Criminal Network Investigation: Processes, Tools, and Techniques

Rasmus Rosenqvist Petersen

Publikation: AfhandlingPh.d.-afhandling


Criminal network investigations such as police investigations, intelligence analysis, and investigative journalism involve a range of complex knowledge management processes and tasks. Criminal network investigators collect, process,
and analyze information related to a specific target to create intelligence products that can be disseminated to their customers. Investigators deal with an increasing amount of information from a variety of sources, especially the Internet, all of which are important to their analysis and decision making process. But information abundance is far from the only or most important challenge for criminal network investigation, despite the massive attention it receives from research and media. Challenges such as the investigation process, the context of the investigation, human factors such as thinking and creativity, and political decisions and legal laws are all challenges that could mean the success or failure of criminal network investigations.
% include commission reports as indications of process related problems .. to "play a little politics" !!

Information, process, and human factors, are challenges we find to be addressable by software system support. Based on those three challenges we formulated our hypothesis for tool support, and analyzed problems related to each individual challenge. Our response to these problems is a list of research focus requirements, to guide our development of new processes, tools, and techniques that ultimately would reduce the impact of the challenges and support the hypothesis. We propose hypertext as the key technology to bridge human and tool related requirements to provide integrated support for both, resulting in increased capabilities, that ultimately will create a synergy effect useful for criminal network investigation.

We create a target-centric process model (acquisition, synthesis, sense-making, dissemination, cooperation) encouraging and supporting an iterative and incremental evolution of the criminal network across all five investigation processes. The first priority of the process model is to address the problems of linear process models that introduce compartmentalization, reducing sense of responsibility and deterioration of information as it passes through compartments. We have developed a list of criminal network investigation tasks encapsulating the work within each process, selected based on their contributions to the success of investigations.

Basic criminal network investigation concepts have been developed and tested using proof-of-concept prototyping, resulting in generic software components for tool support of criminal network investigation. We have used these components to build CrimeFighter Investigator, iteration by iteration, embracing the concepts embedded in the components. We analyze, design, and demonstrate support of individual criminal network investigation tasks for each of the five processes, and we also describe the deployment of CrimeFighter Investigator in scenarios that span multiple processes and tasks. We have used three methods to evaluate CrimeFighter Investigator, capability comparisons, end user interviews, and measures of performance. We have found that our evaluation methods provide good coverage of the research focus requirements. When summarizing evaluation of the requirements, we found strong support of most and medium or weak support of few. In general, our evaluation showed that we had focused on the right challenges, and the inter dependency of the requirements made it clear that a more narrow focus, leaving out one of the challenges, would have provided much less support.

We can conclude that all indicators point toward support of the hypothesis: addressing the challenges of information, process, and human factors by providing tool support based on advanced software technologies is a useful tool for investigators, as it increases the capabilities of both human and tool, thereby reducing the impact of the challenges. Rather than focusing on the inner-workings of network analysis techniques, we have worked toward supporting end user interactions with techniques, to achieve better investigation results. We consider our results to represent guidelines for how to conduct research of tool support for criminal network investigation.
StatusUdgivet - 2012