely a single-offender phenomenon. Offenders, facilitators, brokers, and armourers form adaptable, resilient networks
Fragmented Intelligence
Seizures, traces, phone records, shootings, and financial records arrive as disconnected fragments
Structured Picture
Network analysis organizes those fragments into a coherent whole to support targeting
Disruption Opportunity
A structured network picture reveals chokepoints, key roles, and actionable vulnerabilities
What Is a Criminal Network?
A set of interconnected entities (people, companies, locations, phones, vehicles, weapons, etc) engaged in or supporting criminal activity, defined by their relationships, not just their identities.
Relationship-Centered
The focus is on who interacts with whom, for what purpose, how often, with what directionality, and with what strength, not just who the individuals are.
Fluid, Not Hierarchical
Modern organized crime features loosely structured, adaptable networks that resist disruption better than rigid hierarchies. Roles shift; members are interchangeable.
Broad Entity Types
Entities include persons, businesses, firearms, vehicles, phones, addresses, and events, any node that holds investigative significance and contains unique identifiers.
Trafficking networks
From the 821 most threatening criminal networks identified by Europol, 5 criminal networks engage in firearms trafficking as their sole criminal business. More often firearms trafficking is linked to main criminal activities such as drug trafficking. The report identifies three types of entities involved in firearms trafficking:
1: Criminal networks that specialize in dealing with firearms as their main activity. These networks often originate from the Western Balkans;
2: Large-scale poly-criminal networks, mainly drug trafficking (cocaine and cannabis) and extortion and racketeering networks that engage in weapons trafficking as a subsidiary activity;
3: Individuals selling firearms to different criminal networks and people with violent extremist or terrorist affiliations.
What Questions Can Network Analysis Answer?
These are the operational questions that link charts, flow diagrams, and association matrices are built to answer in investigations.
Centrality
Who is the most connected (or most influential) individual in this firearms network?
Role Identification
What roles do individuals appear to play: broker, importer, courier, armourer, end-user, or corrupt insider?
Disruption Points
Which links or nodes, if removed, would most severely disrupt the supply chain or command structure?
Resilience & Succession
Who can replace key personalities if arrested? Where does the network have redundancy?
Collection Priorities
Which communication links or financial channels are most worth monitoring or targeting?
Exploitation Opportunities
What vulnerabilities, rivalries, or dependencies can be leveraged for disruption or source development?
Key Chart Types in Firearms Investigations
Each chart type answers a different analytical question. Choosing the right chart for the right question is the foundation of effective network analysis.
Chart Type
Purpose in a Firearms Context
Link / Network
Maps roles, associations, hierarchy, and bridges between sub-groups or individuals
Commodity Flow
Traces the movement of firearms, parts, ammunition, and illicit proceeds across the supply chain
Event / Sequence
Constructs a timeline of key events and contacts to reveal patterns and operational tempo
Telephone / Comms
Identifies communication hubs, call frequency, directionality, and links to firearms events
In practice, investigators often layer multiple chart types. For example, overlaying a comms chart onto a link chart to confirm suspected relationships.
Link Charts & Association Analysis
Link charts translate an association matrix (a structured list of entities and their documented relationships) into a visual network that reveals structure at a glance.
1
Consistent Symbols
Use standard icons: circles for people, rectangles for organizations, diamonds for phones, firearms icons for weapons
2
Line Styles
Solid lines = confirmed, strong ties. Dashed lines = weak, inferred, or unverified relationships
3
Layout Discipline
Minimize crossing lines; place the most connected nodes centrally for maximum readability
Commodity & Activity Flow Analysis
Courier
Stash House
Importer/Broker
Source Country
Commodity Flow
Tracks direction, quantity, and timing of firearms, ammunition, components, or illicit cash moving through the network
Activity Flow
Maps the generic steps of the criminal enterprise: sourcing → transport → storage → distribution → recovery — revealing the business logic of the operation
Critical Nodes
Flow analysis surfaces hidden beneficiaries, stash houses, couriers, and brokers who may not appear in direct association data
Event Charting & Telecoms Analysis
Event Charts
Plot the sequence of critical events (meetings, shipments, seizures, and shootings) with precise dates and times. Matrix event charts align multiple entities (persons, phones, vehicles) against a shared timeline to expose coordination patterns.
