2.1. Background on the use of information and data

International institutions have a well-documented history of utilizing information transparency strategies to shape informed security policies, thereby fostering peace and aiding state-building efforts. When used properly in certain contexts, transparency can mitigate tensions, resolve crises, and empower peacekeepers in achieving their objectives (Lindley, Reference Lindley2007). During cooperation and bargaining operations or missions, these institutions have employed information strategies, turning to a variety of mechanisms to both acquire and capitalize on state-level and global information. These mechanisms include but are not limited to exchanging insights at conferences, working groups, and summits, leading informational campaigns, and sharing intelligence among the conflicted sides.

Big data has revolutionized the approach to information usage in the sphere of international conflict resolution, aiding societies in comprehending and prepping for humanitarian crises and conflicts (Letouzé et al., Reference Letouzé, Meier and Vinck2013; Meier, Reference Meier2015). The vast array of information, including voice recordings, videos, and data from commercial satellites and sensor networks, allows international institutions and decision-makers working towards peace objectives to custom-fit decisions and responses (Letouzé et al., Reference Letouzé, Meier and Vinck2013; Pencheva et al., Reference Pencheva, Esteve and Mikhaylov2018; Wählisch, Reference Wählisch2020). Moreover, advancements in digital media technologies, artificial intelligence, and machine learning tools also have played a critical role in understanding conflicts, facilitating communication with affected populations, and the advancement of sustainable development goals (Hassani et al., Reference Hassani, Huang, MacFeely and Entezarian2021). Natural language processing, in particular, has proved to be a potent tool for conflict mediators and peacebuilders. It empowers them to engage in real-time, large-scale dialogues with the public, interact digitally in various languages, filter misinformation, and monitor political stability trajectories, thereby enabling early warning systems (Donnay, Reference Donnay2017; Hassani et al., Reference Hassani, Huang, MacFeely and Entezarian2021; Alavi et al., Reference Alavi, Wählisch, Irwin and Konya2022).

Data analytics represents a new frontier for peace and state-building operations, aiming to infuse data with the precision that aids in identifying relationships that perpetuate conflict and in implementing predictive measures for conflict prevention and peace resolution enhancement. These analytical tools, previously applied in fields like crime and conflict forecasting, intelligence activities, and fraud detection (Sparrow, Reference Sparrow1991; O’Brien, Reference O’Brien2010; Perry et al., Reference Perry2013; Baesens and Veronique Van Vlasselaer, Reference Baesens and Veronique Van Vlasselaer2015), can serve as accessible resources for international institutions, broadening their impact and efficacy in targeting criminal networks and achieving realistic results.

2.2. The need for analytical tools to understand conflict

When countries underpass violent conflicts, wars, and internal political and security turmoil, the peace processes and the reconstruction of governmental institutions are afflicted by the elites’ abuse of power in control of territories and of political power. Corruption, as a generalization of licit or illicit activities, has been extensively researched as a contributing factor to the deterioration of state institutions and political unrest (Le Billion, Reference Le Billion2005), with significant implications such as fueling conflict and violence (Shleifer and Vishny, Reference Shleifer and Vishny1993), undermining electoral systems, eroding the rule of law institutions and culture, and colluding with security and enforcement forces (UN, 2005; MacLachlan, Reference MacLachlan2017; WB, 2020). Such environments severely impact economic development; they create an uneven playing field that strengthens powerful elites, erodes trust in public institutions, and diminishes social cohesion. Because powerful elites operate unchecked and often serve as gatekeepers, tackling corruption networks in criminal environments often uncovers the root causes of conflicts and provides means to identify, target, and address these complex illicit dynamics, such as the collusion between powerful criminal actors and state institutions and individuals in opaque financial systems (Trejo and Nieto-Matiz, Reference Trejo and Nieto-Matiz2022).

However, it has often been claimed that international efforts fail to acknowledge the interests of entrenched political and powerful actors who benefit from a weakened state during or after conflict, and even donors who prioritize strengthening the criminal justice system may overlook the intricate social dynamics that underpin corruption (Gavigan, Reference Gavigan, Cockayne and Lupel2011; Heathershaw, Reference Heathershaw and de Guevara2012; Simon, Reference Simon2023). Contemporary critiques of peace and state-building operations have highlighted the lack of analytical tools available to understand the origins of conflict and political unrest, as well as the dynamics of criminal and illicit networks (Holt and Bouch, Reference Holt and Bouch2009; Cockayne and Lupel, Reference Cockayne, Lupel, Cockayne and Lupel2011), which can have ambiguous consequences for the sustainable transformation of political, economic, and post-war societies (Berdal and Davies, Reference Berdal, Davies, Berdal and Zaum2013).

