1 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 Visual Link Analysis Christopher R. Westphal Visual

1Visual Analytics Inc.Copyright © 2006 – All Rights Reserved

301-407-2200 • www.visualanalytics.com

Visual Link AnalysisVisual Link Analysis

Christopher R. WestphalVisual Analytics Incwww.visualanalytics.com



Christopher R. WestphalChristopher R. Westphal

CEO of Visual Analytics, Inc (VAI)Over 22 years of experienceExperienced with a wide number of domains:

Financial CrimesMoney LaunderingFrauds (corporate/insurance)Law Enforcement (RMS)Intelligence



Need to know your data

Need to think “outside the box”

Need to use your noodle

Need to learn new techniques!

It’s not rocket science…

…but it does require some intelligence

It’s not nuclear science…

1 + 1 = a

Prerequisites for AnalysisPrerequisites for Analysis



There are no roadmaps to follow...There are no roadmaps to follow...

……or existing references to use...or existing references to use...

……you have to “make-it-up” as you go along.you have to “make-it-up” as you go along.



What does…What does…

…. a money launderer look like?

…. a criminal look like?

…. an insider trader look like?

…. a generic disorder in DNA look like?

…. a manufacturing defect look like?

…. a terrorist look like?



Interpretation MethodsInterpretation Methods

Hearing: 60

Visual: 12,500

Reading: 40

Typing: 1

Leverages human facility to process visual information312 times more efficient than reading text



Want to Expose Patterns & TrendsWant to Expose Patterns & Trends

It’s like trying to find a needle in a haystack

New

• Need to use right visual presentation for exposing patterns.

• Many times the pattern is not obvious – and using alternative presentations can help expose the anomaly.

• How will business processes change once the patterns are found?



Pattern #1

Pattern #2

Pattern #3

The method of data presentation is key to exposing hidden patterns

Finding Patterns in the DataFinding Patterns in the Data



Placement Influences InterpretationPlacement Influences InterpretationD

etec

tin

g P

atte

rns

Databases

X1 Y1 Z1

X2

X3

X4

X5

Y2

Y3

Z2

Z3

Z4

X1Y1

Z1

X2

X3

X4

X5

Y2Y3

Z2

Z4Z3

X1 Y1

Z1

X2

X3

X4

X5

Y2 Y3Z2

Z4

Z3

Field-X Field-Y Field-Z

X1 Y1 Z1X2 Y1 Z2X3 Y2 Z2X4 Y2 Z3X5 Y3 Z3X5 Y3 Z4

Table



Example: Unexpected CommonalityExample: Unexpected Commonality

• Certain “entities” should never be shared (e.g., SSNs)

• Data prone to typos and misspellings

• Possible misrepresentation and/or falsifying data on forms

• Appearance of avoidance by varying information

Unexpected Commonality



Example: Too Much Commonality Example: Too Much Commonality

• Many patterns are exposed due to repeating behaviors

• Too many commonalities may indicate organized behaviors

• Subjects perpetrate the same crime at different financial institutions

• Only minor changes in their underlying Modus Operandi (MO)

Too Much Commonality



Example: Accumulated BehaviorsExample: Accumulated Behaviors

• Each unique filing looks valid – need to see it collectively (all at once)

• Large numbers of discrete actions forms the bigger pattern

• Easy to avoid detection if each transaction appears legitimate

• Individual may be using mules to move money in/out of the accounts

Accumulated Behaviors



Organizations

People

Accounts

Weapons

Vehicles

Claims

Addresses

Comms

Passports

ID Numbs

Vessels

Aircrafts

Money

Phones

Meetings

Facilities

Transfers

Events

Drugs

Narcotics

Email

Equipment

Cases

Travel

What are Data?What are Data?

Which of the following are Real-World Objects and which are Conceptual Objects?



Would not want to create:• Caller/Callee

• Deposit/Withdrawal

• From/To

• Arrival/Destination

• Shipper/Consignee

• Seller/Buyer

• Prime/Sub

• Payor/Payee

• Sender/Receiver

• Owner/Renter

Phone

People

Vehicle

Define the type for the entity – not the role

Be Consistent with Defining TypesBe Consistent with Defining Types

Address



Technologies vs. MethodologiesTechnologies vs. Methodologies

• Link Visualization is a tool just as Microsoft Word is a tool

• Link Analysis does not replace the knowledge of the user– Improves efficiency– Produces better and higher-quality results

• Link Analysis does exactly what it is told to do

• Link Analysis makes data explicit

• Methodology drives the technology• Need to fully understand your data• Need to have an expectation of what you want to see



Connect The Dots….Connect The Dots….

Simple…Easy…Straightforward…???? What happens if you…• Don’t know the dots?• Have missing/extra dots?• Mess-up the sequence?• Don’t recognize the threat?

