a wire-puller, who had acted as a financial manager of Al Qaeda. He had attempted to help terrorists enter the United States, and provided **the hijackers**
of the 4 aircrafts with financial support worth more than 300,000 dollars, according to Wikipedia (free encyclopedia on WWW). Furthermore, Usama bin Laden is suspected to be a wire-puller behind Mustafa A. Al-Hisawi and the conspirators behind the hijackers.

This paper presents a computational method to analyze the intelligence data set on the collective actions of the perpetrators of the terrorist **attack, and to** visualize it into the form of a social network diagram which predicts the positions where the wire-pullers conceals themselves. The intuitive interface **between the** intelligence data set and the investigator through the social network diagram is expected to stimulate the investigators' experience and knowledge, and to aid them in decision-making for an immediately effective action. Mathematically, the objective of the analysis is to solve a node discovery problem in a complex network. Two layers are assumed in this problem. The first layer describes the latent pattern of the communication among persons, which is the transmission of the influence on decision-making. It is modeled by a graph structure, where nodes are persons, and links indicate the presence of communication among the persons. The structure is assumed not to be observable directly. **The second** layer describes the observable pattern of collective actions of the **persons. It** appears as a result of the communication in the latent layer. Part, or all of this pattern is assumed to be observable. To solve the node discovery problem means to discover some clues on the covert nodes, which participate in the communication in the latent layer, but do not appear in the collective actions in the observable layer.

Related works are reviewed briefly in the section 2. A method to solve the node discovery problem is developed in the section 3. The section 4 demonstrates an example where the perpetrators and a wire-puller in the **9/11 terrorist**
attack are analyzed. The section 5 concludes this paper.

## 2 Related Works

Social network analysis [3] is a study of social structures, which are made of nodes (individuals, organizations etc.), which are linked by one or more specific types of relationship (transmission of influence, presence of trust etc.). Terrorist or criminal organizations have been studied empirically [20]. Factor analysis is applied to study email exchange in Enron, which ended in bankruptcy **due to the** institutionalized accounting fraud [11]. The criminal organizations tend to be strings of inter-linked small groups that lack a central leader, but **to coordinate**
their activities along logistic trails and through bonds of friends. Hypothesis can be built by paying attention to remarkable white spots and hard-to-fill positions in a network [12]. The conspirators in the 9/11 terrorist organization are relevant in reducing the distance between hijackers, and enhancing communication efficiently [13]. The 9/11 terrorists' social network is investigated from the viewpoint of efficiency and security trade-off [18]. More security-oriented