M7E1: Graphs and Networks: The Hidden Skeleton of Modern Intelligence
Module 7, Episode 1: Graphs and Networks — The Hidden Skeleton of Modern Intelligence
The Questions That Don't Fit in a Spreadsheet
Every intelligence problem that has ever mattered has been a network problem in disguise.
Who is funding this organization? That is a question about edges and flows, not about properties of a single node. Where does the decision authority sit in this regime? That is a question about hierarchy and bridging ties, not about job titles on an org chart. Is this disinformation campaign organic, or is it coordinated? That is a question about structural signatures in a social graph — patterns of timing, amplification, and shared infrastructure — that look like noise in any other representation. Which node in this financial network, if removed, would most disrupt the laundering operation? That is a betweenness problem. Which entity in this corporate web is the real beneficial owner? That is a graph traversal problem.
Most analysts, even sophisticated ones, still approach these questions as if they were document-retrieval problems. They gather text, they read it, they look for named actors and notable facts, and they arrange their findings in a linear report. This works surprisingly well when the answer is contained within a single document or a small set of them. It fails systematically when the answer only becomes visible across the full topology of a network — when truth is structural rather than declarative.
This episode is about building the mental model that lets you see networks where others see noise. It covers the basic vocabulary of graph analysis, the use cases where that vocabulary has the most purchase in intelligence work, the mechanics of the key analytical moves — centrality, betweenness, community detection — and where AI is now changing what's tractable. It also covers, with full honesty, what graphs cannot tell you, because the analysts who cause the most damage are usually those who believe the map is the territory.
Actors, Relationships, Flows: The Basic Grammar
A graph, in the mathematical sense, is simply a set of nodes connected by edges. The nodes represent entities — people, companies, accounts, servers, documents, countries, anything you can define as a discrete actor or object. The edges represent relationships between them — transactions, communications, ownership stakes, shared attributes, physical co-presence, anything that meaningfully links two nodes. That is the entire apparatus. Everything else in network analysis is elaboration on this basic grammar.
The elaborations matter enormously in practice. Edges can be directed or undirected: a wire transfer goes from one account to another (directed), while a shared telephone tower records symmetric proximity (undirected). Edges can carry weights — a $10 million transfer differs from a $50 transfer in ways that matter for an investigation, and the graph can represent that difference. Nodes can carry attributes: an individual's nationality, a company's jurisdiction of incorporation, an account's age and transaction history. The graph is not just a picture of connections; it is a substrate for analysis that preserves relational structure while allowing every attribute to participate in the reasoning.
For intelligence analysts, three fundamental things flow across graphs: money, information, and authority. Financial networks capture the movement of funds — transactions, equity stakes, loan relationships, guarantees, the whole apparatus by which resources transfer between legal and natural persons. Information networks capture the spread of content and signals — who communicates with whom, which accounts amplify which narratives, which email accounts appear together in communication metadata. Authority networks capture control relationships — who directs whom, which entity nominally owns another, which person holds decision-making power regardless of formal title.
These three network types frequently need to be overlaid. The beneficial owner of a sanctions-target entity may hold no formal position in the company — no directorship, no listed shareholding above a reporting threshold. The relationship only becomes visible when you cross-reference financial flows with communication patterns and corporate registry records simultaneously. The legal entity is a node in the corporate graph. The actual controller is a node in the social graph. The money is an edge in the transaction graph. The answer is the relationship between all three.
This is why graph thinking is a cognitive posture, not a technique — a way of framing intelligence problems that treats relationships as primary data rather than as annotation. The analyst who habitually thinks in graphs asks different questions from the start: not "what do we know about Entity A?" but "what does Entity A's neighborhood look like, and what does that neighborhood tell us that the node's own attributes cannot?"
Where Graphs Cut Through the Problem
Four problem domains illustrate how graph thinking reveals what linear analysis consistently misses. They span different intelligence disciplines, which is deliberate — the argument here is about a general analytical orientation applicable across the full range of intelligence problems.
