On the Cover
Welcome
BCD Speaks
VisuaLinks News
What's New?
Did You Know?
Feature of the Month
Link Chart of the Month
DIG News
What's New?
Did You Know?
Feature of the Month
VAI News
What's New?
Upcoming Events
Employment Opportunities
|
|
|
 |
Here are a few tips and tricks to help you use VisuaLinks quickly and more efficiently.
|
 |
The checkbox in the lower, right-hand-corner of the View changes the behavior of the arrow (right, left, up, down) icons from perspective to move. The directions are reversed when the checkbox is selected. |
|
Holding down the Ctrl key when using the Rotate-XY mode, while using a placement algorithm that supports groups (e.g., Group By Circle-of-Circles), will rotate the individual groups on their own axes. |
|
The Find text field at the bottom-middle of the View lets you search for a value in any attribute (including memo fields) of objects currently displayed in the View. Matches are presented in the Query Results Panel on the left. |
|
|
As the techniques associated with detecting financial crimes are improved, money launderers, drug dealers, terrorists, crime organizations, and other financially motivated ventures associated to illicit activities will become more difficult to conduct. Better collection, detection, analysis, and collaboration systems are being put into place to ensure that the profits associated with these endeavors are disrupted through seizures and that the organizations/people are prosecuted for their illegal behaviors.
As many of us know, there are large volumes of drug transactions and alien smuggling activities in the United States that can yield incredible profits. In the struggle to ensure the safety of our borders and our financial systems, the State of Arizona supports one of the most progressive FRU (Financial Remedies Unit) to proactively pursue and uphold financial crimes enforcement. Through innovative legislation, Arizona provides effective remedies for anyone moving money based on ill-gotten gains. Outstanding subpoenas and state laws generate a considerable amount of data relating to various financial transactions occurring in or out of the state. From this data, there are two very distinct patterns associated with drug dealing and alien smuggling.
Alien smugglers call themselves "coyotes" because they can quietly slip through the desert, cross borders, and quickly move between different locations. They are contracted and paid for by family members of the alien(s), businesses in need of cheap labor, or the aliens themselves. They are brokered just like any other commodity often using central
collection locations and the entire operation is tiered (hierarchical). Often the money and the products (e.g., the aliens) move between different levels representing the different middlemen associated with this process. Money is usually transferred using money remitters, money orders, or money transfer locations.
This operating structure provides a unique pattern since most of the recipients of the "product" are outside of Arizona and all the money flows inbound into the State. Therefore, as shown in the first diagram, the coyotes are often depicted as the hub of a spoke of transactions. The figure below represents how a typical "coyote" financial pattern appears where each "SUBJECT" represents a unique transactor within the network (and each linkage represents a transaction between the two parties). In this example, there are actually two coyotes with an indirect set of third-party connections between them. The analysts can quickly find these patterns using VisuaLinks and create affidavits in support of court-ordered seizure warrants to seize the transactions.
The drug-dealer patterns are similar in that they often deal with the same pick-up operators. However, the flow of the monies comes from small sets of drug distributors, each making repeated sending transactions, rather than from large numbers of one-time senders. Although these drug dealers may use slightly differing identification in different transactions to defeat reporting requirements, VisuaLinks analysis can often detect this pattern. The second diagram shows a more concentrated network and the link-thickness reflects the number of transactions along with the dollar amount. In this diagram it is obvious that many more transactions occur between single entities when pursuing drug dealers than with the coyote pattern.
|
|
|
|
|
 |
What's New?
As you are surely aware, VisuaLinks 2.0 shipped on April 15. It was enthusiastically received by our user community. Now that this version has found its way to a wider audience, we are receiving quite a bit of valuable feedback. The feedback has been positive, with many users lauding the numerous new features and the improved documentation.
This version introduced a number of new services that greatly extend the analysis capabilities of VisuaLinks. Some of these new features were discussed in previous issues of this newsletter. Others will appear in the months to come. Keep an eye on these pages for more information.
In addition to adding new features to VisuaLinks itself, the documentation and training materials were treated to a complete overhaul. Our technical writing staff spent endless hours in writing drafts, graphic design, screen captures, reviews and re-drafts. The results of this effort are apparent and have been the subject of some of our most favorable comments. If you are using VisuaLinks 2.0, be sure to check out our new documentation.
|
|
|
|
Feature of the Month
Throughout our years of performing analyses and looking at vast amounts of data, one observation that became obvious is that all patterns can be classified as either structural or behavioral.
