Leadership targeting has limited strategic value if the assessment begins and ends with rank, visibility, or network prominence. Its operational value lies in identifying what may stop working after removal and what the organization could restore without that leader.
The previous analysis of the kingpin strategy examined why leadership removal can produce prolonged disruption in one organization and barely interrupt another. Here the analysis moves to the period before intervention. Analysts need a defensible basis for estimating how much the organization actually depends on the person they intend to remove.
Why this matters: we are developing a framework to structure that pre-removal assessment. It identifies what appears to depend on the leader and how the organization might bypass that dependency. Observation after the operation then tests whether those assumptions were sound. At this stage, the framework remains an analytical hypothesis under development rather than a validated scoring instrument.
Centrality does not tell us what will stop working
Network analysis can identify highly connected actors, brokers between groups, or people positioned close to important flows. That information remains valuable, but dependency asks a different question.
Centrality shows where a leader sits. Functional concentration asks what stops working when that leader disappears.
Consider two leaders with similar network prominence. One approves major payments, but trusted lieutenants routinely do the same when necessary. The other settles disputes among local commanders who refuse to negotiate directly with one another. Both can occupy central positions, yet losing them exposes very different weaknesses.
Functional concentration appears when important activities repeatedly return to the same person. Investigators may find that suppliers require his authorization, territorial disputes consistently reach him, or access to a particular resource depends on his approval. Counting responsibilities is less informative than identifying what other actors cannot readily do without him.
The earlier kingpin strategy analysis introduced that dependency problem. Pre-removal assessment tries to identify it while there is still time to shape the intervention around what intelligence reveals.
Some relationships do not transfer with the position
A network map may show a relationship between a leader and a supplier, financial intermediary, local commander, or public official. The line says that a connection exists. It says much less about whether another person can inherit it.
A supplier may extend credit because the leader has honored commitments for years. A financial intermediary may accept instructions from him but distrust a newly appointed successor. An official providing illegal protection may tolerate contact with one familiar actor and refuse someone unknown because the personal risk has changed.
Trust, reputation, and personal guarantees often remain invisible in ordinary connection maps, yet they can decide whether an arrangement survives the leader’s removal.
We describe this characteristic as relational uniqueness. Analysts need to establish what the relationship provides and how easily another actor could reproduce it. A useful question is
Which relationship sustains which function, and how difficult would it be for someone else to reproduce it?
This connects leadership assessment with critical couplings. A leader does not need to control many activities to become strategically consequential. One personal relationship may preserve access to money, a supply route, institutional protection, or an agreement among actors who otherwise would not cooperate.
How could the organization restore what it loses?
The existence of a potential successor does not mean that the lost capability will return.
Criminal networks have more alternatives than the formal second-in-command. Local commanders can divide responsibilities among themselves. An outside intermediary can reopen a payment route. Another supplier may accept a higher price. A rival organization may provide temporary access to infrastructure that the removed leader previously controlled.
The CRIMOR Tetrahedron broadens the search beyond the internal hierarchy. A replacement can emerge through an illicit market, another network, a facilitating institutional relationship, or decisions made by people who reassess their interests after removal.
Analysts therefore need to map plausible substitution pathways, not only possible successors.
| Possible substitution pathway | What analysts should examine |
|---|---|
| Lieutenant → same intermediary | Whether personal access can transfer to another actor without interrupting payments, supply, or protection. |
| Distributed command → alternative channel | Whether several actors can divide the lost responsibilities and restore coordination without recreating the former leadership structure. |
| Rival network → negotiated access | Whether the function can migrate outside the original organization through new suppliers, routes, intermediaries, or criminal partnerships. |
The pathway may exist and still fail. A lieutenant can know how payments work but lack credibility with the people who receive them. Suppliers may refuse his guarantees. Local commanders can formally acknowledge a new leader while ignoring his decisions. An intermediary may cooperate for several days and withdraw when the risks become clearer.
Human decisions matter throughout this process. Some actors follow out of fear. Others wait, defect, negotiate better terms, or test whether competing claimants can offer more protection. Availability alone therefore says little about whether a substitute will become effective or remain effective under pressure.
What can analysts assess before removal?