Assessing and predicting conflict and political stability for peace prevention is a growing theme in international public policy and the global debate of conflict forecasting (O’Brien, Reference O’Brien2010; Gnanguenon, Reference Gnanguenon2021; Rød et al., Reference Rød, Gåsste and Hegre2023). The existing work claims that an analytical approach is crucial for predicting civil war occurrences and events that can exacerbate or mitigate political crises and the configuration of factors driving instability. It aims to identify patterns in the complex interactions among players, which is essential knowledge for achieving peacekeeping objectives (Lustick et al., Reference Lustick, Miodownik and Eidelson2004; O’Brien, Reference O’Brien2010; Ward et al., Reference Ward, Greenhill and Bakke2010; Donnay, Reference Donnay2017) and for the design of sustainable peace mandates (Wählisch, Reference Wählisch2020). While the analysis of social interactions has been integrated into various empirical methods and conflict modeling networks, including agent-based models, natural experiments, and diverse analytical instruments for explicating and predicting conflict (Collier and Hoeffler, Reference Collier and Hoeffler2004; Lustick et al., Reference Lustick, Miodownik and Eidelson2004), the application of network analysis focused on elite groups is yet to be utilized as a parameter in early warning systems for quantitatively predicting conflict. Such systems traditionally rely on predictive maps and rankings (O’Brien, Reference O’Brien2010; Rød et al., Reference Rød, Gåsste and Hegre2023). The need for frontier research to look at underlying power structures has also been highlighted, particularly in hybrid international missions (Gavigan, Reference Gavigan, Cockayne and Lupel2011; Hallock, Reference Hallock and Pozsgai-Alvarez2021; Zamudio-González, Reference Zamudio-González and Pozsgai-Alvarez2021), such as Guatemala’s CICIG. Hence, it is crucial to analyze the influence of international interventions on elites and powerful networks in conflict zones, providing findings and insights for the design and implementation of mission agreements.

2.3. Advancing peace and state-building with network analysis

Contemporary state-building international operations vary from country to country and from conflict type but often include judicial reforms, commitments to strengthening political structures, assistance in prosecution and law enforcement and anti-corruption strategies, seeking long-lasting stability and peace (Spector, Reference Spector2011; Cheng and Zaum, Reference Cheng, Zaum, Cheng and Zaum2012) and decrease of criminality in the host state (Holt and Bouch, Reference Holt and Bouch2009, Trejo and Nieto-Matiz, Reference Trejo and Nieto-Matiz2022). An international intervention aimed at dismantling illicit networks becomes warranted when years of conflict have eroded state institutions, resulting in resource scarcity, tax collection deficiencies, deep-seated involvement of organized crime syndicates in governance, and participation of violent gangs, groups, or cartels in illicit activities. These factors collectively undermine public confidence in government, and compromise the authority and legitimacy of the state (Brands, Reference Brands2010; Spector, Reference Spector2011; Zamudio-González, Reference Zamudio-González and Pozsgai-Alvarez2021; Trejo and Nieto-Matiz, Reference Trejo and Nieto-Matiz2022). To address these sophisticated operations, network analysis can be used to evaluate potential outcomes based on the anticipated transformation and crisis management of the environment from one riddled with crime and violence to a more secure and non-criminal landscape (Masys, Reference Masys and Masys2014).

The use of data analyzed with computing seeks to add precision and breadth to the possibilities of definition, measurement, and quantitative control from the understanding of the systemic phenomenon in social problems, crime, and corruption (Framis, Reference Framis and Morselli2014; Barabási, Reference Barabási2016; Luna-Pla and Nicolás-Carlock, Reference Luna-Pla and Nicolás-Carlock2020). Several studies have used this approach to detect and understand terrorist networks according to each network structure and function (Morselli et al., Reference Morselli, Giguère and Petit2007; Leuprecht and Hall, Reference Leuprecht, Hall and Masys2014; Campedelli et al., Reference Campedelli, Cruickshank and Carley2019). When used in criminology and intelligence (Strang, Reference Strang and Masys2014; Cunningham et al., Reference Cunningham, Everton and Murphy2016; Tayebi and Glässer, Reference Tayebi and Glässer2016; Burcher and Whelan, Reference Burcher and Whelan2018), this approach illustrates links and graph criminal relationships between people, which contributes to formulating research hypotheses and policing effectively (Sparrow, Reference Sparrow1991; Carrington, Reference Carrington, Scott and Carrington2016; Tayebi and Glässer, Reference Tayebi and Glässer2016; Burcher and Whelan, Reference Burcher and Whelan2018). The approach offers detailed insights into the intricate workings of criminal and corrupt activities while also addressing critical criminological questions, such as linking activity to individuals when the relevant information is available (Felson et al., Reference Felson2006). Recently, this methodology has effectively unveiled interconnections among criminal acts within a community of offenders. Establishing links between crimes like corruption, drug-related offenses, and street-level criminality, substantiates the frequent association of corruption with other criminal activities (Heiler et al., Reference Heiler, Pham, Korbel, Wachs and Thurner2023; Bright et al., Reference Bright, Lerner, Putra Sadewo and Whelan2024).

