Law Enforcement

1
Law Enforcement National Data Exchange (N-DEx)
Program
NAJIS Conference October 17, 2007
2
N-DEx Mission
3
N-DEx Vision
Is to share complete, accurate, timely and useful
criminal justice information across
jurisdictional boundaries and to provide
new investigative tools that enhance the Nations
ability to fight crime and terrorism.

• National information sharing
• Links regional and state systems
• Virtual regional information sharing

4
CJIS Current Information Sharing
Arrests
NCIC
III
IAFIS
18,000 User Agencies
5
CJIS Information Sharing Gap
Current CJIS Systems
NCIC
IAFIS
III
6
CJIS Information Sharing With N-DEx/R-DEx
Integration
7
N-DEx Concept
8
N-DEx Services
Under the hood automated processes triggered by
the ingestion of contributor data
9
N-DEx Services
N-DEx
Services

• Automatically determines related entries that may
  contain varying or non-exact details
• Rob McDonuld and Mark R. MacDonald have
  enough similar additional identifying information
  that there is a high probability they are the
  same person

Identify Who is Who
10
Entity Resolution
11
N-DEx Services
N-DEx
Services
Entity Correlation
Automated Processing
Entity Resolution
Incident/ Case Correlation
Identify Relationships Between People, Places and
Things

• Identifying Non-obvious Relationships Among
  Entities
• Agency As Incident 1 shows an address of 123
  Main Street, Atlantis for Jim Smith
• Agency As Incident 2 shows Bob Woods with an
  address of 789 Main Street, Atlantis
• Agency Bs Booking Report shows Woods recently
  claimed an address of 123 Main Street, Atlantis,
  indicating a possible correlation between Smith
  and Woods.

12
Entity Correlation

• Identifying relationships among entities even if
  they are not obvious or specifically identified
  as related in any one record, for example

• Identify/maintain relationships between entities
  within a record
• Person owns a vehicle correlation established
  between the owner and the vehicle
• Entity correlation will create and manage
  linkages to source records

13
N-DEx Services
N-DEx
Services
Entity Correlation
Automated Processing
Entity Resolution
Incident/ Case Correlation
Find Similar Cases Incidents - Crime
Characteristics

• Finds patterns that link incidents/cases
• Crime characteristics or modus operandi,
• Criminal characteristics or criminal signatures
  that could
• link incidents and ultimately suspects to serial
  crimes
• Automates the current manual practice of
  searching through incident reports for
  similarities
• Helps associate records that do not contain exact
  matches

14
Incident/Case Correlation
15
N-DEx Services
N-DEx
Services
Automated Expert Investigative Practices

• Automatically performs processing upon submission
  of data to the system
• Based on expert knowledge, standard procedures
  and best practices used of law enforcement
• Provide alerts to LEA users for items that may be
  of interest to them, for example
• Check all new suspects against terrorist watch
  lists
• Alert LEA users of addresses that are known to be
  associated with other suspected terrorists

16
N-DEx Capabilities
Applications users can deploy to benefit from
the information within the system
17
N-DEx Capabilities
N-DEx
Capabilities
Visualization
Collaboration
Subscription
Search
Analytical/ Reporting
Notification

• Search for people, places, things, crime
  characteristics, perform key word searches and
  find records (e.g., incident/arrest report)

Find People, Places and Things

• Includes both basic and advanced search functions
  
• Basic search - a simple user interface requiring
  very little training,
• Advanced search for more experienced users
  (e.g., using Boolean, wildcard operators, etc.)
• Results tuned to prevent being overwhelmed by
  data through filtering and ranking of results

18
Search
19
Search Criteria - (Person)
20
Search Criteria - (Crime Characteristics)
21
Search Criteria - (Location)
22
Search Results
23
N-DEx Capabilities
Applications users can deploy to benefit from
the information within the system
24
N-DEx Capabilities
N-DEx
Capabilities
Visualization
Collaboration
Subscription
Search
Analytical/ Reporting
Notification
Automated Notification
Subscribe to Future Events / Information

• Allows law enforcement personnel to register for
  information events about entities and subjects of
  interest

• Users will be able to
• Establish subscriptions based on existing
  entities
• Ask to be notified of updates and/or changes to
  status or the availability of additional
  information on the entity
• Easily discover who else is looking for the
  same subjects or have similar interests
• Supports case de-confliction and encourages
  potential case collaboration

25
N-DEx Capabilities
N-DEx
Capabilities
Visualization
Collaboration
Subscription
Search
Analytical/ Reporting
Notification
Simplified Views of Complex Information