Disinformation and information operations. The exposure of Russia's Internet Research Agency (IRA) operations targeting the 2016 U.S. election established a template for how network analysis contributes to influence operation attribution. A report by Oxford University's Computational Propaganda Project and Graphika (a network analysis firm) offered new details of how Russians working at the IRA sliced Americans into key interest groups for targeted messaging. What made that analysis distinctive was not the content of the IRA's posts, which had been described extensively. It was the structural signatures: Russian operatives created fake accounts and groups posing as ordinary citizens to spread falsified stories on politically divisive topics, the IRA employed thousands of people to post inflammatory content, and bot networks of automated accounts amplified hashtags and created the illusion of widespread support for fringe narratives. The network structure — who amplified whom, at what velocity, with what timing relative to political events — was the evidence. Individual posts could be explained away. The graph pattern could not.
Several highly successful IRA Twitter accounts, like @TEN\_GOP, transformed from average users with a few hundred followers in late 2015 to microcelebrities commanding over one hundred thousand followers before their discovery in September 2017. That trajectory only becomes analytically visible when you track the graph dynamics over time: the follower-accumulation pattern, the coordinated amplification by clusters of accounts, the synchronized timing of narrative pivots. None of those signatures appear in a single snapshot. All of them become obvious when you examine the temporal network.
Financial crime and sanctions evasion. The architecture of financial crime is almost always a network architecture. Money launderers use predictable patterns designed to confuse automated systems — rapid high-volume transactions, circular money flows, structured deposits below reporting thresholds, and dynamic risk-scoring evasion tactics. Network analysis makes these patterns visible even when each individual transaction appears innocuous. Consider a launderer splitting $100,000 into 20 separate $5,000 deposits across different accounts to stay below a $10,000 reporting requirement. In a transaction list, these appear unrelated. In a network visualization, the pattern is immediate — multiple nodes sending similar amounts to a central node within a compressed timeframe.
The Office of Foreign Assets Control's (OFAC, the U.S. Treasury's sanctions enforcement arm) designation in March 2025 of Iranian exchange networks illustrates the same principle at a larger scale. The action against entities including Opal Exchange and Tahayyori Guarantee Society was explicitly a network action — it targeted not just the exchange houses themselves but the front companies providing them with access to the international financial system, hitting both the highly connected hub nodes and the lower-degree nodes feeding them. That hub-and-spoke topology characterizes sanctions evasion networks generally.
Beneficial ownership and corporate opacity. The Panama Papers investigation, built on 11.5 million leaked documents from the offshore law firm Mossack Fonseca, was the largest graph-analysis exercise in the history of investigative journalism. The International Consortium of Investigative Journalists (ICIJ) published a searchable database stripping away the secrecy of nearly 214,000 offshore entities created in 21 jurisdictions, from Nevada to Hong Kong and the British Virgin Islands. ICIJ published its first edition of the Offshore Leaks database in 2013 using graph databases to allow readers to explore connections between officers and more than 100,000 offshore entities, and it was with the Panama Papers that graph databases started playing a key role during the research and reporting. The technical insight was that the Panama Papers entities and their relationships could be used to construct a network permitting a systematic, scientific study at scale.
Researchers who subsequently applied formal centrality analysis to the ICIJ data found something counterintuitive: the intermediaries — the law firms and corporate service providers who registered the shells — were the structurally critical nodes, not the shells themselves. Removing Mossack Fonseca from the network disrupted thousands of connections simultaneously. That insight, derived from graph analysis, carries direct policy implications about where regulatory intervention has the most force.
Organizational intelligence and supply chain risk. Network methods apply to organizational analysis wherever the nominal structure diverges from the operational one — which is to say, almost always. In military and intelligence contexts, targeting decisions increasingly depend on network models of command-and-control: who substitutes for whom when a key node is removed, how information flows around a disrupted node, whether a network reconstructs itself around a different topology after interdiction. In commercial contexts, the same logic governs supply chain risk: a single Tier-2 supplier in a specialized semiconductor component can be the critical node whose removal cascades through the entire production network of a defense contractor or pharmaceutical manufacturer. The nodes and edges are different. The analytical moves are identical.
Centrality, Betweenness, Community Detection: What the Math Is Actually Asking
The three concepts that matter most for applied intelligence work are centrality, betweenness, and community detection. They answer three different questions: Who is important? Who is the bottleneck? Which subgroups exist?
Centrality is the broadest of these concepts, and its apparent simplicity conceals genuine analytical depth. The most intuitive form — degree centrality — simply counts connections. A node with many edges is more central than a node with few. In a financial network, high degree centrality identifies hubs that transact with many counterparties. In a social network, it identifies prolific connectors. Research confirms that more central nodes associate with riskier profiles across network types. But degree centrality is naive in one important way: it treats all connections as equal. Being connected to a powerful node is different from being connected to a peripheral one, and degree centrality cannot capture that distinction.
