An example of why crime analysis is rewarding...

Elements to Consider in a Case

 We start with who, what, where, when, how, and why... then we drill down.

Is Your Agency Considering a New RMS?

A new guide, as described below, is available at this link. Every crime analyst should be at the table when an agency is looking for and purchasing an RMS system, since information is crucial to our work.

"Ashburn, Va., April 21, 2021 - The IJIS Institute is pleased to announce the release of a critical publication entitled Standard Functional Specifications for Law Enforcement Records Managements Systems, Version III. This significant accomplishment was the effort of the Records Management Systems (RMS) Standards Task Force, a joint group formed by the IJIS Institute's Law Enforcement Advisory Committee (LEAC) and the International Association of Chiefs of Police (IACP) Criminal Justice Information Systems (CJIS) committee.

The guidelines have been produced to support agency policy development, request for proposal development, law enforcement training development and delivery, and an overall general understanding of what should be included as part of a records management system."

Also see, at this link: International Association of Crime Analysts (IACA), RMS Technical Requirements for Crime Analysis, Standards, Methods, & Technology (SMT) Committee White Paper 2013-01 August 2013

TII's Free OSINT and Online Research Resources

Toddington International Inc.'s Free OSINT and Online Research Resources page provides links related to topics listed below. The resource is available at this link.

You can search on the "choose a subject category" (from this list), or in the "I need resources to help me find" search bar. A useful site!

If You Find Nothing

If you are a new analyst, you might take it personally when you go over a select group of crimes and find no patterns, or analyze a set of phone or bank records in an investigation and see nothing that is of value.

This is normal. But no one tells you that!

Analysts spend a great deal of time filtering through various forms of data looking for information that will be of value, and often they can spend hours, days, even weeks analyzing with no result. 

It's not necessarily you!

Yes, if you are a crime analyst, you should spot patterns in high volumes of robberies and burglaries, because there are likely repeat offenders committing more than one crime. But in a small jurisdictions, patterns are less frequent than in a large metropolitan area. That is normal.

Unfortunately, often you won't know if you missed patterns; sometimes you will find out when others find them ahead of you. That is normal, too.

If you are an intelligence or investigative analyst, you may often have a multitude of records to sift through. There is never a guarantee that you will find clues that can lead to arrest and prosecution. 

Once I worked through thousands of records for four months and it resulted in nothing. Our job is to dig.

If you find nothing when nothing is there, you are doing a great job!

Preparing for Autonomous Vehicles

 Preparing for Autonomous Vehicles is a webinar by the Justice Clearinghouse with dates scheduled in May 2021; registration is available at this link.

"Autonomous vehicles (AVs) promise many benefits, but questions remain about how law enforcement officers will interact with them. Officers likely will encounter new challenges related to technology, procedures, and constitutional authorities.  However, there are considerable misconceptions regarding the current state of AV technology and pace of adoption.  While many believe we are at the cusp of widespread AV use, the reality which law enforcement will be facing is different.  In the near-term future, law enforcement will deal with many of the same traffic-related challenges with AVs and with non-AVs, though with some added difficulty in the limited number of AV cases.  This webinar will provide a basic walkthrough of what AVs are, the broad state of the field, and some of the high-priority needs of law enforcement in the short- and long-term.  Though short-term issues are important, numerous experts in AV agreed law enforcement should begin proactive preparations to address longer-term challenges before being forced into reactive changes. Key areas of interest for law enforcement are: designing a means of communicating with AVs that also maintains cybersecurity; improving stakeholder communication and collaboration; and developing standard procedures, guidelines, and training needs for law enforcement interacting with AVs."

An interesting topic!

The American Society of Evidence-Based Policing Call for Papers

The American Society of Evidence-Based Policing is holding a conference in August and is seeking research in any topic relevant to policing - which, of course, includes crime and intelligence analysis. Submission deadline is May 15th.

Crime Analysis in The News

 FSU brings together local law enforcement and criminology researchers at new real-time crime center is an interesting article available at this link.

"The HCSO Crime Analysis Unit says they identified a suspect because of the similarity to a burglary committed in Hernando County several years prior." Read the article here.

One benefit of having an established  crime analysis unit is that they can link similar crimes over long periods of time.

A crime analyst did not help in the following case - a Tesla car did:

A Tesla Helped Police Track Down a Hate Crime Suspect Accused of Burning Down a Black Church is available at this link.

DEA's 2020 National Drug Threat Assessment

The US Drug Enforcement Administration's 2020 National Drug Threat Assessment is available at this link.

"The 2020 COVID-19 pandemic and the associated restrictions on daily travel, U.S. border closings, closure of nonessential businesses, and the broad shelter-in-place orders temporarily posed new challenges to criminal organizations and their movement of drugs throughout the United States during the first half of 2020. Global drug markets reported fluctuations in pricing, availability, transportation, and distribution of illicit drugs during the initial stages of the pandemic in the spring of 2020. Despite initial disruptions in drug smuggling, transportation, and distribution, transnational criminal organizations operating throughout foreign countries and in the United States continued to test new methods and use existing techniques to continue operating during the COVID-19 pandemic."

Analysts at a variety of agencies support narcotics investigations.

See a Sinaloa Cartel chart at this link.

See a chart used for identifying assets at this link.

How could you improve those charts?

This was an interesting chart in the .020 National Drug Threat Assessment. I think "lost in transit" means stolen; don't you?

Infographics

I stumbled across The Future of Crime Analysis Infographic and thought it was very clever. You can find it at this link.

I did not use infographics as an analyst, but they could be great tools to help you visualize information. I used Canva to make the Infographic below. Get creative!

TERRORISM SNAPSHOTS

TERRORISM SNAPSHOTS, available at this link,  is "an overview of domestic and international terrorist groups and the threats these organizations present to the State of New Jersey."

It looks like these analytical summaries would be helpful to others.

The source is:

The New Jersey Office of Homeland Security and Preparedness (NJOHSP) leads and coordinates New Jersey’s counterterrorism, cybersecurity, and preparedness efforts while building resiliency throughout the State. 

Visit their Analysis page at this link.

The 2021 Annual Threat Assessment Report

The 2021 Annual Threat Assessment Report  from the Office of the Director of National Intelligence is available a this link. While it may seem to have nothing to do with your job as a law enforcement analyst, being informed about serious threats does make sense. You are the eyes and the ears on the ground.

"This annual report of worldwide threats to the national security of the United States responds to Section 617 of the FY21 Intelligence Authorization Act (P.L. 116-260). This report reflects the collective insights of the Intelligence Community (IC), which is committed every day to providing the nuanced, independent, and unvarnished intelligence that policymakers, warfighters, and domestic law enforcement personnel need to protect American lives and America’s interests anywhere in the world.

This assessment focuses on the most direct, serious threats to the United States during the next year. The order of the topics presented in this assessment does not necessarily indicate their relative importance or the magnitude of the threats in the view of the IC. All require a robust intelligence response, including those where a near-term focus may help head off greater threats in the future, such as climate change and environmental degradation.

As required by the law, this report will be provided to the congressional intelligence committees as well as the committees on the Armed Services of the House of Representatives and the Senate.

Information available as of 9 April 2021 was used in the preparation of this assessment."

Updated TikTok Law Enforcement Guidelines

 Updated TikTok Law Enforcement Guidelines are available at this link.

"TikTok is committed to cooperating with law enforcement while respecting the privacy and other rights of our users. To achieve this, we have internal policies and procedures governing how we handle and respond to law enforcement requests. These require that we disclose user data only where a request is based on a valid legal process or in emergency circumstances.

All requests received undergo a case-by-case assessment by TikTok’s dedicated law enforcement response team before any user data is disclosed. This team is trained to evaluate requests from law enforcement authorities and frequently engages in outreach to communicate TikTok’s requirements for disclosing user data to law enforcement authorities."

Don't forget the great LE resource SEARCH "ISP List," available at this link:

"The ISP List is a database of Internet service and other online content providers that will help you get the information you need for your case. For each Internet Service Provider listed, you’ll find the legal contact information and instructions needed to serve subpoenas, court orders, and search warrants.

The ISP List is a law enforcement community effort, meaning that while it may reside on our website, it belongs to us all. If you come across newer information than what we have listed here, please let us know and we’ll update it. If you discover an ISP that we don’t have in the database, let us know and we’ll add it. 

We know that getting the information you need from Internet service and other online content providers can be challenging. If you need assistance in this area, let us know through our Assistance & Training Center. We can answer your questions about submitting a legal request and we can help you decipher the results."

Working on a Case: Questions to Ask

Here are some questions to ask as an analyst when you working an investigative case.

 

Analyst Advice: Don't Become Obsolete

 

MO Variable "Contact" Helps in Analysis

In an ideal world, it would be easy for officers to collect as much data as was relevant to link serial crimes. But officers are human - they are rushed, are not trained to see the point of all this extra work, and possibly are forced by their data entry fields to leave out important information.

Some information is later collected by detectives who also are rushed, do not see the point of sharing with analysts, or don't ask enough good questions.

Nevertheless, here is a short example list of how a suspect and victim make contact when there are crimes against persons. Analyzing the modus operandi for commonalities when looking for serial crimes should include this variable: CONTACT.

Suspect/Victim Contact Facilitated by One of More of These Variables:

Though an Advertisement 

Ambushed Victim 

Lured Victim

Both In an Entertainment Place 

Forced Entry in Dwelling/Building/Vehicle

Hitchhiked with Victim 

Home/Residence Invitation 

Known to Victim 

Through Mail 

Through Email

In Cyberspace

Rang/Knocked for Entry

Suspect a Pedestrian 

Suspect a Relative 

Suspect an Employee 

Suspect a Former Employee 

Victim Entered Suspect's Business 

Victim a Hitchhiker 

Victim a Pedestrian 

Victim Drugged by Suspect

Suspect Entered Victim's Business

What other means of contact would you put on this list?

Considering a move to the private sector?

From Georgetown University:

"The Master’s in Applied Intelligence program is hosting an event for intelligence professionals to discuss their careers in the private sector and provide insights on emerging trends as well as growing job opportunities."

Read more about attending this webinar at this link.

Not All Evidence is Equal

Not All Evidence is Equal is an excellent blog post by Karim Vellani, CPP, CSC, of the Threat Analysis Group, available at this link. It contains links to other pages, including an article and video by Jerry Ratcliffe containing the image below.

Crime Analysis In the News

Eventually crime analysis will be in every law enforcement agency, even if it takes forever; meanwhile read ASU team trains first crime analysts in 9 Caribbean nations at this link.

For a succinct summary of 5 elements in a crime pattern read Crime analyst says suspects in carjacking case likely 'well-organized' at this link.

Partnerships between researchers (academia) and practitioners (law enforcement analysts and police) exist - read Researchers Partner with Fayetteville Police Department to Understand Local Crime and Public Safety Issues at this link.

Assisting in tracking gangs is one role of crime analysis - read INVESTIGATOR: 37 GANGS IN ONEIDA COUNTY; MEMBERS GETTING YOUNGER at this link.

 

Evaluating Internet Research Sources

“The central work of life is interpretation.” –Proverb 

The 2020 article Evaluating Internet Research Sources, by Robert Harris, is available at this link. It gives an in-depth overview of some element of evaluation that you may not have considered. Check it out!

Excerpt from the article:

"Adopting a Skeptical (or Cautious) Attitude

You might have heard of the term information warfare, the use of information as a weapon. Now, as I just said above, there is a lot of high quality information available through the Internet. Unfortunately, however, there is also a large amount of misinformation (honest people mistakenly spreading false information), together with the information warfare ammunition: disinformation (dishonest people knowingly spreading false information), half truths, distortions, urban legends, fallacies, exaggerations, “fake news,” and just plain old lies. So you need to adopt a skeptical–or at least a cautious–attitude toward all knowledge claims. You don’t have to believe everything you read, hear, or see. (Nor do you have to become completely cynical and disbelieve everything.) Just be very cautious. Instead of putting each knowledge claim into your “accept” or “reject” pile, put it in a “this is claimed, but I neither accept nor reject it right now” pile. Seek confirmation and disconfirmation from other sources and your own thinking. Remember that a Web site that makes up facts, quotes people who don’t exist, and cites imaginary sources could look just as professional and slick as a highly reliable and credible site. Don’t be deceived by appearances. Develop your critical thinking skills."

Problem-Solving Tips: A Guide to Reducing Crime and Disorder Through Problem-Solving Partnerships

"Intended as a reference for those who are interested in implementing a problem-solving approach, Problem-Solving Tips: A Guide to Reducing Crime and Disorder Through Problem-Solving Partnerships contains information and insights into the process. It will take you step by step through solving problems, offer examples of problem solving from the field, and provide additional resources."

This resource was originally published in 1998 and updated in 2011. It can be found at this link.

Law Enforcement Analyst Podcasts

 Jason Elder interviewed me for Law Enforcement Analyst Podcasts, and you can listen to the interview at this link.

Thank you, Jason! My interview was the 50th episode of podcasts on this site and the podcasts are an amazing contribution to the profession. It's an oral history that can help you understand the world of analysts much better.

I like to listen to the L.E.A. Podcasts show on my iPhone podcasts app - there are a few ways to listen and many interesting interviews to hear. Explore the website at this link.

You can also listen on YouTube (my interview is below) and explore the Law Enforcement Analyst Podcasts YouTube interviews this link.

Reevaluating Analysis and Analytical Products

I am as guilty as anyone else - often I did not update analysis and analytical products when new information came in. Often I did not know there was new information, because the investigator did not share it. Other times I was so busy with the next tasks that I forgot about work that I had thought was completed. 

It is easy to do. Yet, it is wrong. 

When and how do we reevaluate if more analysis is needed? When do we update our analytical products or produce new ones?

Evaluate the process: could it be improved with more work, new tools, or could it be more thorough?

Evaluate the analytical product: could it be improved, updated? Is there a new product needed?

Evaluate use of the analytical product: did the intended audience actually use it and benefit? Ask for feedback!

Evaluate priority setting: how important is it to revisit periodically and evaluate this subject for the need to update? Some things truly are just one and done. Think in terms of risk to the community, too, as you conduct reevaluation. Harm reduction matters.

Look from the analyst's perspective: what would a neutral analyst say about this work? Ask for feedback if that is applicable in your situation.

Look from the officer's/investigator’s perspective: what would they say? Ask those you trust for honesty and ask how you might improve the work you hav already done. This will help you perform better in the future.

What Might You Be Missing?

 Most often, we safely assume crimes in a serial crime pattern generally are of the same type. A robber commits another robbery. A burglar commits another burglary. You get the picture. 

There may be the unusual series of crime where the crimes in a series do not fall under the same crime type umbrella. A robber becomes a rapist. A car thief becomes a burglar. 

Then there are the attempted crimes that can fall out of the series crime pattern identification search radar. Examples include a robber following a target without being able to carry out the robbery, resulting in a suspicious person 911 call, or a burglar trying to break in unsuccessfully whose behaviors result in a reported criminal mischief (damage to property by say breaking a lock or window). Anyone looking for more information in a series of crimes must consider looking outside a standard assumption that serial criminals always commit the same crimes.

Crimes occur in context. A serial robber may strike after the bars close in a downtown area. A serial burglar make strike when families are at relatives’ funerals and homes are left unattended. A serial rapist make hunt for individuals on online dating sites. These variables are unlikely to appear in crime reports. 

A number of crimes go unreported. Dependent on the victims’ trust of law enforcement, the perception of whether or not the reporting of the crime is worth the effort or not, the willingness of officers’ to take a report and fill it out completely – these things must be considered when a crime series pattern has been identified. 

You want to fill in as many blanks as possible once you see that two or more crimes may be related. What might you be missing? What reports and files can you review? Who do you need to talk to?

If you work in law enforcement you are fully aware that the quality of data collected in crime reports, intelligence reports, calls for service, and investigative files is far from perfect. Officers in a rush leave out information. Officers who are unmotivated may do the bare minimum to get by. Victims are unreliable in their statements. Those agencies using check boxes for information gathering don’t have check boxes for everything.

How will you fill in your informational gaps?

Assessing Requests for Analytical Services

 

Basic Types of Analysis

"Crime analysis" sounds rather straightforward, but it isn't. The list below includes some things that are done frequently in crime analysis, while some other types of analysis are more often in "intelligence analysis." These categories are broad categories, not types based on analytical products.

Person Analysis (focus on people - who? possible motive (why)?)

Modus Operandi Analysis (focus on methods - how?)

Spatial Analysis (focus on places - where? in relation to what?)

Temporal Analysis (focus on time - when?)

Commodities Analysis (focus on things - what? how many? flow...)

Financial Analysis (focus on finance - what, where, how? flow...)

Communication Analysis (who communicates with who? how? how often?)

Market Analysis  (what markets (what) are involved?)

Demographic Analysis (what populations (who) are involved?)

Link Analysis (what are the connections?)

Statistical Analysis (how many? how much? what changes?)

Problem Analysis (what are the variables? who are the stakeholders?  what are the bigger issues of this case? what has worked in the past? how can we design workable solutions?)

Threat Analysis (what is the threat? who are the threat actors?) 

Types of analysis are usually combined to make meaning.

Examples:

Who does what and how do they do it?

When and where are what activities occurring?

Who is being victimized by whom and why?

What is being taken and how?

No matter where you are in your career as an analyst, in the public or private sector, you can expand your abilities and worth by becoming better trained in types of analysis that you do not currently conduct. Incorporate another type of analysis in your work to provide a more complete analytical product, to more fully meet the needs of those you serve.

CRIME ANALYSIS: CONSIDERATIONS FOR ESTABLISHING OR ENHANCING CAPACITY

 The National Public Safety Partnership's CRIME ANALYSIS: CONSIDERATIONS FOR ESTABLISHING OR ENHANCING CAPACITY by Julie Wartell, Problem Analysis Group Dr. Jessica Herbert, IDEA Analytics is available at this link.

While I think this publication is a great resource, I am also certain that the separation of analytical functions as described in the document, pasted below, is a barrier to the development of the law enforcement analyst profession:

CAUs are not intelligence or investigatory analysis centers or units that focus on researching specific persons or groups to support case development (versus using data to identify trends, patterns, and problems). Although an analyst is valuable for developing information and performing intelligence analysis techniques on complex criminal groups or organizations, crime intelligence techniques (e.g., social network analysis, telephone toll analysis) focus on the individual case level and do not drive the overall strategy of crime reduction and prevention for a jurisdiction.

So how do we integrate the two functions in agencies that do both? I think it is possible and optimal to have them working side by side. Why? Because the specific groups and criminal organizations are a manifestation of the crime problems in a jurisdiction. The crime analyst needs to know as much as possible about them, and the intelligence/investigative analyst needs to know about what other crimes these organizations/groups might have committed, which can be discovered through crime analysis.

Why Intelligence/Investigative Analysts Don't Share with Crime Analysts

In my ten years of practical experience as a working crime analyst, I wondered why crime analysts at the local level of law enforcement seemed so much more willing to share their work processes, products, tips, and advice than state and federal analysts. While I joined both the International Association of Crime Analysts and the International Association of Law Enforcement Intelligence Analysts to learn everything I could, I found the crime analysts to be very open and sharing while the intelligence analysts, and those who might be called investigative analysts working at state and federal agencies, were more private and abstract in what they shared. This is not meant as a criticism at all. I just could not understand it. I knew I was working as a crime analyst and crime analysts were the people doing my job, and their advice was most needed for me. I was SO very grateful to them. But I WANTED to know more about the particulars of intelligence/investigative analysis. It was a big mystery.

Then I went to work at federal law enforcement agency and suddenly the clouds were removed from my eyes. Most of my analytical work involved cases that might go to trial or result in a plea deal, and none of that case information could be shared with anyone, except on a case investigated jointly with another agency. No other sharing was allowed. Maybe after there was a conviction someone might use a case as an example at a conference, but that was about all. 