• Visualization tools make it easier to understand
  the knowledge behind the vast amount of
  information

• Visualize complex returns from correlation,
  search and report functions 
• Provide both tabular and graphical
  representations of data to allow navigation
  through relationships, trends, and timelines of
  crimes and activities
• Overlay data on geographic maps with various
  views of the data
• Drill down" or navigate through complex
  relationship networks
• View the data in a variety of representations for
  effective analysis

26
Visualization of Search Results
27
N-DEx Capabilities
N-DEx
Capabilities
Visualization
Collaboration
Subscription
Search
Analytical/ Reporting
Notification
Identify Criminal Trends Hot Spots

• Assist investigators and analysts in the
  identification of criminal networks, crime
  patterns, crime trends, and crime problems

• Provides administrators, analysts and
  investigators the ability to generate reports
  from N-DEx data for distribution and sharing
• Allows N-DEx to support law enforcements
  investigative reporting needs from a central
  platform
• Supports generation of online reports including
  graphic displays of data for use in predictive
  modeling, reporting and tracking of crime for
  investigative purposes

28
N-DEx Capabilities
N-DEx
Capabilities
Visualization
Collaboration
Subscription
Search
Analytical/ Reporting
Notification

• Enable real-time collaboration and sharing of
  information (e-mail, on-line messaging, instant
  messaging, folders/sharing, task force workspace
  etc.)

Bring Investigators Together

• Allows users to electronically locate others
  working on similar cases
• Dynamically create investigative teams
• Leverage the individual knowledge of police
  officers, analysts and investigators to a greater
  whole

29
N-DEx Functional Integration

• End-User Browser
• LEA users will be provided the ability to access
  N-DEx directly through a web browser
• Web Services
• All N-DEx user level capabilities will be
  available to external LEA systems through web
  service interfaces
• Example - RMS or regional system may wish to
  integrate N-DEx capabilities into the local
  system's user interface

30
N-DEx Functional Integration
31
Network Connectivity

• CJIS will provide N-DEx services on the CJIS Wide
  Area Network (WAN)
• Connectivity will be through any means authorized
  per CJIS Advisory Policy Board (APB)
  policies/guidelines and state policies
• LEAs will also be able to connect to N-DEx via
  secure Internet connections using the Law
  Enforcement Online (LEO) system

32
Mapping Packaging Approach

• Initially focus on the needs of agencies with
  data in relational format
• Georgia Tech Research Institute (GTRI) to develop
  N-DEx IEPD relational model
• Utilize Sypherlink products with GTRI performing
  proof of concept and product configuration
  activities

33
Mapping Packaging Sypherlink Analyzer

• Extracts metadata from LEA system as a precursor
  to performing mapping
• Extracts field name, data type, and field length
• Samples actual data instances to enhance metadata
• Results are contained in a set of files
• Runs unattended

34
Mapping Packaging Status

• Sypherlink licenses have been purchased and GTRI
  has received basic product training
• An LEA has been identified to work with and
  provide data to GTRI during the proof of concept
  phase

35
Data Sharing (Increment 1)

• Allow agency to control how and with whom their
  data is shared
• Option 1 (N-DEx Template) Agencies can enforce
  sharing restrictions for their data through
  agency-administered policy on N-DEx.
• Option 2 (Data Tagging) Agencies can tag data
  prior to submission to N-DEx.
• Accommodate changes to sharing policy
• N-DEx provides tools and mechanisms to allow each
  agency to change/select policies, without
  modifications to N-DEx system
• Allow data contributors to designate their data
  as
• Unrestricted sharing (Green)
• Pointer-based sharing (Yellow)
• Restricted sharing (Red)
• Allows data contributor to specify exceptions
  for red or yellow data (i.e. who can view the red
  or yellow data)

36
N-DEx Template

• Allow data contributors to grant access to
  pointer-based (yellow) and restricted (red) data
  to selected users, groups, or agencies
• N-DEx provides tools for fine-grained access
  control, e.g., to certain individuals or
  groups/task forces
• Allow data contributors to configure sharing
  rules at the record, element/attribute or groups
  of elements/attributes level
• N-DEx provides tools for fine-grained access
  control, e.g., to certain elements such as victim
  identifying information

37
Data Tagging

• Allow agencies to tag data prior to submission to
  N-DEx
• Agencies can restrict sharing at the record level
  only using this method
• Agencies can select generally who can view their
  red or yellow data using N-DEx User Interface
  applies to all red or yellow records
• Agencies cant take full advantage of the
  flexible sharing policies if they opt to tag
  their data prior to submission

38
N-DEx Data Standards

• Extensible Markup Language (XML) - structured
  language for describing information being sent
  electronically to N-DEx.
• The National Information Exchange Model (NIEM) is
  using the GJXDM to build a common XML data
  exchange standard for information sharing among
• - Department of Homeland Security
• - Department of Justice
• - Justice, public safety, homeland security, and
  intelligence.
• The N-DEx IEPD v1.0 is available at
• www.it.ojp.gov
• On left hand column, click on IEPD Clearinghouse
• Click on Find IEPD Information
• In the Search field, search N-DEx
• Click on the N-DEx IEPD
• Click on the Web link to the actual IEPD

39
Mapping PackagingToolkit Goals

• Minimize the burden and cost of N-DEx
  participation for LEAs
• Facilitate mapping from LEA data schemas to the
  N-DEx IEPD schema
• Promote reuse of mappings
• COTS-based to ensure early availability
• Streamlined process to obtain toolkit software

40
N-DEx Data Access Levels
The entering agency categorizes data submitted to
the System into levels of sensitivity upon which
the dissemination of the information/data is
controlled. APB Approved Access Levels

• LEVEL 1 NOT RESTRICTED
• N-DEx shall provide the capability for data
  contributors to allow the sharing of data they
  submit to N-DEx
• LEVEL 2 POINTER
• N-DEx shall provide the capability for data
  contributors to specify pointer based sharing
  of data. (i.e. provide POC information only)
• LEVEL 3 RESTRICTED
• N-DEx shall provide the capability for data
  contributors to restrict data they submit to
  N-DEx. This level is reserved for the most
  restricted investigations and investigative
  information.

- This capability will allow agencies to submit
information for sharing but control the
dissemination of
sensitive information to protect investigative
equities. - Sensitivity applied to specific data
elements if needed
41
Sharing Policy Options

• Sharing policy rules
• If data received is pre-tagged, sharing policy
  must apply to the entire record
• Using the N-DEx Template, the sharing policy
  can be applied to specific elements/attributes
  within the record, or groups of
  elements/attributes as well as the entire record.

41
42
Search Example
43
Concepts Illustrated through User Interface
Mock-ups
44
Concepts Illustrated through User Interface
Mock-ups

• Notes
• In this example, personal identifying data is
  Name, SSN, Age, and Address
• A capability also exists to select individual
  records to change a specific sharing policy

45
Sharing Rules for Pre-Tagged Data

• If a contributor chooses to submit data
  pre-tagged
• sharing policy specifies who has access to any
  restricted (RED) or pointer-based (YELLOW)
  incident reports

46
N-DEx / R-DEx Relationship

• National Information Sharing
• Virtual Regional Information Sharing

SCIEX
NJSP
AFOSI
DELJIS
CJIS SOS
N-DEx
LARCIS
I-CLEAR
ARGIS
BOP
DHS/USSS
OneDOJ
USMS
DOJ
DHS/ICE
NCIS
DOI
OneDOJ
FBI
DEA
Federated Search (Web Services Standard Interface)
ATF
47
N-DEx / R-DEx Integration
LEGEND RED R-DEX GREEN N-DEX BLACK
N-DEX/R-DEX
48
N-DEx Governance
GUIDING PRINCIPLE N-DEx governance and policies
must be developed and managed cooperatively with
the law enforcement community they cannot be
mandated by the federal government.
N-DEx will be an information system administered
by the FBIs CJIS Division who will employ a
Shared Management Philosophy for development and
operation of through collaboration with
CJIS Advisory Policy Board (APB)
APB Information Sharing (INSH) Subcommittee
INSH Task Force Subject Matter Experts (SME)
APB Working Groups
49
N-DEx Prototype Areas

• Prototype activities will support the following
  program initiatives
• Support and establish the N-DEx data set and data
  submission guidelines through the Global Justice
  XML Data Model / National Information Exchange
  Model.
• Support the evolution of N-DEx business and
  policy rules through the Advisory Policy Board.
• Provide law enforcement active participation and
  submission / validation of existing RMS data.

