Graph visualization and law enforcement data

20th February, 2017

This blog post looks at how KeyLines can visualize the range and volume of data generated by law enforcement. In the first of three posts on this topic, we’ll look at two approaches to visualizations; one driven by an incident or event; the other driven by an ongoing investigation into trends.

Data generated by law enforcement

It’s no secret that both civilian and sworn law enforcement employees work with masses of data. Historically this was limited to a back-room crime or intelligence analysis scenario, but increasingly ‘big data’ can be found throughout law enforcement processes, including:

Incident Reporting; in North America this is typically covered by Computer Aided Dispatch (CAD) and Records Management Systems (RMS). Other parts of the world tends to use dedicated systems for recording and processing data from phone calls or anonymous tips. These can even be Customer Relationship Management (CRM) solutions tailored for a law enforcement environment.

Uniform Crime Reporting; the United States and Canada have the “nationwide, cooperative statistical effort” of UCR. Law enforcement at all levels of service voluntarily report crime statistics to the FBI / Statistics Canada. Sharing this data helps compare agencies and trace crime trends year on year.

Operational Data; every large organization has to manage this. In law enforcement, the data can cover scheduling, vehicle logs, payroll, expenses, and records of legally mandated training courses taken by sworn officers.

Production Orders; production orders are often cellphone data from telecommunications companies in North America. They provide the duration, frequency, and means of communication between relevant parties. Analysts typically use them to produce visualizations for situational awareness.

Automated License Plate Readers (ALPR); agencies across the world are using ALPR to apply optical character recognition (OCR) to photographs of vehicles. OCR extracts the plate number in a computer-readable form so that analysts can make connections between registered owners, vehicles and their location at the time of an incident.

Dashboard/Body-worn cameras; police services handle the scale of real “Big Data” in the form of recordings and metadata from dashboard and body-worn cameras. Collecting and retaining data at this scale poses significant storage and retrieval challenges.

An incident-driven approach to visualization

Our first example shows how to use KeyLines as part of a crime analysis application. This approach is typically incident-driven; we start from an incident and expand our network to include relevant auxiliary nodes and connections.

Here’s a simple data model for this type of analysis. It features data typically found in a records management system (RMS):

A possible data model for an incident-driven approach to crime analysis
A possible data model for an incident-driven approach to crime analysis

This isn’t necessarily the complete picture. It could also show convictions and gang membership connections or relationships between officers and vehicles, but these additions might clutter our network.

The most important nodes in this network are Occurrence and Ticketing. These are definitive events representing points in time. They often contain vital information for analysts such as unstructured narratives that can help understand criminal intent.

Here’s the same data model visualized in KeyLines:

Visualizing a criminal incident in KeyLines
Visualizing a criminal incident in KeyLines

We’ve chosen basic icons for each node. Another option is to display mugshots taken from the RMS as images for each individual. Familiar visuals are a great way to make icons instantly recognizable, but you should use them cautiously to prevent large charts looking like a sea of faces.

To keep track of the event we’re investigating, we’ve added a halo to the node that represents the Occurrence. This will make it easier to spot once we display other nodes of interest.

An intelligence-driven approach to visualization

As an alternative to incident-driven we can use visualizations to show awareness for crime trends and common characteristics. These could include:

  • Find tickets that officer #2123 gave in November 2016
  • Show incidents (tickets, occurrences or other) since 2010 that connect to John Smith of 123 Link Avenue
  • Find occurrences that contain the phrase “liquor store” and individuals listed on those occurrences with the role of “witness”

These queries are trivial to execute against a standard graph database (such as Neo4j), a traditional RDBMS (such as Microsoft SQL), or spreadsheets you wish to visualize with KeyLines.

If we run a query to find occurrences containing “liquor store” and “witness”, here’s how it looks in KeyLines:

Visualizing law enforcement incidents relating to liquor store and witness in KeyLines
Visualizing law enforcement incidents relating to liquor store and witness in KeyLines

You can see occurrences and individuals shown in both the KeyLines chart and Time Bar. The Time Bar breaks down the times of each occurrence, so you can filter the chart by occurrence or by time range.

This view shows us that some node clusters contain witnesses of multiple occurrences – these are likely to be liquor store workers. We can also see many incidents have occurred without witnesses. This seems strange and could be a quirk in classification by officers that needs further exploration.

We can plot some or all nodes against a map using KeyLines geospatial integration. Just like in network mode, we can apply filtering and styling options to the occurrence locations:

KeyLines Geospatial can be used to produce geographic heat maps of incidents
KeyLines Geospatial can be used to produce geographic heat maps of incidents

Instead of nodes and links we’re showing a heatmap. When we search for “liquor store”, we now get a clearer view of potential crime hotspots.

It’s clear where events have taken place, and again, the Time Bar lets us to slice the visualization by date and time. This may be useful information for officer dispatch or analysis purposes. For example, liquor store crimes committed outside those hotspots at unusual times may represent outliers that need further investigation.

This post focused on a small subset of the data available to law enforcement, namely CAD and RMS data. Graph visualization helps to provide a holistic view of crimes at both an event-level and trend-level that help analysts and officers fight crimes more efficiently.

In future posts in this series we’ll explore the benefits visualization with KeyLines can provide to other data sources. In the meantime, if you’d like to learn more about KeyLines, get in touch or request a free trial account.

| | | |

Subscribe to our newsletter

Get occasional data visualization updates, stories and best practice tips by email