The culture of federal law enforcement is based on asking permissions if you want to do work outside of the agency that often involves navigating a long chain of command that ends up from your field office to offices and desks in Washington, DC. You can get permission to do things outside your agency, but it requires a real determination and the need for an excellent justification. You don't do things just because it sounds like a good idea, or you feel like trying it, or you want to help an individual or the whole profession (unless you are super-motivated). Your loyalty is to the agency - that permeates everything about the workplace. Because what you do is seen as reflecting on the agency's reputation, you have to have the agency's reputation in mind. Your individual identity and opinion is a moot point. I will always have a loyalty to the federal agency where I worked, but it was difficult for me to not desire my individuality when I worked for it.

And this is why I have been quiet for many years, not blogging, not doing extra beyond working as an investigative analyst (and grateful for the experience), nose to the grindstone, and then enjoying early retirement. I just did not like asking permission! The irony is that I was better at being an investigative analyst, because case work is like having a big research project with one limited universe of a subject, and crime analysis involves a big wide universe of crime and many technical tools that challenged me often, as I am not a statistician nor very computer tech savvy, and only type with a few fingers. But crime analysis meant more to me, because it is urgent and public safety could be impacted positively on a daily basis if I did a good job. It could protect the families I know in the city I live in. 

I prefer to be part of preventing crime over getting the bad guy (or woman) off the street - even though that matters, too. State and federal law enforcement agencies are mainly focused on criminal investigation over crime prevention.

Unfortunately, the culture of not sharing inhibits the growth of the analytical profession. There is much to be learned from one another, and in all agencies we benefit from mutual support.

When I read the article below, I was happy to see my observations articulated and confirmed in the realm of cyberthreat analysis - which is not shared as it should be - and you want cyberthreat information shared with many, because the target victims are across the globe. Threat intelligence analysis should help prevent crime, and sharing really matters in prevention efforts.

Read: Most Threat Analysts Banned from Sharing Intel with Peers at this link.

Quote from the article:

"It revealed that two-thirds (66%) of threat intelligence analysts participate in a professional community, in order to gain access to the most up-to-date and actionable information to help them protect their organization.

This includes subscriptions to vulnerability databases (61%), taking part in professional forums and blogs (45%) and receiving threat intelligence from paid (42%) and free (33%) feeds.

However, employers are usually against these same analysts sharing their own intelligence with external communities. Over half (52%) claimed they do not allow such activity."

It's Spring: Traveling Criminals

Although you may see indicators of them in other seasons, traveling criminals may visit your community in the spring and fall. 

One indicator:

You see an uptick in crimes where elderly people are scammed for roof or driveway repairs. You should investigate similarities in these incident reports and all related information, to ascertain if two or more crimes can be attributed to the same suspect(s).

From: https://www.loewerpaving.com/signs-of-asphalt-scams1

"Here are 7 asphalt paving warning signs:

Selling door-to-door: Reputable asphalt contractors will sometimes offer their services if they are doing a legitimate job in the immediate area. Always ask for references.

Claiming they have leftover asphalt from another job: Professional asphalt contractors will know, with great accuracy, how much paving material is needed to complete a project. Rarely will they have leftover material. Some of the reasons a contractor might have leftover material are weather, equipment problems, cancellations. etc.

Push you to make a quick decision: Reputable contractors will provide a written estimate that will be valid for weeks or months. If the great deal they are offering you today is not available tomorrow or next week, it may be a scam.

No contract offered: Insist upon a written contract specifying in detail the work to be performed and the agreed-upon price.

Cash-only sales: Most reputable contractors take checks or credit cards and don’t require cash-only terms.

Deals that seem to be good to be true: If the quoted price seems very low, chances are the quality of the work will also be quite low.

Unmarked truck: Often the trucks scammers travel in are unmarked or they have an out-of-town address and phone number. A little research will reveal that they have no permanent address, and the phone number is often an answering machine."

Read Bogus Caller Impostor and Deception Theft or Distraction Burglary by Traveling Criminals at this link.

Read Traveling Contractor Scams at this link.