1. 1 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Visual Link Analysis Christopher R. Westphal Visual Analytics Inc www.visualanalytics.com

2. 2 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Christopher R. Westphal CEO of Visual Analytics, Inc (VAI) Over 22 years of experience Experienced with a wide number of domains: Financial Crimes Money Laundering Frauds (corporate/insurance) Law Enforcement (RMS) Intelligence

3. 3 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Need to know your data Need to think “outside the box” Need to use your noodle Need to learn new techniques ! It’s not rocket science… …but it does require some intelligence It’s not nuclear science… 1 + 1 = a Prerequisites for Analysis

4. 4 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com There are no roadmaps to follow... …or existing references to use... …you have to “make-it-up” as you go along.

5. 5 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com What does… …. a money launderer look like? …. a criminal look like? …. an insider trader look like? …. a generic disorder in DNA look like? …. a manufacturing defect look like? …. a terrorist look like?

6. 6 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Interpretation Methods Leverages human facility to process visual information 312 times more efficient than reading text

7. 7 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Want to Expose Patterns & Trends It’s like trying to find a needle in a haystack New Need to use right visual presentation for exposing patterns. Many times the pattern is not obvious – and using alternative presentations can help expose the anomaly. How will business processes change once the patterns are found?

8. 8 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Pattern #1 Pattern #2 Pattern #3 The method of data presentation is key to exposing hidden patterns Finding Patterns in the Data

9. 9 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Placement Influences Interpretation Detecting Patterns Databases X1Y1Z1 X2 X3 X4 X5 Y2 Y3 Z2 Z3 Z4 X1 Y1 Z1 X2 X3 X4 X5 Y2 Y3 Z2 Z4 Z3 X1Y1 Z1 X2 X3 X4 X5 Y2Y3Z2 Z4 Z3 Field-XField-YField-Z X1Y1Z1 X2Y1Z2 X3Y2Z2 X4Y2Z3 X5Y3Z3 X5Y3Z4 Table

10. 10 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example: Unexpected Commonality Certain “entities” should never be shared (e.g., SSNs) Data prone to typos and misspellings Possible misrepresentation and/or falsifying data on forms Appearance of avoidance by varying information Unexpected Commonality

11. 11 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example: Too Much Commonality Many patterns are exposed due to repeating behaviors Too many commonalities may indicate organized behaviors Subjects perpetrate the same crime at different financial institutions Only minor changes in their underlying Modus Operandi (MO) Too Much Commonality

12. 12 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example: Accumulated Behaviors Each unique filing looks valid – need to see it collectively (all at once) Large numbers of discrete actions forms the bigger pattern Easy to avoid detection if each transaction appears legitimate Individual may be using mules to move money in/out of the accounts Accumulated Behaviors

13. 13 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Organizations People Accounts Weapons Vehicles Claims Addresses Comms Passports ID Numbs Vessels Aircrafts Money Phones Meetings Facilities Transfers Events Drugs Narcotics Email Equipment Cases Travel What are Data? Which of the following are Real-World Objects and which are Conceptual Objects?

14. 14 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Would not want to create: Caller/Callee Deposit/Withdrawal From/To Arrival/Destination Shipper/Consignee Seller/Buyer Prime/Sub Payor/Payee Sender/Receiver Owner/Renter Phone People Vehicle Define the type for the entity – not the role Be Consistent with Defining Types Address

15. 15 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Technologies vs. Methodologies Link Visualization is a tool just as Microsoft Word is a tool Link Analysis does not replace the knowledge of the user –Improves efficiency –Produces better and higher-quality results Link Analysis does exactly what it is told to do Link Analysis makes data explicit Methodology drives the technology Need to fully understand your data Need to have an expectation of what you want to see

16. 16 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Connect The Dots…. Simple…Easy…Straightforward…???? What happens if you… Don’t know the dots? Have missing/extra dots? Mess-up the sequence? Don’t recognize the threat? Pattern #1 Enters country on student visa Attends flight-training school Indirect connections to known terrorist Pattern #2 Commercial driver’s license Apply for chemical-hauling permits Purchase storage containers Rent transport trucks a b c d e f g h i j k l m n o p q r u t v w x y z 1 2 3 4 5 6 s …Pattern #X…

