On the Cover
Welcome
BCD Speaks
VisuaLinks News
What's New?
Did You Know?
Feature of the Month
Link Chart of the Month
DIG News
What's New?
Did You Know?
Feature of the Month
VAI News
What's New?
Upcoming Events
Employment Opportunities
|
|
|
 |
Here are a few tips and tricks to help you use VisuaLinks quickly and more efficiently.
|
 |
The Set Default Directory command under the Settings menu defines the directory that is automatically selected whenever
you save data from VisuaLinks. By default,
it is set to the ./MyVLFiles subdirectory in the VisuaLinks directory.
You can set this to any path.
|
|
There is an AutoSave option under the File menu that automatically saves your session periodically.
You can adjust the AutoSave settings in the ClientResources.Properties file using:
- vl.auto.save.period to define how often data is saved (in milliseconds)
- vl.auto.save to enable (true) or disable (false) the option
For example, to save every 15 seconds:
vl.auto.save.period=15000
vl.auto.save=true
|
|
The Tools menu has a Side-by-Side Layout command that moves the Data Control Panel to the bottom of the interface
(instead of displaying it on the left side of the window).
|
|
A Search History List is automatically generated from any query performed. The icon that looks like a scroll
 in the query window contains all the values used to form queries.
You can select a value from this list when creating a new query. This list is also accessible from the Lists menu and is
used by the Memo Viewer to highlight these values when they display in text windows (such as Remarks fields).
|
|
Stubs can be the KEY to successful Modeling…
Anyone who has created models in VisuaLinks has most certainly encountered a situation where the creation of "stubs"
is required to reflect the proper analytical model. But what exactly is a stub? Simply put, stubs act as placeholders
within the model for creating associations between primary objects. In order to establish an association between any
two objects, the keys for both objects must appear together in the same table. Since this is often not the case, a
"stub" table can be created to "join" the two object keys. An example will help clarify the "stub" concept.
Suppose we have a database that has a table, SUBJECT, with data pertaining to our target individuals. In this table,
the SUBJECT_ID represents the KEY for the subject object. There is also an ORGANIZATION table, with data describing
the operations of various businesses. The ORGANIZATION_ID is the KEY for the organization object in this database.
Creation of both objects using the model wizard is very straightforward.
|
|
| |
In order to make our model complete we want to link the SUBJECT to the ORGANIZATION through an association.
However, based on the data contained in both of these tables, there is no logical way this can be done. There is
nothing in either table that tells us what subjects are associated with which organizations. This can be a stumbling
block for many novice data modelers. The answer lies in finding the table that contains the
OBJECT KEY for both objects that need to be linked
together. Note that the OBJECT KEYS can be, and often
are, different columns than the database key columns.
This database contains a third table (commonly referred to as a link, or association, table)
called ORG_SUB_ASSOC. Within this table,
there are only two columns which contain the ORGANIZATION_ID and the SUBJECT_ID. Two additional objects must be created
in the data model for each of these two columns. It is critical that the TYPE be the same as the other objects you are
trying to link. For example, if we initially created a SUBJECT object type, we do not want to create a SUSPECT, PERSON,
INDIVIDUAL, TARGET, or some other TYPE. Remember, the KEY and TYPE combination are what uniquely define the objects
within VisuaLinks. Using different TYPE definitions for the same KEY will result in two completely different objects.
|
|
| |
Once you create the two additional objects (ORGANIZATION and SUBJECT) from the ORG_SUB_ASSOC table, you can link the
objects together via the Associations tab in the model wizard.
The use of stubs provides a very efficient query protocol because all requests are based on SQL "SELECT" statements
rather than "JOINS" thereby making VisuaLinks one of the fastest systems in the marketplace.
Data sources with a large number of many-to-many style table references can often result in the creation of numerous
object stubs. For quick reference, the following grid provides a breakdown of the number of objects that need to be
created based on the number of database tables being used to model the objects.
|
|
|
|
This financial investigation started with a subject involved with a Suspicious Activity Report (SAR) filing using the
occupation of "judge." Further expansion of this individual shows that his Washington, DC, Driver's License Number was
used by another individual who was identified on a different SAR. This individual was identified as a "surgeon" from the
country of Colombia in South America. A quick check into national archives of the original subject (shown in the upper
left of the diagram) yielded no additional information and showed there was no person in the United States listed as a
judge with the name provided. Needless to say, people laundering money do not always tell the truth.
