law enforcement national data exchange n-dex concept overview

Law EnforcementNational Data Exchange

N-DEx Concept Overview

2

Presentation Overview

The N-DEx Need and Vision

What Will N-DEx Do? Services and Capabilities Law Enforcement Scenarios

Integration and Connectivity Data Functional

Key Assumptions

3

A National Need

4

CJIS Current Information Sharing

18,000 User Agencies

NCICNCIC IIIIII IAFISIAFIS

WarrantsWarrantsWarrantsWarrants ArrestsArrestsArrestsArrests

5

CJIS Information Sharing Gap

Police RMSPolice RMS

PolicePoliceReportsReports


NCICNCIC

Current CJIS SystemsCurrent CJIS Systems

IIIIII IAFISIAFIS

Data

Gap


6

CJIS Information Sharing With N-DEx

Police Police RMSRMS

Police Police RMSRMS


NCICNCIC IIIIII IAFISIAFIS

PolicePoliceReportsReportsPolicePolice

ReportsReports

Local/ State/ Local/ State/ RegionalRegional

CJIS SystemsCJIS Systems

N-DExN-DExFederal Crime Federal Crime

ReportingReporting(Federal Agency (Federal Agency

Information SharingInformation Sharing))


7

N-DEx Vision

“To share complete, accurate, timely, and useful law enforcement information across jurisdictional boundaries and to provide new investigative tools that enhance America’s ability to fight crime and terrorism.”

Executive Concept of OperationsNovember 2005

Provides National Information Sharing

Links regional and state systems

Enables virtual regional information sharing capability

Virtual Regional Task Force

N-DEx

8

Concept of Operations Services, Capabilities and Integration

9

N-DEx will provide law enforcement

agencies

with a powerful new investigative

tool to

search, link, analyze and share

criminal justice information such

as,

incident/case reports, incarceration

data,

and parole/probation data on a

national

basis to a degree never before

possible.

What Will N-DEx Do?

10

Franklin CountyAuto Thefts

January

0600- 1000-1400- 1800- 2200- 0200-1000 1400 1800 2200 0200 0600

987654321

February

0600- 1000-1400- 1800- 2200- 0200-1000 1400 1800 2200 0200 0600

987654321

Auto TheftPickaway, Fairfield, Union, Licking,

2004 - 2005

Time

#

2

Corruption Case XYZ

SelectSelect

OKOKShare:

Do Not Share:

Conditional Share Options:

Name: John England

SSN: 123-45-6789

Sharing Attributes

Subscribe: NextNext

Entity Relationships

Entity InquiryJames Bluefield 04/15/1968

Recent AddressRecent Address

142 WashburnSeattle Wa 12345 Recent PhoneRecent Phone

123-456-7890

DispositionDispositionParole

AliasesAliases

Other AddressesOther Addresses

Other Phone #sOther Phone #s

J. Blueman

Jesse Bluefield

John Bluefield

Jamie Bluefield

RecordsRecords

AssociatesAssociates

MoreMore

Map ItMap It

Incident – Bank Robbery

Arrest Report - Tacoma

Arrest Report – Seattle

Incident - DUI

Jesse James02-28-2003

MugMug

MoreMore NextNextMoreMore

OR

Crime Characteristics

Offense: Forcible Rape

Suspect: Male

Race:

Sex:

Age:

Height:

Weight:

Hair:

NextNext

Female

White

55 to 65

64to

Blonde

0

Victim:

to

Find Similar:

Subscribe:

1300

Data

Data SubmittedData Submitted Information ReturnedInformation Returned

Collabora-tion

Sub-scription

Visualization

Analytical/Reporting

Search

Notification

ServicesServices CapabilitiesCapabilities

Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation

N-DExNN--DExDEx

People, Places, Things, Relationships, CharacteristicsPeople, Places, Things, Relationships, Characteristics

Catalog/Catalog/IndexIndex

EntitiesEntities

N-DEx ConceptData SubmittedData Submitted Information ReturnedInformation Returned

