Social Network Analysis Link Discovery of Florida

Social Network Analysis & Link Discovery of Florida Department of Corrections Data May 7, 2007 Presenter: Donna Nystrom Aerospace Data Mining Center donna. m. nystrom@aero. org (310)336 -5303 Contributors: Frank Meng frank. meng@aero. org (310)336 -0386 Karen Jones karen. l. jones@aero. org (703)812 -0623 © 2007 The Aerospace Corporation

Introduction: James Upchurch, FDOC Bureau Chief, Security Operations Introduction – A Practitioner’s Perspective… • The ALERT prototype tool can help to manage a prison population and system • Florida Department of Corrections – captures a large amount of inmate data across all 53 facilities – needs better analytical tools to leverage its vast storehouse of records and data to improve safety, prison management and operations – goal is to leverage analytical tools in a near real time capacity to predict adverse events that may occur • The "ALERT" data mining effort represents a component of FDOC's larger effort to develop a "dash board" tool set to monitor inmate and prison conditions and to predict certain events

Agenda • • ALERT Project Overview ALERT Prototype Demonstration Moving Forward Conclusions

ALERT Project Automated Link Extraction of Relationships and Threats • The Aerospace Corporation (Aerospace) www. aero. org Non-profit corporation Operates a Federally Funded Research and Development Center Supports national-security, civil and commercial space programs for the US Government – ALERT is funded through Aerospace’s R&D funds – Aerospace Data Mining Center – – • Florida Department of Corrections (FDC) – – www. dc. state. fl. us Wealth of data on prisoners and corrections staff Needs tools to mine and analyze this data Cooperation and dedication of staff and investigators

What is Data Mining? • Non-trivial extraction of implicit, previously unknown, and potentially useful information from data – Relationships, patterns and correlations • Investigation and intelligence gathering – Investigative techniques use a priori knowledge – Intelligence gathering techniques do not • Multi-disciplinary – Fusion of statistical modeling, database, visualization, machine learning, artificial intelligence and other technologies • Also known as KDD – Knowledge Discovery in Databases

ALERT Short Term Goals • Understand prison gangs – – – Organizational structure and individual roles Recruitment methods and culture Interactions between members Interactions with non-members Methods of financing crimes and activities • Detect criminal activity • Measure prison tension • Understand implications for more effective intervention and prevention of criminal and gang activity

ALERT Long Term Goal • Prisoner radicalization poses a threat of unknown magnitude to national security and an objective risk assessment is urgently needed – – – Terrorist groups are adopting existing gang culture and organization Terrorist groups and gangs are cooperating in criminal activities Prison provides an ideal environment for radicalization Every radicalized prisoner becomes a potential terrorist recruit Newly released prisoners are especially vulnerable to recruitment Source: Homeland Security Policy Institute (GWU) & Critical Incident Analysis Group (UVa), Out of the Shadows: Getting Ahead of Prisoner Radicalization Special Report released at the Senate Homeland Security and Governmental Affairs Committee hearing, 9/2006. Understand the nature and extent of links between prison gangs and terrorist groups

ALERT Project Roadmap Think Big, Start Small and Scale Fast • Rapid Prototype (current phase) – Develop low-cost, flexible prototype by loosely integrating open source applications with custom code – Apply prototype to FDC data to demonstrate effectiveness and value of analysis techniques – Work with domain experts to refine the prototype, analyses and results • Full-Scale Application – Establish longer term working relationship with the corrections, DHS and law enforcement communities – Work with these communities and a selected commercial vendor to expand the prototype to a user-friendly, full-scale application • Next Generation Applications – Continue as a thought leader – Pioneer new analysis techniques and applications

FDC Data Extract Data Content • Data Statistics • • Jan 2004 – Oct 2006 53 Major Facilities 90, 000 Active Inmates 165, 000 Total Inmates Source: http: //www. dc. state. fl. us/facilities/map. html • • • Inmate profiles – Offense history – Custody history – Disciplinary history – Demographics Visitation logs Outgoing checks Incident logs Movement history Work assignment history

ALERT Prototype Architecture Input Cleansing & Conditioning Link Discovery Analysis Offense History Network Data Custody History Pattern-based query Disciplinary Reports Warehouse Entity-based query Visitation Logs Outgoing Checks Incident Logs Movement History Work History Social Network Analysis Unconstrained query Iterative query Pattern Analysis Output

Social Network Analysis (SNA) • The mapping and analysis of relationships and flows between people, groups, computers or other entities SNA • A collection of strategies rather than a fixed methodology • SNA techniques can be used to identify and analyze network: – Structure (e. g. subgroups, bridges, holes) – Roles (e. g. leaders, outliers, gatekeepers) – Processes (e. g. flow, evolution, resilience) 11

Inmate-Visitor-Check Recipient Network before SNA

Inmate-Visitor-Check Recipient Network after SNA 13

Pattern Analysis Categorical Temporal $ $ $ $ Geo-spatial Facility A $ $ $ Outgoing Checks per Month F F A A B B B C D Categorization Algorithm E A A B B C D D D Assigned Facility per Month tattoos associates visitors checks … 14

ALERT Prototype Demonstration

Moving Forward • Analysis – – Entity resolution Automated pattern recognition Predictive analysis Dynamic network analysis • Data – – – Phone logs Incoming checks Community corrections data Other state corrections and Federal Bureau of Prisons Beyond the prison system, e. g. • • Joint Terrorism Task Force Law enforcement FBI DHS

Conclusions • The corrections environment is ripe for link extraction, social network analysis and other data mining techniques • The ALERT Prototype is effective and valuable – – Customized to unique data and environment of the corrections domain Distills data to actionable intelligence Identifying the most effective analyses Identifying ways to improve data collection • Global understanding of prison gangs, STGs, and terrorist networks will require: – Scalable applications – across facilities, state and federal jurisdictions and international borders – Shareable data – Common Reference Model – Shareable applications – open, reusable software architectures

The Florida Department of Corrections seal and the maps in Slides 8 and 13 are reprinted with the permission of the Florida Department of Corrections.