Monday, November 28, 2016

Introduction to Link Analysis: Part 2 Association / Activity Matrix

I originally wrote this post for a software company’s blog in 2014. This company was bought out and recently their blog and website have been removed from the web permanently. I am reposting it here for posterity. 

Last week I started a series of posts on Link Analysis. Link Analysis diagrams are used to explain the relationships between entities in a criminal investigation. There are three main types of diagrams that are part of Link Analysis. They are:

  • Time Event Chart
  • Association / Activity Matrix
  • Link Analysis Diagram

Last week’s post focused on Time Event Charts. This post is going to cover the Association / Activity Matrix. One of the main uses of the Association / Activity Matrix is as a preparatory step in the creation of the Link Analysis Diagram. That’s not to say that it’s entirely useless by itself but you’ll rarely see it front and center in a Link Analysis presentation.

Association / Activity Matrix
Matrix analysis allows you to represent the relationship between persons, entities and/or events. Both the Association and Activity matrixes are similar in appearance.

An Association Matrix represents the relationships between persons and/or entities. There are two variations on the construction of an Association Matrix. The first has the names of the persons/entities along both the vertical and horizontal axis.



This type is the easiest to construct using a computer spreadsheet. The only caveat is that the names need to be in the same order along both axes in order to allow all possible combinations to be represented. This can make it more difficult to add persons to the matrix at a later time.

The other type is simpler to label as the labels only need to be entered once along the diagonal at the top of the diagram.



The easiest way to generate this second type is probably to photocopy or otherwise reproduce an existing blank chart form unless you are good with a drawing program.

Both types of diagram work the same way.



In this chart the relationship between Jones and Joe’s Bar is represented. Follow the column for Jones down to the row for Joe’s Bar.

There are a number of symbologies taught by various groups teaching link analysis. I am a firm believer that simpler is better. Rather than filling the matrix with a variety of symbols I believe the best method is to use this simple symbology:



As an investigator, it is your judgment that determines what a known association is and what is a suspected association. Representing suspected associations may assist you in determining potential areas for intelligence gathering activities or further investigation.

Activity Matrixes represent the relationship between persons and/or entities and events. Activity Matrixes work in nearly the same way. The main difference is that Activity Matrixes are constructed using a square or rectangular grid as opposed to a triangle grid.



You should normally label persons along the vertical axis and events, entities, locations, etc. along the horizontal axis. You do not need to have the same number of items on one axis as you do on the other.

An Activity Matrix is helpful in identifying key actors in a case. The more events a person is associated with, the more active that person is in your case. Some variations of both matrixes include a space to count the number of associations depicted for each person. Include a row along the bottom of your matrix and then count the number of associations in the column above that cell.

Next week, we’ll look at Link Analysis Diagrams.

Monday, November 21, 2016

Introduction to Link Analysis: Part 1 Time Event Charts

I originally wrote this post for a software company’s blog in 2014. This company was bought out and recently their blog and website have been removed from the web permanently. I am reposting it here for posterity. 

Most of the posts that I have done for are related to the field of Crime Analysis. The next couple of posts are going to deal with a topic that more rightly falls into the field of Criminal Intelligence Analysis. Where crime analysis more often deals with the numbers of reported crimes, criminal intelligence more often deals with information from human sources. In spite of this difference, by practice most crime analysts end up doing some of both fields. The criminal intelligence analysis task probably most often asked of crime analyst is performing Link Analysis.

We’ve all heard the old saw “A picture is worth a thousand words.” While it might be an old saying, there is a lot of truth in it. Often times a picture or diagram can explain something far easier that words. The football coach who uses a diagram to explain a complicated play during practice does so because it’s much more effective than trying to explain it with words alone.

Link Analysis diagrams are used to explain the relationships between entities in a criminal investigation.

The analytical tools and techniques used in Link Analysis can help you to understand the complex group of facts that is the case you are working. Many times, the cases we are assigned to investigate are pretty simple and don’t require us to use Link Analysis tools to understand them. However, there are times we’re assigned one of those huge complicated cases that end up filling up file boxes with documents. Even if you’re the case agent the sheer volume of information can be hard to keep up with, much less explain to your supervisor or a prosecuting attorney. It’s these types of cases where Link Analysis tools really shine.