The quantitative analysis of networks in cases of past or ongoing conflicts has the potential to generate metrics to identify and measure the structure, levels of the organization, dynamics of the network, roles within it, concentration, self-organization, and links of what is being analyzed (Barabási, Reference Barabási2016; Marin and Wellman, Reference Marin, Wellman, Scott and Carrington2016). However, the formulation of metrics, understanding of power distribution dynamics, and devising progress indicators within international collaborative endeavors must align with the values and principles outlined in intervention agreements. Strategic and operational guidance remains crucial in this pursuit (Gavigan, Reference Gavigan, Cockayne and Lupel2011; Heathershaw, Reference Heathershaw and de Guevara2012).

3.1. Fundamentals of network analysis in addressing social issues

Network analysis is essentially a structured method that employs principles from statistical physics and computer science to model and interpret diverse relationships within various datasets. These quantitative tools serve to describe, quantify, predict, model, map, and reproduce specific environments, sometimes reflecting real-life relationships and activities. Initially utilized to explore natural and physical phenomena, this approach has recently expanded its scope to encompass social issues and humanities, driven by advancements in computing sciences, knowledge sharing, and cross-disciplinary problem-solving (Ball, Reference Ball2003; Caldarelli et al., Reference Caldarelli, Wolf and Moreno2018; Gershenson et al., Reference Gershenson, Siegenfeld and Bar-Yam2020).

Phenomena like violent conflict, corruption, and crime often stem from socio-political and economic systems that can be conceptualized as networks comprising individuals, institutions, organizations, and activities, as demonstrated in network analysis (Morselli et al., Reference Morselli, Giguère and Petit2007; DellaPosta, Reference DellaPosta2017; Ribeiro et al., Reference Ribeiro, Alves, Martins, Lenzi and Perc2018). Understanding the interrelations within these environments is complex due to their temporal evolution and the inability to explain behavior solely by isolated components (Ball, Reference Ball2003; De Domenico et al., Reference De Domenico, Brockmann, Camargo, Gershenson, Goldsmith, Jeschonnek, Kay, Nichele, Nicolás, Schmickl, Stella, Brandoff, Martínez Salinas and Sayama2019). Network analysis serves as a key tool to comprehend such behavior, representing players as nodes and their relationships as edges. For instance, in a social network, an edge might signify a friendship, a familial tie, or another form of social interaction (Scott, Reference Scott2017). Nodes can also represent diverse relationships within a bipartite network, such as an individual connected to a business organization as a stakeholder, and that business linked to a government institution through a contract (Wachs et al., Reference Wachs, Fazekas and Kertész2020; Nicolás-Carlock and Luna-Pla, Reference Nicolás-Carlock and Luna-Pla2023). These interconnections among nodes can take various forms and quantities, from the formation or absence of triads to networks consolidating into a single large component, as exemplified in Figure 1.

Figure 1. Examples of configuration in a network.

Network analysis extends beyond merely linking nodes and creating graphical representations of interconnected actors, entities, or activities within conflict-laden environments. It harnesses a spectrum of tools to evaluate the network’s density, indicating the overall linkage among nodes, and its robustness against interventions and disruptions (Barabási, Reference Barabási2016), as it possesses the capability to reorganize itself (Duijn et al., Reference Duijn, Kashirin and Sloot2014; D’Orsogna and Perc, Reference D’Orsogna and Perc2015). The dynamics within networks, whether human or inanimate entities, and their nonlinear structural evolution under specific conditions render the system highly unpredictable, and challenging to control (Bar-Yam et al., Reference Bar-Yam, McKay and Christian1998).

Metrics examining the structure and dynamics of corruption and criminal networks have provided insights into various forms, including hierarchical or familial networks, organized crime, diverse illicit markets (Morselli et al., Reference Morselli, Giguère and Petit2007; Framis, Reference Framis and Morselli2014; DellaPosta, Reference DellaPosta2017), and even conspiracies and favoritism (Nicolás-Carlok and Luna-Pla, Reference Nicolás-Carlok and Luna-Pla2021; Falcón-Cortés et al., Reference Falcón-Cortés, Aldana and Larralde2022). The structure and dynamics of these networks evolve in response to changes and regulations within their environment, shaped by a multitude of factors and cohesive actors (Barabási, Reference Barabási2016; Carrington, Reference Carrington, Scott and Carrington2016; Campedelli et al., Reference Campedelli, Cruickshank and Carley2019; Luna-Pla and Nicolás-Carlock, Reference Luna-Pla and Nicolás-Carlock2020). The goal of network analysis is to grasp the properties of these systems, the collaborative behavior of interconnected components, and the implications of behavior on a macro scale. This understanding is crucial to prevent misinterpretation of the causes of phenomena (Bar-Yam et al., Reference Bar-Yam, McKay and Christian1998; Gershenson et al., Reference Gershenson, Siegenfeld and Bar-Yam2020), significantly impacting strategies developed to intervene in these networks, whether in a controlled laboratory setting or real-life intelligence operations.

