Skip to main content

Examining the importance of existing relationships for co-offending: a temporal network analysis in Bogotá, Colombia (2005–2018)


This study aims to improve our understanding of criminal accomplice selection by studying the evolution of co-offending networks—i.e., networks that connect those who commit crimes together. To this end, we tested four growth mechanisms (popularity, reinforcement, reciprocity, and triadic closure) on three components observed in a network connecting criminal investigations (\(M = 286\) K) with adult offenders (\(N = 274\) K) in Bogotá (Colombia) between 2005 and 2018. The first component had 4286 offenders (component ‘A’), the second 227 (‘B’), and the third component 211 (‘C’). The evolution of these components was examined using temporal information in tandem with discrete choice models and simulations to understand the mechanisms that could explain how these components grew. The results show that they evolved differently during the period of interest. Popularity yielded negative statistically significant coefficients for ‘A’, suggesting that having more connections reduced the odds of connecting with incoming offenders in this network. Reciprocity and reinforcement yielded mixed results as we observed negative statistically significant coefficients in ‘C’ and positive statistically significant coefficients in ‘A’. Moreover, triadic closure produced positive, statistically significant coefficients in all the networks. The results suggest that a combination of growth mechanisms might explain how co-offending networks grow, highlighting the importance of considering offenders’ network-related characteristics when studying accomplice selection. Besides adding evidence about triadic closure as a universal property of social networks, this result indicates that further analyses are needed to understand better how accomplices shape criminal careers.


Crimes can be committed either by individuals or by groups of people acting together. While there are some contexts in which the involvement of multiple offenders is incidental—it plays no material role in the commission of the crime—there are others where it is a crucial ingredient: a crime could not, or would not, take place without it Tremblay (1993). The study of co-offending, therefore, has both theoretical and practical value: as well as providing insights into criminal behaviour, understanding how criminal collaborations arise may suggest ways to disrupt the conditions that facilitate crime-related activities. Within this, a particular topic of interest is accomplice selection—i.e., how offenders choose their criminal partners. While this has been discussed extensively from a qualitative perspective, there has been little attempt to examine it using a quantitative networked approach (for an exemption see, e.g., Cornish and Clarke 2002; McCarthy et al. 1998; Weerman 2003, 2014).

Several theories have been proposed to explain accomplice selection and, in particular, to suggest which factors influence the choice of co-offender (see Weerman 2014; van Mastrigt 2017 for reviews). Some of these focus on the role of personal characteristics—such as age, gender and criminal aptitude—or discuss the influence of the social environment more generally; the idea that offenders tend to commit crimes with others from their social circle, for example. Others, however, relate to previous offending behaviour: individuals may be more likely to form new collaborations if they have already co-offended with multiple individuals in the past, for example, while others may tend to repeatedly offend with the same accomplices (Charette and Papachristos 2017). Hypotheses such as these relate to the influence of prior co-offending relationships on the formation of new ones, and it is these that we focus on in this study.

Networks provide a natural framework for studying these effects. Social network analysis has helped revive interest in co-offending in recent decades by providing tools and theories to study the interactions between individuals systematically (Bright and Whelan 2020; Carrington 2014; Papachristos 2011). In co-offending networks, individuals are linked based on the crimes they have co-executed: the network is composed of nodes, representing individuals, and any pair of offenders who have co-offended are connected by an edge, representing the criminal event in which they participated. Since edges represent co-offending relationships, understanding the mechanisms which drive network formation is equivalent to understanding how these relationships arise.

In this study, we seek to gain insights into the principles that drive co-offending by analysing the growth of three network components representing co-offending relationships in Colombia’s capital city, Bogotá, between 2005 and 2018. In previous work (Nieto et al. 2022), this network was shown to display structural regularities—in particular, triadic closure—when studied as a static network. Here we go further by examining its evolution.Footnote 1 In particular, we examine the links formed due to each criminal event during the study period. Each link formation represents the selection of an accomplice: conceptually, this selection might represent an explicit choice (e.g. recruitment), or it might reflect a more passive process (e.g. shared circumstance). In either case, identifying regularities in how these selections occur will offer insights into how co-offending relationships develop.

Understanding how co-offending networks evolve over time is crucial for identifying the mechanisms which drive their formation. Apart from a few contributions (e.g., Sarnecki 2001; Charette and Papachristos 2017; Iwanski and Frank 2013; Brantingham et al. 2011), the studies that have adopted a network approach to study co-offending have analysed static networks. Static networks are snapshots that aggregate co-offending relationships into a single network, regardless of when the crimes were executed (Faust and Tita 2019). The analysis of such networks can allow us to better understand the properties of co-offending networks; however, they cannot reveal how these networks evolve through the decisions made by offenders when creating new relationships. As has been shown for networks in general, different underlying formation processes can lead to graphs with indistinguishable properties when analysed in the aggregate (Mitzenmacher 2004).

This article starts to fill this gap by studying how co-offending networks evolve over time. Specifically, it applies a recently developed approach in network science that considers the formation of social networks as the result of choices made by nodes (offenders, in our case) when joining a network (Opsahl and Hogan 2011; Overgoor et al. 2019; Feinberg et al. 2020). When a node joins a network—or, if it is already part of it, creates a new connection—it selects a ‘target’ from the pool of nodes that are already part of the network. Discrete choice modelling examines whether the features of the potential targets influence this selection by comparing the characteristics of chosen nodes to those that were not. Identifying these influences can shed light on offenders’ decisions when selecting accomplices for new criminal ventures. In this study, the features we focus on are network-related, such as the number of existing links or the presence of reciprocal connections. Since these features reflect prior offending connections, they can be used to make inferences about the role of existing relationships in guiding new ones.

At least four mechanisms can explain the growth of networks in terms of nodes’ preferences for particular network-related properties. These have been examined in discrete choice studies of other social networks (Opsahl and Hogan 2011; Overgoor et al. 2019). Here, we focus on four of these—popularity, reciprocity, reinforcement, and triadic closure—each of which can be interpreted in terms of offender behaviour. Popularity refers to the tendency of offenders to form links (i.e., co-offend) with those who already have many connections (i.e., recurrent or prolific co-offenders). Reciprocity refers to offenders selecting individuals who have previously selected them, while reinforcement describes the situation in which one individual re-selects another. Triadic closure describes the tendency to create links with the associates of prior associates (‘co-offending with the accomplice of my accomplice’).

In our analysis, we employed a discrete choice model with network features corresponding to these four growth mechanisms to study their relative roles in accomplice selection. We applied this approach to analyse three components observed in a co-offending network in Bogotá (Colombia) between 2005 and 2018, containing 4286 (component ‘A’), 227 (component ‘B’), and 211 (component ‘C’) individuals. These components were derived from criminal investigation records and included all crime types defined by Colombia’s criminal law; therefore, they reflect criminal collaboration in a general sense rather than in the context of any particular offence.

Theories of co-offending conceptualise accomplice selection as a fundamentally directional process in which individuals acting as recruiters instigate collaborations with others (Reiss 1988); indeed, directionality is implicit in the four mechanisms outlined above. For this reason, our underlying model of the co-offending network is a directed graph, with orientation reflecting recruitment. This, however, presents an analytical challenge since our data does not contain information about which offenders acted as recruiters. We address this by adopting a procedure in which the analysis is repeated multiple times, with the directionality of edges randomised in each case: any findings robust to the choice of orientation can be assumed to apply generally. We follow this approach because a method that disregarded directionality would not reflect the nature of co-offending (as per the mechanisms identified above) and would be of limited theoretical value.

Theoretical and practical implications derive from this article. From a theoretical perspective, this study suggests that a combination of growth mechanisms might explain how co-offending networks grow, highlighting the importance of considering offenders’ network-related characteristics when studying accomplice selection. It also highlights the importance of former accomplices, as the results suggest that they may act as sources of information for potential new accomplices. From a methodological perspective, this study demonstrates a recently-developed approach to studying how networks evolve over time which has not previously been applied in criminology. Researchers interested in studying co-offending or covert networks might employ this approach to study the formation of crime-related networks.

Practitioners can also benefit from this study as it shows how to exploit existing information to identify and track the evolution of co-offending networks. From a strategic perspective, understanding the mechanisms at play in the evolution of particular networks can offer practitioners insights which may inform the design of crime prevention strategies. Similarly, studying the evolution of co-offending networks can assist practitioners in assessing the effectiveness of their interventions. The proposed approach can help evaluate the interventions’ effectiveness by analysing the behaviours a network displays after an intervention.