Telephone & Comms Analysis
Use billing records and call data to identify frequent contacts, peak calling windows, and the relationship between communication bursts and known firearms events. Reveals hubs, intermediaries, and indirect links between subjects.
Key Takeaway: Combine event charting with telecoms analysis to confirm whether communication spikes precede or follow firearms seizures, shipments, or violence 🡪 turning timing into intelligence.
Social Network Analysis (SNA)
A Systematic Approach to Understanding Firearms Trafficking Networks
Crime Is Relational
Offenses don't occur in isolation they emerge from connections between actors
Structure Shapes Behavior
A network's architecture determines how actors communicate, trust, and operate
SNA Reveals Hidden Structure
Quantitative mapping exposes roles and relationships invisible to traditional analysis
What Is Social Network Analysis?
Three Dimensions of SNA
A Theory
Grounded in the principle that human organization is fundamentally relational — structure defines group behavior
A Method
Quantitative framework for measuring the strength, direction, and pattern of ties between actors
A Tool
Produces visual maps and numeric metrics from raw investigative data
Basic Unit: Two nodes (actors) connected by one edge (relationship) — the fundamental building block of any criminal network
1
2
3
What Does SNA Measure?
Every analysis produces two core outputs: a visual network map and a set of quantitative metrics that characterize each actor's structural role.
Degree Centrality
Counts the number of direct connections an actor holds — identifies the most actively linked nodes in the network
Betweenness Centrality
Measures how often an actor sits on the shortest path between others — reveals control of information and resource flow
Closeness Centrality
Calculates average distance to all other nodes — indicates speed of access and operational reach across the network
Hubs, Brokers & Network Structure
Key Actor Roles
Hub
Holds many direct links, high degree centrality, visible and active within their cluster
Broker
Connects otherwise disconnected groups, high betweenness centrality, often the most operationally critical node
Network-Level Characteristics
Density
Ratio of actual to possible ties — tight networks signal trust; loose networks signal compartmentalization
Clusters
Sub-groups with high internal connectivity — often map to functional roles (suppliers, couriers, distributors)
Centralization
Degree to which the network depends on one or few actors — high centralization signals a critical vulnerability
Applying SNA in Firearms Cases
Key Analytical Questions
Who connects the supplier to the buyer across the supply chain?
Who introduces actors and facilitates trust between strangers?
Who links cross-border nodes 🡺 bridging domestic and international networks?
Who is structurally irreplaceable 🡺 removal of whom would fragment the network?
Primary Data Sources
Strengths & Limitations of SNA
STRENGTHS
Surfaces Hidden Influencers
Identifies high-value targets who hold structural power but maintain a low operational profile
Reduces Confirmation Bias
Metric-driven analysis deprioritizes assumptions 🡺 evidence follows structure, not intuition
Sharpens Targeting
Focuses disruption efforts on nodes whose removal maximizes network degradation
Supports Joint Operations
Shared visual maps align multiple agencies around a common understanding of the network
LIMITATIONS
Missing Data Distorts Structure
Incomplete records skew centrality scores 🡺 gaps in data can render a key node invisible
Metrics ≠ Intent
Centrality reflects position, not culpability 🡺 structural prominence alone does not establish criminal intent
Structure ≠ Hierarchy
Network position does not always map to command authority 🡺 flat networks can appear centralized
Output Quality Follows Input Quality
Analytical conclusions are only as reliable as the underlying data used to build the network
A 6-Step Firearms Network Analysis Workflow
A practical, repeatable process you can apply to a live case — start to finish in as little as 15 minutes of planning time.
OPERATIONAL GUIDANCE
Step 1: Define the Problem & Question
Problem Definition
Write a clear statement of the intelligence problem — e.g., "Understand the network supplying converted pistols used in recent shootings in Region X."
Project Aim
One sentence: "Identify key individuals and network vulnerabilities for tasking and disruption."
Scope
Define what is in — crime types, timeframe, geography — and what is deliberately excluded.