In a network analytical model, signs of network destabilization may manifest as a decline in the network’s information flow rate, reduced operational efficiency, or a significant slowdown in decision-making processes (Duijn et al., Reference Duijn, Kashirin and Sloot2014). Similarly, disrupting a network involves identifying and eliminating specific nodes or edges that, upon removal, result in the least cohesive network, effectively sabotaging it or isolating certain nodes (Tayebi and Glässer, Reference Tayebi and Glässer2016). For example, findings from studies on criminal interventions suggest that imprisoning high-profile criminals and targeting specific nodes and edges can profoundly influence the network’s reorganization (D’Orsogna and Perc, Reference D’Orsogna and Perc2015; da Cunha and Gonçalves, Reference da Cunha and Gonçalves2018), potentially bolstering illicit activities and escalating violence when disrupting clusters (Contreras Velasco, Reference Contreras Velasco2023).

It’s important to note that networks often display substantial resilience against targeted disruption strategies, sometimes transforming into even more robust and resilient configurations following perturbations (Framis, Reference Framis and Morselli2014; D’Orsogna and Perc, Reference D’Orsogna and Perc2015). Consequently, evidence indicates that interventions are more likely to succeed when executed during the initial stages of network growth before it has had the chance to organize or reorganize for maximum resilience (Duijn et al., Reference Duijn, Kashirin and Sloot2014).

Over an extended period, criminologists have utilized analytics to study network behavior, guiding decision-making, targeting specific nodes, predicting future occurrences, and aiding in prevention—particularly advantageous in law enforcement (Sparrow, Reference Sparrow1991; Carrington, Reference Carrington, Scott and Carrington2016). Previous analyses have revealed that network intervention extends beyond punitive actions, encompassing the disassembly or disruption of the network while simultaneously addressing underlying economic root causes, preventing recurrence, and altering the environmental conditions contributing to its formation. This process might involve rehabilitating individual behavioral patterns or building capacities and economic conditions to counteract systemic illicit practices (D’Orsogna and Perc, Reference D’Orsogna and Perc2015; da Cunha and Gonçalves, Reference da Cunha and Gonçalves2018; Prieto-Curiel et al., Reference Prieto-Curiel, Campedelli and Hope2023). Furthermore, a deep understanding of complex financial and social motivations can facilitate severing ties between corrupt entities and the ultimate beneficiaries of such illicit agreements (Costa et al., Reference Costa, Baez-Camargo, Kassa and Lugolobi2021; Diepenmaat, Reference Diepenmaat, Granados and Nicolás-Carlok2021). Such insights could significantly enhance conflict forecasting and assessment endeavors.

3.2. Optimal data types for relational analysis

Finding data conducive to the development of network analysis in criminal and conflict contexts hinges on aligning goals, aims, or hypotheses. For instance, this quest could involve a forensic investigation targeting specific individuals, deciphering relationships between distinct groups, or uncovering connections linking criminal activities and governmental bodies. Whether aiming to understand historical events or current undertakings, the data essential for analysis seldom resides within a single accessible source, encompassing all necessary elements for drawing conclusions.

As a result, crafting datasets typically involves amalgamating information from diverse sources to create comprehensive sets for descriptive and predictive network analysis (Baesens and Veronique Van Vlasselaer, Reference Baesens and Veronique Van Vlasselaer2015). This process contends with the unstructured nature of the data, which refers to vast amounts of information lacking predefined patterns, thereby posing challenges in search and analysis. Unstructured data stems from various sources and file formats, including social media, documents, communication transcripts, and technical reports. The task of constructing datasets from unstructured data poses several hurdles, primarily the need for specialized tools to standardize and organize it.

Amidst the realm of unstructured data, significant insights can be derived from publicly available sources like news stories, technical reports from institutions or non-profit organizations (O’Brien, Reference O’Brien2010), and investigative journalism revealing corruption scandals (Ribeiro et al., Reference Ribeiro, Alves, Martins, Lenzi and Perc2018; Luna-Pla and Nicolás-Carlock, Reference Luna-Pla and Nicolás-Carlock2020). Additionally, governmental sources like judicial case files, evidence, and open data platforms offer pertinent information, including historical crime records from security and police authorities (Perry et al., Reference Perry2013), unveiling the complexities within elite networks linked to illicit activity.

Economic data is also crucial to understanding incentives and reorganizing dynamics within networks in a larger financial context. Tracking individuals’ economic wealth and using transactional data (when available) becomes immensely valuable. This includes information related to consumer practices, such as the illicit enrichment of elites. Such data allows for clustering and weighting relationships within the network, enabling analysis of variables like recency, frequency, and monetary amounts. It plays a vital role in identifying and gathering evidence for cases involving money laundering, fraud, and embezzlement, all of which contribute to conflicts, violence, and organized crime through systemic corruption (Baesens and Veronique Van Vlasselaer, Reference Baesens and Veronique Van Vlasselaer2015).

Economic data is closely linked to contractual information, which encompasses contracts, bank account records, memberships or subscriptions, and business bylaws (some of which are publicly available depending on the jurisdiction). This data forms the basis for identifying various variables, including relationships between buyers and suppliers, instances of illicit enrichment and embezzlement, connections between governments and networks engaged in illicit activities or power control, individuals occupying multiple roles within these networks, instances of tax avoidance, and company misuse (Baesens and Veronique Van Vlasselaer, Reference Baesens and Veronique Van Vlasselaer2015; Luna-Pla and Nicolás-Carlock, Reference Luna-Pla and Nicolás-Carlock2020; Wachs et al., Reference Wachs, Fazekas and Kertész2020).