Co-offending is a topic that has been discussed extensively within criminology, and several theories—often based on qualitative studies—have been proposed to explain the features and dynamics of group offending (Weerman 2014). On the particular topic of accomplice selection, several perspectives have been advanced, discussing how offenders become aware of potential partners and how they evaluate their value as prospective co-offenders (van Mastrigt 2017). These theories lay along a continuum: at one end are those which discuss collaborations that arise spontaneously, while others conceptualise accomplice selection as a rational process in which offenders seek to choose partners who will be of maximum benefit.

This section discusses some of these theoretical principles, which relate to the influence of prior collaborative behaviour on accomplice selection. In a network context—where links represent instances of co-offending—these theoretical principles correspond to models of link formation based on network-related features. In each case, we discuss the principle from a criminological perspective and its interpretation regarding network growth. In doing so, our conceptualisation of a co-offending network is as a directed multigraph; that is, a network which can have multiple links between any pair of nodes and where each link has an orientation. Multiple links represent distinct instances of co-offending, and the orientation reflects the initiation of the collaboration (i.e., recruitment).


One suggestion that has been put forward in the literature is that individuals are more likely to be chosen as accomplices if they already have multiple co-offending connections (e.g., Sarnecki 2001). Such individuals can be considered ‘popular’ from a co-offending perspective because they have frequently been selected as accomplices. The mechanism is analogous to the ‘rich get richer’ principle for social networks, whereby individuals forming new links preferentially attach to those who are already well-connected (Newman 2018).

There are two reasons why popular co-offenders may be preferred as potential accomplices. First, their popularity may be attractive in itself, implying that the individual is an experienced co-offender, and their existing co-offending relationships may be seen as a form of endorsement. On the other hand, popularity may act as a marker of the individual’s underlying utility as a criminal partner: it is not popularity per se that is attractive, but rather that individuals become popular because of their aptitude for crime. Certain characteristics or assets can affect the value that an individual can contribute to a potential criminal collaboration. These characteristics—referred to as ‘criminal capital’—may include information, skills, contacts and personality traits (e.g., trustworthiness) deemed beneficial for the execution of a crime (Reiss 1986; McCarthy et al. 1998; McCarthy and Hagan 2001; Hochstetler 2014). Those with these features will, in principle, be more attractive as potential accomplices and therefore selected more frequently. In this way, the popularity of an offender may simply be a proxy for their criminal capital.

When popularity plays a role in the growth of a network, it is likely that a small subset of individuals will form disproportionately high numbers of connections. This can, however, be manifested in two ways. In the first scenario, the connections are formed with distinct individuals, meaning that the popular nodes have many neighbours. In the second scenario, some of the connections relate to the same co-offenders (i.e. they are multi-edges), reflecting the fact that they have interacted on multiple occasions. In the first scenario, popular nodes have numerous neighbours, but their connections tend to be ‘weak’ as they represent single events. In the second one, popular nodes may not have as many neighbours as in the first scenario, but their connections will be ‘stronger’ or heavier. This scenario echoes McGloin et al. (2008)’s findings about how frequent offenders create stable co-offending relationships. If popularity were a prevalent mechanism in co-offending networks, we would expect to see a small subset of offenders forming many links, either with different associates (first scenario) or with the same ones repeatedly (second scenario). As explained in the following section, we have considered both scenarios when analysing the growth of co-offending networks.

However, popularity might also be unattractive to potential accomplices. As offenders make more connections, their visibility increases and with it does their risk of getting arrested (Morselli 2009). Accordingly, popularity may have a negative effect on accomplice selection in some circumstances, and its overall role in the growth of co-offending networks is not straightforward. Offenders with ample criminal capital will make more or stronger connections, but their attractiveness as potential accomplices may be short-lived since their popularity makes them prone to be removed by law enforcement agencies.

Reciprocity and reinforcement

Two further mechanisms that may play a role in the growth of co-offending networks are reciprocity and reinforcement. The mechanisms are similar in that they both refer to the formation of multiple links between pairs of offenders but differ in their directionality.

Reciprocity refers to situations in which offenders select accomplices who have previously selected them—i.e., A selects B, having previously been selected by B themselves. In network terms, this corresponds to the tendency for pairs of nodes linked in one direction to be linked in the opposite direction. Such situations may arise when pairs of offenders repeatedly collaborate, each offender instigating on different occasions. Research has found that offenders do not have fixed roles throughout their criminal careers; rather, they alternate between the roles of ‘recruiters’ and ‘followers’ Van Mastrigt and Farrington (2011).

Conceptually, reciprocity refers to the likelihood of observing two individuals exchanging benefits or services over time—‘doing for others if they have done for them’ Plickert et al. (2007); Gouldner (1960). This exchange is not mediated by an explicit negotiation or a power imbalance between participants. Instead, it is an exchange explained through social norms or self-interests of the parties involved (Molm 1997). Reciprocity in co-offending has been analysed from the perspective of individual events but not to predict new co-offending relationships. For example, the social exchange theory of co-offending proposed by Weerman (2003) describes co-offending as a reciprocal interaction between co-offenders: co-offenders exchange material and immaterial goods to access rewards hard to obtain by solo offending. However, this mutual interaction primarily relates to collaborations themselves rather than accomplice selection.

Reinforcement, on the other hand, refers to instances where individuals repeatedly re-select the same accomplices (Grund and Morselli 2017; McGloin et al. 2008), thereby strengthening existing connections between connected pairs (Gouldner 1960). From a network perspective, these repeated interactions can be represented by multiple links—or ‘heavier’ links—connecting pairs of nodes. This tendency might be expected due to the cost or risk of forming new co-offending relationships. When committing an offence, it is easier and safer to renew a previous collaboration than to initiate a new one. Reinforcing existing relationships might also be expected when accomplice selection is viewed as a rational process (van Mastrigt 2017). Accomplices liaise with those with the criminal capital that matches the needs for successfully executing the crime at hand. Hence, reinforcing existing relationships might reduce the costs of finding new associates with the skills needed to exploit new criminal opportunities. Moreover, trust builds among those who co-execute a crime (Charette and Papachristos 2017). Hence, initial interactions between unknown offenders can help them gain trust in their accomplices, allowing them to stick together.

Reinforcement overlaps to some degree with popularity because repeated re-selection can result in the selected accomplice having a high number of in-links. The mechanisms are distinct, however. The principle of popularity is that an individual X may favour an accomplice simply because of their number of prior connections; whether those connections are from X themselves is immaterial. With reinforcement, on the other hand, the preference is specifically for individuals whom they have chosen previously (with multiplicity irrelevant).

Reciprocity and reinforcement are similar in that they refer to the formation of multiple links between pairs of individuals but differ in directionality. As mentioned, the directionality in these relationships is closely related to the idea of recruitment (or instigation). Co-offending relationships are created when a person, acting as a recruiter, brings together other motivated offenders, who act as followers, to execute a crime (Reiss 1986). Hence, these mechanisms are distinct, and both may play a role in explaining the empirical findings on how co-offending relationships are created and the behaviours offenders exhibit throughout their criminal careers. We included both mechanisms for these reasons and used simulation analysis as a robustness check.

While both reciprocity and reinforcement represent plausible hypotheses, there is a large body of evidence concerning the instability of co-offending relationships. Numerous studies show that offenders are more likely to co-offend with new accomplices rather than stick with the same associates (e.g., Weerman 2003, 2014; Warr 2002, 1996; Carrington 2002; McGloin and Thomas 2016; McGloin and Piquero 2010; van Mastrigt 2017). If this is the case, reciprocity and reinforcement may not play a role in how co-offending networks evolve; on the contrary, we may expect that the presence of existing links has a negative effect on accomplice selection. However, research by Grund and Morselli (2017) has suggested that the instability of criminal partnerships has been overestimated in the literature due to a measurement issue. Using a method which adjusts for this, they find that the chance of a pair of offenders being arrested again is as high as 50%, contradicting prior studies and suggesting that reciprocity and reinforcement may play a role.

Triadic closure

Triadic closure refers to the tendency for new links to form between two unconnected individuals who share a common neighbour Wasserman and Faust (1994); Holland and Leinhardt (1971). If A co-offends separately with B and C, triadic closure predicts that B and C will likely co-execute a crime.

Trust is often cited as a reason why social networks display this trait. Burt (2005) explained that when two people trust each other, there is a commitment to a relationship without knowing how the other person will behave. Two individuals sharing a connection to the same person will therefore have a basis to trust one another, increasing the chances of creating a new connection (Easley and Kleinberg 2010). In these situations, trust emerges from the possibility of using informal sanctions to discipline the person breaking social norms (Coleman 1988)—gossiping, for example, can be an informal sanction against those who break social norms. Similarly, trust plays a vital role in co-offending since offenders need to act together as planned without the need to supervise one another (Gambetta 2011). Two willing offenders sharing an accomplice have a basis for trusting each other since the shared accomplice can arbitrate between them.