Link Analysis Tools

There are a number of tools that are used for link analysis. Some analysts include flow charts as a link analysis tool but others do not. The same goes for Time Event Charts. I am not going to include flow charts in this series of posts. The tools I will discuss are:


  • Time Event Chart
  • Association / Activity Matrix
  • Link Analysis Diagram


There is nothing really magical about these tools. Often times, investigators view them as some sort of mysterious mojo that an analyst cooks up over a steaming cauldron while muttering incantations. These analytical tools can only help you arrive at a solution. They will not determine the solution for you. The most important tool is you, a seasoned analyst with your judgment and wisdom. As the authors of an US Army manual said about link analysis tools “The techniques themselves are not the solution. Don't let the tools drive the problem.”

Let’s look at the first Link Analysis tool.

Time Event Chart

A Time Event Chart records events temporal relationships. In other words, it’s a diagram that represents events in a chronological fashion. Time Event charts can display events spanning long periods of time in a reasonably compact fashion. Often times, criminal conspiracies include relevant events spanning several years. Events that are relevant to proving a conspiracy may include preparatory events as well as the actual crime itself. Knowing how these events interrelate is important to gaining a complete understanding of the conspiracy itself.

The first, and sometimes last, event in a Time Event Chart is displayed with a triangle. You may wish to avoid using a triangle for the last event on a chart unless it’s a concluding event such as an arrest. If you prepare a Time Event Chart for an ongoing case, don’t worry about the last symbol being a triangle, you may have more events to plot as your case grows.

Successive events in a Time Event Chart are represented by a rectangle. You should note information such as the event date, case number or a brief description of the event the symbol represents. A particularly significant event can be highlighted by drawing an X through the event node. The flow of time in a Time Event Chart is symbolized by arrows.

A simple Time Event Chart is depicted below.


A variation on the Time Event Chart includes the days between events on the arrows between event nodes. This may assist you in determining a temporal pattern to your series of events.

We’ll look at ways to draw these diagrams in a subsequent post. However, the drawing tools built into Microsoft Office work really well for these charts, especially the Time Event Chart.

Next week we’ll look at Association / Activity Matrixes.

Monday, November 14, 2016

Five Things a Crime Analyst Can Do To Keep Your Officers Happy

I originally wrote this post for a software company’s blog in 2014. This company was bought out and recently their blog and website have been removed from the web permanently. I am reposting it here for posterity. 

At the end of 2013 I decided to spend this year writing a series of posts that I hoped would help new crime analysts or analysts from small agencies who may not have had a lot of formal training in crime analysis. I hoped that I could pass on some useful tips that would help them to become an asset to their agency.

Back before I started this series, I sent an email out to the membership of the International Association of Crime Analysts and solicited topics that they felt were important for a beginning analyst. One of the suggestions I received was "how to communicate and relate to police officers".  

I was pretty fortunate in that I was a police officer for 14 years before I gave up the badge and gun and became a crime analyst. Working both sides gave me some insights into how the other side views things. While there are all types of people with a lot of different personalities that get into police work there are a few generalities that you can apply and come up with some tips on how to communicate and get along with your officers.

One, Be economical with the things you ask your officers to do. Your records management system software or offense report forms have lots of fields to fill out or boxes to check off. While it's pretty easy to create a new form for the officers to complete, you should first ask yourself: Do I really need this information? There is a difference between 'nice to have' and 'need to have'. You'd be surprised at the staggering number of forms, affidavits, etc. that your officers have to complete in the course of a shift. If at all possible, don't add to that unless it's absolutely necessary.

Two, Don't wait for your officers to ask for your assistance. Often times there are things you can do much more easily than your officers or detectives. Searching for related cases or cases with similar M.O.'s is one example. Cops are taught to be self sufficient. They often won't ask for your help or just assume that you're too busy. If you can easily help them out, just do it. Speaking of that, remember the old adage: If you give a man a fish, you feed him for a day. Teach a man to fish and you feed him for a lifetime. If they are willing and you will take time to show your officers how to accomplish a relatively simple task such as searching your records management system, they will love you for it.