Another category of data, frequently utilized in intelligence strategies and discoverable through investigative efforts, pertains to communications found in social networks, phone records, and emails. When these communications are part of private registries, they remain confidential to the public, accessible only by law enforcement authorities during investigation processes. However, they might also surface in disclosed records, such as trials or through information requests to governments. While economic and communication information is typically confidential to journalists or nongovernmental organizations, ethical investigations conducted by government authorities can uncover crucial links between individuals, their roles, and their influence on decision-making processes within various operations.

3.3. Limitations in analytical approaches for powerful networks

Learning from criminal network studies, it is possible to identify certain considerations that can bias network analysis results and pose substantial challenges for both scientists and technicians, whether they’re implementing these methods within or outside governmental spheres. For anyone researching powerful networks and performing network analysis for practical purposes presents a challenge owing to the inherent unpredictability of situations and behaviors. Consequently, even the most advanced models encounter difficulty in forecasting changes in levels of political violence and the emergence of new security outbreaks in regions historically known for peace (Tayebi and Glässer, Reference Tayebi and Glässer2016; Rød et al., Reference Rød, Gåsste and Hegre2023).

From a network perspective, research has to take into account that illicit activities mutate over time as players adapt and learn from mistakes (Sparrow, Reference Sparrow1991; Grabosky and Duffield, Reference Grabosky and Duffield2001; Simonofski et al., Reference Simonofski, Tombal, De Terwangne, Willem, Frenay and Janssen2022), networks’ composition and dynamics evolve, individuals and agencies exhibit volatility or camouflage, and self-organization and emergent behavior within the network make it a complex phenomenon. Moreover, in conflict-ridden and criminally violent contexts, networks arise from the interconnectedness of illicit events, activities, individuals, and groups, which gradually develop patterns over time (von Lampe et al., Reference von Lampe and van Duyne2006; McGloin and Kirk, Reference McGloin, Kirk, Piquero and Weisburd2010), and because of the links with public or private organizations to conceal their activities, maintain control over the territory, and protect their core members (Gambetta, Reference Gambetta1993; Morselli et al., Reference Morselli, Giguère and Petit2007).

In addition, it is worth recognizing that information related to criminal activities is often obscured by the involved actors (Zamudio-González, Reference Zamudio-González and Pozsgai-Alvarez2021). Information in judicial cases can be incomplete or may leave loose ends (Sparrow, Reference Sparrow1991; Jones et al., Reference Jones, Dittmann, Wu and Reese2020), and it is biased by the investigative focus (Jones et al., Reference Jones, Dittmann, Wu and Reese2020). The accuracy of information is also affected by limitations such as the inability to include complete results from interrogations, informants, wiretapping, and financial investigations. Due diligence issues can arise in fraud detection procedures (Baesens and Veronique Van Vlasselaer, Reference Baesens and Veronique Van Vlasselaer2015; Pencheva et al., Reference Pencheva, Esteve and Mikhaylov2018; Tombal and Simonofski, Reference Tombal and Simonofski2021), as well as in investigations conducted by criminal prosecutors, that can distort the real facts. Moreover, corruption activities are often underrepresented in data due to logical and procedural challenges, as in most countries, corruption is harder to prove than a criminal offense. Likewise, security and conflict-related information often remain classified and challenging for non-governmental entities to access in numerous countries (Gnanguenon, Reference Gnanguenon2021). Additionally, certain actions go undocumented when they are arbitrary and lack accountability.

Conflict-affected governments are typically weak, plagued by high levels of corruption within the judiciary and police forces, and have constrained budgets, limited credibility among citizens, and unclear mandates. These contextual factors contribute to a lack of reliable data and accurate information for peacebuilding institutions engaged in analytics (Letouzé et al., Reference Letouzé, Meier and Vinck2013). Furthermore, the available information often overlaps or contradicts itself, and there are political barriers to information transparency (Lindley, Reference Lindley2007). Government agencies in conflict-affected states may also produce disconnected and mismatched information, further complicating the analysis process (Lindley, Reference Lindley2007).

As an empirical study, understanding criminal network behavior commonly suffers from selection bias, lacking data on undetected or unresolved criminal cases, thereby failing to capture the complete spectrum of network dynamics or covert operations (Morselli et al., Reference Morselli, Giguère and Petit2007; Heiler et al., Reference Heiler, Pham, Korbel, Wachs and Thurner2023). Indeed, the analysis’s breadth is constrained by available data, offering only partial glimpses or fragmented depictions that fail to encapsulate the entirety of the conflict landscape. Hence, employing these tools necessitates complementing them with traditional policy and contextual analysis methods, alongside invaluable insights from individuals possessing firsthand experience and on-ground knowledge of the situation.