Accordingly, information about offenders’ trustworthiness is essential for accomplice selection. McCarthy et al. (1998) contended that offenders rely on the information circulating in social networks to evaluate the trustworthiness of potential accomplices. Thrasher (1963) introduced a similar idea when referring to the underworld’s ‘grapevine system’ in which information about offenders and their reputations circulate. In this sense, we can hypothesise that triadic closure might play a prominent role in the evolution of co-offending networks. Two individuals with an accomplice in common are more likely to co-offend: the shared contact can vouch for each individual and act as a mediator if needed.

Feld (1981)’s focus theory approach provides an additional explanation for triadic closure in social networks. According to this theory, there are elements in the environment that act as social foci—settings in which individuals organise their social activities (e.g., family, workplaces, neighbourhoods). Feld suggested that two individuals sharing a connection to a third person might also share the same social foci, facilitating new relationships between unconnected pairs. Felson’s (2003) notion of offender convergence settings resembles Feld’s theory. In these settings, offenders contact potential accomplices to seize criminal opportunities and design criminal plans. Individuals sharing social foci (or offender convergence settings) are more likely to create new co-offending relationships than those not sharing these settings. This idea of people who share settings having more chances of creating new connections aligns with Granovetter (1973)’s explanation of triadic closure. If two individuals spend time with a third, they will likely encounter each other and potentially form a connection. The potential role of offender convergence settings is another reason we expect triadic closure to be prevalent in co-offending networks.

Relatively few studies have explicitly investigated the presence of triadic closure in co-offending networks; however, those that have done so (e.g., Grund and Densley 2015; Nieto et al. 2022) have found evidence that it is indeed present. Nevertheless, the underlying mechanisms that give rise to it—for example, whether it is an effect in itself or a bi-product of convergence settings - remain unknown.

Figure 1 illustrates the four mechanisms described in this section. The review presented in this section suggests that we should expect to see popularity play a relatively limited role in the growth of co-offending networks. Similarly, reinforcement and reciprocity might only partially explain the evolution of these networks, as most evidence suggests that co-offenders tend to find new accomplices as they continue their criminal careers. However, triadic closure seems likely to play a substantial role in the growth of co-offending networks since there is a clear overlap between the mechanisms which typically give rise to this trait in social networks and the principles driving co-offending selection.

Fig. 1
figure 1

Based on the existing relationships (black solid lines), popularity, reinforcement, reciprocity, and triadic closure predict new connections between the nodes (dashed lines)

Before going further, it is worth noting that these four mechanisms only consider nodes’ network-related properties. These include the number of connections and their position in the network and exclude individual-level properties such as age, sex, or criminal history. The reason for focusing on these was partly practical—offender-level characteristics were not available in the dataset we studied—but also theoretical: our primary interest is in how prior co-offending behaviours shape accomplice selection. Nevertheless, individual-level characteristics will also play a role (Robins 2009), and their inclusion will be an essential topic for future work. It is also worth noting that edges’ directionality is also crucial to better understanding co-offending. It allows us to better model co-offending relationships as they are initiated by motivated offenders who recruit those willing to participate in the criminal venture. It also allows us to differentiate between reciprocity and reinforcement. Below we discuss how we addressed edges’ directionality in the co-offending components we studied here.

Prior studies of network evolution

Although relatively little research has formally examined the evolution of co-offending networks from the perspective of accomplice selection, several studies offer important context. For example, Charette and Papachristos (2017), using a dynamic approach to analyse co-offending dyads, showed that the longevity of co-offending relationships—measured through the number of times pairs of offenders were co-arrested—tended to be short. However, they observed that a small proportion of relationships persisted. According to their findings, homophily (i.e., the tendency to create connections with similar others), experience (i.e., criminal capital), and transitivity (i.e., shared accomplices) might explain why some co-offenders stick together despite having previously been arrested together.

Another group of studies have analysed the evolution of covert criminal networks. Bright et al. (2019) found that triadic closure explained the structural changes experienced by a drug trafficking network comprised of 86 participants between 1991 and 1996 in Australia. Bright and Delaney (2013) also observed that drug trafficking networks were flexible and adaptive, as central offenders became peripheral when new individuals joined the network. Similarly, Morselli and Petit (2007), using information about a criminal investigation between 1994 and 1996 in Canada, observed that drug trafficking networks could become less centralised as law enforcement agencies try to disrupt them. While these are important insights, they are of limited relevance in the present context since the networks studied are primarily organisational rather than reflecting instances of co-offending. The networks model communication patterns between individuals participating in illegal activities as part of a wider enterprise, not the co-execution of individual crimes.

As far as we know, no studies have adopted a dynamic approach to analyse the evolution of co-offending networks, particularly in terms of the mechanisms that guide the formation of links. Therefore, the question that we study here—of how this evolution offers insight into the principles guiding accomplice selection - remains unanswered.


Data and network construction

This study used data from the Colombian Attorney General’s Office (AGO) regarding all criminal investigations—either closed or ongoing—of crimes committed in Bogotá (Colombia) between 01/01/2005 and 31/12/2018 by adult offenders (>18 years). These investigations originated from either the actions of the National Police (e.g., an arrest executed by a police officer) or the investigators working alongside prosecutors (e.g., new investigations derived from ongoing cases). A criminal investigation does not necessarily imply an arrest, as they could be in an early stage of the process, on trial, or at the last stage with a sentence. However, all arrests result in an investigation. A single investigation could involve one or more offenders and multiple crime types.

We included information about all types of crime defined by Colombia’s Criminal Law. Each record in our dataset corresponds to an offender’s involvement in a particular criminal investigation. Offenders were identified using the (encrypted) national identity number (NIN), and Criminal Investigation Record Number (CIRN)—a code assigned by the AGO—acted as a unique identifier for criminal investigations. Each CIRN had an associated timestamp corresponding to the date the AGO started investigating a crime. We used this as a proxy for the date on which the offenders executed the crime(s). Unfortunately, no information about offenders’ attributes (e.g., sex, ethnicity or criminal history) was available.

We used this data to construct a bipartite network representing the associations between offenders (N = 274,689) and investigations (M = 286,591). Each link corresponds to a unique record in our dataset, representing a connection between an offender and a criminal investigation. We took the one-mode projection of this network to derive a separate (undirected) network of associations between offenders (i.e. a co-offending network). In this projected network, a link is placed between any pair of offenders connected to the same investigation; that is, two offenders have a co-offending relationship if they are both associated with the same CIRN. If two offenders shared more than one investigation, multiple edges were placed between them. This same network was used in a previous study that looked into the measurement of triadic closure in bipartite co-offending networks Nieto et al. (2022).

Of those individuals included in our network, 92,376 (34%) were co-offenders (i.e. had at least one link to another offender), with solo offenders (182,313) accounting for the remainder of the network (66%). The network had 32,348 components with two or more offenders. Of all investigations, 38% included a crime against private property, 27% a crime against people’s physical integrity (e.g., assault), and 9% a crime against public safety (e.g., arms trafficking). On average, each offender was connected to 1.8 investigations, and each investigation included, on average, 2.5 offenders.

The largest component observed at the end of the study period included 4286 individuals (component ‘A’), followed by two others with 227 (‘B’), and 211 (‘C’) offenders. The proportion of offenders in these components is small relative to the total number of offenders in the network. They represent less than 1% of the total number of offenders (as expected, given the low network density). Still, they constitute a substantial group when placed in the broader context. For example, the offenders in these components are equivalent to 44% of Bogotá’s prison capacity or, since there is prison overcrowding in this city, 30% of the actual prison population as of December 2018 (INPEC 2021). Based on their significance in terms of the number of offenders, we decided to study the growth of these components.

Table 1 presents some descriptive statistics of these components, and they are plotted in Figs. 2, 3, and 4. Each plot also includes a histogram showing the degree distribution and some descriptive statistics—the average degree centrality, diameter, density and clustering coefficient.

Table 1 Descriptive network statistics: number of nodes, number of edges, number of investigations in the underlying bipartite structure, the mean number of offenders per investigation, the mean number of offenders per investigation, the mean number of investigations per offender, and the proportion of investigations linked to specific crime types
Fig. 2
figure 2

Component ‘A’

Fig. 3
figure 3

Component ‘B’

Fig. 4
figure 4

Component ‘C’

Several similarities and differences can be seen in the structure of the three components. Despite the difference in the number of nodes and investigations in the underlying bipartite structure, ‘A’ and ‘B’ had a relatively similar mean number of offenders per investigation (1.89 and 2.3, respectively), though the average degree in the latter was slightly higher (10.8) than the former (8.5). However, it is notable that ‘B’ contains some densely-connected clusters of nodes, which are likely to partly be a by-product of certain investigations with large numbers of participants. This is even more apparent in ‘C’, in which two particularly large clusters can be seen: again, this indicates the presence of large offending groups. This component had fewer investigations (128), a higher mean number of offenders per investigation (3.1), and a higher average degree (53). On the whole, however, ‘A’, ‘B’, and ‘C’ are relatively sparse networks and exhibit some transitivity in their connections (the clustering coefficients ranged between 0.77 and 0.95).