17. 17 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Is this an Important Pattern? Ron Ronnie Ronald Ronny The Gipper Dutch-Boy 480-07-7456 Mary George Betty John Roger Pam 480-07-7456 Depends on Context Depends on Content Depends on Sources Depends on Data Quality UNKNOWN 999-99-9999 111-11-1111 000-00-0000 123-45-6789 NOT DEFINED Depends on Interpretation Depends on Importance

18. 18 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Is this an Important Pattern? JOHN SMITH What about this pattern? Common values can short circuit a network and potentially lead to inconsistencies. Therefore, it is important to decide how to represent your entities and try to manage the “lowest common denominator” Also need to factor the degree of transpositions to determine if it reflects an intentional misrepresentation of the facts.

19. 19 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Pattern #1 PHONE Is this a Reliable Pattern? ADDRESS Pattern #2 Pattern #1 PHONE EVENT 01/01/02 EVENT 01/05/02 EVENT 01/11/02 SUBJECT EVENT 05/16/05 EVENT 06/03/05 EVENT 06/27/05 EVENT 07/01/05 SUBJECT Pattern #3

20. 20 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Do these Patterns Make Sense? ADDRESS PHONE ID NUMBER SSN ORG SSN REPORT SUBJECT Pattern #1Pattern #2 SSN = SS Death Master Hit

21. 21 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Is this an Important Pattern? 222334444 INVALID

22. 22 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com REPORT Which Pattern Is More Valuable? REPORT SUBJECT ADDRESS PHONE SUBJECT ADDRESS REPORT PHONE SSN REPORT SUBJECT ID NUMBER REPORT SSN ADDRESS SUBJECT ID NUMBER PHONE Pattern #1 Pattern #2

23. 23 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com What Does this Pattern Tell Us?

24. 24 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Who is the Most Important Person?

25. 25 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Methodologies – What’s Important?!?! SUBJECT has numerous SAR filings utilizing the same ACCOUNT number A single SAR with a large number of SUBJECTS typically indicates some type of fraud-scheme. Data Result Sets

26. 26 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com What Are We Looking For? Single Source Multiple Sources TELEPHONETERRORISM CRIMINAL

27. 27 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Source Integration Patterns Income < $10k Property > $500k (non-compliant) Income Property No Income Any Property (non-filers) Overlap

28. 28 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Entity Resolution John Quincy Adams 123 Main Street Boston, MA 774-207-0000 Jonathan Q. Adams Boston, MA 05/29/1968 DL:54321-123 Quincy Adams Bedford, MA 774-207-0000 12/05/1965 Source ASource BSource C Anonymous Resolution md5_128bit = d35ecc61e4cc6810913e5de7fcb5931c Are they the same entity? Standardization Aliasing Normalizing Tokenizing Value-add Permutation

29. 29 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Sample Network - Unchanged Multiple references to the same people based on spelling variations in their name. Different color-boxes show the like/similar entities EDISON MARIA DAVID

30. 30 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Same Network - Consolidated Reduced network from 14 entities to 3 entities. Much more readable and comprehendible. Proper data-cleaning is important for highly- variable data entry processes. Same exact data and information being displayed from previous diagram Larger frequency between Edison and David Bi-directional flow between Edison and David Transfers only flows from Edison to Maria No transfer between David and Maria

31. 31 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Network Structures – Interpretation Highly centric network – shows either source/sink behavior and strong influence/control over the network. Vulnerable and easy to monitor and seize assets. Network may be alien smuggling or various fraudulent activities. More interconnected nodes provides less overall control over the network. Multiple players act in a distributed fashion to add complexity to monitor or disrupt due to multiple targets of interest. Network may be narcotics trafficking or gambling operations. Highly distributed structure shows limited control or oversight across the network. No single control point and network can easily reconstitute using alternative entities. Hard to track and trace. Network may be terrorist financing.

