North Central Texas Fusion System

March 2, 2009

1

Arlington Homeland Security / Special Events Unit Arlington Homeland Security / Special Events Unit

How We Can Help You

• North Central Texas Fusion System Access

• Regional Analysts and Analysis Reports

• Advanced Tools Access

• Intelligence Analyst Training

• Analyst Notebook Training

• Threat Models

• Special Event Models

• Tactical Dashboards

• Lessons Learned Sharing

Law Enforcement WebsiteHigh regional participation

950 users from 140 jurisdictions. 2500 receive bulletins and alerts. 94 agencies sharing data.

Secure remote access to massive amount of data

>90 million databases records searchable by single query. Examples include incidents, jail management system, calls for service, field interviews.

>2 terabytes free text searchable by single query. Examples include news, blogs, alerts, bulletins, crime analyst reports, documents , social sites.

Easy-to-use website for access to tools, information, heads-up

Alerts, crime analyst messages, news, contacts, references

All-hazards threat models for region – terrorism, crime, weather, health

Powerful visualization tools for investigations

Help desk, advanced tools, setup of restricted access libraries, consultation and specialized training for investigations

3

User Status950 users from 16-County Region

Law Enforcement Home Page

5

Listserve Crime Analyst Messages

Query and Visualization, Share Documents, Search Contacts, etc.

Hourly Law Enforcement News

Threat Model Dashboards

Automatic display of query result locations on maps

6Automatic display of query result

timelines and locations

Automatic display of query result linkages (incident, address, person, vehicle)

Query and Visualization Functions

Query

7

Enter what you know

Form with pop-up help for common fields

Query any words (gang, tattoo, drug, weapon, etc.)

Click for Links, Maps, Timelines

Officer safety information

Query results from many agencies and databases. Click to view details.

Select specific or all libraries

Previous arrests

Automated Link Diagram (1 of 2)

• Automated links generated for query results

• Shows linkages of incidents, people, addresses and vehicles

• Hover over line for description of the link

• Left click to see metadata about a node

8Query any node to expand chart

Automated Link Diagram (2 of 2)

9

• Filter links by

– Offense

– Agency

– Type (person, incident, address, vehicle)

– Incident report

– Date range

• Save to Powerpoint for annotation and records

• Export to Analyst Notebook for large-scale, on-going analysis

Automated Map Display

• Over 300 million addresses geo-coded

• Icons show locations of people and incidents

• Hover over icon to see metadata details

• Filter by

• Offense type

• Incident report

• Date range

10

Open Source Summarization

11

5. Security – Law Enforcement (with modes 1,7)

New Projects in Progress• Inmate phone query pilot

– Part of radicalization and gang monitoring

– Currently one jail to be expanded to other jails and prisons

– Automated transcription of speech to text so can query from office

– Translation from Spanish to English (future Chinese, Arabic, Vietnamese)

• Private security pilot

– Sharing of suspicious activity reports between companies and to law enforcement

– Models detect threats to private partner facilities and senior personnel

• Ability to visualize unstructured data links and maps

• Identifying top 10 threats to region and threat analyses

• Analyst Notebook training

• Advanced intelligence analyst training

• Adding at least 20 new datasets in 2009

12

Registration Instructions

• Send list of email addresses to kstone@co.collin.tx.us

• Registrants will be

– directed to http://register.ofcc.us:9955 to register

– provided several options for 1-hour training webinars from their office

– given access to help desk/support

Regional Analysts and ReportsOscar MartinezIntelligence AnalystNorth Central Texas Fusion System

Alicia AlexanderCrime AnalystDPS/North Central Texas Fusion System

David TractenbergIntelligence AnalystDHS / North Central Texas Fusion System

Tony BrysonIntelligence AnalystDHS /North Central Texas Fusion System

James R. (Bob) JohnsonArchitect and Analyst SupportNorth Central Texas Fusion System