Pattern #1Enters country on student visaAttends flight-training schoolIndirect connections to known terrorist

Pattern #2Commercial driver’s licenseApply for chemical-hauling permitsPurchase storage containersRent transport trucks

a

b

cd

e

f

g

h i

j

k

l

m

n

o

pq

r

u

tv

w

x y

z

1

2

3

4

5

6

s

…Pattern #X…



Is this an Important Pattern?Is this an Important Pattern?

RonRonnie

Ronald Ronny

The Gipper Dutch-Boy

480-07-7456

Mary George

Betty John

Roger Pam

480-07-7456

Depends on Context

Depends on Content

Depends on Sources

Depends on Data Quality

UNKNOWN999-99-9999111-11-1111000-00-0000123-45-6789NOT DEFINED

Depends on Interpretation

Depends on Importance




JOHN SMITH

What about this pattern?

Common values can short circuit a network and potentially lead to inconsistencies.

Therefore, it is important to decide how to represent your entities and try to manage the “lowest common denominator”

Also need to factor the degree of transpositions to determine if it reflects an intentional misrepresentation of the facts.



Pattern #1

PHONE

Is this a Reliable Pattern?Is this a Reliable Pattern?

EVENT 01/01/02

EVENT 01/05/02

EVENT 01/11/02

SUBJECT

EVENT 05/16/05

EVENT 06/03/05

EVENT 06/27/05

EVENT 07/01/05

SUBJECT

Pattern #3

Pattern #3



Do these Patterns Make Sense?Do these Patterns Make Sense?

ADDRESSPHONE

ID NUMBERSSN

ORG

SSN

REPORTSUBJECT

Pattern #1 Pattern #2

SSN

= SS Death Master Hit




222334444INVALID



REPORT

Which Pattern Is More Valuable?Which Pattern Is More Valuable?

REPORT

REPORT

SUBJECT

ADDRESS

PHONE

SUBJECT

ADDRESS

ADDRESS

ADDRESS

REPORT

REPORT

REPORT

PHONE

PHONE

SSN

REPORT

REPORT

SUBJECT

ID NUMBER

REPORT

REPORT

REPORT

REPORT

REPORT

SSN

SSN

SSN

ADDRESS

SUBJECT

ID NUMBER PHONE

Pattern #1

Pattern #2



What Does this Pattern Tell Us?What Does this Pattern Tell Us?



Who is the Most Important Person?Who is the Most Important Person?



Methodologies – What’s Important?!?!Methodologies – What’s Important?!?!

SUBJECT has numerous SAR filings utilizing the same ACCOUNT number

A single SAR with a large number of SUBJECTS typically indicates some type of fraud-scheme.

Data Result Sets



What Are We Looking For?What Are We Looking For?S

ing

le S

ou

rce

Mu

ltip

le S

ou

rces

TELEPHONE TERRORISMCRIMINAL



Source Integration PatternsSource Integration Patterns

Income < $10kProperty > $500k(non-compliant)

IncomeProperty

No IncomeAny Property(non-filers)

Overlap



Entity ResolutionEntity Resolution

John Quincy Adams123 Main Street

Boston, MA774-207-0000

Jonathan Q. AdamsBoston, MA05/29/1968

DL:54321-123

Quincy AdamsBedford, MA

774-207-000012/05/1965

Source A

Source B

Source C

Anonymous Resolution md5_128bit = d35ecc61e4cc6810913e5de7fcb5931c

Are they the same entity?

Standardization

AliasingNormalizing

Tokenizing

Value-addPermutation



Sample Network - UnchangedSample Network - Unchanged

Multiple references to the same people based on spelling variations in their name. Different color-boxes show the like/similar entities

EDISON

MARIA

DAVID



Same Network - ConsolidatedSame Network - Consolidated

Reduced network from 14 entities to 3 entities.

Much more readable and comprehendible .

Proper data-cleaning is important for highly-variable data entry processes.

Same exact data and information being displayed from previous diagram

Larger frequency between Edison and DavidBi-directional flow between Edison and DavidTransfers only flows from Edison to MariaNo transfer between David and Maria



Network Structures – Interpretation Network Structures – Interpretation

Highly centric network – shows either source/sink behavior and strong influence/control over the network. Vulnerable and easy to monitor and seize assets. Network may be alien smuggling or various fraudulent activities.

More interconnected nodes provides less overall control over the network. Multiple players act in a distributed fashion to add complexity to monitor or disrupt due to multiple targets of interest. Network may be narcotics trafficking or gambling operations.

Highly distributed structure shows limited control or oversight across the network. No single control point and network can easily reconstitute using alternative entities. Hard to track and trace. Network may be terrorist financing.