PageRank, the algorithm underpinning Google's original search engine, addresses this limitation by computing importance recursively: a node's centrality depends on the centrality of the nodes pointing to it. Unlike degree centrality, PageRank accounts for the quality of the connections pointing to you — being connected to a mastermind is more significant than being connected to a low-level mule. This is the correct analytical intuition for understanding power in financial and organizational networks: a shell company held by a sanctioned oligarch is more dangerous than a similarly structured company held by an ordinary private individual, because the importance of the connections propagates through the graph.
Betweenness centrality answers a different question: not how connected is a node, but how much traffic flows through it. Formally, it measures how often a given node lies on the shortest path between all other pairs of nodes in the network. It serves as a powerful indicator of actors who bridge otherwise disconnected parts of a network, offering unique control over the flow of information and resources across network boundaries. Unlike degree centrality, which emphasizes direct ties, betweenness centrality highlights those who can influence inter-group dynamics.
For intelligence work, betweenness is often the most operationally significant measure. Research by Calderoni (2014) examined the Italian 'Ndrangheta (the Calabrian organized crime network with extensive international reach), finding that individuals with high betweenness centrality played pivotal roles in connecting local criminal cells to broader, often international networks. These connectors were essential for coordinating illicit activities across regions and facilitating transactions that would otherwise remain confined to isolated groups. Targeting them gave law enforcement a strategic point to disrupt cross-regional collaboration.
In fraud networks, high-betweenness nodes often represent coordinators or chokepoints in money laundering pipelines. An Estonian coordinator in Operation Gold Rush — a major international money laundering case — had betweenness centrality in the 99th percentile. He was the bridge between Russian masterminds and U.S.-registered shell companies. The high-betweenness node is not necessarily the most powerful actor in the network, or the one with the most connections. It is the one whose removal would most disrupt communication and resource flow between otherwise separate clusters. That is a targeting criterion, not an academic measure.
There is a critical caveat. Sophisticated criminal networks are increasingly designed to minimize the centrality signature of key actors. Money launderers may organize specifically to avoid standing out in typical centrality measures, while still representing influential nodes due to their structural position. Researchers refer to such nodes as "anti-central" — they actively self-organize to evade detection. The adversary is aware of the analytical framework and designs the network to frustrate it. This arms race between analysis and evasion is one of the most consequential dynamics in the current financial crime and counterterrorism space.
Community detection identifies clusters — groups of nodes more densely connected to each other than to the rest of the network. The algorithms that accomplish this (Louvain, Girvan-Newman, Leiden, and others) vary in their mathematical approaches, but all aim to find the natural partitions in the graph — the subgraphs that behave as semi-autonomous units. In a criminal network, communities often correspond to distinct operational cells that share resources and coordination internally while limiting exposure across cell boundaries. In a disinformation campaign, communities correspond to the audience segments being targeted with tailored messaging. In a corporate graph, communities often reveal the real operational groupings that cut across nominal legal structures.
Network-based analyses can be conducted through centrality analysis (to determine the most important money laundering actions as priorities for prevention), resilience analysis (to simulate iterative interventions), and subgroup analysis (to identify groups of commonly undertaken schemes). This framework translates directly into intelligence practice: centrality tells you where to apply pressure, resilience analysis tells you how much disruption a given intervention will achieve before the network adapts, and subgroup analysis tells you which typologies dominate the threat environment.
The three measures are most powerful in combination. A node with high degree centrality and low betweenness centrality is a hub within a single community. A node with moderate degree centrality but high betweenness centrality is a broker between communities — likely the most operationally significant target for disruption. Together they describe network architecture that neither measure alone can reveal.
Where AI Is Changing the Tractability Problem
The analytical concepts described above are not new. Social network analysis has been a discipline since at least the 1930s, and the mathematical foundations of graph theory extend back centuries. Network methods have been underutilized in intelligence work not for theoretical reasons, but for practical ones. Building a graph requires knowing the nodes and the edges. For most intelligence problems, both are buried in unstructured text — cables, intercepts, corporate filings, news reports, financial disclosures, social media feeds. A human analyst who reads all of that text and manually enters relationships into a graph tool is doing something that does not scale.
This is where AI has changed the calculus, substantially, in the period between 2024 and 2026.
Entity extraction is the task of identifying named entities in unstructured text — people, organizations, locations, financial instruments, dates. Modern large language models (LLMs) perform this task at a quality that has reached practical deployment in intelligence and compliance contexts. The contribution is not that entity extraction is new; rule-based named entity recognition (NER) systems have existed for decades. The difference is that LLMs handle the ambiguity, linguistic variation, and domain-specific vocabulary that rule-based systems struggle with. "The senior partner," "Mr. K," and "Konstantin Volkov" may refer to the same individual across a document set. A well-configured LLM, given sufficient context, can resolve that coreference and produce a unified entity record.
The positioning of open-source intelligence (OSINT) in public governance and anti-corruption work has shifted from a supplementary lead source to a systemic capability for evidence-chain construction and risk warning. Multilateral and governmental agencies have integrated OSINT into their regular toolkits for asset recovery and financial investigations, including the World Bank's Stolen Asset Recovery Initiative, which emphasizes open-source asset profiling and money tracing alongside evidence from law enforcement investigations. The technical substrate enabling this shift is AI-assisted entity extraction and relationship mapping at scale.
Relation extraction — identifying the semantic relationship between two named entities — is harder than entity extraction, and this is where current LLMs show more variable performance. The sentence "Oleg Petrov serves as a nominee director of Meridian Holdings Ltd" contains an entity-relationship triple (Petrov → NOMINEE\_DIRECTOR → Meridian Holdings) that needs to be extracted and encoded as a graph edge. Getting consistent, structured output from LLMs on this task, across thousands of documents with varied phrasing and document formats, remains an active engineering challenge rather than a solved problem.
Only 4% of the Panama Papers files were structured — data organized in tables. The vast majority of intelligence-relevant information about corporate relationships exists in emails, PDFs, scanned documents, and informal correspondence that requires transformation before graph analysis can begin. That proportion is representative of the broader intelligence problem.
Current practitioner approaches combine several tools. Palantir AIP (Palantir's AI-integrated data fusion platform) applies LLMs to entity and relation extraction within its data environment, allowing analysts to define relationship schemas and extract structured graph data from heterogeneous document sets. TigerGraph (a graph analytics database platform) provides the graph database and analytics layer, with regulators explicitly calling for use of "advanced analytics" to identify "emerging money laundering typologies" — language that maps directly to graph neural network (GNN) based detection. For OSINT investigations, platforms like ShadowDragon (a commercial intelligence aggregation tool) automate data collection and correlation across public sources, surfacing relationship signals that would require thousands of analyst-hours to assemble manually.
The emerging frontier, as of 2026, is graph-augmented LLM agents: systems where a language model reasons over a dynamically constructed knowledge graph, using graph traversal to navigate relationships that cannot be held in a context window. The research framework FinDKG, described in a 2025 arXiv paper, explores using LLMs as dynamic knowledge graph generators — not just extraction tools but active maintainers of a graph that updates as new information arrives. An analyst who previously had to manually refresh a relationship map each time new information arrived could instead interact with a graph that updates itself and surfaces anomalies in real time.
GNNs have changed the field of machine learning by enabling the processing of data structured as graphs. Unlike traditional neural networks that operate on grid-like data, GNNs capture the complex relationships and interdependencies inherent in graph structures. For intelligence applications, the key property is that GNNs function by propagating information along the edges of a graph, allowing nodes to aggregate features from their neighbors — a message-passing mechanism that enables GNNs to learn representations encapsulating both local neighborhood structures and global graph properties. A node that is individually unremarkable may look very different once its neighbors' attributes propagate into its representation. This is the graph equivalent of guilt by association, implemented as a principled mathematical operation rather than a cognitive heuristic.
The Honest Inventory of What Graphs Cannot Tell You
Every analytical method has a characteristic failure mode. For network analysis, the failure mode is seductive: the graph looks complete, the centrality measures are precise, the community structure is clean — and none of it captures the thing that matters.
The first limit is collection bias. A graph of what was collected is not a graph of what exists. The Panama Papers captured the network of entities created through Mossack Fonseca. It said nothing about the entities created through the hundreds of other offshore service providers who were not in the leak. Ownership information is often buried in emails, power-of-attorney letters, and internal notes, and cannot easily be extracted in a systematic manner. Any centrality measure computed on an incomplete graph is a measure of importance within the observed network, which may differ arbitrarily from importance in the true network. Analysts who forget this produce targeting assessments that are precisely wrong.