In uncontrolled environments requiring intervention through peace and state-building policies, the verifiability of information becomes crucial. Analytical tools must effectively discern signals from the noise of information (Strang, Reference Strang and Masys2014), particularly as data often stems from informal sources, whistleblowers, informants, or witnesses. Nonetheless, it’s vital to contextualize these outcomes within each specific case, as their applicability might be constrained by contextual elements.

3.4. Ethics, misuse, and privacy concerns in network analysis

In conflict or post-conflict scenarios, ethical considerations and privacy concerns become critical when handling unstructured data related to social issues and political instability, especially for conflict prevention purposes. Curating data demands adherence to regulatory standards, ensuring compliance with transparency and information access regulations.

On the one hand, guaranteeing data quality involves verifying its availability, reliability, usability, and relevance for network analysis (Cai and Zhu, Reference Cai and Zhu2015). Neglecting this process can pose the risk of producing biased narratives, leading to inaccurate outcomes (Carrington, Reference Carrington, Scott and Carrington2016) and misguided decision-making misaligned with unverified data. On the other, the confidentiality of data is covered by country legislation on data protection and privacy, besides the human rights international law protection. This poses restrictions from the process of collection of data, to management and publishing, that apply to journalist groups, non-governmental organizations, and scholars who rely on publicly accessible information. Alternatively, researchers can use relational data obtained from public sources, such as career resumes, criminal records, and social media interactions, which can also reveal significant familial and friendship connections (Perry et al., Reference Perry2013; Scott, Reference Scott2017).

In some instances, anonymization might be essential when publicly disclosing data to protect individuals’ privacy or uphold confidentiality in legal matters. This ensures the implementation of privacy-by-design practices to secure data. Beyond privacy concerns, using criminal records and data requires a profound comprehension of individuals’ legal statuses. Upholding the presumption of innocence for individuals, whether they are undergoing a judicial trial or not, demands considering the circumstances outlined in the original information source to prevent violating rights to reputation and honor.

Maintaining ethical standards in data science tools is crucial, necessitating the mitigation of risks related to data publication and reuse (Cai and Zhu, Reference Cai and Zhu2015; Hosseini et al., Reference Hosseini, Wieczorek and Gordijn2022). For instance, when governments or powerful entities utilize analytical tools and AI, there’s a risk of leveraging their authority to control data repositories. This can lead to witch hunts, prosecution of individuals or judges, or exertion of impunity and political control. Conversely, in ideal governmental practices, intelligence and law enforcement thoroughly investigate network activities with available data, as demonstrated in studies on criminal gangs (Morselli et al., Reference Morselli, Giguère and Petit2007; Papacristos and Smith, Reference Papacristos, Smith and Morselli2014; DellaPosta, Reference DellaPosta2017). However, these analytical tools could be misused by illicit networks or conflicting groups, underscoring the necessity for datasets designed with a “do no harm” principle. Providing data context and specifying the intended usage goals becomes imperative in preventing potential misuse (Letouzé et al., Reference Letouzé, Meier and Vinck2013; Pencheva et al., Reference Pencheva, Esteve and Mikhaylov2018; Wählisch, Reference Wählisch2020; Simonofski et al., Reference Simonofski, Tombal, De Terwangne, Willem, Frenay and Janssen2022).

4.1. CICIG’s mandate and efforts targeting illicit elites

In 2003, the State of Guatemala sought assistance from the United Nations, leading to the establishment of the International Commission against Impunity (CICIG) through an Agreement between the United Nations and the State of Guatemala. This agreement was subsequently approved by Guatemala’s Congress of the Republic, and the CICIG commenced its operations in 2007 (UN, 2006). At that time, organized crime and cartels had gained effective control over six out of the country’s twenty-two states and wielded significant power in three others. Violence was rampant, with murder rates escalating by over 120 percent from 1999 to 2006, marking the highest murder rate in the region spanning from Mexico to Colombia (Brands, Reference Brands2010, Cruz, Reference Cruz2022). These factors were compounded by insufficient tax revenue, escalating levels of extreme poverty, and growing inequality among the population.

In Guatemala, the peace agreements of 1996 recognized the imperative of rebuilding institutions and ensuring citizen participation. Consequently, the CICIG agreement aimed to strengthen and support the institutions of the Guatemalan state responsible for investigating and prosecuting crimes allegedly committed in connection with the activities of illegal security forces and clandestine security organizations. The CICIG’s objectives encompassed identifying the structures, activities, operational methods, and sources of financing of these organizations. It also aimed to facilitate their dismantling and prosecute individuals involved in their activities (UN, 2006).

CICIG had certain powers to carry out its mandate, which included requesting statements, documents, and cooperation from any government official or entity; to investigate any person, official, or private entity, and presenting criminal charges to Guatemala’s Public Prosecutor and joining criminal proceedings as a private prosecutor; to report to the relevant administrative authorities the names of civil servants who committed administrative offenses and to participate as a third party in resulting disciplinary proceedings; and finally, recommend public policies and legal and institutional reforms to congress (UN, 2006). Among several other instruments to strengthen CICIG, the government created a special police unit from the National Civilian Police to support the investigations of the Public Prosecutor and created legal obligations for inter-institutional collaboration among financial and oversight agencies by providing information and evidence. In addition, the government of Guatemala committed itself to undertake adequate measures to ensure the protection and security of CICIG officials, the victims, witnesses, and any other person who cooperated with CICIG (UN, 2006).

