The intelligence cycle and the ROXANNE platform

Figure 1: The intelligence cycle (adapted from [1])

The lifecycle of criminal investigations can be modelled using the concept of the intelligence cycle of Figure 1, which includes the following phases:

• Direction/Planning: A new case is brought to law enforcement agency’s attention and a set of questions are formulated. These questions express a requirement for an investigation focusing on a subject or a range of subjects of concern, a risk, threat or opportunity. Examples of questions are:
  • Who is central in this criminal organization?
  • Which communication links are most worth monitoring?
  • How often are the interactions?
  • Who is the initiator of the interactions?
  • The removal or incapacitation of which individuals would sever a criminal group?
• Collection: After the set of questions are clearly defined, the law enforcement practitioners need to follow a data collection plan in which the specific data items needed, possible sources of information are identified and eventually the relevant data are obtained. There are several categories of data sources that are used by law enforcement agents, such as:
  • closed information sources (e.g., those collected for a specific purpose with limited access and availability to the general public such as a car license plate register),
  • classified information collected by specifically tasked covert means including use of human and technical resources (also known as Image intelligence and Signals Intelligence),
  • open information sources (i.e., those that are publicly available such as popular social networks), and
  • seized documents, biometrical data and digital media (e.g., smartphones and laptops). 
• Evaluation: The validity and accuracy of the data obtained is assessed, which heavily depends on the reliability of the source. For example, open information sources need to be carefully examined as these can frequently be biased or inaccurate.
• Collation/Processing: The data that were found to be relevant and accurate is transferred into a digital storage system in a structured way (e.g., indexed and cross-referenced) that permits authenticated and timely access. Any further processing, such as use of translation software for dealing with data in foreign languages is also performed during this step, while maintaining chain of custody (i.e., a complete record of data lifecycle and each person who accessed it) for ensuring integrity.
• Analysis: In this phase the investigator examines the data by querying and filtering the digital storage system and performs temporal, subject, object and statistical analysis for identifying linkages between the data that convey useful information. By combining different pieces of information and information about the context the investigators obtain intelligence about trends and patterns.
• Dissemination: The intelligence developed during the analysis phase is disseminated to the rest investigative team using formal reports or presentations with supporting documentation. In this way, candidate answers to the questions posed are given, information gaps are highlighted and decisions on how to proceed are taken, e.g., new questions are posed, and responsibilities are assigned. This leads to a new intelligence cycle, where the scope may be broader or narrower, depending on the quality of intelligence already obtained. The path from data to information, to intelligence and eventually to decisions can be modelled using the pyramid in the figure below.

                                                   Figure 2: From data to decisions pyramid (adjusted from [2])

The ROXANNE platform aims to support law enforcement practitioners in several phases of the investigation process outlined above. In particular, the ROXANNE platform supports with:

• Collation/Processing phase by processing and combining data of various modalities (e.g., audio, text and video) for automating the most time-consuming tasks during evidence extraction. In future releases, support for user management (i.e., account creation, removal, update, view) and case management (i.e., creation, edit, overview, collaboration and chain of custody) will be added, as well.
• Analysis phase by automatically producing information on the entities (e.g., persons engaged in a phone call and/or appearing on a video footage) and their importance, as well as the topics that are discussed and the languages used. The user is offered with a wide range of visualisation schemes and filters to choose from so that different inferences can be formulated and tested.

Future releases of the ROXANNE platform intend to support law enforcement practitioners in other phases of the investigation cycle. In particular, ROXANNE will be supporting:

• the Evaluation phase by supporting practitioners to judge the outputs and adjust them, so the accuracy of the AI-based technologies are improved in the long run.
• the Dissemination phase by generating reports that can be used in court, as well as exporting the outputs in other commercial platforms that can be shared with other colleagues.

References

1. “Criminal Intelligence for Front Line Law Enforcement”, The United Nations Office on Drugs and Crime, 2010, available online from https://www.unodc.org/documents/organized-crime/Law-Enforcement/Criminal_Intelligence_for_Front_Line_Law_Enforcement.pdf
2. https://publichealthmatters.blog.gov.uk/2018/12/05/from-data-to-decisions-building-blocks-for-population-health-intelligence-systems/