Regarding the proportion of investigations linked to specific crime types, almost half of the investigations in these components were related to crimes against private property. Offences against public safety (e.g., arms trafficking) and public administration (e.g., obstruction of justice) were also present in nearly one-quarter of the investigations in each component.Footnote 2 We did not select these components as representative of the complete network; we chose them based on their size, as co-offending networks in their own right. Nevertheless, there was a resemblance between the entire network and the three components we studied here. They all had a considerable proportion of criminal investigations related to crimes against private property. There was little variation in the average number of offenders per investigation and the average number of investigations per offender.

To get an initial understanding of the components’ evolution, we partitioned the data set into landmark windows that encompass all data between a fixed start-point and sliding end-point (Cordeiro et al. 2018; Gehrke et al. 2001). Figure 5 shows a graphical representation of this approach, with the total number of offenders in the full network at each window. For the three components we studied, Table 2a–c show the number of offenders, components, incoming nodes, and investigations observed in each sliding window. These components resulted from the coalescence of smaller clusters that merged and created a large connected component when new links formed ‘bridges’ between smaller fragments. The pace and proportion of incoming nodes varied between components (NB: the term ‘incoming nodes’ in these tables refers to new nodes joining the components. It excludes existing offenders creating new co-offending relationships).

Fig. 5
figure 5

A landslide approach to partition the dataset. The y-axis displays the landslide windows, starting in 2005 (the landmark) at the top. The black bars represent the number of co-offenders with the number of co-offenders in brackets, and the grey bars represent the total number of offenders per window. Between 2005 and 2018, there were 274,689 offenders, of which 92,376 were related to at least one co-offence

Table 2 The number of offenders, components, incoming nodes, and investigations per window for each of the three networks considered here — (a) network 1, (b) network 2, and (c) network 3

Analytical framework

For the main part of our analysis, we examined the formation of individual links in the co-offending networks to gain insight into the mechanisms via which offenders select accomplices. We did this by employing a discrete choice approach first proposed by Opsahl and Hogan (2011) and similar to that used in subsequent work by Overgoor et al. (2019), Feinberg et al. (2020), and Overgoor et al. (2020). The model is an example of the more general discrete choice framework, which seeks to describe or predict the choices made by individuals from a discrete set of alternatives (McFadden 1981). A random utility theory approach assumes rational actors make choices by considering the attributes of their options and choosing the one maximising their utility (McFadden 1974). These models have been extensively used to explain decisions such as what colleges people attend, how they travel, or how they decide whether to enter the workforce (e.g., Train 2009; Ben-Akiva et al. 1985; Simonson and Tversky 1992).

In the discrete choice approach, the growth of the network is viewed as a sequence of link formations ordered in time. The key principle is to consider the formation of each link to be the outcome of a choice process, whereby one node has selected another to connect with from the set of all available nodes. By comparing the characteristics of the selected node to those of the nodes that were not, it is possible to infer which characteristics are favoured (or otherwise) when forming new links. In this context, where each association created represents a co-offence, any insights into the influence of particular network features can be interpreted in terms of the mechanisms driving accomplice selection. This approach captures two essential processes in co-offending: the first refers to the creation of new criminal relationships, and the second to the reinforcement or reciprocation of existing connections.

Formally, the model considers the formation of each edge in the network in sequence. For an edge (ij) created at time t, it is assumed that node i could have chosen to form a tie with any node already present in the network at time t. This set of possible nodes is denoted \(A_t\), and constitutes the choice set in discrete choice terminology. It is assumed that each node in this choice set has an associated utility, which is a function of its attributes and represents its quality as a potential connection. In the framework used here, this utility is assumed to take a linear form: if the attributes of each node k at time t are represented by a vector \(Z_{k, t}\), then k’s utility as a potential connection is a linear function of \(Z_{k, t}\).

Under some assumptions about the random components of the utility (McFadden 1974), it can be shown that the probability that j is chosen by i is given by:

$$\begin{aligned} P \left\{ J_t = j | Z_{t} \right\} = \frac{\exp \left( \beta ' Z_{j, t}{} \right) }{\sum _{k \in A_t}\exp \left( \beta ' Z_{k, t}{} \right) } \end{aligned}$$

where \(\beta '\) is a vector of coefficients. These can then be estimated via maximum likelihood (Hosmer et al. 2013).

Node attributes

The attributes incorporated in the model represent nodes’ features; these can be either endogenous characteristics (e.g. age, sex) or network-related properties (e.g., the number of existing connections). Our analysis focuses only on the latter, corresponding to the mechanisms we seek to test. We leave the integration of endogenous features in this analysis as an avenue for future research when such data becomes available.

Two variables were used to reflect nodes’ popularity. A node’s in-weight corresponds to the number of connections to it - i.e. the number of times that the offender has previously been chosen as an accomplice (including multiple times by the same individual). On the other hand, the in-degree of a node measures only the number of other nodes connected to it, even if some are connected by multiple links (i.e. multiple crimes). Reinforcement was coded as a binary variable: 1 if there was an existing link from i to j and 0 otherwise. Similarly, we operationalised reciprocity as a binary variable: it took the value 1 if there was an existing link from j to i and 0 otherwise. Triadic closure was measured as the number of accomplices shared by a pair of co-offenders. Note that these variables can evolve: if i forms multiple edges with j, for example, j’s reinforcement value will be 0 the first time and 1 after that. For each choice, the values used for \(Z_{k, t}\) were as they were at the point t when the corresponding choice was made.

Applying this discrete choice framework to our data requires meeting the assumptions of the underlying model. Discrete choice models assume that individuals act rationally when making a choice—i.e., they will select the option that maximises their utility from the available options. Based on the theoretical arguments reviewed in the previous section, this is justifiable in the context of accomplice selection. A common feature in accomplice selection theories is that offenders seek to maximise benefits and reduce costs when selecting accomplices (e.g., Cornish and Clarke 2002; Tremblay 1993; Weerman 2003). In doing so, they evaluate potential partners based on their perceived trustworthiness (to minimise the risk of betrayal) and the likelihood of this individual maximising the expected benefits from the criminal venture. This evaluation implies judging the ‘criminal capital’ of their potential accomplices: the skills, information, and contacts deemed beneficial for successfully executing a crime (McCarthy and Hagan 2001; McCarthy et al. 1998). Since there is a strong foundation for the notion that accomplice selection is a rational process, discrete choice models are suitable for studying the growth of co-offending networks.

Analytical challenges

We faced three technical challenges while completing this study. The first of these was computational. Each time a node makes a new connection, every other node currently in the component can be selected, creating a large and imbalanced choice set (i.e., dominated by non-selected nodes). This makes the estimation of models computationally expensive and can lead to biased estimates (Opsahl and Hogan 2011). This can be addressed via negative sampling: rather than including all non-chosen alternatives in the choice set, only a smaller, randomly-selected sample—referred to by Opsahl and Hogan (2011) as ‘control cases’—is included (Train 2009). As long as this sample is chosen randomly, parameter estimates can be shown to be unbiased and consistent with those derived from the complete set. There is no general rule for the appropriate number of control cases; instead, it can be established via sensitivity analysis, which we present in Appendix A. In our analysis, we used 30 control cases for ‘A’ and 10 for ‘B’ and ‘C’.

The second challenge was related to the nature of our data. The discrete choice framework outlined above assumes—in line with accomplice selection theory—that the links in the network are directional; that is, an edge (ij) refers specifically to i choosing j, rather than vice versa. In our co-offending network, however, links were undirected; we knew that a pair of offenders participated in an offence but not who instigated the link. To address this, we estimated the model described in Equation 1 1K times, randomly assigning the direction of each link at each iteration. The logic of this approach was that, if findings were consistent across the iterations, then the underlying principles were not sensitive to the edges’ directionality.

A third challenge related to investigations comprised of three or more offenders (see Table 1 for the mean number of offenders per investigation). Such investigations result in the simultaneous formation of multiple links; however, while in reality, they are formed simultaneously, the order in which they are listed in the dataset affects the statistical analysis. For each choice scenario, the attributes of candidate nodes were calculated based on the current state of the network and before the connection between i and j was created. These attributes might change as more links are added since j can be selected more times or form connections with i’s neighbours. To mitigate this, we shuffled the ordering of links associated with each investigation at each iteration of the analysis. Figure 6 illustrates the randomisation process that we followed. Again, the rationale was to remove any dependency of the findings on an arbitrary ordering of links. Overall, these randomisation procedures—directionality and ordering of links—meant that the model in Equation 1 ran for 1K realisations of each of our three components of interest. Given the computational demands, we used UCL’s Cluster Computing Services to perform the analysis.