Further expansion of the network shows that the phone numbers of the second subject are linked to a third subject
(also with an occupation of surgeon). What is unusual at this point is that, even though the phone numbers (home and work)
matched, the addresses were different. In fact, the third subject is connected to a fourth subject (with an occupation of
"doctor") through a shared address and bank account number. The money flowing through this network represents approximately
a quarter million dollars ($250k) and the dates of filing (not shown in the display) are less than 1 month apart.
The nature of the occupations, time frames, out-of-country addresses, and the common ID numbers, phones, accounts, and
addresses make this network a very attractive target for further investigation.
|
|
|
|
|
|
|
 |
What's New?
VisuaLinks 2.0 has been in circulation since mid-April. One of the best things about people using your software is that
they provide feedback.
When people and software meet, feedback of various types is generated. In the case of VisuaLinks, the bulk of the
feedback we have received has been positive, constructive, and even instructive.
What does VAI do with this valuable feedback?
Naturally, we incorporate user feedback into the tool. Usability issues are addressed, current-feature improvements
are incorporated and new features are added. All of this activity is driven by your feedback.
A VisuaLinks 2.0 maintenance release is due out in the next few weeks. This release will bring with it bug fixes,
a few adjustments to new features, and some user interface changes to address usability feedback we have received.
Our graphic artists have been hard at work incorporating feedback as well. Our user community has submitted several
suggestions for custom skins and we have worked hard to respond. If you have not visited our Support Site recently,
you may want to take a minute to see the new skins.
Recent additions include:
|
|
|
|
Feature of the Month
Money laundering is a term applied to any process that is used to take the proceeds of illegal activities and transform
them into assets that appear to have been legitimately obtained. Laundering illegal proceeds is essential to successful
criminal operations. One of our key lines of defense against criminal activity is to detect and confiscate ill-gotten gains when they
enter a legitimate financial system.
Money laundering occurs when financial transactions are conducted involving assets representing the proceeds of some
Specified Unlawful Activity (SUA) such as illegal drug trafficking, organized crime operations, credit card scams,
insider trading and securities fraud, terrorist financing, and many others. If left unchecked, money laundering can
undermine the integrity of any financial institution and may affect the social, economic, and political structure of
a society through corruption and crime. Money laundering is also an international problem - crossing multiple
jurisdictions that often do not have reciprocal laws or the resources to deal with this immense problem - which some
experts estimate approaches nearly $1 TRILLION dollars.
Within the United States, quite a number
of laws have been enacted to fight financial crimes and money laundering operations.
Financial institutions are required to comply with the federal statutes imposed by the
Money Laundering Control Act of 1986 and revised in the Money Laundering and Financial Crimes Act of 1998.
Additionally, the Patriot Act of 2002 further requires that additional collection and detection protocols be
established to address this unwieldy problem.
Currently, under the Bank Secrecy Act (BSA), Title 31, the U.S. Government requires submission of the following forms:
|
| FinCEN Form 102 |
Suspicious Activity Reports by Casinos and Card Clubs |
SAR-C |
| IRS Form 8362 |
Currency Transaction Report by Casinos |
CTR-C |
| FinCEN Form 101 |
Suspicious Activity by the Securities and Futures Industry |
SAR-SF |
| Treasury Form (TD F 90-22.56) |
Suspicious Activity Report by Money Services Business |
SAR-MSB |
| IRS Form 4789 |
Currency Transaction Report |
CTR |
| IRS Form 8300 |
Report of Cash Payments over $10,000 Received in a Trade or Business |
8300 |
| Customs Form 4790 |
Report of International Transportation of Currency or Monetary Instruments |
CMIR |
| Treasury Form (TD F 90-22.1) |
Report of Foreign Bank and Financial Accounts |
FBAR |
| Treasury Form (TD F 90-22.47) |
Suspicious Activity Report |
SAR |
|
Cases related to financial crimes often involve the review of these data in addition to individual and corporate tax filings,
wire transfers (e.g., Western Union, MoneyGram, etc.), charitable donations, and any type of international movement potentially involved with
terrorist financing. VisuaLinks is the engine for many government
operations fighting money laundering and other types of financial crimes.
To be compliant with the BSA filing statutes, the majority of financial institutions submit their reports via magnetic tape.
These tapes are uploaded directly into the Currency Banking and Retrieval System (CBRS) database located at the IRS Detroit
Computing Center (DCC). Each document in CBRS is assigned a unique document control number (DCN) which is also used within
VisuaLinks to represent the corresponding document object (e.g., CTR, SAR, 8300, CMIR, etc.).