For now, three areas provide a practical structure for organizing the available intelligence.
| Assessment area | What the evidence should help establish |
|---|---|
| Functional concentration | Which activities repeatedly return to the leader? Look for personal authorization, arbitration, control over access, and decisions that subordinates rarely make without him. |
| Relational uniqueness | Which arrangements rely on personal trust, reputation, exclusivity, or guarantees that another actor may not inherit? Historical continuity and previous failed substitutions can be especially revealing. |
| Substitution capacity | Who or what could restore payment, supply, discipline, access, or coordination? Examine previous substitutes, redundant routes, autonomous actors, external intermediaries, and plausible alternative arrangements. |
These conditions can be investigated before the intervention. Expected recomposition speed belongs to another category. It is a forecast derived from what analysts know about those conditions and from the network’s previous behavior.
An organization with autonomous local commanders, tested financial alternatives, and several established suppliers may recover quickly. Another may look large and sophisticated while relying on one personal relationship that nobody has successfully replaced.
The assessment should also record how strongly the evidence supports each assumption. Some findings will rest on repeated observations. Others may remain plausible but indirect. There is little value in hiding that difference behind a numerical score.
Dependency is not the same as vulnerability
A criminal activity may depend heavily on one leader and still recover quickly if a reliable alternative already exists. Dependency is not the same as vulnerability.
Dependency concerns what relies on the leader. Vulnerability appears when removal exposes that reliance and the available alternatives prove weak, expensive, or slow.
Consider a leader who personally controls access to a financial intermediary. The dependency may be high. If another trusted actor can use the same intermediary the following morning, the vulnerability is limited.
Another leader may control only one external relationship, but no one else has the trust, access, or reputation required to reproduce it. That narrower dependency could offer a more consequential opportunity.
The state also enters the equation. A vulnerability in the criminal network does not produce sustained disruption by itself. Authorities must recognize the opening and act before replacement arrangements stabilize.
If a financial relationship becomes unstable, investigators may have only a short interval to identify who tries to restore it. A succession conflict may expose communications that previously remained hidden. Those advantages disappear when the new arrangement settles.
A good dependency assessment therefore cannot stop with the criminal organization. It also needs a realistic view of whether the institutions involved can act on what the operation may expose.
When the forecast meets the response
Before removal, analysts can estimate. After removal, criminal actors begin supplying evidence.
Suppose intelligence suggests that access to a financial intermediary depends personally on the leader and will remain disrupted for several weeks. Payments resume two days later through someone the investigation had not identified.
The forecast failed, but the failure is informative. The network contained a substitution pathway that analysts had missed.
The opposite can happen. Intelligence may identify an obvious lieutenant and assume that succession will occur quickly. Suppliers then refuse to work with him, local commanders challenge his authority, and payments become unreliable.
Comparing the forecast with what returned, moved elsewhere, or remained broken gives the institution a basis for revising its next assessment.
hypothesis → intervention → observed adaptation → institutional learning
A perfect initial forecast is unlikely in an adaptive criminal environment. The more important capability is to record where expectations diverged from behavior and use that difference to improve the next intervention.
That comparison is the role of crime adaptation sensors. They help analysts follow whether payment channels reopen, supply changes, unfamiliar intermediaries appear, authority becomes distributed, or coordination returns through arrangements that did not exist before the operation.
Crime Adaptation Sensors: Why Public Security Must Measure How Crime Learns
Crime adaptation sensors reveal when public security learns, and when organized crime only moves, hides, replaces, and adapts.
Turning assessment into institutional memory
The value of the framework lies in making assumptions explicit before authorities act. If analysts believe that a relationship depends personally on the leader, they should record the evidence. If they expect payment, supply, or command to return through a particular route, that pathway should also appear in the assessment.
After removal, the organization tests those assumptions through its own behavior. A supposedly unique relationship may recover almost immediately. An obvious successor may prove incapable of securing cooperation. A financial function may return through another organization rather than through the original network.
The institution gains something only when those observations survive the operation and influence the next decision. This is the bridge between targeting and institutional learning: each intervention can improve the next assessment if analysts compare what they expected with what the criminal system actually rebuilt.
Crime Adaptation Sensors: Why Public Security Must Measure How Crime Learns addresses the post-removal side of the same problem by showing how analysts can follow the return, displacement, or continued disruption of payment, supply, authority, and coordination after the original dependency has been exposed.