Fig. 6
figure 6

Starting with an undirected component (left), the order of the nodes in the edge list and the directionality of the edges between pairs of nodes were randomly assigned in each of the 1K iterations. The model described in Eq. 1 was estimated in each iteration using the resulting random version of the edge list for the three components considered here

Alternative approaches

Using discrete choice models to study how social networks grow differs from other approaches that seek to identify the mechanisms driving networks’ evolution. In some methods, the structural properties of the network at a single point of observation are used to deduce the process by which it reached its current state (Overgoor et al. 2019); for example, the degree distribution is commonly used to infer whether a network has grown via preferential attachment. This approach has shortcomings, however, since different formation processes can lead to networks that are structurally indistinguishable (Mitzenmacher 2004). This can be avoided when the ordering of edge formations is known. Here we used the timestamps attached to each criminal investigation to formulate each instance of accomplice selection as a choice.

We also favoured the proposed approach over the stochastic actor-oriented models (SAOM) (Snijders et al. 2010). SAOM use panel data (i.e. snapshots of a relatively stable group of nodes) to model network dynamics using computer simulations. Since there was a considerable variation in the number of offenders observed in each temporal window (see Table 2a–c), we deemed the panel data approach prescribed by SAOM unsuitable.

The proposed analytical framework also differs from Dynamic Network Actor Models for Relational Events (DyNAM) (Stadtfeld and Block 2017). The statistical models in DyNam investigate coordination ties found in diverse social settings (e.g., scientific collaboration, international trade, and friendship). The idea of a mutual agreement between i and j to form a relationship is at DyNam’s core; hence, the decision is two-sided, and the directionality of who chooses whom is irrelevant. However, this principle contradicts how co-offending relationships are formed, since, as outlined above, instigation is essential to understanding co-offending and gaining insights into crime prevention (Reiss 1988). Accordingly, the directionality in the relationships between offenders is vital when studying co-offending, limiting the applicability of DyNam.

Results and discussion

We jointly tested popularity, reciprocity, reinforcement, and triadic closure to understand the evolution of three components of the co-offending network. To analyse their growth, we ran models with two different specifications: one with in-degree as a proxy of popularity and the other with in-strength. In each case, we iterated the estimation of our model 1K times, in line with the randomisation procedure outlined above.

The results across all models are summarised in Table 3, with coefficients shown for each component studied and each measure of popularity (see Appendix B for a graphical representation of the results). This table also includes the minimum and maximum C-statistic observed for each model (also known as the ‘concordance’ statistic or C-index), which is a measure of goodness of fit. According to the classification proposed by Hosmer et al. (2013), the models used to describe the largest network can be considered as ‘strong’ models as their C-statistic is above 0.8. The models used for the other two networks are ‘good’ since their C-statistic is above the 0.7 mark—especially for ‘C’. Accordingly, these models represent a good fit for the observed data.

Since the results are similar for both measures of popularity (in-degree and in-strength), we use the values for in-degree to illustrate our findings in the remainder of this section. The results reveal that the components evolved in different ways. Reciprocity, reinforcement, and triadic closure yielded positive, statistically significant coefficients for ‘A’, while in-degree generated negative ones. Accordingly, the odds of an offender connecting with a former recruiter (reciprocity) were 44 times higher than connecting to an offender who had not previously selected them (\({\tilde{x}} = 3.78\); exp(3.78) = 43.8). Similarly, the odds of observing an offender co-offending with a former associate were 13 times higher (\({\tilde{x}} = 2.6\)) than co-offending with an offender with no previous connections (reinforcement). Likewise, the odds of co-offending with someone with whom incoming offenders had a mutual associate were four times higher for each additional accomplice they shared (triadic closure, \({\tilde{x}} = 1.46\)).

Table 3 The median coefficient observed in the 1000 simulations and the minimum and maximum values of the C-statistic

Component ‘B’ displayed a different behaviour. Triadic closure was the only mechanism that yielded statistically significant coefficients. In this case, the odds of an offender committing a new crime with someone with whom they have a mutual associate were four times higher for each additional accomplice they shared (\({\tilde{x}} = 1.33\)). ‘C’ was the only component that yielded negative statistically significant coefficients for reciprocity and reinforcement. Former recruiters were 21 times less likely to be selected by a former associate (\({\tilde{x}} = -3.03\); exp(−3.03) = 0.048; 1/0.048 = 20.83). Likewise, incoming offenders were 16 times less likely to co-offend with someone they had previously selected (\({\tilde{x}} = -2.79\); exp(−2.79) = 0.061; 1/0.061 = 16.4).

These results challenge the importance attributed to popular offenders in explaining how co-offending networks evolve (Sarnecki 2001; Englefield and Ariel 2017; Malm and Bichler 2011; Bichler and Malm 2018). Based on prior findings, we would have expected positive, statistically significant coefficients for both proxies of popularity. Instead, popularity only yielded negative statistically significant results for the largest component, suggesting that having multiple connections reduced the odds of an individual being selected for a subsequent collaboration. The increased visibility experienced by popular offenders could explain this outcome. As mentioned, those who have been subject to multiple criminal investigations are naturally more visible to law enforcement and have a track record of being ‘caught’. Potential recruiters may therefore view them as a risky prospect from the perspective of co-offending.

In turn, these results point to the limited predictive power of popularity in forecasting how co-offending networks might evolve. It is worth noting that this limited predictive power could not be identified by only considering the degree distribution of a network snapshot (see, for example, Fig. 2). This distribution shows that a large number of offenders had few links but that a small proportion had a large number of accomplices. On its own, this might suggest that some form of preferential attachment played a role in the network’s evolution. However, by continuously observing its growth using the analytical strategy adopted here, we showed that, despite the skewed distribution, popular offenders had only a marginal role in explaining the evolution of the components considered here. Note that our data relate to ‘failed’ (i.e., detected) co-offending relationships. Popular offenders who have not been arrested or prosecuted could still have prominent roles in expanding these components or linking unconnected components in the observed network. This is an inherent limitation of studies relying on official records to study crime, and we discuss this further in the final section.

Based on the results reported elsewhere about co-offending relationships being unstable (Weerman 2003, 2014; Warr 2002, 1996; Carrington 2002; McGloin and Thomas 2016; McGloin and Piquero 2010; van Mastrigt 2017), we would have expected to see similar results to the ones seen for ‘C’ in all cases. However, previous interactions increased the odds of observing former associates executing new crimes in ‘A’. Moreover, neither reciprocity nor reinforcement yielded statistically significant coefficients for’ B’. These outcomes suggest that in some networks, offenders are likely to re-offend with known associates. From a rational perspective, re-offending with the same accomplice might reduce costs linked to the search for new accomplices. Likewise, previous interactions might create and increase trust between pairs of offenders. While we cannot test these explanations here, future research could combine the analysis conducted here and the approach proposed by Charette and Papachristos (2017) to understand the factors that might explain why some co-offenders decide to stick together.

The mixed results for reciprocity indicate that this mechanism might operate in contrasting ways. On the one hand, it can bring together offenders, giving rise to interactions of the sort ‘offender A selects offender B’, followed by ‘offender B selects offender A’, as seen in component ‘A’. This sequence of events aligns with our earlier comments about how offenders alternate between the roles of ‘recruiter’ and ‘follower’. Alternatively, recruitment can act as a ‘repellent’ between known associates, as seen in ‘C’. Again, this effect could be explained by the transient nature of individuals’ roles in co-offending relationships. Once an individual is instigated into a crime, they can become embedded into a criminogenic network of potential accomplices. As part of this network, this person can change roles based on the criminal expertise they acquire. Criminal expertise can help reduce the inherent risks of co-offending as people might feel less uncertain when committing a crime with a seasoned offender (McGloin and Nguyen 2012).

In interpreting our results with respect to reciprocity and reinforcement, however, it is important to mention some caveats. The first is that our analysis is based on information about ‘failed’ co-offending relationships; i.e., those detected by law enforcement. This might explain why recruitment acts as a repellent: followers could be more inclined to seek new accomplices and avoid former recruiters based on their unsuccessful ventures. Accordingly, followers might look for seasoned criminals that could reduce detection risks. The second caveat is analytical. Because our analytical procedure involved the randomisation of link directions, we cannot confidently discriminate between reinforcement and reciprocity; we do not know the recruiters in each case. However, the fact that findings persist across our 1000 iterations suggests that the findings are not spurious. In addition, the results for both mechanisms mirror each other—the direction and significance of the effects is the same in all models—indicating that they operate (or not) in tandem.