Depending on the BSA form being reviewed, the specific detail may also include the names of the SUBJECTS involved
(e.g., senders, receivers, payors, payees, etc.) and any other identifying data including ADDRESSES, ACCOUNTS, PHONES,
ID NUMBERS (e.g., social security, alien registration, driver's licenses, etc). The following diagram is representative
of data derived from CBRS that would be created in a VisuaLinks data model.
A single financial transaction can often be associated with multiple SUBJECTS which, in turn, can be connected to
multiple ADDRESSES, ID NUMBERS, ACCOUNTS, and PHONES. An individual listed on any one particular report is usually
not very interesting by themselves. However, when the same or similar information begins to appear on different forms,
investigators will want to know when certain behaviors are being exhibited. The diagram shown below depicts how the
entities on a single form can be related or linked together using VisuaLinks.
Over a period of time, the information derived from these forms becomes cumulative and starts to tie together different
operations, groups, and networks cooperating to launder money. The connections are typically made through shared object
types such as SSN, PHONE, ADDRESS, and ID NUMBER. Often, people committing financial crimes try to vary the way their
personal data is represented and typically will use name variations, alternative spellings, and other misleading information.
Utilizing the advanced analytical tools within VisuaLinks, these types of pattern detection capabilities are fairly routine.
The following several diagrams depict different combinations of data that would indicate a "well qualified" selection of data
from which to pursue more detailed analyses and/or investigations.
In this first diagram, a single social security number (SSN ) is connected to a half-dozen unique individuals.
This type of over-utilization of a single SSN obviously indicates questionable behavior. However, this pattern
can be caused by very similar spellings or pronunciations. Alternatively, if the SSN represents a TIN/EIN
(taxpayer ID for a business), it is possible that different employees deposit cash in the name of the business.
Regardless of the circumstances, these types of situations should always be detected and reviewed for possible
illicit operations.
This next diagram shows a similar pattern where at least three (3) separate SUBJECTS are sharing an SSN and two of
these three also share the same ID NUMBER. What is interesting about this pattern is the "unique" representation
of the PHONES and ADDRESSES - which is a strong indicator that the SUBJECTS are distinct from one another.
Additionally, if more than one SUBJECT was listed on a form (SAR in this example) they would never be connected
to the same SSN. As can be seen in this diagram, there are 8 distinct SAR objects and none of the 3 SUBJECTS is
connected to the same SAR. Because there are no additional SSNs and no
common SARs, we can conclude that the utilization
of a single SSN was intentional and not the result
of a typographical or data entry error.
In the next diagram, VisuaLinks shows a very simple pattern. An individual involved in a single SAR transaction
has listed an SSN that is associated with a deceased individual. The red X on the SSN icon indicates that a match
was made in the SSN Death Master database (not available as part of the BSA basic dataset). The date-of-death and
transaction filing dates are the critical pieces of information in this case. If the filing-date is later than the
date-of-death, we have a well-qualified target to pursue.
In this last example, the diagram shows a connection between two SUBJECTS based on the common use of a PHONE.
Although this pattern looks promising, we must ensure that the uniqueness between these two is authentic and
not based on some fluke in the collection process. On SAR related forms, there are entries for both WORK and HOME
phone numbers. In this particular model, both phone types are mapped to a single PHONE object type.
This helps identify cases in which a number is listed as both a home and work phone number. In VisuaLinks,
the link colors generally indicate the role of the connection. However, in cases where individuals share a
WORK phone number, there may not be any type of "real" relationship between the two people. This can occur in
situations involving large business such as McDonalds, IBM, GE, Ford, etc. where there is a main switchboard
number that employees can list rather than a direct extension. Analysts must be aware that connections based on
PHONE objects should always be reviewed for this particular set of circumstances.
The number of patterns associated with financial transactions is essentially limitless. These examples represent
a small fraction of the known patterns currently being reviewed. As more and more sources are made available to
investigators and law enforcement, the number of patterns is expected to expand significantly, especially as the
sources are combined through tools such as VisuaLinks. Furthermore, as the community becomes more reliant on these
kinds of technologies, more complex and interesting patterns will be discovered.
For additional reference material, see our April 2003 newsletter for
an overview of the presentation given at the Pacific Rim International Conference on Money Laundering.
|
|
|
|
|