From the beginning, CICIG was not intended to be a truth commission or the sort to investigate the perpetrators of human rights violations committed during the years of conflict. Its modern mandate was carefully tailored to address the current infiltration of government institutions by clandestine criminal organizations and the operation of illegal security forces (Hudson and Taylor, Reference Hudson and Taylor2010). Drawing upon criminal insights, CICIG identified the CIACS (later called RPAI) as the root cause of impunity and created a criminal strategy to uncover the networks. It focused on the heads of the criminal gangs and the high-ranked public servants and military forces involved, finding illicit electoral financial structures, administrative corruption, customs fraud, smuggling, narcotraffic, money laundering, and judicial corruption. Within its dismantling approach, CICIG also targeted politicians and businessmen who created shell companies to massively divert public funds through procurement contracts and to hide public money (CICIG, 2019). However, its intelligence capabilities were constrained, and analytical tools, such as network analysis, were underutilized.

4.2. Guatemala’s illicit networks: gaining insights with network analysis

This case study offers an opportunity for conducting a historic network analysis due to the abundance of judicialized cases during the tenure of the CICIG. These cases provided detailed information about the individuals’ modus operandi and interrelations. A pivotal factor contributing to the substantial judicialization of criminal offenses was the work of the independent prosecutor of the CICIG, which facilitated evidence collection, categorization of criminal activities, and the pursuit of victim reparation in courts (Zamudio-González, Reference Zamudio-González and Pozsgai-Alvarez2021). In terms of network analysis, the CICIG provided relational data and activity reports from these cases. Physical evidence in corruption cases was obtained through contracts, negotiable instruments, bank transfer reports, and communications acquired through judicial orders, among other sources, to unveil falsifications or simulations of operations (CICIG, 2019).

Waxenecker’s (Reference Waxenecker2019) comprehensive network analysis, augmented by contextual insights, entailed building a dataset that interlinked individuals, businesses, and institutions. This dataset depicted a complex network of social connections and legal proceedings leading to convictions spanning from 2011 to 2015. This network was built upon eight key cases: 1) The Line; 2) Impunity Law Firm; 3) Former Deputy Gudy Rivera; 4) The Coperacha; 5) Co-option of the State; 6) TCQ; 7) Land Information Registry: a payment box; and 8) Case of Subordination of the Legislative Power to the Executive (Waxenecker, Reference Waxenecker2019). The dataset included over 300 individuals, government agencies, public officials, and business associations related to each case.

The primary finding of the network analysis modeling revealed that individuals and institutions involved in the eight cases formed a cohesive and interconnected large component within a bipartite network. The aim was to identify connections and weights within the network, highlighting individuals with high levels of connectivity to others. This network model represents the relational dynamics of power particularly during the electoral campaign and the exercise of government power by the “Patriotic Party”. The analysis of criminal investigations within this network identified key central nodes referred to as “core powers”, including former President Otto Pérez Molina, former Vice President Roxana Baldetti, and former Secretary of the President Juan Carlos Monzón. The network analysis utilized degree and intermediation indicators to explain the concentration of power. Notably, the ministers of government, defense, communications, energy, mines, and the Social Security Institute played pivotal roles in the connectivity of network components, particularly in the Coperacha case, which involved exchanges of gifts between public servants and the President (Waxenecker, Reference Waxenecker2019).

According to the case contextual investigation, the central powers (former president, ministers, individuals involved in criminal activities, and military personnel) acted through the political party “Partido Patriota” to appoint high-ranking public officials. This allowed for the diversion of public funds to enrich an elite group and establish enduring effective clusters that maintained control over procurement markets, regardless of changes in political leadership (CICIG, 2019; Waxenecker, Reference Waxenecker2019).

The second significant discovery pertains to the distribution of illicit activities within the network. By observing individuals and their actions, the analysis revealed that criminal gangs and covert military units were utilized to expand the network’s scope. These entities engaged in extrajudicial executions, human trafficking, drug trade, illicit trafficking of goods and people, and extortion (CICIG, 2019). Further research indicates that the network exploited judicial channels by leveraging judges to grant immunity to its members, while judicial candidates secured positions through favoritism, privilege, and undue influence (CICIG, 2019, Escobar, Reference Escobar and Rotberg2019; Waxenecker, Reference Waxenecker2019).

Thirdly, the analysis exposed an extensive web of businesses contracted by the government and the central power. These enterprises acted as intermediaries in specific sectors like construction, security, and port control. Key figures within these businesses were implicated in crimes such as fraud, bribery, illegal wealth accumulation, and the perpetuation of undue influence. Their economic and political clout, coupled with their close ties to the central power, allowed them to exploit mechanisms for illicit enrichment and operate with impunity (Waxenecker, Reference Waxenecker2019).