Triadic closure plays a consistent role in explaining the emergence of co-offending relationships across all components. This result suggests that former accomplices might be essential in procuring potential associates. It also supports the importance of the information circulating in the ‘grapevine system’ (McCarthy et al. 1998; Thrasher 1963) that facilitates finding partners and, ultimately, the execution of a crime (Tremblay 1993).


The analytical strategy employed here shows how to consider multiple mechanisms when the data at hand allows researchers to observe how new connections are created in an ordered sequence. According to our results, the evolution of co-offending networks, as in other social networks, could be partly explained by the interaction of multiple mechanisms (Hedström and Swedberg 1998). Specifically, popularity was found to either be unattractive or play no role at all, while there were mixed outcomes for reciprocity and reinforcement. On the other hand, triadic closure showed consistently positive results. Moreover, the results also indicate that the models used provided either a ‘strong’ (for the largest component considered here) or ‘good’ (for the other two) fit to the data.

Using a discrete choice approach to study the evolution of networks offers an alternative to previous techniques that relied on aggregated information (e.g., degree distribution) to examine how co-offending networks grow. A static network analysis might mask essential drivers of the growth of co-offending networks. Despite the limited number of networks considered here, this paper contributes to the scarce literature that has included a temporal dimension in the analysis of criminal networks (Bright and Delaney 2013; Charette and Papachristos 2017; Bright et al. 2019). We believe this work sets a basis for future analyses of similar covert networks to grasp their evolution mechanics.

This analysis included four network-growth mechanisms, but, as explained by Overgoor et al. (2019), the integration of discrete choice models and network evolution is flexible enough to consider more and more complex mechanisms and integrate information such as node-level characteristics (e.g., age, sex, or prior history in the criminal system). Future research could incorporate precise information about who selected whom and use node-level information to verify findings about recruiters’ characteristics. For example, Van Mastrigt and Farrington (2011) reported that recruiters tend to be older than followers in juvenile co-offending relationships; however, there are no reports about recruiters’ traits in adult co-offending.

Future research could also include geographical information (e.g., place of residence and where offenders committed the crimes) to gain more insights into how adult co-offenders select their accomplices. Including such information would be useful, especially when considering the mechanisms, such as triadic closure, with a geographical component as an underlying explanation (i.e., social foci/offenders’ convergence settings). Incorporating more information when analysing the evolution of co-offending networks will help us better understand crime’s aetiology and how to prevent the emergence of new co-offending relationships.

Apart from including node-level and geographical information, future research could examine co-offending networks through a multilayer approach. Multilayer networks consist of a fixed set of nodes connected by several different types of connection, represented by multiple layers (Newman 2018), and have been studied across a wide range of contexts (Kivelä et al. 2014). However, studying criminal networks through multilayer networks is rare and has largely been limited to organised crime research (e.g. Ficara et al. 2021, 2022). In the present context, co-offending networks could be studied using a multilevel approach by using different layers to represent specific crime types or time frames. Disaggregation by crime type has particular potential in this regard: this could be used to examine whether co-offending patterns differ across crime types, or whether individuals tend to repeatedly collaborate on particular types of crime (i.e. specialise). Comparing and contrasting the layers in these networks can shed light on co-offenders’ behaviours, which is an opportunity to refine this work.

Our analysis is subject to some limitations, primarily relating to data availability. Although our underlying model framed accomplice selection as a directional process, with relationships initiated by offenders acting as recruiters, the data used here did not capture this trait. Future research could incorporate precise information about directionality once it becomes available. Furthermore, we did not have access to the individual-level attributes of offenders (e.g. age, sex, ethnicity), meaning that our analysis focused exclusively on the role of prior co-offending relationships. While this addresses several theoretical mechanisms, it is clear that individual-level features will also play a role in determining ‘criminal capital’ and therefore influencing accomplice selection (Robins 2009). Information on the incarceration or death of individuals was also missing in our dataset. Both of these would have implications for our analysis since they would mean that such individuals are not available for selection by others (i.e., they are excluded from the choice set). In particular, it constitutes a caveat to our results concerning popularity since popular offenders (i.e., prolific) are more likely to be unavailable. However, this issue is less likely to be problematic for reinforcement and reciprocity since any incarceration due to a prior offence is likely to affect both partners simultaneously. More generally, it is important to note that the fact that an offender was subject to an investigation did not preclude them from making new connections: while under investigation or on trial, they may still commit crimes.

More generally, since our study is based on law enforcement data, it suffers from the inherent limitations of official records used to study criminal networks (Campana and Varese 2020). Most notably, attrition at various stages of the criminal justice system means that officially-recorded crime represents only represents a subset of all crime that takes place, with the remainder representing a ‘dark’ figure. Victims may fail to report crimes they suffer, or law enforcement agencies may overlook crimes once victims come forward (Carrington 2014; Campana and Varese 2020). Furthermore, prosecutors might fail to identify any or all those involved in a criminal event, resulting in a closed investigation or missing connections between offenders (i.e., co-offending networks with missing links). This issue is common to all studies of crime which rely on official records; however, such records are the only viable source of data concerning co-offending at a large scale and are used as the basis for almost all research on the topic.

Some decisions were taken to minimise the impact of these data issues. We included information about all ongoing and closed investigations over a relatively long period (14 years). Moreover, our data resemble two sources of information commonly used to study co-offending—arrest records and court files. These sources are typically used separately and rarely combined. Ongoing investigations represented arrest records because every person arrested in Colombia needs to be linked to a criminal investigation. It also resembled court records because it included information about closed cases with a guilty verdict and those in which the offenders pleaded guilty. Furthermore, we included information on all possible crimes, capturing different organisational practices within the AGO and not those of a particular task force.

Nevertheless, we must bear these limitations in mind when interpreting our findings. It is possible, for example, that under-recording means that the popularity of some offenders was underestimated, which might mean that the role they played in network formation is not captured. Furthermore, some missing links may connect components in our network, meaning its fragmentation is not as great as it may appear. In simple terms, our findings may provide an incomplete picture of co-offending relationships. However, it should also be borne in mind that, from a practical point of view, findings relating to officially recorded offending are still of value, even if not wholly representative of the overall situation. Law enforcement agencies can only disrupt offending of which they are aware—if an offence never comes to their attention, it cannot be a target for prevention—and so, to some extent, recorded crime is a population of interest in itself.

Apart from theoretical contributions that this sort of analysis might produce, temporal analyses of co-offending networks such as the one conducted here can provide new insights to law enforcement agencies by showing the different networks displayed when evolving. Using the data collected about people arrested or sentenced, these agencies can use the framework proposed here to study the growth of particular co-offending networks. Based on these results, these agencies might be able to design interventions to prevent the expansion of these networks (Bright 2015; Cavallaro et al. 2020). Suppose popularity is a strong predictor of how a co-offending network grows. In that case, law enforcement agencies must target hubs and understand why these individuals attract new accomplices. If triadic closure explains the evolution of co-offending networks, crime prevention strategies should disrupt the underlying processes that allow offenders to converge in specific locations, for example. These interventions could also interfere with the information circulating in the ‘grapevine system’ to increase offenders’ costs while searching for trustworthy accomplices. Recently developed findings about the effects of police-led interventions (aka crackdowns) (e.g., Smith (2021)) should be integrated to predict the dynamics that co-offending networks would display after such interventions. The unintended consequences of these interventions should also be considered (Diviák et al. 2022; Morselli et al. 2007). Suppose the police target a popular offender that happens to get notoriety given their leadership role within a criminal organisation. In that case, violence might increase as other organisation members start fighting to gain control. Removing a leader could also increase violence as it might signal an opportunity for a rival group to attack the organisation whose leader has been removed (Braga et al. 2018; Felbab-Brown 2013). There are strategic and ethical considerations when intervening in a criminal, covert network. Here, we showed an option to improve the understanding of the dynamics displayed by co-offending networks that could support the decisions adopted by the relevant stakeholders.

Availability of data and materials

The datasets used and/or analysed during the current study are available from the corresponding author upon reasonable request.


  1. In this article, we use the terms growth and evolution interchangeably.

  2. We relied on the classification used by the Colombian Criminal Law to group the crimes linked to each investigation. This Law groups crimes into broader categories based on the civil or human rights each crime type intends to protect.


  • Ben-Akiva M, Litinas N, Tsunokawa K (1985) Continuous spatial choice: the continuous logit model and distributions of trips and urban densities. Transp Res Part A: General 19(2):119–154.

