wwf and traffic’s information management...

1

F O R I N T E R N A L U S E O N L Y N O T F O R O N W A R D D I S T R I B U T I O N

DRAFT JULY 2015

WWF and TRAFFIC’s Information Management Guidelines

Introduction The purposes of this document are to provide guidance primarily on the management and best practices in relation to information and intelligence gathering/use, and to ensure it is fit for purpose and handled in a professional and secure manner. What is intelligence?

All intelligence is information BUT

Not all information is intelligence

Intelligence introduces the concept of a systematic approach to criminal data/information collection, evaluation, collation and analysis. Intelligence is information that has undergone an evaluation process to assess its worth. In short, actionable information (information that you can use to plan an action or operation to stop crime) is intelligence.

2


DRAFT JULY 2015

Justification Intelligence Management (IM) is a crucial component of law enforcement and WWF/TRAFFIC’s mission to support law enforcement. Good IM not only aids understanding of single case/incidents but also helps in understanding the greater crime nexus/scenario operating at a national, regional or even international scale. If information gathered is not handled and assessed correctly, enforcement operations become riskier, both for informants and enforcers. A standardised, consistent and secure electronic IM system is essential to the success of WWF/TRAFFICs enforcement support work. Consideration of the following will further enhance the integrity and effectiveness of collected information.

● To ensure proportionality and relevance of the data being held by WWF/TRAFFIC it may be necessary to establish a review and ‘weeding’ (selective removal) process. Where the information held on an individual is no longer deemed proportionate and / or relevance it should be deleted from the database.

● Investigators teams require timely input of accurate information in order to provide meaningful contributions to intelligence products.

● Consideration of a tracking system for approved intelligence developments and collection plans is highly desirable.

It is important to avoid the culture whereby staff feel they are providing data into a ‘black hole’, of which they perceive little value or benefit. To avoid this, information captured in the database should be developed in a meaningful and informative manner to aid understanding and promote:

• Better informed decision making to direct resources where most needed; • Enhanced working relationships between WWF and TRAFFIC to effectively combat poaching

and trafficking in an intelligence-led approach; • Improved profiling of illegal wildlife trade, allowing a more effective understanding of

current threats; • Provision of actionable intelligence packages to law enforcement agencies; • Effective monitoring and evaluation of WWF and TRAFFIC’s work on combating poaching and

trafficking. WWF/TRAFFIC will use the following IM systems to support law enforcement work to reduce the poaching and trafficking of wildlife:

• SMART • iBase (see Step Three)

3


DRAFT JULY 2015

Risk Management Even the best technical countermeasures can be foiled by user error. Security basics are essential across WWF/TRAFFIC, particularly when we consider how we share / access information and the prevalence of the Internet in every part of our working life. Perfect security is impossible online just as it is physically, and all security involves a trade-off with convenience, efficiency and costs. Privacy and security, however, do not work retroactively after a threat is detected, and our growing digital footprint combined with constantly changing threat vectors and a myriad of means of tracking make it worthwhile to implement some basic measures to protect sensitive activity online. Basic Web Security The setting of strong passwords and not reusing them across different accounts, and being conscientious about which files to download and links to follow, are all crucial. If you are not expecting an attachment to an email, do not download the file without asking the sender, and do not follow links on suspicious websites or emails that do not look right. Keep all of your software, especially the browser, antivirus, and PDF reader, updated so that newly discovered vulnerabilities will be patched. Use two-factor authentication for important accounts such as email whenever possible, particularly for Gmail and Facebook - a tutorial on implementing two factor authentication can be found here: http://www.pcworld.com/article/2036252/how-to-set-up-two-factor-authentication-for-facebook-google-microsoft-and-more.html Browsing Anonymously There are some simple precautions that can make users much harder to track and identify online. A growing concern for privacy has caused leading browsers to offer modes that block cookies, data from websites stored in the browser, and web history. For Google Chrome this is “Incognito Mode” and for Firefox this is “Private Browsing”. Though most of the tracking that these modes prevent is meant for your convenience, market research or advertising, this is still a simple precaution worth taking when conducting sensitive Internet research. To access these browser options, right-click the Google Chrome icon and select “New Incognito window” rather than “New window” or in Firefox, select “Start private browsing” in the “Tools” dropdown menu. If necessary, browser settings can also change the default language which can be seen via your HTTP headers through language settings and preferences. Services to hide your identity and usage information online are readily available. Two popular options are “Tor” and a VPN1, and they are sufficiently different to justify having both. Tor is a worldwide relay of nodes provided by volunteers that user web traffic passes through at random, encrypting the data each step of the way. As a result, if one node is compromised, the attacker can only find the previous node, not the user. The Tor browser is free and easy to install by following the instructions at this link: https://www.torproject.org/download/download.html.en

1 Virtual Private Network

http://www.pcworld.com/article/2036252/how-to-set-up-two-factor-authentication-for-facebook-google-microsoft-and-more.html

http://www.pcworld.com/article/2036252/how-to-set-up-two-factor-authentication-for-facebook-google-microsoft-and-more.html

https://www.torproject.org/download/download.html.en

4


DRAFT JULY 2015

Encrypted Email There are a variety of ways that email can be intercepted, especially by skilled, persistent attackers or states. Sensitive information, particularly information that can imperil investigations and sources, should not be sent unencrypted. The simplest encrypted email service is Hushmail, which is also useful for creating “burner” email accounts not linked to user information. Hushmail allows encrypted email to be sent between Hushmail users and, when sending mail to other email providers, lets you encrypt email using a question, such as “What is my mother’s maiden name?” that the receiver must answer correctly to see the contents of the email or attached documents. The subject is never encrypted, however, so do not put any sensitive information into the subject line. It is also important to remember to sign in to your Hushmail account at least once every 3 weeks, or else the account and all of its content will be locked. You can sign up for a Hushmail account at https://www.hushmail.com/. Hushmail offers free accounts that can only store 25 MB, which may be fine for limited written communications, or unlimited email aliases and 10 GB of storage can be purchased for $34.99 a year, as well as options for enterprise use. Other useful tools Also worth considering is using Truecrypt. You can use this free software to encrypt parts or all of your laptop / computer / hard disk: http://www.truecrypt.org/ This software can create a hidden operating system on a laptop. This means an area can be created where data is encrypted, but within that area there is an additional secure area where files can be stored. If a password for the first area has been compromised, it still won’t show (based on file size) that there is a second area that is encrypted within it. Another programme that can be useful is Eraser. This allows sensitive data to completely be removed from the hard drive by overwriting it several times with carefully selected patterns, so it is truly erased: http://eraser.heidi.ie/ HTTrack web site downloader may be useful if websites need to be studied in detail. This software downloads a website from the internet to a local directory, building all the directories, HTML, images and other files. It arranges the files exactly as they are on the web, so the website is mirrored and browsing is the same as on the website itself: http://www.httrack.com/ Skype is not secure. In 2011 Microsoft (owner of Skype) patented a technology that allows the company to intercept secure calls over the Skype network. Since then it is believed that this technology is being implemented, and that many governments already have access to Skype calls. For secure voice and video calls, consider Jitsi instead; https://jitsi.org/

https://www.hushmail.com/

http://www.truecrypt.org/

http://eraser.heidi.ie/

http://www.httrack.com/

https://jitsi.org/

5


DRAFT JULY 2015

Step One: Information Collection The information collection process should be focused, which will increase its efficiency so that specific information needs are fulfilled.

Types of Information The following types of information will be collected by WWF/TRAFFIC (with specific guidelines, where applicable):

1. Information: collected on a continuous basis, and concerns the involvement of persons, organizations, associations, modus operandi on-going and suspicious activities that contextualises the threat to wildlife and mostly originates from informants or protected sources. This information should be graded using the 5x5x5 system (see Step 2).