Data Quality Impacts AnalysesData Quality Impacts Analyses• MANHA HAN• MANHANHATTAN• MANHANTAN• MANHANTHAN• MANHANTTAN• MANHATAN• MANHATTAN• MANHATTAN K• MANHATTAN N Y• MANHATTAN NY• MANHATTEN• MANHATTON• MEW YORK• N Y• NEW Y ORK• NEW Y ORK• NEW YO RK• NEW YOEK• NEW YOIK• NEW YOK• NEW YOKR• NEW YOORK• NEW YOR• NEW YOR K• NEW YOR,• NEW YORJ• NEW YORK• NEW YORK 10017-1011• NEW YORK 10031• NEW YORK 725• NEW YORK 806• NEW YORK 806• NEW YORK 987• NEW YORK BK• NEW YORK CITY• NEW YORK N• NEW YORK NEW YORK• NEW YORK NY• NEW YORK NY• NEW YORK NY 10001• NEW YORK NY 10002• NEW YORK NY 10009

• NEW YORK NY 10016• NEW YORK NY 10018• NEW YORK NY 10019• NEW YORK NY 10022• NEW YORK NY 10023• NEW YORK NY 10028• NEW YORK NY 10029• NEW YORK NY 10036• NEW YORK NY 10036-3619• NEW YORK QUEENS• NEW YORK ROOSEVELT ISLAND• NEW YORK STATE• NEW YORK Y• NEW YORK,• NEW YORK,• NEW YORK, NEW YORK• NEW YORK, NY• NEW YORK, NY 10017• NEW YORKCITY• NEW YORKD• NEW YORKE• NEW YORKJ• NEW YORKK• NEW YORKQ• NEW YORKS• NEW YORKY• NEW YORK|• NEW YORL• NEW YORY• NEW YOTK• NEW YOUR• NEW YOURK• NEW YOYK• NEW YRK• NEW YROK• NEWYORK• NY• NY NY• NY PLAZA• NYC• Y

Lower Manhattan 10004, 10005, 10006, 10007, 10038, 10280



Question?Question?

What country is represented by the code SA ?

What country is represented by the code ZA ?



Example – StructuringExample – Structuring

Dentist




Same Address




Dental Practice




More Structuring Date (2004)




Original Filing(over $10k)



Elderly Abuse Pattern…

SAR-MSB where SUBJECT DOB < 1930

Notice anything in common among these SAR-MSBs?



Analysis of the Warranty DataAnalysis of the Warranty Data

Extracted Set Repair Type

1 hour - $45

1 hour - $60

1 hour - $50

1 hour - $65

1 hour - $45

Review Details

Show all vehicles with fewer than 100 milesbrand new carsmany will still be on the dealership lotnot realistic mileage for general service repairs

Show labor onlyentire cost is based on mechanic timeno parts replaced (not traceable)no work was outsourced (not external)

Cigarette Lighters



Example – Geospatial FilingsExample – Geospatial Filings

• All SAR forms filed by banks in Howard County, Maryland

• Filing Years 2004 – 2005• Approximately 300 filings• Group by CITY/STATE of the

subject




• Geo-encoded the

Centroid of the

Zipcode

• Centroid = approx

middle of region

• Populated GIS

viewer with results

of encoded

addresses




• Filtered out any addresses associated with SAR transactions below $100k

• Heavy concentration along I-95 corridor




• Zoom-in to the map

• Highlight the boundaries for Howard County

• Notice: all but a few of the addresses fall outside the county



1. Family Name2. First (Given) Name3. Birth Date (Day/Month/Year)4. Country of Citizenship5. Sex (Male or Female)6. Passport Number7. Airline and Flight Number8. Country Where You Live9. City Where You Boarded10. City Where Visa Was Issued11. Date Visa Issued (Day/Month/Year)12. Address While in the United States13. City and State14. Family Name15. First (Given) Name16. Birth Date (Day/Month/Year)17. Country of Citizenship

I-94 - Arrival-Departure Record I-94 - Arrival-Departure Record

SUBJECT

ADDRESS

PASSPORT

FLIGHT

EVENT



I-94 – Multiple Passport NumbersI-94 – Multiple Passport Numbers

Identified a courier with over 50 different passport numbers for over 200 travel eventsGenerated a timeline to show the number was changed in July (Mexican Passport)



I-94 – Multiple Passport NumbersI-94 – Multiple Passport Numbers

1) Reverse look-up on address2) Identified a courier business3) Expanded to show other I-94 targets



What Type of Data are in a Date?What Type of Data are in a Date?

7th MoY

July

4th DoM

3rd QTR-c

Summer

4th QTR-f

2nd WoM

186 DoY

Sunday

Holiday-US

Leap Year

1976

2nd DoW

Banks Closed

28 WoY

JULY 4, 1976

DOW - Day of WeekDOM - Day of MonthDOY - Day of YearDOQ - Day of QuarterWOQ - Week of QuarterWOY - Week of YearWOM - Week of MonthMOY - Month of YearQTR-f - Quarter FiscalQTR-c - Quarter CalendarSeason/Holiday/Leap Year

What do these dates have in common?