    Article  Google Scholar 

  • Bichler G, Malm A (2018) Social network analysis. In: Wortley R, Sidebottom A, Tilley N, Laycock G (eds). Routledge

  • Braga AA, Weisburd D, Turchan B (2018) Focused deterrence strategies and crime control: an updated systematic review and metaanalysis of the empirical evidence. Criminol Public Policy 17(1):205–250

    Article  Google Scholar 

  • Brantingham PL, Ester M, Frank R, Glässer U, Tayebi MA (2011) Co-offending network mining. In: Counterterrorism and open source intelligence. Springer, pp 73–102

  • Bright D (2015) Disrupting and dismantling dark networks: lessons from social network analysis and law enforcement simulations. In: Gerdes LM (ed), Illuminating dark networks: the study of clandestine groups and organizations. Cambridge University Press, pp 39-51.

  • Bright D, Delaney JJ (2013) Evolution of a drug trafficking network: mapping changes in network structure and function across time. Global Crime 14(2–3):238–260

    Article  Google Scholar 

  • Bright D, Koskinen J, Malm A (2019) Illicit network dynamics: the formation and evolution of a drug trafficking network. J Quant Criminol 35(2):237–258

    Article  Google Scholar 

  • Bright D, Whelan C (2020) Organised crime and law enforcement: a network perspective. Routledge, London

    Book  Google Scholar 

  • Burt RS (2005) Brokerage and closure: an introduction to social capital. Oxford University Press, Oxford

    Google Scholar 

  • Campana P, Varese F (2020) Studying organized crime networks: data sources, boundaries and the limits of structural measures. Social networks

  • Carrington PJ (2002) Group crime in Canada. Can J Criminol 44:277

    Article  Google Scholar 

  • Carrington PJ (2014) Co-offending. In: Bruinsma G, Weisburd D (eds), Encyclopedia of criminology and criminal justice. Springer New York, pp 548–558.

  • Cavallaro L, Ficara A, De Meo P, Fiumara G, Catanese S, Bagdasar O, Liotta A (2020) Disrupting resilient criminal networks through data analysis: the case of Sicilian Mafia. Plos one 15(8):e0236476

  • Charette Y, Papachristos AV (2017) The network dynamics of cooffending careers. Soc Netw 51:3–13.

    Article  Google Scholar 

  • Coleman JS (1988) Social capital in the creation of human capital. Am J Sociol 94:S95–S120.

    Article  Google Scholar 

  • Cordeiro M, Sarmento RP, Brazdil P, Gama J (2018) Evolving networks and social network analysis methods and techniques. Soc Media J: Trends Connect Implications 101(2)

  • Cornish DB, Clarke RV (2002) Crime as a rational choice. Bridging the past to the future. Criminological theories, pp 77–96

  • Diviák T, van Nassau CS, Dijkstra JK, Snijders TA (2022) Dynamics and disruption: structural and individual changes in two dutch jihadi networks after police interventions. Soc Netw 70:364–374

    Article  Google Scholar 

  • Easley D, Kleinberg J (2010) Networks, crowds, and markets, vol 8. Cambridge University Press, Cambridge

    Book  MATH  Google Scholar 

  • Englefield A, Ariel B (2017) Searching for influencing actors in cooffending networks: the recruiter. Int’l J Soc Sci Stud 5:24

    Article  Google Scholar 

  • Faust K, Tita GE (2019) Social networks and crime: pitfalls and promises for advancing the field. Annu Rev Criminol 2:99–122

    Article  Google Scholar 

  • Feinberg F, Bruch E, Braun M, Falk BH, Fefferman N, Feit EM, et al (2020) Choices in networks: a research framework. Mark Lett 31(4):349–359

  • Felbab-Brown V (2013) Focused deterrence, selective targeting, drug trafficking and organised crime: concepts and practicalities. Selective targeting, drug trafficking and organised crime: concepts and practicalities

  • Feld SL (1981) The focused organization of social ties. Am J Sociol 86(5):1015–1035

    Article  Google Scholar 

  • Felson M (2003) The process of co-offending. Crime Prev Stud 16:149–168

    Google Scholar 

  • Ficara A, Fiumara G, Catanese S, De Meo P, Liu X (2022) The whole is greater than the sum of the parts: a multilayer approach on criminal networks. Future Internet 14(5):123

    Article  Google Scholar 

  • Ficara A, Fiumara G, Meo PD, Catanese S (2021) Multilayer network analysis: the identification of key actors in a Sicilian Mafia operation. In: International conference on future access enablers of ubiquitous and intelligent infrastructures, pp 120–134

  • Gambetta D (2011) Codes of the underworld. In: Codes of the underworld. Princeton University Press, Princeton

  • Gehrke J, Korn F, Srivastava D (2001) On computing correlated aggregates over continual data streams. ACM SIGMOD Rec 30(2):13–24

    Article  Google Scholar 

  • Gouldner AW (1960) The norm of reciprocity: a preliminary statement. Am Soc Rev, pp 161–178

  • Granovetter MS (1973) The strength of weak ties. Am J Sociol 78(6):1360–1380

    Article  Google Scholar 

  • Grund T, Morselli C (2017) Overlapping crime: stability and specialization of co-offending relationships. Soc Netw 51:14–22

    Article  Google Scholar 

  • Grund TU, Densley JA (2015) Ethnic homophily and triad closure: mapping internal gang structure using exponential random graph models. J Contemp Crim Justice 31(3):354–370

    Article  Google Scholar 

  • Hedström P, Swedberg R (1998) Social mechanisms: an introductory essay. Social mechanisms: an analytical approach to social theory, pp 1–31

  • Hochstetler A (2014) Co-offending and offender decision-making. In: Bruinsma G, Weisburd D (eds) Encyclopedia of criminology and criminal justice. Springer New York, pp 570–581.

  • Holland PW, Leinhardt S (1971) Transitivity in structural models of small groups. Comp Group Stud 2(2):107–124

    Article  Google Scholar 

  • Hosmer DW Jr, Lemeshow S, Sturdivant RX (2013) Applied logistic regression, vol 398. Wiley, London

    Book  MATH  Google Scholar 

  • INPEC (2021) Registro de la población privada de la libertad. Retrieved 17-05-2021, from

  • Iwanski N, Frank R (2013) The evolution of a drug co-arrest network. In: Crime and networks. Routledge, pp 64–92

  • King G, Zeng L (2001) Logistic regression in rare events data. Polit Anal 9(2):137–163

    Article  Google Scholar 

  • Kivelä M, Arenas A, Barthelemy M, Gleeson JP, Moreno Y, Porter MA (2014) Multilayer networks. J Complex Netw 2(3):203–271.

    Article  Google Scholar 

  • Malm A, Bichler G (2011) Networks of collaborating criminals: assessing the structural vulnerability of drug markets. J Res Crime Delinq 48(2):271–297.

    Article  Google Scholar 

  • McCarthy B, Hagan J (2001) When crime pays: capital, competence, and criminal success. Soc Forces 79(3):1035–1060

    Article  Google Scholar 

  • McCarthy B, Hagan J, Cohen LE (1998) Uncertainty, cooperation, and crime: understanding the decision to co-offend. Soc Forces 77(1):155–184.

    Article  Google Scholar 

  • McFadden D (1974) Conditional logit analysis of qualitative choice behavior. In: Zarembka P (ed) Frontiers in econometrics. Academic Press, New York, pp 105–142

    Google Scholar 

  • McFadden D (1981) Econometric models of probabilistic choice. Structural analysis of discrete data with econometric applications, 198272

  • McGloin JM, Nguyen H (2012) It was my idea: considering the instigation of co-offending. Criminology 50(2):463–494

    Article  Google Scholar 

  • McGloin JM, Piquero AR (2010) On the relationship between co-offending network redundancy and offending versatility. J Res Crime Delinq 47(1):63–90

    Article  Google Scholar 

  • McGloin JM, Sullivan CJ, Piquero AR, Bacon S (2008) Investigating the stability of co-offending and co-offenders among a sample of youthful offenders. Criminology 46(1):155–188

    Article  Google Scholar 

  • McGloin JM, Thomas KJ (2016) Incentives for collective deviance: group size and changes in perceived risk, cost, and reward. Criminology 54(3):459–486

    Article  Google Scholar 

  • Mitzenmacher M (2004) A brief history of generative models for power law and lognormal distributions. Internet Math 1(2):226–251

    Article  MathSciNet  MATH  Google Scholar 

  • Molm LD (1997) Coercive power in social exchange. Cambridge University Press, Cambridge

    Book  Google Scholar 

  • Morselli C (2009) Inside criminal networks, vol 8. Springer, Berlin

    Google Scholar 

  • Morselli C, Giguère C, Petit K (2007) The efficiency/security trade-off in criminal networks. Soc Netw 29(1):143–153.