2. Incidents: an individual occurrence or event that happened at a specific location, time & date such as poaching and seizures (see fig.1 for the differences between information & incidents; for example, we may receive three pieces of information about one poaching incident)

3. Market observation: wildlife trade in physical and online markets

Figure 1. Information versus Incidents

Information Collection WWF/TRAFFIC will be required to use these guidelines and the more detailed operating procedure guidance developed for each of the below-mentioned data collection methods, for their own information management processes. TRAFFIC/WWF staff have several options for collecting/recording information and intelligence:

• WWF patrol staff and rangers will collect information and download into SMART • Paper/digital templates: to capture Incidents (including poaching, seizures etc.), Market

Monitoring and Intelligence (available to all staff), that will then be inputted/imported directly into iBase (secure database managed by TRAFFIC) by staff with iBase access

6


DRAFT JULY 2015

• IntelliShare: a web-based portal for inputting and accessing data directly in iBase (available to staff with licences)

• iBase: restricted number of staff will have access and input data directly to iBase (these staff are also responsible for data cleaning, security and management)

Step Two: Evaluation

Intelligence Assessment TRAFFIC/WWF uses the international 5x5x5 tool to evaluate and grade the information it receives. Designating a grade to every piece of sensitive / nominal information ensures the integrity of the data and how it should be managed. While the first two parts (source and information evaluation) are as per the standard 5x5x5 model, the handling codes sections has been slightly adapted to meet the needs of WWF/ TRAFFIC and refers to who can access this information. Access to this information will be dependent on your role, see Data Security. The informant handler and other staff members receiving this type of information should grade the source and the information by using the 5x5x5 risk model. It allows information to be correctly evaluated where the original source is not made known to the recipient. The model grades the source of the information by 5 letters, A to E, it evaluates the information as a score of 1 to 5 and on the same basis indicates who has access to the information.

Source Evaluation

A Always reliable B Mostly reliable C Sometimes reliable D Unreliable E Untested source

Intelligence Evaluation 1 Known to be true without reservation 2 Known personally to source but not to officer 3 Not personally known to source but corroborated 4 Cannot be judged 5 Suspected to be false or malicious

Handling Code

To be completed at time of entry on iBase and reviewed on dissemination 1 External use approved 2 May be disseminated to appropriate TRAFFIC and WWF offices 3 May only be disseminated within TRAFFIC 4 May only be disseminated to enforcement agencies and international agencies (eg. Interpol) 5 No dissemination without referring to the Database Controller

7


DRAFT JULY 2015

Step three: Collation WWF/TRAFFIC will only collect and store information that is relevant and proportionate to support the law enforcement goals of WWF/TRAFFIC:

● Data at site / protected level will be stored in SMART ● Data at site/ landscape, national and international level will be stored

in iBase (the central i2 database);

Information Collation across Different Geographical Levels Level 1: Spatial Monitoring and Reporting Tool (SMART) provides a platform to record information gathered at site / protected area level. The following information can be recorded in the SMART intelligence plug-in:

- Source of information

8


DRAFT JULY 2015

- Date of information received - Information details - Validity - Photographs/documents - GPS location

Information recorded in SMART can be connected to a patrol plan and patrol results and can be uploaded into iBase. Level 1, 2 & 3: iBase is a database application that enables the capture, management of data and the dissemination of information and insight in support of an intelligence-led approach, at a local (including site / protected area level) national and international level. iBase has the capacity to record rich, detailed information regarding seizures, incidents and intelligence that contextualises the problem and allows for an understanding of the threat level regarding all species. Links and associations between seizures and poaching incidents can be established using information gathered throughout the network to understand where and how wildlife trade routes exist and the person of interest. Figure 2: Information Captured at Site Level Entered into iBase

9


DRAFT JULY 2015

Step Four: Intelligence Analysis

4.0 Basic Principles

Intelligence analysis is the process of taking known information about situations and persons of interest and with appropriate statements of probability, the future actions in those situations and by those individuals. The intelligence and analysis should use a qualitative approach to collect the information that is needed to fulfil specific law enforcement support requirements. The diagram below describes a Requirements-Based Approach (fig.3) to the interpretation of the intelligence picture and may enable;

1. Understanding your intelligence goal

2. Building an analytic strategy

3. Defining the criminal network

The intelligence product should aim to: - Determine the level of threat the individuals (see App I for an ex. of a Target Profile) or group of individuals pose; - Identify key individuals for targeting, consider the use of social analysis network; - Focus effort and resources; - Outline intelligence gaps (to drive investigation process); - Produce specific recommendations (to be decided as a team / collective).

Contemplative

Answers questions by collecting &

analysing information

Selectively

explores leads based on priorities

Statistics

produced for decision making

Infer persons of

interest from intelligence

Emphasizes

analysis of data

Analysis-driven

Requirements-Based Approach

Figure 3: Requirements-Based Approach to Intelligence Analysis

10


DRAFT JULY 2015

Step Five: Dissemination

Intelligence development and corroboration One tried method in developing information comes from ‘tasking’ which involves going back to informant handler and/or investigators with specific asks that have been identified from the analysis;

○ Ask for additional detail on what is already known by the informant (who is this person selling to? who else is involved?) so additional leads are gathered

○ Ask informant handler to follow procedure risk assessment and information evaluation

Or: use information in low quality form, but grade accordingly (5x5x5) and can only be used or published with that grading.

5.1 Dissemination of WWF/TRAFFIC intelligence The flow of intelligence between WWF/TRAFFIC and enforcement agencies and other NGOs is critical to the success of investigation development. Intelligence dissemination occurs for two reasons:

1. To make law enforcement agencies aware of imminent or ongoing criminal activity 2. To gain more information from the originator or other organisations on a particular event or

individuals where the original report is not complete and where further contextual information is sought.

The dissemination of intelligence received by WWF/TRAFFIC should adhere to the following points:

● Who, how and when the dissemination occurred should be recorded on iBase (see Dissemination Process for Actionable Information)

● Reference numbers should be provided from the iBase ● Informs who else has been notified (to avoid duplication by different organisations) ● Reciprocity relationships for information sharing should be advocated as much as possible

Monitoring impact and progress in iBase on whether or not the other party takes action based on the information provided is crucial. This will allow evaluation of whether WWF/TRAFFICs information is effective or where improvement is needed.

11


DRAFT JULY 2015

12


DRAFT JULY 2015

Data Security

Database Permission Levels Each region/country will be responsible for assigning permission levels within iBase for each staff member who should require access, in conjunction with the iBase database manager2. This decision should take into account trust, experience, length of time with WWF/TRAFFIC, and each staff member accessing iBase should sign the Confidential Agreement. Permissions and Security Levels (iBase access and control)

● Database manager/analyst: full access ● Investigators: full access ● Data entry and researchers: limited access ● Informant handler: no access

Limiting the access to information in this way means that the privacy of the informants will be safeguarded to the greatest extent possible and that access to sensitive information occurs on a need-to-know basis. This is a general practice for investigation processes that is accepted as the least invasive method and therefore compliant with privacy protection principles.

Auditing Process WWF/TRAFFIC should wherever possible, employ an auditing process for those staff accessing information. iBase will automatically document who accesses what information, aiding the auditing process. Appropriate security measures should be taken against unauthorised access to, or alteration, disclosure or destruction of, personal data and against accidental loss or destruction of personal data. The following are provided as best practices guidelines: Physical security. iBase is located on a cloud server in the UK, which requires two different security passwords and

usernames to be accessed. The database is backed up on a daily basis within the cloud server environment. Manual records are within a lockable room, that remains locked outside office hours or when a

member of the enforcement team does not occupy it. Operational security. A log is kept of all operations carried out on iBase.

Passwords are changed at frequent and irregular intervals.

2 The database controller is able to set different user permissions allowing variable access to different areas of the database, and to amend and delete records or disseminate information dependent on their role and responsibility.

13


DRAFT JULY 2015

Data entry and amendment can only be carried out by the database manager and designated

data entry staff. Technical security. All data files are capable of recovery after partial or complete loss. There are procedures to ensure that no unauthorised access can be made to the system via the

internet or internal computer network. The database contains warnings, which advise when an unauthorised access has been

attempted.

Laws and standards The WWF/TRAFFIC database is housed in the UK, where it is legal to hold personal data if a number of criteria are met. In the UK, TRAFFIC are registered with the Information Commissioner’s office as a data controller and under the terms of this registration, TRAFFIC is allowed to hold personal data for a number of reasons, which includes the prevention of crime and the prosecution of offenders.

Data Protection Only information which can be used directly or indirectly to identify a natural person qualifies as personal data, to which the UK Data Protection Act is applicable and which imposes obligations on the controller of the data, in this case WWF/TRAFFIC. Any information retained concerning personal data (either on computer files or on iBase) will need to adhere to the following eight principles as a minimum:

Processing of the personal data will adhere to the following conditions:

1. Personal data shall be processed fairly and lawfully 2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall

not be further processed in any manner incompatible with that purpose or those purposes. 3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or

purposes for which they are processed. 4. Personal data shall be accurate and, where necessary, kept up to date. 5. Personal data processed for any purpose or purposes shall not be kept for longer than is

necessary for that purpose or those purposes. 6. Personal data shall be processed in accordance with the rights of data subjects under this

Act. 7. Appropriate technical and organisational measures shall be taken against unauthorised or

unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

14


DRAFT JULY 2015

In so far as the envisaged processing of the data is strictly necessary for WWF/TRAFFIC's mission to reduce poaching and trafficking of threatened species, the data processing can be based on this legal basis. However, these interests are at all times and during the whole process being weighed against the fundamental (privacy) rights of the individuals involved, in accordance with the principles of proportionality and subsidiarity.

Processing To further professionalise our handling of sensitive and personal data, staff collecting such data should be in a position to show the source of the information and the reasons for recording it and should keep the following principles in mind; Staff obtaining data ensure that they are obtained only for the purpose of crime prevention and prosecution of offenders. Speculative data, which may be of relevance, are not recorded unless they consist of information, which is relevant to crime prevention and prosecution of offenders. Disclosure of information can only take place where it has been demonstrated that the data requested are necessary for the purposes of crime prevention and prosecution of offenders. Staff ensure that the information sought is the minimum amount of information about each individual that is required in order to properly fulfil the purposes of crime prevention and prosecution of offenders. It is not acceptable to hold information on the basis that it might possibly be useful in the future without a view of how it will be used. Historical data, which cannot be shown to be relevant to crime prevention and prosecution of offenders should be deleted after two years, unless there is relevance to a conviction or a current enquiry into a similar offence can be clearly demonstrated. All records show the source of information, the date on which the information was received and its reliability. The international 5x5x5 tool to evaluate and grade the information is used. The recording of how, when and what information was disseminated takes place to ensure there is an audit trail. In addition, the handling code assigned to each piece of information determines the correct dissemination of the information. Information which is the opinion of a third party is recorded but is clearly marked as such. Inaccurate information is corrected as soon as possible. If no correction exists then this information is deleted as soon as possible.

15


DRAFT JULY 2015

APPENDIX I: Target Profile Analysis

Personal Record

Name Alias Gender Date of birth Age Ethnicity IC / Passport Number Passport Number Height Weight Hair / Eye Colour Eye Colour Facial Hair Distinguishing Features Warning Marker

Employment Details

Occupation Employer’s name & address Source

Address Details

Current Address

Dates Source

Previous Address

Dates Source

Transport Details

Originator Date Title Dissemination How / When

TARGET PHOTO: Include source, date taken and likeness.

16


DRAFT JULY 2015

Current Vehicle Current Licence No. Source

Communication Details

Current Mobile Number Current Home Number Email Address Skype Name Facebook ID Source

Introduction This should contain details on the aim of the analysis and should identify the target’s vulnerabilities, highlight any intelligence gaps and propose recommendation that will enable informed decisions to be made on how best to progress the profile. Inference Describe the target and the level of inferred criminality based upon the intelligence. Intelligence Synopsis Describe the general intelligence picture, can even be given as bullet points. Crime Pattern Analysis Can refer to seizures and incidents (poaching), this should aim to highlight intelligence gaps and recommendations. Network Analysis (including Social Network Analysis) and or Criminal Business Profile Produced in AnB and illustrates links and associations, hierarchies, how the ‘business’ operates. Intelligence Collection Plan A table listing all identified intelligence gaps and ways in which this information will be obtained – needs to be specific to individuals or agencies. Target / Enforcement Plan What specific enforcement initiatives can happen in relation to this target? Prevention Plan What points have been identified that can be prevented in the future, eg. target hardening, awareness, messaging at strategic locations.

wwf and traffic’s information management...

Documents