The second limit: structure does not imply intent. High betweenness centrality identifies a broker. It does not tell you whether that broker knows what they are brokering, whether they are a willing participant or a dupe, or whether their role is criminal or commercially routine. A bank that processes large volumes of international wire transfers will have high betweenness centrality in a transaction network almost by definition. Centrality is a filter for attention, not a verdict. Treating a centrality score as a finding rather than a hypothesis is a category error.
Third, graphs capture structure at a point in time and obscure the dynamics that created the structure. Resilience analysis of money laundering networks shows that the power to disable multiple schemes through removing nodes is minimal. Even when iteratively removing actions according to closeness centrality, 70 actions — 8.7% of all actions — had to be removed before alternative access could be cut off. Money laundering is highly prone to crime displacement: the substitution of one criminal method for another following a preventative intervention. A network that looks fragile in a static snapshot may be extraordinarily resilient in practice because the actors have learned to route around disruption.
Fourth, the most critical activity may not be in the network at all. The most sensitive communications in a criminal or terrorist organization are often conducted through methods that leave no network trace — in-person meetings, hand-carried messages, verbal instructions. An analyst who maps the digital communication network of a target organization has a map of the organization's risk tolerance, not a map of its decision-making. The things that are in the graph are there precisely because the actors were not careful enough to keep them out.
The March 2025 U.S. decision to exempt domestic companies from beneficial ownership reporting requirements — a policy reversal that directly contradicts guidance from the Financial Action Task Force (FATF, the international standard-setter for anti-money laundering and counter-terrorism finance) — is a concrete illustration of how collection infrastructure for graph analysis can be deliberately degraded. When a government removes a data layer that feeds the graph, every analysis that depended on that layer becomes unreliable in ways that are invisible unless the analyst knows the collection gap exists. The graph looks the same. The ground truth has changed.
Finally, graph analysis addresses structure, not motivation. A network map can tell you that Entity A and Entity B are connected through six degrees of relationship. It cannot tell you whether that relationship is the product of conscious coordination, shared professional community, coincidence, or manufactured proximity. The causal question — why is the network structured as it is, and what does that structure predict about future behavior — requires intelligence tradecraft, domain expertise, and source development that graph analysis alone cannot substitute for.
Graph analysis is a powerful lens that reveals structural patterns invisible to other analytical approaches. Every lens also creates blindness in the areas it does not illuminate. Hold both facts simultaneously.
What You Are Now Equipped to Do
The vocabulary established in this episode is the entry point for the more technically demanding content that follows in this module. Centrality, betweenness, community detection — these are analytical questions with operational answers: Where is the leverage point? Who is the critical broker? What are the natural operational groupings? Those questions apply to disinformation networks, to sanctions evasion architectures, to organizational targeting, to supply chain intelligence, to any domain where answering "how does this work?" requires understanding relationships rather than attributes.
Network analysis provides context that helps distinguish between genuinely suspicious activity and complex but legitimate business operations. Investigators apply it throughout the anti-money laundering (AML) investigation lifecycle, from initial detection through case building for law enforcement referrals. That lifecycle description generalizes: graph methods are useful at the discovery phase, where they surface anomalies and candidates for investigation; at the analysis phase, where they map the structure of a network and identify key nodes; and at the presentation phase, where they make visible to decision-makers and jurors the patterns that would be opaque in tabular form.
The AI transition is not replacing graph analysis — it is making it tractable at scales and speeds that were previously unavailable. The bottleneck was always building the graph. Getting from unstructured text to a structured graph of entities and relationships was the hard part, the part that required armies of analysts doing manual data entry. LLMs and GNNs are attacking that bottleneck from both sides: LLMs extract the entities and relationships from text, and GNNs reason over the resulting graph to surface patterns too subtle for human inspection.
The analyst who enters this module knowing what a betweenness score means, why community structure matters, and where AI is genuinely helping versus where it is creating new gaps, will be equipped to use these tools without being fooled by them. The analyst who does not understand the underlying concepts will mistake the precision of graph metrics for accuracy, and will build confident, wrong assessments on the foundation of incomplete or biased graph structure.
Graphs make the invisible visible. The question that remains is always: what invisible things is the graph not showing you?
That question is what separates analysis from pattern-matching. The rest of this module is about the tools that pattern-match. Hold that question close while you use them.