Geoprofiling and other geo-spatial methods against metal theft CONFIDENTIAL SNCF London, September 15th, 2015

 My name is Jean RUAUD  I’m crime mapper and geomatician for SNCF Security. 

 Every time a security incident occurs on the network a CEZAR form is filled in.  CEZAR is SNCF’s security incidents database.  CEZAR means: ConnaissancE des Zones A Risques (knowledge of zones at risk). CONFIDENTIAL SNCF

 Information on the CEZAR form is entered into the dedicated CEZAR database.  The following typology is used for metal theft: ◦ Main category : THEFT ◦ Type : SIMPLE THEFT or THEFT WITH INTRUSION ◦ Main Consequence : SNCF ◦ Second Consequence : METAL or TRACK MATERIAL, ATTEMPTED THEFT  Other details can be entered : ◦ Offenders involved ◦ Offenders arrested ◦ Victim categories ◦ Number of trains affected ◦ Total time lost ◦ Type of metal and weight ◦ Estimated cost CONFIDENTIAL SNCF

 Data is geolocated: ◦ By line number ◦ by kilometer post number where the incident occured on this line number.  This geolocation allows localization mapping of the data: CONFIDENTIAL SNCF More important for geospatial analysis

Maps address different issues and audiences. Operational maps:  What happened and where?  Quick reaction  Management of day to day resources Very simple “dots” maps, conveying their meaning clearly under all conditions. CONFIDENTIAL SNCF

Example of map produced

CONFIDENTIAL SNCF

Example of map produced

Tactical maps: Assistance to management in:  Resource allocation  Hot spot identification  Evolution over time  Criminal movements  Accountability, communication and reporting Density and chloropeth maps, hot spot analysis, animated maps. CONFIDENTIAL SNCF

Example of map produced

CONFIDENTIAL SNCF

Strategic maps:  Statistical visualization (correlations, spatial relative quotient)  Problem solving analysis  Long term evolution  Predictive mapping  Geographic profiling  Monitoring, assessment, evaluation and performance reviews  Communication CONFIDENTIAL SNCF

Example of map produced

 GIS (Geographic Information System): ArcGIS 10.2  Geographical databases: ◦ Infrastructure geographical database (all the elements of network infrastructure in vector shapefiles) ◦ IGN shapefiles (for administrative limits and elements in the local environment)  ArcGIS Online (for streaming photographic maps from the Web in GIS)  CrimeAnalyst (ArcGIS extension specialized in crime analysis)  RIGEL (geographic profiling) CONFIDENTIAL SNCF

 Geo-profiling is an investigative methodology that uses the locations of a connected series of crimes to determine the most probable area of offender residence (or base, or anchor point).  Originally developed to help police locate serial killers, rapists and arsonists, geographic profiling can be applied to any circumstances where an unidentified person is known to have carried out criminal activities at a series of known geographic points.  Very useful to explore high volume crime series such as metal theft on the railway network. CONFIDENTIAL SNCF Approaches to geo-profiling

 Prioritises areas and individuals for attention  Helps to manage information  Is based on what is most likely What geographic profiling is not… An “X marks the spot” estimation A “silver bullet” A substitute for good investigative work CONFIDENTIAL SNCF What geographic profiling does…

 Identify a crime series  Evaluate suitability for geographic profiling  Verify the linkage and seek missing data  Develop a scenario  Create the geographic profile  Draw up a suspect list and prioritize it  Produce the report and suggest investigative strategies CONFIDENTIAL SNCF The geographic profiling process

 Professional geographic software for police and military analysts  Rigel® is produced and distributed by Environmental Criminology Research Inc. (ECRI) Vancouver, Canada. CONFIDENTIAL SNCF

 An investigator from the Gendarmerie Nationale (Cooperation Unit) came to us to make a geo- profile of a series of thefts committed on the network.  A series of thefts was detected in the east of France and investigators already had some clues.  They had already done the linkage process and attributed all the offences in the series to the same group of suspected offenders. CONFIDENTIAL SNCF

 The thefts were entered in the CEZAR database.  We extracted the entries from the database and made a simple map of their position in ArcGIS.  In this way we could assign geographical coordinates to each of the thefts.  Then the crime sites and clue locations were entered into RIGEL®. CONFIDENTIAL SNCF

 Then we produced the first geo-profile based on the scenario involving all the crime sites: CONFIDENTIAL SNCF High probability zones

 Investigators suspected an organized crime group operating in the area.  This group used the same modus operandi for each crime.  In an abandoned vehicle used by the group, investigators found a piece of metal from the SNCF, this clue allowed them to make the connection between the group and this series of crimes. CONFIDENTIAL SNCF

 Investigators made a search of premises used by the group and found more SNCF material.  The premises were found to be within a zone identified by RIGEL. Zone where the group’s premises were found CONFIDENTIAL SNCF