50
N-DEx Prototype

• Prototype has received and processed 1,977,373
  (as of October 14, 2007) incident reports from
• ARJIS
• Los Angeles County Sheriffs Department, LA,
  California
• Delaware
• Nebraska
• Scheduled to participant
• Georgia-Marietta- Testing
• ARIES - Testing
• Ohio - Testing
• AFOSI - Testing
• Texas Testing
• Illinois (Nov. 2007)
• One DOJ (BOP-Testing, USMA, ATF, DEA, FBI)
• Oregon
• Virginia
• Oklahoma
• South Carolina
• Pennsylvania SE Region
• West Virginia

51
N-DEx Functional Overview
52
Development Implementation

• Performance-Based Acquisition
• Development contract awarded to Raytheon Company,
  February 12, 2007
• Contractor start date February 26, 2007
• Incremental Deployment
• Increment I February 2008
• Sharing of incident/case report information
• Search
• Correlation (basic)
• Visualization (basic)
• Limited fail-over capability
• Initial support 50,000 users

53
Increment 1 Capabilities

• Objective
• Introduce a national information sharing service
  with up to 5 years of correlated incident reports
• Features
• Resolve and correlate entities
• Search, sort and filter results
• Visualize incident relationships and timelines
• Reporting using pre-defined reports
• On-line training
• Security and data privacy controls (red / yellow
  / green sharing policy)
• Agency toolkit to facilitate RMS N-DEx IEPD
  Mapping

54
Increment 1 Capabilities (cont.)

• Leveraged Systems
• NCIC / III
• CJIS Services
• ESAN for storage
• SITS for data backup / restore
• LEO for user identification, collaboration
  through existing LEO services
• Users
• 50,000 Users
• Emphasize detectives, analysts, and investigators
• Data
• Incident / Case Reports
• N-DEx IEPD v1.0, compatible with N-DEx Bundle
  1.0.4 and Search IEPD
• Risk Reduction Prototypes
• Raytheon Usability prototype for search and
  visualization
• Raytheon Technology prototype for search and
  correlation scalability and accuracy

55
N-DEx / NCIC Integration

• N-DEx will be required to query NCIC via NCIC
  transactions such as the QW, QG, QA, and QV
  transaction.
• N-DEx will search 16 of the 21 NCIC files, to
  include Interstate Identification Index (III)
  search.

• Originating Agency Identifier
• Wanted Person
• Missing Person
• Foreign Fugitive
• U.S. Secret Service Protective
• Vehicle
• License Plate
• Boat

• Vehicle/Boat Part
• Article
• Gun
• Violent Gang and Terrorist Organization
• Convicted Person on Supervised Release
• Convicted Sexual Offender Registry
• Identity Theft
• Immigration Violators

56
Increment 1

• Other Features
• On-Line Training
• Data Sharing Policies
• Role-Based Access Control

Entity Correlation
Visualization (non-map)

• Leveraged Systems
• III
• NCIC

• Contributors
• Local, State, Tribal, Federal

Entity Resolution
Search
Catalog/ Index
Incident/ Case Report
Analytical Reporting

• Data Types
• Incident/Case Reports
• One DOJ Data

57
Development Implementation

• Increment II February 2009
• Add data sets
• incarceration data and arrest/booking data
• Correlation (advanced)
• Visualization (advanced)
• Subscription/Notification (advanced)
• Analytical/Reporting (basic)
• Increasing system fail-over capabilities
• 100,000 Users

58
Increment 2

• Other Features
• On-Line Training
• Data Sharing Policies
• Role-Based Access Control
• Personalized Settings
• Alternative N-DEx Web Portal
• WEB Services

Entity Correlation
Visualization (non-map)

• Leveraged Systems
• III
• NCIC
• Federated Search

• Contributors
• Local, State, Tribal, Federal

Notification
Entity Resolution
Search
Subscription
Catalog/ Index
Incident/ Case Report
Collaboration
Analytical Reporting
Automated Processing

• Data Types
• Incident/Case Reports
• One DOJ Data Expansion
• Arrest/Booking Date
• Incarceration Data

• New for Increment

59
Development Implementation

• Increment III February 2010
• Add data sets probation/parole data
• Enhancements and modifications to previously
  deployed functionality
• Analytical reporting (advanced)
• Implement fully redundant system and environments
• 200,000 Users
• Operations and Maintenance Delivery
• September 2010

60
Increment 3

• Other Features
• On-Line Training
• Data Sharing Policies Control
• Role-Based Access Control
• Personalized Settings
• Alternative N-DEx Web Portal
• WEB Services Expansion