11

N-DEx Services

ServicesServices CapabilitiesCapabilitiesN-DExN-DExN-DExN-DEx


Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation

12

N-DEx Services



Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation

Identify Who isIdentify Who is WhoWho

13

Entity Resolution

Automatically determine related entries that may contain varying or non-exact details

“JT Smith” and “Jimmy Smith” have enough similar additional identifying information that there is a high probability they are the same person

Address Name DOB SSN

121 Main St., Wichita Rob McDonuld 01/01/1980 123-44-4444

121 Main, Kansas City Bobby M. MacDonald 123-45-5555

121 North Main,Topeka Robert McDonnal 12/12/1979

121 Maine St, Wichita Mark R. MacDonald 01/01/1980 123-45-5555

121 S Main St, Wichita Bob McDonnald 12/12/1979

14

SuspectSuspectArrestedArrested

EntityEntityResolutionResolution

EntityEntityResolutionResolution

Potential TerroristPotential TerroristIdentifiedIdentified

IncidentReportIncarceration

Name:David Fuller

SSN 123-45-6789

Arrest Report

Name: Ortega FirstLast

Ramon

NextNext

Offense: Robbery

Insert Mug Shot

SSN: 123-45-6789

BrowseBrowseC:/Ortega.Ramon.jpg


Potential Entity Consolidation

Miami Dade County Jail

David Fuller, 123-45-6789

Ramon Ortega, 123-45-6789

Consolidate Checked OKOK

Entity Resolution

Subscription Notification

Terrorist Watch List

David Fuller, Arrest Report Robbery

David Fuller, Arrest Report Robbery

San Diego JTTF

15

N-DEx Services



Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation

Identify Relationships BetweenPeople, Places and Things

16

Identifying relationships among entities even if they are not obvious or specifically identified

Identify/maintain relationships between entities within a record

Entity correlation will create and manage linkages to source records

Entity Correlation

17

Incident ReportNashville, PD

Jim Smith

123 Main Street

Nashville, TN

Incident ReportNashville, PD

Bob Wood

789 Main Street

Nashville, TN

Incident ReportAtlanta, PD

Bob Wood

123 Main Street

Nashville, TN

Entity Correlation

Bob Wood and Jim

Smith are linked by address

18

N-DEx Services



Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation

Find Similar Find Similar Cases/Incidents/Cases/Incidents/Crime CharacteristicsCrime Characteristics

19

Incident/Case Correlation Service

Finds “patterns” that link incidents/cases Crime characteristics or modus operandi, Criminal characteristics or criminal signatures that could link

incidents and ultimately suspects to serial crimes Automates the current manual practice of searching

through incident reports for similarities Helps associate records that do not contain exact

matches

20

Incident/Case Correlation

Incident 12345Offense:Rape

Victim:Sex: FemaleRace: White Age: 57Height: 5’ 1”Weight: 120

Crime Characteristics Entered

OR

Crime CharacteristicsOffense:

Forcible RapeForcible Rape

Suspect:Male

Male

Race:

Sex:

Age:

Height:

Weight:

Hair:

NexNextt

FemaleFemaleWhiteWhite

5555 to

6565

6464

to

BlondeBlonde

00

Victim:to

Find Similar:

Subscribe:

1300

Similar CasesPensacola, FL, Forcible Rape, 12 Dec 2005

Pensacola, FL, Forcible Rape, 19 Dec 2005

Mobile, AL, Forcible Rape 24 Dec 2005

Fort Walton Beach, FL, Forcible Rape, 3 Jan. 2006

98%

95%

95%

88%

Similar CasesFound

Incident/CaseIncident/CaseCorrelationCorrelation

CharacteristicsComparison Against

Records











Record

Incident 12345Incident 12345

NextNext

Find Similar:

Subscribe:

21

N-DEx Services



Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation

Automated ExpertAutomated ExpertInvestigative PracticesInvestigative Practices

22

Automated Processing Service

Automatically performs processing upon submission of data to the system

Based on expert knowledge, standard procedures and best practices used of law enforcement

Provide alerts to LEA users for items that may be of interest to them, for example:

Check all new suspects against terrorist watch lists Alert LEA users of addresses that are known to be associated

with other suspected terrorists

23

Arson IncidentsArson IncidentsSubmittedSubmitted

Incident Report

Suspect: Unknown

Witness:Gordan Kanseah

Arson Jul 2001

Concord, NH

Incident Report

Suspect: Unknown


Arson Jul 2001

Automated Processing/Notification

Witness BecomesWitness BecomesSuspectSuspect

N-DExN-DExAutomated Automated ProcessingProcessing

AutomatedAutomatedProcessingProcessing

Incident Report

Suspect: Unknown


Arson Jun 2003

Incident Report

Suspect: Unknown


Arson Jun 2003

New York, NY

Automated Process Notification:

Gordan Kanseah witness to multiple Arsons

Incident Report Jul 2000Concord, NH

Incident Report Feb 2003 New York, NY

!

24

N-DEx Catalog/Index


Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation

Entities


25

N-DEx Capabilities


Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation


Simplified Views ofSimplified Views ofComplex InformationComplex Information

26

Visualization

Visualization tools make it easier to understand the “knowledge” behind the vast amount of information

Visualize complex returns from correlation, search and report functions

Provide both tabular and graphical representations of data to allow navigation through relationships, trends, and timelines of crimes and activities

Overlay data on geographic maps with various views of the data “Drill down" or navigate through complex relationship networks View the data in a variety of representations for effective analysis

27

Visualization

28

N-DEx Capabilities


Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation


Find People, Places Find People, Places and Thingsand Things

29

Search Search for people, places, things, crime characteristics,

perform key word searches and find records (e.g., incident/arrest report)

Includes both basic and advanced search functions Basic search - a simple user interface requiring very little

training, Advanced search – for more experienced users (e.g., using

Boolean, wildcard operators, etc.)

Results tuned to prevent being overwhelmed by data through filtering and ranking of results

30

SearchIntegrated View ofIntegrated View ofAll Jesse James All Jesse James

RecordsRecords

ComprehensiveComprehensiveSearchSearch

SearchSearch

Person SearchPerson SearchRequestedRequested

Search

SSN: 123-45-6789

123-45-6789

FindFind

NameJames

FirstLastJesse

DOB: 04/15/1956

04/15/1956

mm/dd/yyyy

Entity InquiryJesse James 04/15/1972

Recent AddressRecent Address167 Cedar St.Oklahoma City OK 12345

Recent PhoneRecent Phone123-456-7890

DispositionDispositionProbation

AliasesAliases

Other AddressesOther Addresses

Other Phone #sOther Phone #s

James Jesse

Jesse Jameson

John Boothe

Jamie Jameson

RecordsRecords

AssociatesAssociates

MoreMore

Map ItMap It

Incident - 1123xyz Drugs

Arrest Report - Baily

Arrest Report - Dallas

Arrest Report - Oklahoma


MugMug

MoreMore NextNextMoreMore

Incident Report

Arrest Report Arrest ReportPossession of Cocaine

4 February 1999

167 Cedar stOklahoma City 12345

Aliases: Jimbob, jaime Lovebone



Mug ShotsJesse James




Jesse James11-11-2001Jesse James

12-06-1974




31

Potential Suspect Potential Suspect IdentifiedIdentified

N-DEx Search N-DEx Search (Person)(Person)

SearchSearch

Arrest Report

Richard Coleman

TattoosRight Hand: SpiderNeck: Goldie

Mug Shot/Photos

Goldie

Manual Gonzales123-45-7689

Manual Gonzales123-45-7689

Unknown Unknown SuspectSuspect

DescriptorsDescriptors

Suspect: Unknown

Right Hand: SpiderNeck: Maria

Tatoos

SearchName:

Sex:

UnknownUnknown

SpiderSpider

GoldieGoldie

Male

Tattoos:

Right Hand:

Neck:

SearchSearch

Search

Records Found

Arrest Report – Richard Coleman - Assault

Incident Report –Richard Coleman - Burglary

32

N-DEx Capabilities


Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation


Subscribe to Future Subscribe to Future Events/InformationEvents/Information

33

Subscription Allows law enforcement personnel to register for

information events about entities and subjects of interest

Users will be able to: Establish subscriptions based on existing entities Ask to be notified of updates and/or changes to status or the

availability of additional information on the entity Easily discover “who else is looking” for the same subjects or

have similar interests Supports case de-confliction and encourages potential

case collaboration

34

SubscriptionSubscription& &

NotificationNotification

OR

Search

[email protected]

NextNextSubscribe:

Name: LindbladFirstLast

Sam

DOB: 04-25-1964

E-Mail:

192.250.250.25IP:

OtherInvestigative

Arrest ReportIncident

SubscriptionName: Lindblad, SamDOB: 04/25/1964E-Mail: [email protected]: 192.250.250.25

Search

[email protected]

NextNextSubscribe:

Name:FirstLast

DOB:

E-Mail:

192.250.250.25IP:

Subscription/Notification

E-Mail: [email protected]: 192.250.250.25

Air Force OSIFE Warren AFB, WY

Notification!

35

N-DEx Capabilities


Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation


Identify Criminal Identify Criminal Trends/Hot SpotsTrends/Hot Spots

36


Assist investigators and analysts in the identification of criminal networks, crime patterns, crime trends, and crime problems

Provides administrators, analysts and investigators the ability to generate reports from N-DEx data for distribution and sharing

Allows N-DEx to support law enforcement’s investigative reporting needs from a central platform

Supports generation of online reports including graphic displays of data for use in predictive modeling, reporting and tracking of crime for investigative purposes

37

Results Results Graphed/MappedGraphed/Mapped

ReportReportSubmittedSubmitted

Crime Analysis & Reporting

Baltimore CityBaltimore City

50 50 MilesRadius:

Jun 05 Jun 05 Begin:

Location:

Dec 05 Dec 05 End:

Cocaine, Heroin Cocaine, Heroin Drug:

Analytical/Analytical/ReportingReporting

Incident DataIncident Data


Cocaine

Anne Arundel, County

Heroin

38

N-DEx Capabilities


Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation


Automated NotificationAutomated Notification

39

AutomatedAutomatedProcessingProcessing

Fraud

Batta

HPDInvestigations

NotificationNotification!

M. BattaM. BattaAssociated WithAssociated With

Suspected TerroristSuspected TerroristM. CartaM. Carta

JTTF Investigations

Terrorist

CartaNotificationNotification!

M. CartaM. CartaAssociates FoundAssociates Found

M. AccamM. AccamM. AccaM. Acca

Drug Trafficking

Acca

LVMPDInvestigations

M. AccamM. AccamAssociated WithAssociated With

Suspected TerroristSuspected TerroristM. CartaM. Carta

NotificationNotification!

Incident Report

Incident ReportAssault

Suspect(s): M. Accam

Witness(s):M. CartaM. Batta

Assault IncidentAssault IncidentSubmittedSubmitted

NotificationAgencies Notified ofAgencies Notified of

Terrorist LinksTerrorist Links

40

N-DEx Capabilities


Collaboration

Notification

Visualization

Subscription

Search


Incident/Case

Correlation

AutomatedProcessing

Entity Resolution

Entity Correlation


Bring InvestigatorsBring InvestigatorsTogetherTogether

41

Collaboration

Suspect: Unknown

Right Hand: SpiderNeck: MariaTatoos

Create Task Force

Create Name: Grand Rapids

Grand Rapids

NextNext

Add Users: User# 12345 User# 12354User# 23445User# 34599

Read:

Write:

Attributes

Task Force Message BoardsWalker Drug related robbery in south04/25

Suspect: Unknown


Suspect: Unknown


Task Force Work SpaceGrand Rapids

Incident Report

Incident Report

Submitter:Officer Roberts

Suspect: Doug Montrose

Victims:Homer OlsenRandall Milton




Assault 8/2/2004Assault 8/2/2004

Incident Report

Incident Report







Assault 8/2/2004Assault 8/2/2004

Incident Report




Assault 8/2/2004

Incident Report




Assault 8/2/2004

Incident Report




Assault 8/2/2004

Incident Report




Assault 8/2/2004

Incident ReportIncident Report




Grand Rapids

Drill Down

42

Collaboration

Enable real-time collaboration and sharing of information (e-mail, on-line messaging, instant messaging, folders/sharing, task force workspace etc.)

Allows users to electronically locate others working on similar cases

Dynamically create investigative teams Leverage the individual knowledge of police officers,

analysts and investigators to a greater whole

43

N-DEx Integration

Data Integration

Functional Integration

44

N-DEx Data Integration

• N-DEx provides view of full record • No need to “pull” from the source

• Example - incident reports from RMSs

• N-DEx is an index/pointer• N-DEx can request a “pull” from source• Example – R-DEx

• N-DEx not aware of their information• Legacy transactional system that must be queried• Example - NCIC and III (via NCIC)

45

Non-Interactive Data Source Examples

46

Data Standards Extensible Markup Language (XML) will be the structured

language for describing information being sent electronically to N-DEx.

The N-DEx Program has developed an Information Exchange Package (IEP) using the Global Justice XML Data Model (GJXDM) schema

The National Information Exchange Model (NIEM) is using the GJXDM for building a common XML data exchange standard for information sharing among:

Department of Homeland Security Department of Justice Supporting communities in justice, public safety, homeland security, and

intelligence.

N-DEx will also develop an IEP using standards based on the latest NIEM release

47

N-DEx Functional Integration

End-User Browser LEA users will be provided the ability to access N-DEx directly

through a web browser

Web Services All N-DEx user level capabilities will be available to external LEA

systems through web service interfaces Example - RMS or regional system may wish to integrate N-DEx

capabilities into the local system's user interface

48

N-DExN-DEx

Network

NetworkNetwork

LEA System

End-User Browser Integration

Web Services

Integration

N-DEx Functional Integration

49

Network Connectivity CJIS will deliver N-DEx on the CJIS Wide Area Network (WAN)

Connectivity will be through any means authorized per CJIS Advisory Policy Board (APB) policies/guidelines and state policies

Methods of connectivity to the CJIS WAN from secondary locations (e.g., NLETS, RISS.NET, state network, etc.)

LEAs will also be able to connect to N-DEx via secure Internet connections using the LEO system

50

Key Assumptions The Key Success Factor - ensuring that N-DEx meets the real-world needs of law

enforcement N-DEx will be deployed incrementally based on user priorities The effectiveness of N-DEx is dependent upon widespread participation N-DEx is an information sharing system, not a statistical reporting system N-DEx is not an intelligence system Management of data shared in N-DEx will remain with the LEA that provided it An objective of the N-DEx implementation is to reduce the points of integration from a

data and functionality perspective N-DEx will offer a range of options for LEAs to integrate their systems Existing standards, systems and networks will be leveraged MOUs will be the mechanism N-DEx will use to document agreements between N-

DEx and its information-sharing partners N-DEx will be designed and built in consultation with its local, state, tribal and other

federal partners in a collaborative manner Only data classified as Sensitive but Unclassified (SBU) or below will be permitted within

N-DEx

51

Questions

law enforcement national data exchange n-dex concept overview

Documents

ndex visionto

presentation overviewthe

record entity correlation

north main

s main st

jimmy smith

jim smith

entity resolutionautomatically