3.6 Types of Link Analysis

3.6 Types of Link Analysis

Link analysis is the process of building up networks of interconnected objects or items over time and the use of special techniques and software tools for forming, examining, modifying, analyzing, searching, and displaying these patterns of behavior, especially for the investigative data miner. These objects or items may consist of entities, events, and associations. Typically, the entities of interest include:

  • Places, such as a physical or IP address, or geo code coordinate, such as latitude

  • Organizations, such as cells, gangs, governments, commercial or military units

  • Facilities, such as factories, airports, hotels, schools, warehouses

  • Individuals, such as names, titles, or identification numbers

  • Components, such as chemicals, fertilizers, masks, acids

  • Documents, such as passports, driver licenses, e-mails

  • Money, such as cash, wire transfers, money orders

  • Weapons, such as guns, knifes, rifles, bombs

  • Vehicles, such as planes, trucks, boats, cars

  • Drugs, such as type, weight, source

Additionally, for entities, such as a suspect, other more detailed dimensions may be available, such as name, aliases, gender, membership, affiliation, relegion, marital status, citizenship, race, date of birth, occupation, country of origin, hair color, eye color, height, weight, countries visited, among other things.

For events the nature of the investigation is the determiner of the dimensions in the data. For example, for counter-drug analysts, this may include processing, purchasing, transportation of drugs, planning, meeting, cartel association, region affiliation, training or educational background, military background, and communication about drugs. On the other hand, for counter-terrorist intelligence analysts those events may include the dimensions of training in weapons and tactics, affiliations to groups, place of birth, bombing, hijacking, killing, hostage-taking, countries visited, buying and stealing of weapons, the sending and receiving of money, and the purchases of materials for the assembling of weapons of mass destruction.

3.7 Combating Drug Trafficking in Florida with Link Analysis: A Case Study

By its very nature, drug trafficking involves some organization—transportation, distribution and sales "channels"—all of which try to keep themselves hidden. Investigating such organizations may require correlating apparently unrelated information and finding submerged links between people and organizations. The growing amount of online data could make this work easier if access to it were automated.

Florida's St. Petersburg Police Department had more online data than could be known or effectively used by detectives in the course of routine investigations. They had 10 years of data in a fairly sophisticated database from which they could extract fields and look up information. The department had been sharing the data with the Pinellas County Sheriff's office for five years. They had not, however, been able to extract information from the narratives of crime reports. Under the department's system, officers entered basic information about an incident into an online form. This form included such things as the names of involved parties, the time of the incident, etc.

Officers did not, however, type the narrative descriptions of the incident. Instead, they dictated the narratives, which were later transcribed. This method saved officers time and had proven much more cost-efficient. When the narratives were later transcribed, they were electronically associated with the basic data entered by the detectives. Although the narrative data had technically always been available online, the existing software couldn't search the narratives, let alone do link analysis.

Development of a system to access narrative data began when representatives of the federal Counterdrug Technology Assessment Center (CTAC) approached the department. CTAC falls under the Office of National Drug Control Policy and is the central counterdrug enforcement research and development organization of the U.S. government. CTAC interviewed 30 narcotics detectives, asking them, if they could have a computer do anything for them, what would it be? Following the initial meetings, the University of Tennessee got involved to do the application development. Rather than suggesting theoretical solutions from afar, the university took the time to find out what was really needed by the field investigators. They worked with them in the field to understand their information needs.

What came out of this design phase was a plan for several applications, collectively known as the West Florida Counterdrug Investigative Network (WFCIN). The first application to be implemented gives officers the ability to query the information contained in the online narrative reports. This is done using a Web interface that talks through a backend process to the existing database system: The University of Tennessee developed both the interface and the backend. For example, if a detective receives a report of an incident in which a drug dealer used a specific type of gun, he can enter the gun type and get back a standard HTML page with links to narrative reports in which that type of gun is mentioned.

A second application to be implemented will stores images—surveillance photographs, evidence photographs, or scanned newspaper articles—linking them to criminal cases. The application automatically stores and links images to cases; so, say there are 100 images on a case, and one is a photograph of a gun under a bed. The user can go into the comments section and type in "gun under bed." The application links the comments to the photo and stores that information. The comments become part of the case file; so, if another investigator types in "gun under bed," it will not only search the narratives, but also the associated photos. Searches will return links to both the text-based narrative and the images associated to that case.

The network's image-carry capacity extends to real-time audio and video for teleconferencing—or for sharing video monitoring tapes with law enforcement officers in other jurisdictions. Another application will provide "link analysis" for graphically displaying connections between individuals, groups, and organizations. This kind of functionality can help locate associations that otherwise would have gone unnoticed, and that may be key to developing a case or directing an investigation.

The data mining applications being developed and used by the St. Petersburg Police Department are still in the beginning stages, but they show the promise of things to come. A complete, integrated package that allows investigators to search across jurisdictions for common characteristics and to build link analysis charts to help identify key culprits and their associates will help bring crime investigation and prosecution into the twenty-first century.