?

?

2000 March 7 2001 February 27 2002 February 12 2003 March 4 2004 February 24 2005 February 8 2006 February 28 2007 February 20 2008 February 5 2009 February 24 2010 February 16



Temporal – SAR FilingsTemporal – SAR Filings

Day of Week

Wee

k of

Yea

r

Very regular filing (1 per month – except Dec)

Represents a very consistent filing behavior

Dates for first ½ year occurred more often on Mondays

Unusual change for remainder of year – jumps around a bit

Reflect filing behavior of financial institution



Holiday break timeframe is quite active and includes 12/25

Holiday – 4th July

Long weekend

Long weekend (Labor Day)

Period of inactivity

Period of inactivity

Temporal – SARC FilingsTemporal – SARC Filings

SAR-CASINO filing that clearly show the individual tends to prefer weekend and holiday gambling time frames.

Tells us he is “employed” since he is working during the week.

Inactive times correspond to known work periods



Convenience Store Deposits Convenience Store Deposits

Mondays / Fridays

Period of inactivity(2 week vacation)

Pattern abruptly stops

Cash Transaction Reports (CTR) filings for a convenience store owner. Business offers “check cashing” for clients.

All transactions represent over $10,000.

Very consistent Monday & Friday filings

All transactions represented are cash DEPOSITS – which is inconsistent for a check-cashing business (the events should be WITHDRAWLS)



Temporal Grid – HOD / WOYTemporal Grid – HOD / WOY

After hours

After hours

After hours

12:00

Mostly afternoon

Border Crossing



Temporal Grid – HOD / WOYTemporal Grid – HOD / WOY

Border Crossing



Little Old Man…Little Old Man…

• Use of SAR-MSB• DOB between 1920-1930• Same use of ID Number• 55 unique filings• Narratives state:

– “CUSTOMER PURCHASES MONEY ORDERS TOTALING LARGE AMOUNTS VERY FREQUENTLY.”

– “CUSTOMER NEEDS THEM FOR PAYROLL FOR EMPLOYEES”

– “OPERATES AN INSURANCE BUSINESS”

• Over $400k of MSB• Primarily in filed 2006

Heavy filings on Mondays and Wednesdays

Averages 2-3 transactions per week



Reference SourcesReference Sources

Death Master Match

Public / CommonPhone Match

Address Validation

SSN Validity Check

Watch list / PIP Check

CaseRecords

Public Records

Criteria Countries

Critical Infrastructure

ImportantDates

Sex Offenders

ITINCheck



SUBJECT PHONE

ADDRESS

SUBJECT

SUBJECT

SUBJECT

SUBJECT

SUBJECT

ADDRESS

EVENTEVENT

SUBJECT

SUBJECT

SUBJECT

SUBJECT

EVENT

PHONE

EVENT

SUBJECT

SSN

ADDRESS

A Basic Network DiagramA Basic Network Diagram



SUBJECT PHONE

SUBJECT

SUBJECT

SUBJECT

SUBJECTEVENT

SUBJECT

SUBJECT

SUBJECT

SUBJECT

EVENT

ADDRESS

SSDM

Pay Phone

Watch List

Prior Case

Bad Address

A Value-Added Network DiagramA Value-Added Network Diagram

Sex Offender Embassy



Some Simple Questions…Some Simple Questions…

What do these companies have in common?CARIBBEAN HAPPY LINES MODERN ELECTRONIC COMPANY SACKS FACTORY

Where can this telephone number be found?202-289-9313

What is located at this address?801 Mount Vernon Place, NWWashington, DC 20001

What is the vehicle make/model of this VIN?ZA9BC10U13LA12551

Who owns this Social Security Number?078-05-1120

1) OFAC list 2) Greyhound Bus Station 3) DC Convention Center 4) Lamborghini 5) The Woolworth Card



Some Simple Questions…Some Simple Questions…

What happened on 03/11/2004 ?

Where is 38.898748° -77.037684° ?

Who owns this IP address: 198.81.129.100 ?

Where is ZIP code 96616-2876 found ?

1) Usama Bin Laden 2) Madrid Bombings 3) White House 4) CIA 5) USS Ronald Regan



A Simple Question…A Simple Question…

Who is the FBI’s most wanted fugitive ?



What Do Terrorists Looks Like?What Do Terrorists Looks Like?

• White / Black / Asian / Arabic?

• Man / Woman?

• Domestic / Foreign?

• Poor / Rich?

• Illiterate / Educated?

• Adult / Teenager?

It’s based on their actions, behaviors, and relationships …

Documents

1 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 Visual Link Analysis Christopher R. Westphal Visual