Criminal collaboration and risk: The drivers of Al Qaeda's network structure before and after 9/11

•Al Qaeda (AQ) faced two different levels of law enforcement activity pre/post-9/11.•ERGMs are used to test whether this affected their patterns of collaboration.•Before 9/11, co-offenders were more likely to form dense, local triads.•Triad closure had no impact on co-offending after risks of detection increased.•AQ relied on lower-level leaders to bridge the network under more intense scrutiny.

A group's resilience is often linked to its network structure. While decentralized network properties have been associated with resilience at the group-level, little is known about the individual-level factors that lead groups to adopt these structures. Criminal groups, consistently faced with unexpected external disruptions, provide an opportunity to examine individual decisions to collaborate across periods of increased risk. Using data on 118 terrorist offenders across six attacks we test whether individual decisions to collaborate are influenced by variation in law enforcement activity. Results from exponential random graph models demonstrate that many of the processes that drive collaboration between offenders differ when faced with greater risk. Connectivity was maximized in periods of decreased enforcement activity, with offenders more likely to collaborate in dense, local triads. Following an increase in interdictions, triad closure had no impact on co-offending.