Entity Correlation
Visualization (non-map)
Notification Enhanced

• Leveraged Systems
• III
• NCIC
• Federated Search

• Contributors
• Local, State, Tribal, Federal

Entity Resolution
Subscription Enhanced
Catalog/ Index
Search
Incident/ Case Report
Collaboration Enhanced
Analytical Reporting
Automated Processing

• Data Types
• Incident/Case Reports
• One DOJ Data
• Arrest/Booking Date
• Incarceration Data
• Probation / Parole Data

• New for Increment

61
N-DEx Program Timeline
62
Key Assumptions

• The Key Success Factor - ensuring that N-DEx
  meets the real-world needs of law enforcement
• N-DEx will be deployed incrementally based on
  user priorities
• The effectiveness of N-DEx is dependent upon
  widespread participation
• N-DEx is an information sharing system, not a
  statistical reporting system
• N-DEx is not an intelligence system
• Control of data shared in N-DEx will remain with
  the LEA that
• provided it
• An objective of the N-DEx implementation is to
  reduce the points of integration from a data and
  functionality perspective
• Only data classified as Sensitive but
  Unclassified (SBU) or below will be permitted
  within N-DEx

63
Questions
Melissa J. Farrell Liaison Specialist N-DEx
Program Office Criminal Justice Information
Services Division 1000 Custer Hollow
Road Clarksburg, WV 26306-0101 (304)
625-5568 or [phone] mfarrel1_at_LEO.GOV
64
R-DEx Capabilities

• Today, R-DEx is the mechanism for
• Sharing DOJ Data
• Stores shareable case information ATF, FBI, DEA,
  and USMS
• Stores shareable booking and incarceration
  information from USMS and BOP
• Implements search and retrieval of information
• Provides standard interface for connection to
  regional partner systems
• Providing
• Search capabilities (e.g. FD 302s)
• Analytical tools (e.g., link analysis, mapping)
• Federated access to regional partner systems

65
N-DEx/R-DEx Parallel Programs

• At N-DEx Increment 1 (2/08), N-DEx will provide
  some R-DEx capabilities in parallel
• Sharing DOJ Data
• Stores shareable case information ATF, FBI, DEA,
  and USMS
• Stores shareable booking and incarceration
  information from USMS and BOP
• Implements search and retrieval of information
• Provides standard interface for connection to
  regional partner systems
• Providing
• Search capabilities (e.g. FD 302s)
• Analytical tools (e.g., link analysis, mapping)
• Federated access to regional partner systems
• Impact
• All users (federal, state, and local) can get
  access to N-DEx in addition to whatever tools
  they have now
• R-DEx continues to support federated information
  sharing on a regional basis.

66
N-DEx Integration of R-DEx Capabilities

• After N-DEx Increment 2 (2/09), N-DEx will
  provide R-DEx capabilities
• Sharing DOJ Data
• Stores shareable case information ATF, FBI, DEA,
  and USMS
• Stores shareable booking and incarceration
  information from USMS and BOP
• Implements search and retrieval of information
• Provides standard interface for connection to
  regional partner systems
• Providing
• Search capabilities (e.g. FD 302s)
• Analytical tools (e.g., link analysis, mapping)
• Federated access to regional partner systems
• After N-DEx Increment 2 (2/09), N-DEx will
  provide all OneDOJ capabilities exclusively
• R-DEx will be fully integrated
• Services provided by R-DEx will be provided by
  N-DEx and will be transparent to the DOJ user
• N-DEx will manage the federated query of regional
  systems

67
N-DEx / R-DEx Integration
LEGEND RED R-DEX GREEN N-DEX BLACK
N-DEX/R-DEX
68
N-DEx / R-DEx Participants

• R-DEx
• Only DOJ (ATF, BOP, DEA, FBI, USMS) data is in
  R-DEx.
• Current FBI field offices where R-DEx interfaces
  exist
• Seattle (Interface with LInX).
• San Diego (Interface with ARJIS)
• Jacksonville (Interface with LInX)
• St. Louis
• The following FBI offices are in the process of
  submitting to
• R-DEx
• Houston
• Atlanta
• Los Angeles
• Additional locations identified as priorities
  are
• National Capital Region
• New York City

• N-DEx
• DOJ information, incidents reports and
  incarceration data
• Currently data being submitted to N-DEx
  Prototype
• San Diego, ARJIS
• Bureau of Prisons (BOP)
• Delaware
• Los Angeles County California
• Nebraska
• The following are in the process of submitting
  test data to
• N-DEx
• Air Force OSI
• Northern California, ARIES
• Ohio
• Marietta, GA
• Texas