32. 32 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Data Quality Impacts Analyses MANHA HAN MANHANHATTAN MANHANTAN MANHANTHAN MANHANTTAN MANHATAN MANHATTAN MANHATTAN K MANHATTAN N Y MANHATTEN MANHATTON MEW YORK N Y NEW Y ORK NEW YOEK NEW YOIK NEW YOK NEW YOKR NEW YOORK NEW YOR NEW YOR K NEW YOR, NEW YORJ NEW YORK NEW YORK 10017-1011 NEW YORK 10031 NEW YORK 725 NEW YORK 806 NEW YORK 987 NEW YORK BK NEW YORK CITY NEW YORK N NEW YORK NEW YORK NY NEW YORK NY 10001 NEW YORK NY 10002 NEW YORK NY 10009 NEW YORK NY 10016 NEW YORK NY 10018 NEW YORK NY 10019 NEW YORK NY 10022 NEW YORK NY 10023 NEW YORK NY 10028 NEW YORK NY 10029 NEW YORK NY 10036 NEW YORK NY 10036-3619 NEW YORK QUEENS NEW YORK ROOSEVELT ISLAND NEW YORK STATE NEW YORK Y NEW YORK, NEW YORK, NEW YORK NEW YORK, NY NEW YORK, NY 10017 NEW YORKCITY NEW YORKD NEW YORKE NEW YORKJ NEW YORKK NEW YORKQ NEW YORKS NEW YORKY NEW YORK| NEW YORL NEW YORY NEW YOTK NEW YOUR NEW YOURK NEW YOYK NEW YRK NEW YROK NEWYORK NY NY PLAZA NYC Y Lower Manhattan10004, 10005, 10006, 10007, 10038, 10280

33. 33 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Question? What country is represented by the code SA ? What country is represented by the code ZA ?

34. 34 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example – Structuring Dentist

35. 35 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example – Structuring Same Address

36. 36 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example – Structuring Dental Practice

37. 37 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example – Structuring More Structuring Date (2004)

38. 38 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example – Structuring Original Filing (over $10k)

39. 39 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Elderly Abuse Pattern… SAR-MSB where SUBJECT DOB < 1930 Notice anything in common among these SAR-MSBs?

40. 40 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Analysis of the Warranty Data Extracted SetRepair Type 1 hour - $45 1 hour - $60 1 hour - $50 1 hour - $65 1 hour - $45 Review Details Show all vehicles with fewer than 100 miles brand new cars many will still be on the dealership lot not realistic mileage for general service repairs Show labor only entire cost is based on mechanic time no parts replaced (not traceable) no work was outsourced (not external) Cigarette Lighters

41. 41 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example – Geospatial Filings All SAR forms filed by banks in Howard County, Maryland Filing Years 2004 – 2005 Approximately 300 filings Group by CITY/STATE of the subject

42. 42 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example – Geospatial Filings Geo-encoded the Centroid of the Zipcode Centroid = approx middle of region Populated GIS viewer with results of encoded addresses

43. 43 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example – Geospatial Filings Filtered out any addresses associated with SAR transactions below $100k Heavy concentration along I-95 corridor

44. 44 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Example – Geospatial Filings Zoom-in to the map Highlight the boundaries for Howard County Notice: all but a few of the addresses fall outside the county

45. 45 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com 1. Family Name 2. First (Given) Name 3. Birth Date (Day/Month/Year) 4. Country of Citizenship 5. Sex (Male or Female) 6. Passport Number 7. Airline and Flight Number 8. Country Where You Live 9. City Where You Boarded 10. City Where Visa Was Issued 11. Date Visa Issued (Day/Month/Year) 12. Address While in the United States 13. City and State 14. Family Name 15. First (Given) Name 16. Birth Date (Day/Month/Year) 17. Country of Citizenship I-94 - Arrival-Departure Record SUBJECT ADDRESS PASSPORT FLIGHT EVENT

46. 46 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com I-94 – Multiple Passport Numbers Identified a courier with over 50 different passport numbers for over 200 travel events Generated a timeline to show the number was changed in July (Mexican Passport)

47. 47 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com I-94 – Multiple Passport Numbers 1) Reverse look-up on address 2) Identified a courier business 3) Expanded to show other I-94 targets

48. 48 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com What Type of Data are in a Date? 7th MoY July 4th DoM 3rd QTR-c Summer 4th QTR-f 2nd WoM 186 DoY Sunday Holiday-US Leap Year 1976 2nd DoW Banks Closed 28 WoY JULY 4, 1976 DOW -Day of Week DOM -Day of Month DOY - Day of Year DOQ - Day of Quarter WOQ - Week of Quarter WOY - Week of Year WOM - Week of Month MOY - Month of Year QTR-f - Quarter Fiscal QTR-c- Quarter Calendar Season/Holiday/Leap Year What do these dates have in common? ? ? 2000 March 7 2001 February 27 2002 February 12 2003 March 4 2004 February 24 2005 February 8 2006 February 28 2007 February 20 2008 February 5 2009 February 24 2010 February 16

49. 49 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Temporal – SAR Filings Day of Week Week of Year Very regular filing (1 per month – except Dec) Represents a very consistent filing behavior Dates for first ½ year occurred more often on Mondays Unusual change for remainder of year – jumps around a bit Reflect filing behavior of financial institution

50. 50 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Holiday break timeframe is quite active and includes 12/25 Holiday – 4 th July Long weekend Long weekend (Labor Day) Period of inactivity Temporal – SARC Filings SAR-CASINO filing that clearly show the individual tends to prefer weekend and holiday gambling time frames. Tells us he is “employed” since he is working during the week. Inactive times correspond to known work periods

51. 51 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Convenience Store Deposits Mondays / Fridays Period of inactivity (2 week vacation) Pattern abruptly stops Cash Transaction Reports (CTR) filings for a convenience store owner. Business offers “check cashing” for clients. All transactions represent over $10,000. Very consistent Monday & Friday filings All transactions represented are cash DEPOSITS – which is inconsistent for a check-cashing business (the events should be WITHDRAWLS)

52. 52 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Temporal Grid – HOD / WOY After hours 12:00 Mostly afternoon Border Crossing

53. 53 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Temporal Grid – HOD / WOY Border Crossing

54. 54 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Little Old Man… Use of SAR-MSB DOB between 1920-1930 Same use of ID Number 55 unique filings Narratives state: –“CUSTOMER PURCHASES MONEY ORDERS TOTALING LARGE AMOUNTS VERY FREQUENTLY.” –“CUSTOMER NEEDS THEM FOR PAYROLL FOR EMPLOYEES” –“OPERATES AN INSURANCE BUSINESS” Over $400k of MSB Primarily in filed 2006 Heavy filings on Mondays and Wednesdays Averages 2-3 transactions per week

55. 55 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Reference Sources Death Master Match Public / Common Phone Match Address Validation SSN Validity Check Watch list / PIP Check Case Records Public Records Criteria Countries Critical Infrastructure Important Dates Sex Offenders ITIN Check

56. 56 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com SUBJECT PHONE ADDRESS SUBJECT ADDRESS EVENT SUBJECT EVENT PHONE EVENT SUBJECT SSN ADDRESS A Basic Network Diagram

57. 57 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com SUBJECT PHONE SUBJECT EVENT SUBJECT EVENT ADDRESS SSDM Pay Phone Watch List Prior Case Bad Address A Value-Added Network Diagram Sex Offender Embassy

58. 58 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Some Simple Questions… What do these companies have in common? CARIBBEAN HAPPY LINES MODERN ELECTRONIC COMPANY SACKS FACTORY Where can this telephone number be found? 202-289-9313 What is located at this address? 801 Mount Vernon Place, NW Washington, DC 20001 What is the vehicle make/model of this VIN? ZA9BC10U13LA12551 Who owns this Social Security Number? 078-05-1120 1) OFAC list 2) Greyhound Bus Station 3) DC Convention Center 4) Lamborghini 5) The Woolworth Card

59. 59 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Some Simple Questions… What happened on 03/11/2004 ? Where is 38.898748° -77.037684° ? Who owns this IP address: 198.81.129.100 ? Where is ZIP code 96616-2876 found ? 1) Usama Bin Laden 2) Madrid Bombings 3) White House 4) CIA 5) USS Ronald Regan

60. 60 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com A Simple Question… Who is the FBI’s most wanted fugitive ?

61. 61 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com What Do Terrorists Looks Like? White / Black / Asian / Arabic? Man / Woman? Domestic / Foreign? Poor / Rich? Illiterate / Educated? Adult / Teenager? It’s based on their actions, behaviors, and relationships …