Three, Don't presume to boss them around. Cops are used to being in control. Their command presence is often the thing that keeps a run of the mill disturbance call from spiraling out of control and turning into a real donnybrook. If they perceive you as telling them what to do, they could resent it and will not be very likely to do it. Better to make suggestions. A favorite line I use in my crime bulletins is "Officers coming into contact with this subject should do X" or "Officers may wish to investigate further".

Four, Be concise in your communications. If you create a crime bulletin, try to keep it to one page. Remember, they will likely  print these out and stick them in the their clipboard or under the visor of their squad car. A multi-page tome just to say there's a roof top burglar operating in a certain part of town is a waste and will likely end up in the round file. I try to include a summary paragraph, usually in bold font, with the most important details. Tell them what they need to know and nothing more.

Five, Know your place. Yes, a crime analyst is a valuable part of a modern police agency but in the end they would do away with you before they would do away with police officers. You are there to assist your officers if making the community they serve safer. Enable them to be more efficient, to be more responsive, and more effective at their jobs and you have done your job. Be satisfied with that supporting role. It's really not a bad place to be.

What other things would you include?

Monday, November 7, 2016

Crime Analysis with Google Earth

I originally wrote this post for a software company’s blog in 2014. This company was bought out and recently their blog and website have been removed from the web permanently. I am reposting it here for posterity. 

I am very fortunate to work for an agency that can provide a lot of very nice tools with which to do my job. We have a full blown enterprise Geographic Information System or GIS along with quite a number of features and enhancements for it.

What's funny is that while I have and use this very powerful GIS, I often find that most of the mapping tasks I need to perform don't require that kind of sophistication. Firing up the GIS application just to locate a street is kind of like swatting flies with a shotgun. The tool I turn to most often for simple mapping tasks is Google Earth.

There are a lot of advantages to using Google Earth for many tasks. Here's a few:

Cost: The basic version of Google Earth is free. Not only the application itself but the data it uses, streets, satellite imagery, etc. If you've ever purchased GIS data you know that it is not cheap. The same goes for GIS applications, extensions, etc.

Ubiquity: Since Google Earth is free and it's offered on a number of computer platforms, it's very easy to share data with another user. You can create a map and save it as a .KML file and then you can email the file to them. No worries about file format, data compatibility, projection, etc.

Ease of Use: Unlike a GIS application with a steep learning curve, a Google Earth user can map meaningful data very easily. Google Earth is often used in grade schools and secondary schools to help kids learn geography. If a school kid can learn it, we should be able to figure it out.

So what kind of maps can we create with Google Earth?

The most basic map is just one that shows geographic features such as streets, lakes, etc. Maybe you just need a simple map of a neighborhood showing the streets in it.

You can also create a point map. Maybe you have a series of armed robberies that you want to look at to see their geographic relationship. You can use the "Add Placemark" command to place  marker at a location, give it a location and an icon. Do this for all the robberies and you have your map. The downside is that the free Google Earth does not come with the ability to batch geocode. If you have hundreds of points to plot you'll have to turn to an outside tool or upgrade to Google Earth Pro.

You can create boundary maps by drawing polygons on the map with the appropriately named "Add Polygon" tool. This works great for drawing beat boundaries, enforcement zones, etc. You can label these polygons and set the colors and symbology to create your maps.

It's also possible to draw maps with routes using the "Add Path" tool. This works well for creating maps of parade routes, maps showing the route a criminal took between crimes, etc.

Another feature I use quite often is the "Show Ruler" tool. This tool allows you to measure distances on your maps. There are a number of criminal law penalty enhancements in Texas that increase penalties for offenses if they occur within a specified distance of a school. This tool allows you to easily determine just how close the offender was to that certain geographic feature.

Google Earth also makes it very easy to export your map as an image file that you can then drop into a report or presentation. I use this feature quite often when I create briefings on crime series or other types of bulletins. The old adage about a picture being worth a thousand words is true. By including maps in your presentations or briefings you can easily communicate geographic relationships. They also make your reports visually appealing.

Since I have access to GIS, I also use it to help create content layers for use in Google Earth. I use ESRI's ArcGIS which comes with tools that will convert GIS layers to Google Earth compatible formats. For instance, I'll export our city limit boundary file from GIS to Google Earth so I can easily add it to Google Earth maps. I have also done this with our Beat Boundaries, Policing Districts, etc. These two tools work very well together.

Do you use Google Earth as part of your crime analysis toolbox?