Simply put, structural patterns seek to expose questionable connections between different types of entities. For example, a SUBJECT that is connected to multiple PASSPORTS would be considered an interesting structural pattern. Other structural patterns may be based merely on the assignment of a particular value to an attribute such as the amount of a financial transaction exceeding a billion dollars or the date-of-birth indicating someone is 120 years old (see last month's newsletter on reference data sources). Structural patterns are fairly basic to detect and classify in systems like VisuaLinks because they typically expose an excessive frequency of connections or some type of value boundary violations.
To better classify implicit structural patterns VisuaLinks is being outfitted with special heuristics and placement techniques based on SNA (Social Network Analysis*) approaches to better classify critical objects within a network. SNA has been around for quite some time and the concepts of Centrality, Closeness, and Betweeness have been used extensively to help major businesses better understand their underlying inter-personal operating behaviors. Although the existing "Weighted" placement within VisuaLinks provides basic representation of well connected entities, the new SNA techniques (version 2.1) will provide more novel ways to help emphasize those objects with special associations/configurations within a network. Following is a brief description of these new capabilities:
|
 |
Centrality
Centrality is designed to expose those entities that are most interrelated and potentially exhibit a high degree of control within a network. The centrality of an object defines how many connections it has with other objects - more connections indicates more centrality. Very centralized networks tend to be dominated by a few entities and therefore are subject to failure should these "central" nodes fail or be removed. Less central networks tend to be more resilient. Depending on the application, knowing this fact can prove very useful when disrupting the operations of a network. In the figure below, OBJECT-4 is the most central to the network.
|
|
Closeness
Closeness calculates how "close" objects are with respect to the overall coverage or distance within the network. Objects that are "closest" have the fewest direct and/or indirect relationships to all other objects within the network. They can reach another object in the shortest number of steps, hops, or linkages. Detecting the closest object can provide an ideal vantage for monitoring the operations of a network or spreading information. OBJECT-6 and OBJECT-7 mutually represent the objects in the network that are closest to all other objects.
|
|
Betweeness
Betweeness represents a way to identify objects that support the largest number of pathways within a network. There can be any number of pathways (e.g., multiple routes) between objects in a network and the most "between" object ties together the largest number possible routes. The object with the largest number of connections does not necessarily represent the object with the best betweeness factor. These types of objects can exhibit a great deal of influence within a network. OBJECT-8 is the most between object in this network.
|
|
The second type of pattern classification is based on "behaviors" and always includes some type of "temporal" element that is almost exclusively found in transactional data sets such as financial transfers, telephone calls, credit card purchases, or border crossings. Behavior can be determined when a set of events (e.g., 3 or more transactions) relates to a specific entity such as a SUBJECT, ACCOUNT, ADDRESS, etc. The temporal characteristics of when the events occur form the basis for exposing the pattern.
People typically think in terms of cycles of convenience that tend to fall within intervals that we find easy to interpret. Convenient cycles include abstract temporal representations such as minutes, hours, days, weeks, months, and years. We understand, accept, and work within these cycles, and are therefore often predisposed to look for patterns within them. However, the interesting patterns do not always fall within these convenient cycles. Stock markets can have very irregular patterns of behavior that do not fit known cycles. Likewise criminals will often deliberately try to disguise their behaviors by acting at irregular intervals to avoid detection.
Generally there are two categories of temporal patterns - absolute and relative. Absolute time patterns are based on exposing the amount of time that occurs between events and are detected when measurable periods (e.g., a day, week, month) are the basis for when events start to repeat on themselves. For example, a SUSPECT conducting financial transactions every third-Tuesday would be an example of an absolute time pattern because the period represents a measurable characteristic (cycle of convenience). VisuaLinks is outfitted with a Temporal Grid and a TimeLine placement to help expose absolute temporal patterns.
Relative time patterns are based on the order in which the events have occurred, such that one event precedes another event. Unlike absolute time, there is no consideration of the amount of time that has passed between events, only their relative order. For example, a relative pattern exists when SUBJECT-X calls SUBJECT-Y shortly after being called by SUBJECT-Z. The sequence is Z->X then X->Y with a certain level of occurrence within a data set. VisuaLinks provides a relative-temporal sequencer capability to help detect these types of relative temporal patterns.
Additionally, the ability to perform spatial behavioral analysis is an up-and-coming area of research that VAI is actively pursuing. Spatial patterns are based on the alignment, distance, and orientation among objects, usually with a time component to detect changes. Using the Disambiguator and the GIS capabilities of VisuaLinks, detecting these types of patterns will soon become a reality.
* Refer to these sites to learn more about SNA:
|
|
|
|
 |
|
|