Finally, the analysis illuminated the pivotal roles and influence of military actors throughout the network’s operations. Both inside and outside formal institutional frameworks, these individuals wield substantial power within the network’s vertical and compartmentalized structure. They maintained interconnectedness with a political system heavily influenced and infiltrated by criminal and drug trafficking networks. The network exhibited a central position in political-strategic coordination and demonstrated cohesive operations within an organized framework (Waxenecker, Reference Waxenecker2019).

While Waxenecker’s network analysis is confined to national networks due to the cases data used, it’s crucial to note that Guatemala’s criminal networks primarily operated transnationally, exhibiting intricate structures across diversified illicit markets. These networks maintained connections with international drug trafficking organizations like the Zetas and Sinaloa Mexican Cartels, engaging in a spectrum of illicit activities. With substantial financial resources, they directly funded political parties, presidential campaigns, and congressional endeavors (Brands, Reference Brands2010; Gavigan, Reference Gavigan, Cockayne and Lupel2011; Waxenecker, Reference Waxenecker2019). Another influential group known as the ’poderes ocultos’ or hidden powers comprised individuals leveraging their positions and connections across public and private sectors (Mattiache and Pappier, Reference Mattiache and Pappier2022). Moreover, street gangs like the Maras, extending their reach into other Central American countries, were involved in extortion, robbery, small-scale drug trafficking, homicides, and abductions (Brands, Reference Brands2010; Cruz, Reference Cruz2022).

4.3. Discussing CICIG’s impact in dismantling illicit networks

In 2019, Guatemala’s decision not to renew the United Nations agreement marked the conclusion of CICIG, terminating its operations shortly after launching an investigation into economic crimes implicating President Jimmy Morales’ family, alongside military officials and politicians tied to past war crimes (WOLA, 2022). Subsequently, influential figures linked to existing illicit networks exposed by CICIG assumed control of the government and the Attorney General’s office. Their actions targeted journalists, civil society leaders, judges, and public servants involved in prosecuting individuals within these networks. This upheaval forced judges and former prosecutors to flee, while others faced unjust imprisonment on fabricated charges (IACHR, 2021; Mattiache and Pappier, Reference Mattiache and Pappier2022; WOLA, 2022). Paradoxically, key figures from these networks were absolved of charges.

The anti-corruption accords in Guatemala represented a pivotal moment in the nation’s history of international agreements. Nevertheless, CICIG’s approach, while occasionally effective in judicial proceedings (Call and Hallock, Reference Call and Hallock2020), primarily relied on criminal prosecutions and legal reforms to dismantle illicit networks. This strategy exposed the power structures within Guatemala, shedding light on the dynamics between the military, public sectors, courts, congress, political parties, and organized crime (Beltrán, Reference Beltrán, Rosen and Kassab2020; Call, Reference Call and Pozsgai-Alvarez2021). Collaborating with the attorney general’s office, CICIG achieved an impressive 85 percent efficiency in charging and convicting over 400 individuals and entities (CICIG, 2019; WOLA, 2022).

However, while this punitive strategy might have weakened the networks’ economic and political influence for some time, the lack of robust analytical tools made it challenging to gauge its long-term impact and the imbalances generated within these intricately interconnected networks. Attempting to prosecute the numerous defendants from the networks overwhelmed the judicial system and penitentiary institutions, leading to case dismissals and burdening judges (Zamora Palma, Reference Zamora Palma2023). Consequently, crucial aspects like enhancing judicial independence, building institutional capacities, enforcing economic sanctions, and recovering illicit assets might have been sidelined. Moreover, the abrupt termination of the agreement and the expulsion of trained officers hindered the transfer of critical knowledge, as CICIG was designed for state-building rather than permanent intervention (Simon, Reference Simon2023).

The initial UN-Guatemala agreement establishing CICIG recommended preventive measures against the resurgence of illicit networks. Employing network analysis could have been instrumental in pinpointing specific syndicates and tailoring measures based on individual roles and influences within these networks. This involved leveraging insights from network analysis to explore alternative strategies, like encapsulating groups rather than relying solely on a kingpin strategy (Contreras Velasco, Reference Contreras Velasco2023), identifying ways to weaken the network’s workforce (Prieto-Curiel et al., Reference Prieto-Curiel, Campedelli and Hope2023), and supplementing punitive measures with social and formal economic reintegration of individuals (da Cunha and Gonçalves, Reference da Cunha and Gonçalves2018). Furthermore, proactive strategies could have been developed to shift CICIG’s functions to other institutions after its mandate expired, promoting accountability and enhancing analytical capabilities within Guatemala’s anti-corruption alliances. This approach could have anticipated conflicts and effectively disrupted the structure and activities of corrupt networks, thereby controlling the impact of their potential resurgence.

Ultimately, the lessons learned from this case underscore the potential value of employing network analytics in international missions combating illicit networks and implementing state-building strategies, both pre- and post-intervention.