14

Advanced Tool Access• Starlight

– Handle many dimensions– Inserts maps– Temporal analysis

visualization

• Analyst Notebook– Large-scale link

visualization– Useful for complex cases

and intelligence monitoring

Intelligence Analyst Training

• Interfacing with decision makers

• Recognizing and handling of perceptions and deceptions

• Recognizing and handling of biases

• Gathering information

• Proposing and handling competing hypotheses

• Monitoring of topics and situations

• Intelligence reporting

• Training on advanced tools

Analyst Notebook Training

• NCTFS is planning to host Analyst Notebook training (4 days)

– HIDTA provides training on software

– NCTFS provides training on using NCTFS link visualization to get

data into Analyst Notebook

– Date and time to be determined

Threat Models

• Example Data Sources– News, blogs, suspicious activity reports, incident reports, websites, submitted emails

• Example Factors Evaluated– Sequences of events (stolen uniforms, smuggling, surveillance, recruitment, etc)

consistent with potential terrorism planning and preparation activities

– Threatening words (bomb, protest, nuclear materials, crimes, hatred, etc) associated with the North Central Texas region or with specific individuals, methods, events, and facilities

– Analysis of links and threads connecting entities

– Global, US, and Texas threats that could effect the North Central Texas region

• Example Benefits– NCTFS Dashboards give all users insight into emerging regional and local threats from

weather, health hazards, terrorism, and major crimes

– Fort Worth Police Department models notify officials when there are potential threats to critical infrastructure, dignitaries and events

– North Central Texas analysts issue alerts and notify officials based on tip-offs from models

Threat models are computer models that run continuously in the Fusion System to detect pre-incident indicators, to recognize emerging

threats, and to notify analysts to evaluate detected information.

18

Models Types in the NCTFS

19

Model Attributes VisualizationWorld Terrorism Threat

• News feeds and selected websites• Keywords and 15 other economic-type

factors

North Central Texas Threats

• National weather service, news feeds, law enforcement sources

• Keywords in 11 major categories

Pre-Incident Indicators

• Models of observables• Hierarchical modeling to get threats

Table of observable hits and threat results

Facility Threat Models • CARVER parameters from questionnaire

• Information about deterrents • News feeds and blogs

Persons of Interest • Blogs, law enforcement data, emails Hyperlinked colored boxes

Methods • Blogs, law enforcement data, emails Table of methods of attack

Threats to General Businesses

• Selected Internet and open sources• NLP, entities, links and threads

Threats to Events • Blogs, law enforcement data, emails Combination of tables

Threats to Specific Entities

• Selected Internet and open sources• NLP, entities, links and threads

Special Event Models• Example Models

– NASCO Conference (2007)

– Armed Forces Bowl Game (2007, 2008)

– Texas Motor Speedway (2007, 2008)

– Republican Straw Poll Conference (2008)

• Threat assessment prior to each event used to set models parameters

• Data sources unique to each event

• Lt Dixon, James Janning notified via email of important findings

Preparing for Event Model• Agency provides description of event,

known threats and concerns

• NCTFS Threat assessment using all available sources

– Terrorism, gangs, hate groups, extremist groups, activist groups, etc.

– Impacts to surrounding facilities and government buildings

• Agency fills out facility and high level official threat questionnaire

• Identify additional data sources joint effort

• NCTFS sets up model and test prior to event

– Accuracy

– Notifications

Tactical Dashboard ExampleFort Worth Police Dept Dashboards

Fort Worth Police Department

Repeat Offenders Facility Threats Method Threats Individual/Group ThreatsOffenses by PRA Dignitary Threats

Computer model-driven, Fort Worth-specific tactical dashboards

22

Fort Worth All-Hazards Dashboard

Repeat Offenders Example BUTTON TURNS RED WHEN NEW DATA. DRAWS ATTENTION TO ACTIVITIES BY DESIGNATED REPEAT

OFFENDERS.

23

Fort Worth Police Department

Repeat Offenders Facility Threats Method Threats Individual/Group ThreatsOffenses by PRA Dignitary Threats

Last Change Div Individual Latest Activity

2008/6/13, 07:15 C John Doe (Big Mac), DOB 10/14/1978 Theft

2008/1/11 C Fred Joseph Smith, DOB 6/8/1948 News Reference

2007/11/23, 23:00 N Susan McAbee (Lulu), DOB 9/3/1982 Aggravated Assault

2007/11/23, 02:30 S Samuel David Smith (Samson), DOB 6/5/1990 Assault Deadly Weapon

2007/10/01, 03:15 S Jesus Jose Manuel, DOB 3/21/1964 Sexual Assault of Child

2007/8/2, 8/14, 03:00 E Franklin Joseph Franks (Blackie), DOB 3/7/1971 Theft

2007/5/5 W Marie Angel Johnson (Lady Luck), DOB 1/29/82 Released from Jail

2007/2/23, 02:15 W Marcus Franklin Woodrow, DOB 8/8/1949 Murder

2006/12/25, 23:30 W David Douglas Michaelson, DOB 7/19/1964 Sexual Assault

[more]

[more]

[more]

[more]

[more]

[more]

[more]

[more]

[more]

Repeat Offenders

Repeat Offenders

Lessons Learned

Happy to share experiences and materials:

•Lessons Learned Document

•Policies & CFR Compliance

•Job Descriptions

•Analysis Tool Advice

•Technical Advice

•Etc.

Contact InformationKelley StoneChief, North Central Texas Fusion Systemkstone@co.collin.tx.us(972) 548-5537

Oscar MartinezNorth Central Texas Fusion Systemomartinez@co.collin.tx.us(972)548-4395, (214)803-0931 cell

James R. (Bob) JohnsonArchitect, North Central Texas Fusion SystemJames_r_johnson@earthlink.net575-741-0699 cell

Anita Miller Manager, North Central Texas Fusion Systemanita_miller@earthlink.net575-741-0699 cell

25

Backup Charts

Example Data90M Database Records, >2 Terabytes Unstructured Data

27

Arlington RMSCollin County RMS, JMS, CFSDallas RMSErath County RMS, JMSEuless RMSFort Worth RMS, CFS, Gang, Field

Interview, NarcoticsFrisco RMS, JMS, CFSGarland RMS, JMSHaltom City RMSHudson Oaks RMSHunt County RMS, JMSHurst RMS, Crime Analysis, Criminal

Records, StatisticsJohnson County RMS, JMSKeller RMSLake Worth RMSLewisville RMS, JMSMesquite RMSMurphy RMSNorth Richland Hills RMSParker County JMSPrinceton RMSRichardson RMS, JMSRoanoke RMSRowlett RMS, JMS

Somervell County RMS, JMSSulphur Springs RMSTarrant County RMS, JMSWhite Settlement RMSWise County RMS, JMSWylie RMS

Crime Analysts ListserveDHS Fusion Center ReportsLaw Enforcement ReportsOperation Rio GrandeTDCJ Scanned LettersTexas Fusion Center

ATM BurglariesEnvironmental CrimesGangsNASCO-NAFTASouthwest Border SecurityThreats to High-Profile Individuals

After Action ReportsAmerican Journal of Public HealthBest PracticesDallas ISD PublicationsDefense News

Fusion System ReportsFusion System Source MaterialsHAZMAT Locations & ReferencesDHS Advisory CommitteeIntelligence Analysis & Info SharingLessons LearnedMySpace ExcerptsNews FeedsPrivate Security MaterialsTerrorismUS Government PublicationsWebsite Pulls and Website Research

Burlington Northern IncidentsListserve Historical DataDallas NarrativesDART IncidentsFort Worth ADMSInmate Phone CallsMcKinney RMSRegional Citation DataRegional InmateRowlett CFSSherman RMS, CFSSuspicious Activity ReportsTDCJ Gang DataWortham RMS

Agency Databases, Unstructured Datasets, Cases/Special Interests (some restricted), Open Source Unstructured Data, Upcoming