    Article  Google Scholar 

  • Morselli C, Petit K (2007) Law-enforcement disruption of a drug importation network. Global Crime 8(2):109–130

    Article  Google Scholar 

  • Newman M (2018) Networks. Oxford University Press, Oxford

    Book  MATH  Google Scholar 

  • Nieto A, Davies T, Borrion H (2022) “Offending with the accomplices of my accomplices’’: evidence and implications regarding triadic closure in co-offending networks. Soc Netw 70:325–333

    Article  Google Scholar 

  • Opsahl T, Hogan B (2011) Modeling the evolution of continuously-observed networks: communication in a facebook-like community. arXiv preprint arXiv:1010.2141

  • Overgoor J, Benson AR, Ugander J (2019) Choosing to grow a graph: modeling network formation as discrete choice. The World Wide Web Conference

  • Overgoor J, Pakapol Supaniratisai G, Ugander J (2020) Scaling choice models of relational social data. In: Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery and data mining, pp 1990–1998

  • Papachristos AV (2011) The coming of a networked criminology. Adv Criminol Theory 17:101–140

    Google Scholar 

  • Plickert G, Côté RR, Wellman B (2007) It’s not who you know, it’s how you know them: who exchanges what with whom? Soc Netw 29(3):405–429

    Article  Google Scholar 

  • Reiss AJ (1986) Co-offending influences on criminal careers. Criminal careers and career criminals

  • Reiss AJ (1988) Co-offending and criminal careers. Crime Justice 10:117–170.

    Article  Google Scholar 

  • Robins G (2009) Understanding individual behaviors within covert networks: the interplay of individual qualities, psychological predispositions, and network effects. Trends Organized Crime 12(2):166–187.

    Article  MathSciNet  Google Scholar 

  • Sarnecki J (2001) Delinquent networks: youth co-offending in Stockholm. Cambridge University Press, Cambridge

    Book  Google Scholar 

  • Simonsohn U, Simmons JP, Nelson LD (2020) Specification curve analysis. Nat Hum Behav 4(11):1208–1214

    Article  Google Scholar 

  • Simonson I, Tversky A (1992) Choice in context: tradeoff contrast and extremeness aversion. J Mark Res 29(3):281–295

    Article  Google Scholar 

  • Smith TB (2021) Gang crackdowns and offender centrality in a countywide co-offending network: a networked evaluation of operation triple beam. J Crim Just 73:101755

    Article  Google Scholar 

  • Snijders TA, Van de Bunt GG, Steglich CE (2010) Introduction to stochastic actor-based models for network dynamics. Soc Netw 32(1):44–60

    Article  Google Scholar 

  • Stadtfeld C, Block P (2017) Interactions, actors, and time: dynamic network actor models for relational events. Sociol Sci 4(14):318–352.

    Article  Google Scholar 

  • Thrasher FM (1963) The gang: a study of 1313 gangs in Chicago. University of Chicago Press

  • Train KE (2009) Discrete choice methods with simulation. Cambridge University Press, Cambridge

    MATH  Google Scholar 

  • Tremblay P (1993) Searching for suitable co-offenders. Routine activity and rational choice, vol. 5, pp 17–36

  • van Mastrigt SB (2017) Co-offending and co-offender selection. The Oxford handbook of offender decision making, 6, 338.

  • Van Mastrigt SB, Farrington DP (2011) Prevalence and characteristics of co-offending recruiters. Justice Q 28(2):325–359

    Article  Google Scholar 

  • Warr M (1996) Organization and instigation in delinquent groups. Criminology 34(1):11–37

    Article  Google Scholar 

  • Warr M (2002) Companions in crime: the social aspects of criminal conduct. Cambridge University Press, Cambridge

    Book  Google Scholar 

  • Wasserman S, Faust K (1994) Social network analysis: methods and applications, vol 8. Cambridge University Press, Cambridge

    Book  MATH  Google Scholar 

  • Weerman FM (2003) Co-offending as social exchange: explaining characteristics of co-offending. Br J Criminol 43(2):398–416.

    Article  Google Scholar 

  • Weerman FM (2014) Theories of co-offending. Encyclopedia of criminology and criminal justice 5173–5184.

Download references


Colfuturo (Colombia) and the University College London, through the UCL-Overseas Research Scholarship and the Dean’s Prize-Faculty of Engineering, supported Alberto Nieto throughout the completion of this research article.

Author information

Authors and Affiliations



All the authors contributed equally to this article. The final manuscript was read and approved by all of them.

Corresponding author

Correspondence to Alberto Nieto.

Ethics declarations

Competing interests

The authors declare that they have no competing interests

Additional information

Publisher’s Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.


Appendix A: Sensitivity analysis of control cases

The regression coefficients of discrete choice models can be biased when the proportion of 1’s (i connection with j) to 0’s is small - i.e., a large number of potential accomplices exist, but incoming co-offenders select only one. King and Zeng (2001) suggested using some control cases to prevent introducing a bias, such that any additional case included would not significantly increase the model’s significance or decrease coefficients’ standard errors.

We conducted two sensitivity analyses to determine the number of control cases: one for the network with 4286 offenders and one for the other two. Both analyses used in-degree as a proxy of popularity. We used 5, 10, 20, 30, 40, and 60 control cases for the largest network and 2, 4, 6, 8, 10, 12, 14, 16, 18, and 20 for the one with 227 offenders. Since the analytical strategy implied using a simulated version of the original network, we simulated the network 100 times for each number of control cases.

The Wald \(\chi ^2\) statistic allowed us to assess the significance of the models. Figure 7 presents the mean value of this statistic in each round of iterations and for each number of control cases. Figure 8 shows the mean value of standard errors for each independent variable (i.e., the four growth mechanisms considered). Considering how the Wald (\(\chi ^2\)) statistic and the standard errors behaved for each number of control cases, we considered that 30 control cases were an appropriate number to strike a balance suggested by King and Zeng (2001).

Fig. 7
figure 7

Mean value of the Wald statistic observed for each iteration using multiple number of control cases for the network with 4286 nodes

Fig. 8
figure 8

Mean value of standard errors yielded after 100 simulations for a indegree, b reinforcement, c reciprocity, and d triadic closure. Network: 4286 nodes

Figures 9 and 10 present similar figures for the network with 227 nodes. Based on these results, we decided to use ten control cases for this network. Since the number of nodes is roughly similar, we also used the same number of control cases when analysing the network with 211 offenders.

Fig. 9
figure 9

Mean value of the Wald statistic observed for each iteration using multiple number of control cases for the network with 270 nodes

Fig. 10
figure 10

Mean value of standard errors yielded after 100 simulations for a indegree, b reinforcement, c reciprocity, and d triadic closure. Network: 270 nodes

Appendix B: Graphical results of models

To summarise our results, we use an approach inspired by the ‘specification curve analysis’ method recently proposed by Simonsohn et al. (2020). This involves plotting the fitted coefficients from the 1000 models on a curve, ordered from lowest to highest and marked according to whether they were statistically significant. Viewing the results in this way allows the distribution of results across all possible realisations—in this case corresponding to directionality and ordering—to be seen. These can be summarised by reporting the median coefficient across all models and the statistically significant proportion (Figs. 11, 12, 13, 14, 15, 16).

Fig. 11
figure 11

Results of the model for the network with 4286 offenders jointly testing four growth mechanisms: a popularity (indegree as a proxy), b reinforcement, c reciprocity, and d triadic closure

Fig. 12
figure 12

Results of the model for the network with 4286 offenders jointly testing four growth mechanisms: a popularity (instrength as a proxy), b reinforcement, c reciprocity, and d triadic closure

Fig. 13
figure 13

Results of the model for the network with 227 offenders jointly testing four growth mechanisms: a popularity (indegree as a proxy), b reinforcement, c reciprocity, and d triadic closure

Fig. 14
figure 14

Results of the model for the network with 227 offenders jointly testing four growth mechanisms: a popularity (instrength as a proxy), b reinforcement, c reciprocity, and d triadic closure

Fig. 15
figure 15

Results of the model for the network with 211 offenders jointly testing four growth mechanisms: a popularity (indegree as a proxy), b reinforcement, c reciprocity, and d triadic closure

Fig. 16
figure 16

Results of the model for the network with 211 offenders jointly testing four growth mechanisms: a popularity (instrength as a proxy), b reinforcement, c reciprocity, and d triadic closure

Rights and permissions

Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Nieto, A., Davies, T. & Borrion, H. Examining the importance of existing relationships for co-offending: a temporal network analysis in Bogotá, Colombia (2005–2018). Appl Netw Sci 8, 4 (2023).

Download citation

  • Received:

  • Accepted:

  • Published:

  • DOI: