Data Fusion – eradicating both terrorism and crime

This post is also available in: עברית (Hebrew)

Data Fusion: Using data that includes a shot of a vehicle license plate, an occasional pic on Facebook, cellular positioning of a group of people and information on the transfer of funds, it is indeed possible to intercept members of a terrorist cell and apprehend them prior to their executing a lethal attack.

A new report by the US Department of Homeland Security (DHS), dated June 2014, that was only now cleared for publication, discusses the US government’s plan to unify, even if only partially, the 78 “Data Fusion” centers working for the defense, intelligence and law enforcement authorities in the US.

What is “Data Fusion” and how is it related to counter-terrorism and to crime?

The quantities of data accumulated by the various intelligence agencies in the US and by the various law enforcement agencies, along with those coming in from a variety of technological intelligence systems (SIGINT) or human sources (HUMINT) as well as from civilian data systems (legal, transportation, financial, medical and so on) are staggering in stature, primarily taking highly divergent and rudimentary forms.

Various bodies equipped with dedicated technologies gather the data they require, store it and process it using numerous methods, forms and media. For example, you can find a particular person’s medical data, complete with text in English and Latin and stored in a particular format, this person’s facial pics from a border control system, a file with this his or her voice taken from a contact to a government agency, credit card data and his or her geographical positioning at a given period, taken from his or her cellular provider’s database.

Simply multiplying the number of US citizens, visitors to the US and those the US defines as adversaries and as such gathers available information on, by the amount of data available on them, produces an inconceivable amount of data.

The primary and most fundamental problem is that of “normalizing” the various and divergent data into one structure that is similar in form and structure so that it can house a database from which the relevant information could be retrieved rapidly and reliably in the future.

The next phase in the process of “Data Fusion” is adding data timeline and dating. It is possible to deduce operational and tactical implications from the chronology of the actions of a person, a group or a body, in particular in data systems in real time or near real time.

A sanity check is carried out at each phase of “Data Fusion”, until reaching the so-called “desirable temperature”. This sanity check is conducted on each and every bit of data uploaded to the database to be fused, in order to verify no data contamination affects the source. In addition, the original data is backed up in case it will be necessary to go back retrieve the original data.

At some “maturity” phase of the data in the database, human intervention sets in, comprising of the introduction of rules and thresholds which are also activated when the data is uploaded as well as downloaded, to be used as a form of rapid alert to some ongoing event or to prevent overload with repeat or irrelevant data. Furthermore, aggregation of data between persons, subgroups and data groups within the database is carried out – all of which can be used to draw links between entities throughout the database.

iHLS – Israel Homeland Security

Nurturing the system of connections in the framework of intelligence data systems is crucial, as it can be used to deduce the direction of the flow of information (e.g., the religious leadership of an extremist organization contacts the head of the organization’s military wing, who then sends an email to the head of a terrorist squad who instructs a suicide bomber by phone), as well as deduce the quality of the relations, its “intensity” and so on.

Another phase in which artificial intelligence is introduced through highly powerful computation is Prediction. Visible internet-based data along with data found in public systems (such as Google Trends), incorporated with the post-fusion data already stored, can assist in predicting crime-related or terrorist related events (e.g.: heightened search activity of words containing the assembly of a ‘dirty’ bomb, the whereabouts of a Pakistani biology specialist within an operational cell associated with terrorism, phone calls between the leaders of an extremist religious organization and the organization’s operatives, records of a search for a mass-event coming in from designated IP addresses and so on).

Concern for homeland security and for the safety of the residents dictates an unrelenting fight against terror on the one hand and serious crime on the other, two actions which are time and again revealed to be intertwined. Terror funds often derive from criminal acts and or are illegally laundered on the one hand, and on the other, munitions designed for terrorists often arrive in the hands of criminals as well.

The need to unify police and other law enforcement databases with security databases is ever increasing. There is no doubt the records of land, sea and air border check points are an essential component in deciphering acts of terror and foiling them. The same can be said of financial data coming in from bank account records, from money transfers, transportation data coming in from roadside cameras, and so on.

The US DHS announced the establishment of “Fusion Centers” back in 2003 and some 78 of them are currently operating across the US. These centers have 3000 employees, 30% of them analysts. The operating budget alone for all of these centers reached about 308 million USD (!) in 2013.

The unclassified section of the report consists of some 100 pages examining the activity of the fusion centers according to various interesting parameters:

• Consolidating, analyzing and then disseminating the data to its relevant intelligence consumers
• Constant improvement of intelligence capabilities
• Improving support for operational activity
• Enriching the cooperation between law enforcement agencies and activities
• Effective law enforcement activities
• Improving deterrence capabilities
• Privacy, civil rights and personal liberties

The fusion centers, whose dispersal across the US is primarily geographical, have improved the intelligence capabilities, the alert and the operation activity of counter-terrorism and law enforcement agencies in the US. Nevertheless, their detachment from one another and the fact they do not function as one unified Federal database, makes it harder to handle particularly adverse cross-state events both in the US and worldwide, and in fact confounds counter-terrorism and counter crime efforts when facing a particular event.

Linking the fusion centers into one network once again highlights the issue of personal liberties and constitutional rights, since in such a huge system of 3000 users, who can guarantee each and every citizen that all this ample data stored in state-run systems is not being misused?