Digital investigations succeed by drawing data together from every source, without siloes, and analyzing it as an aggregated whole. Lawful intelligence draws on sophisticated technologies to detect patterns and insights within those vast datasets, increasing analysts’ efficiency and reach, but those capabilities are only an adjunct to human expertise. Repeatable techniques to interrogate data evolve over time into proven workflows and tradecraft that enhance both efficiency and effectiveness.
SS8 has worked closely with law enforcement, the intelligence community, communication service providers, and international standards groups for more than 25 years to improve investigative workflows and the capabilities that underlie them. The narratives in this article show how some common types of lawful intelligence tradecraft fit together to detect, deter, and disrupt specific threats while upholding legal and ethical standards. These patterns suggest how individual techniques can be combined and rearranged to fit the requirements of individual use cases and investigations.
Solving a Murder
A hypothetical murder investigation begins with scant evidence—there are no witnesses, although a hat found at the scene is not recognized by any of the victim’s roommates. Analysis of video from a neighbor’s digital doorbell reveals that the same car passed by the crime scene several times in the days preceding the murder, slowing down each time it goes by. The license plate is not visible, but the color and make/model of the car are enough to cross-reference with official records and identify a list of potential subjects.
Drawing a geofence around the crime scene, investigators subpoena tower dumps in the area, which identify a single subject of interest corresponding to timestamps in the doorbell video. Auto records corroborate that identity, and investigators obtain warrants to access the subject’s location data and residence. The subject’s handset is shown to have moved toward the crime scene around the time of the murder, before being switched off for several hours. DNA taken from items in the home matches the hat found at the scene, and a solid evidential narrative emerges.
Image of geofence defined in Intellego XT
Illuminating a Property Theft
High-value, remotely located items such as agricultural equipment and fuel make rural areas frequent targets of theft by criminal groups. It is not unusual for a series of tractors and combines to disappear overnight from the same farm area, almost without a trace; no surveillance coverage is available, and very little physical evidence is left behind. Knowledgeable thieves will disable GPS positioning devices, blocking the clearest method of tracking the equipment, so investigators must turn to other technical means.
Speed cameras and plate readers at rural intersections, patterns of nearby purchases, CB radio chatter, and phone intercepts feed into a data fusion engine. Data correlation assisted by machine learning identifies subjects from outside the area known to law enforcement and flags suspicious patterns of movement by a flatbed truck registered abroad. A burner phone’s location is associated with movements of the truck, which supports link analysis that helps broaden the pool of suspects and map their relationships. Cross-referencing further with surveillance cameras near a shipping port, the investigative team works toward recovering the stolen equipment and apprehending the suspects.
Rescuing a Human Trafficking Victim
In a story tragically similar to reality, a victim of human trafficking manages a brief call for help before the line goes dead. That small contact is the foundation for a digital investigation. High-accuracy location intelligence shows the
phone’s last known signal from the northeast corner of a warehouse on the city’s edge. Officers arrive too late, but historical device movement and financial records show a pattern of short-term stays and frequent SIM swaps by the captors—hallmarks of trafficking logistics.
Undercover officers infiltrate an encrypted messaging platform used by the traffickers to gain trust and access hidden chats. That resource helps build profiles of the organization and its members, including mannerisms, tattoos, and other identifying characteristics, cross-referenced with metadata and tagged location data. That information helps identify gang members in surveillance video and witness accounts, as well as understand their patterns of life. The breakthrough comes when a trafficker posts a GPS-tagged selfie in a private group, generating a real-time alert to the investigation team and initiating a rescue operation.
Interrupting a Narcotics Flow
A customs audit might raise suspicion when analysts flag an exporter’s over-invoicing and wire transfers to offshore shell companies. Suspicious activity reports filed by the firm’s bank show a pattern of structured deposits just below reporting thresholds, further suggesting trade-based money laundering and launching a deeper probe by a multi-agency narcotics task force. Lawful intelligence analysis of customs manifests, bill of lading inconsistencies, and tariff code mismatches reveal a pattern of shipments with inflated declared values and impossibly short transit times, further suggestions of money laundering.
Pattern analysis of financial transactions, intercepted call data records, and offshore account data helps identify a shipment deemed likely to contain illegal drugs. The relevant container is flagged for a customs hold and subject to physical inspection and atmospheric sampling to detect traces of narcotics. No contraband is found, but the effort does not raise alarms for the traffickers, so multiple shipments are targeted over the course of months, until a lode of cocaine is discovered inside a cargo of hollow pump casings.
This blog is part four of a four-part series, “End-to-Intelligence Gathering,” which illustrates investigative challenges and technological solutions throughout the intelligence lifecycle. Part 1, “Sources & Methods,” introduces conceptual and operational practices for sourcing and identifying value in relevant data. Part 2, “Ingest & Analysis,” discusses transformation of that data into actionable intelligence. Part 3, “Dissemination & Impact,” addresses methods for using intelligence in investigations effectively and securely. This final installment, “Use Cases & Illustrations,” wraps up the series with examples of how analysts apply end-to-end intelligence in real-world scenarios.
About Kevin McTiernan
Kevin McTiernan is a seasoned professional with over 20 years of experience in the security industry. His extensive expertise spans big data, cybersecurity, network security analysis, and regulatory compliance. As Vice President of Government Solutions at SS8, Kevin specializes in the implementation of advanced intelligence solutions for the U.S. Government, law enforcement, and the Five Eyes alliance. He is an accomplished public speaker and an adamant supporter and volunteer for the National Child Protection Task Force. You can learn more about Kevin on his LinkedIn profile.
About Rory Quann
Rory Quann is a Senior Solutions Engineer specializing in End-to-End Government Solutions at SS8 Networks and brings with him over 14 years of experience in the Lawful Interception and Data Analysis industry. Prior to joining SS8 in 2013, Rory worked for BAE System Applied Intelligence where he was focused on large scale Government deployments of Intelligence Solutions. Rory has held multiple positions in the Lawful Intelligence space ranging from Deployment Engineer, System Consultant, and Sales Engineer focusing on Country-wide Passive deployments. Rory is a Certified Microsoft MCSA Engineer and EMC Certified deployment Engineer. Learn more about Rory on his LinkedIn profile here.
About SS8 Networks
As a leader in Lawful and Location Intelligence, SS8 is committed to making societies safer. Our mission is to extract, analyze, and visualize critical intelligence, providing real-time insights that help save lives. With 25 years of expertise, SS8 is a trusted partner of the world’s largest government agencies and communication providers, consistently remaining at the forefront of innovation.
Discovery is the latest solution from SS8. Provided as a subscription, it is an investigative force multiplier for local and state police to fuse, filter, and analyze massive volumes of investigative data – in real time.
Intellego® XT monitoring and data analytics portfolio is optimized for Law Enforcement Agencies to capture, analyze, and visualize complex data sets for real-time investigative intelligence.
LocationWise delivers the highest audited network location accuracy worldwide, providing active and passive location intelligence for emergency services, law enforcement, and mobile network operators.
Xcipio® mediation platform meets the demands of lawful intercept in any network type and provides the ability to transcode (convert) between lawful intercept handover versions and standard families.
To learn more, contact us at [email protected].
