Here are three articles on uncovering and disrupting insurgent networks. Decentralized network insurgencies are organized differently than the hierarchical Mao Zedung model. They require different strategies to defeat. These techniques can be adapted to a Counterinsurgency strategy.
Martin J. Muckian Structural Vulnerabilities of
Networked Insurgencies

Tsvetovat and Carley Structural Knowledge and Success of Anti-Terrorist Activity

Carley, Lee and Krackhardt Destabalizing Networks

The first problem discussed in “Structural Knowledge” is that insurgent networks remain hidden. COIN forces lack knowledge of the structure so they must uncover covert networks node by node and estimate what the structure looks like. Then you encounter the second problem – not all enemy structures look the same.

Intel methods have to map out each individual social networks. Networks change over time as individuals join or leave the cell. Insurgent cells try to adapt and hide, so if they are detected, they change structure and attempt to evade. Tsvetovat and Carley experiment with different methods to discover how to identify critical nodes and which ones provide the greatest disruption effect.

Discovering and disrupting “gateway” nodes can cut off flows throughout the social network. This interrupts communication and material flows – so orders or bomb materials cannot reach all the cells. This is only a temporary effect – the terrorist cell will redistribute the loads to different gateway nodes, or decentralize their distribution system even more to make it more resilient against future attack.

It turns out disrupting the flow of “knowledge” is the most effective disruption tactic:

They conclude:

Due to the dynamism of covert networks and their ability to self-heal using low-priority links and referential data, it is also unclear that separation of a covert network into components is the desired outcome of an isolation event. In our virtual experiments, the covert network was able to recover quickly from isolation of individuals in a gatekeeper position, while removal of key experts resulted in permanent damage. Thus, destabilization strategies that only consider the connections between agents are not sufficient. One needs to take into account properties such as knowledge and resource distribution, as well as to analyze the dynamic processes that reshape the network as it is being acted upon.

Disrupting Networks (pdf)
They first define destabalization. This measures the ability of a social network to adapt and recover from attacks. A real disruptive attacks prevents recovery.

-One is where the rate of information flow through the network has been seriously reduced, possibly to zero.
-A second is that the network, as a decision-making body, can no longer reach consensus, or takes much longer to do
-A third is that the network, as an organization, is less effective; e.g., its accuracy at doing tasks or interpreting information has been impaired.

Hierarchical networks are vulnerable to leadership decapitation through assassination strategies. Assassination is ineffective against decentralized networks, because they have a high redundancy of independent local leaders and can quickly “rewire” the connections in the network to replace fallen leaders.

So looking beyond command and control, there are other processes in the network which may be vulnerable:

The dynamics are a function of not just the social network, but a meta-matrix of networks – not the least of which are the knowledge network (who knows what), the information network (what ideas are related to what), and the assignment network (who is doing what)

What they find is that the key individuals in a network at not necessarily those in the structural center, but those with the highest cognitive load. They bear knowledge, expertise, assignments, and have superior individual capability relative to others in the node. High cognitive load bearing individuals are critically needed in a social network.

While leadership is redundant, other critical skills may not be. When intel maps out social networks, they have to analyze all possible flows in a network, not just its structural organization.

Structural Vulnerabilities of Networked Insurgencies
Muckian concurs with the theory that assassinations are ineffective. He makes some suggestions about targetting vulnerabilities in networked insurgencies. Many of his suggestions are targetting logistical flows – financial, bomb making experts, material distribution, etc. Removing key experts and shutting down resource flows can have a destabilization effect.

Disrupting enemy communications and “knowledge” centers can do the most damage to a network by eliminating or restricting its ability to share information and coordinate its activity.

Enemy-centric tactics like Counterterrorism will not be especially effective against network insurgencies and Terorrist networks. Networks are covert, adaptable, and decentralized. They are difficult to uncover, difficult to destabilize, and they are very adaptable.

One great weakness of network insurgency is their small and inadequate logistical system. Hierarchies are better organized and can manage a larger flow of men and material.

A second great weakness is that they may have too many separate leaders who may come into conflict with one another.

Proper tactics may be to isolate networks from the civilian resource base (via COIN population centric tactics), use CT enemy-centric tactics to try and keep the enemy off-balance, and try to “disaggregate” the network insurgency by dividing the leadership with political wedge issues.