Step 2: Develop a Focused Collection Plan
Plan what you need, where it comes from, and by when
Key Data Categories
Persons
Suspects, victims, brokers, armourers
Firearms
Make, model, calibre, serials, conversion markers, ballistic links
Events
Shootings, seizures, thefts, imports, border interceptions
Comms
Phones, social media, IMEI, email
Financial
Accounts, payment platforms, money remitters
Locations
Stash houses, dealers, gun shops, border points
Key Sources
Step 3: Evaluate & Collate
Evaluate First
Apply a structured reliability grading system
4×4, 5×5×5, or 6×6
Be cautious about discarding untested links too early — weak data may gain significance as new information arrives.
Collate Into Structure
Association Matrix
Map people, phones, firearms, and addresses against each other to reveal hidden connections.
Event / Incident Table
Log dates, locations, and entities for every significant incident in chronological order.
Step 4: Describe the Network
Use charts to describe what the data shows before moving to interpretation. One network, one timeframe, one question per chart.
Link Chart
Visualise associations between people, phones, firearms, and locations. Essential for identifying clusters and central nodes.
Commodity Flow Chart
Track the movement of firearms and cash through the network — from source to end user.
Event / Sequence Chart
Plot key incidents in chronological order to reveal patterns, operational tempo, and network behaviour over time.
Step 5: Analyse & Infer
Action
Inferences
Premises
Move from raw facts to actionable intelligence by building and testing inferences systematically.
Building Inferences
1
Identify Premises
Cluster facts that "go together" e.g., repeated firearms links between A and B, shared storage, recurring comms.
2
Develop Inferences
Hypotheses (tentative explanations), Predictions (e.g., next shipment before date X), Conclusions (well-supported explanations).
3
Test & Gap
Test each inference against available data. Document gaps to drive further targeted collection.
Step 6: Present & Recommend
Product Types
Every Product Needs
Know Your Audience
Tailor format and language to the consumer — investigators, firearms units, prosecutors, or senior management each need a different level of detail.
Criminal Network Analysis: Group Exercise
1
Continue the scenario
As a group, go through the intelligence packages and discuss within the group.
2
Describe the network
What links incidents? Look for similarities in MO, geography, suspect indicators, or crime type, communication, etc
3
Draft Trend Questions
Suggest 1–2 observations and questions you would bring into your FFP based on what you observed.
Handout includes: Incident reports on arrests of multiple suspects upon a detection and seizure of a larger number of firearms at the border. Assess the intelligence provided and work on the data as a group. Use the laptop with basic Microsoft tools and or flipchart.
Four Key Elements of a Network
Entity
Any node of interest: person, business, firearm, vehicle, phone, address, or event
Relationship
The tie between entities: familial, criminal, financial, communication, or logistical
Directionality
Who gives orders, who supplies, who pays, the flow of authority, goods, or funds
Strength
Intensity and importance of the tie. Measured by frequency, duration, and corroboration level
Strong & Directional
"A sells pistols to B" — commodity flow, directional, high-strength tie with clear criminal purpose
Moderate & Non-Directional
"C knows D from prison" — social bonding, non-directional, medium-strength tie indicating shared history
Common Pitfalls to Avoid
"Pretty Charts, Weak Thinking"
Charts produced without clear questions or inferences — visual output without analytical substance.
Data Overload
Charting everything instead of focusing on relevance. More data is not better analysis.
Intelligence ≠ Evidence
Overstating analytical confidence or treating intelligence products as court-ready evidence.
Static Analysis
Neglecting to review and re-evaluate charts and inferences as new data arrives.
Practical Next Steps
Take this workflow off the slide and into your casework — starting this week.
Find a Case
Identify one live or recent firearms case where a network chart or profile could add investigative value.
Agree a Product
Agree with local analysts which product to produce — e.g., a simple link chart plus a 2-page subject/network profile.
Build a Collection Plan
Draft a short, focused plan prioritising firearms data and communications — what, where, by when.
Feed Into Tasking
Present results at your next tasking meeting or FFP meeting to drive operational action.
Thank you
seesac@undp.org
(+381) 11 415 5300