Data Mining for Intelligence, Fraud & Criminal Detection: Advanced Analytics & Information Sharing Technologies

450 Pages·2008·10.64 MB·English

by  Christopher Westphal

DATA MINING INTELLIGENCE,
FOR
FRAUD, CRIMINAL DETECTION
&
Advanced Analytics
&
Information Sharing Technologies
CHRISTOPHER WESTPHAL
Boca Raton London New York
CRC Press is an imprint of the
Taylor & Francis Group, an informa business
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2009 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed in the United States of America on acid-free paper
10 9 8 7 6 5 4 3 2 1
International Standard Book Number-13: 978-1-4200-6723-1 (Hardcover)
This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been
made to publish reliable data and information, but the author and publisher cannot assume responsibility for the valid-
ity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright
holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this
form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may
rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or uti-
lized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopy-
ing, microfilming, and recording, or in any information storage or retrieval system, without written permission from the
publishers.
For permission to photocopy or use material electronically from this work, please access www.copyright.com (http://
www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923,
978-750-8400. CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For orga-
nizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for
identification and explanation without intent to infringe.
Library of Congress Cataloging-in-Publication Data
Westphal, Christopher R. (Christopher Ralph), 1965-
Data mining for intelligence, fraud & criminal detection : advanced analytics & information sharing
technologies / Christopher Westphal.
p. cm.
Includes bibliographical references and index.
ISBN 978-1-4200-6723-1 (alk. paper)
1. Law enforcement--United States. 2. Data mining--United States. I. Title.
HV7921.W47 2008
363.25’6--dc22 2008021209
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Dedication
This book is dedicated to the analysts around the world who work dili-
gently to secure the borders, critical infrastructure, and integrity of their
homelands. It is for all those people who support law enforcement, the
intelligence community, and corporate security. It is for the police offi cers,
special agents, and criminal investigators who ensure our safety every
day. It is for all the heroes who have given their lives to uphold our laws,
protect our rights, and guarantee our freedoms.
All royalty proceeds from this book are being donated to the National
Law Enforcement Offi cers Memorial Fund (NLEOMF) in honor of those
individuals who have made the ultimate sacrifi ce to the service, protec-
tion, and security of others. More than 18,200 names, representing law
enforcement offi cers who died in the line of duty, are engraved on the
National Law Enforcement Memorial located in Washington, D.C. To
learn more about NLEOMF and to further contribute to the fund, please
visit their site at www.nleomf.com.
iii

Contents
FOREWORD xi
ACKNOWLEDGMENTS xvii
THE AUTHOR xxi
PART 1 INTERPRETING PATTERNS AND ANALYTICAL
METHODOLOGIES
1 Overview 3
Introduction 4
Sharing Data 5
Connect the Dots 8
Analytical Versus Referential Data 18
Information Sharing 25
Conclusion 32
2 The Quality of Data 33
Introduction 34
Value Errors 35
Missing Data and Bad Structures 39
Unique Addresses 42
Distinct Phone Numbers 44
Individual ID Numbers 45
Anomalous Accounts 46
One-of-a-Kind Transactions 46
Original Organizations 47
v
C O N T E N T S
Perspicuous People 48
Entity Resolution 50
Anonymous Resolution 62
Conclusion 66
3 What Are Patterns? 67
Introduction 68
Which Pattern Is More Important? 72
Do These Patterns Make Sense? 78
Is This a Reliable Pattern? 81
Is This an Actionable Pattern? 85
Which Pattern Is More Valuable? 87
What Does this Pattern Show? 90
Who Is the Most Important Person? 97
Conclusion 101
PART 2 REAL-WORLD EXAMPLES AND OPERATIONS
4 Border Protection 105
Introduction 106
I-94 Arrival/Departure Records 106
Land Border Targeting 113
Cluster by Hour of the Day (HOD) 130
Cluster by Day of the Week (DOW) 133
Cluster by Date 133
Cluster by Port of Entry (POE) 137
Clusters by Lane 137
Cluster by Inspector 139
Cluster by City/State 139
Cluster by VIN 140
Putting It Together 140
Conclusion 141
5 Money Laundering and Financial Crimes 143
Introduction 144
Suspicious Activity Reports 159
Structuring Transactions 161
Bust-Out Schemes 169
A Consumer Bust-Out Scheme 173
Busting and Kiting 175
vi
C O N T E N T S
Identity Fraud 177
Large Connections 181
Attorneys and Law Firms 188
Cheap Motels 191
Location, Location, Location 194
Individual Taxpayer Identifi cation Number 198
SAR Versus STR 200
Timing Is Everything 205
False Temporal Patterns 213
A Final Note 216
Conclusion 220
6 Money Service Businesses 223
Introduction 224
What Is a Money Service Business? 224
Why Wire Remitters? 225
Steps of a Wire Remittance 226
Structure of a Wire Transfer 228
Combating Human Smuggling 238
The Smuggling Process 240
Changing the Rules 250
Seizing Assets 252
Corridor States 254
Drug Dealers 258
Suspicious Activity Reports 262
Elder Abuse Pattern 266
Ornery Old Man 269
Other MSB Patterns 272
Multiple Locations 272
Minimal Overlaps 274
Offi cial Deposits 274
Heavenly Offerings 278
Dirty Dancing 280
Conclusion 280
7 Fraud Analytics 283
Introduction 284
Warranty Fraud Anecdotes 286
Automobile Warranties 287
Hurricane Katrina 292
Corporate Frauds 298
vii
C O N T E N T S
Employees as Vendors 298
Vendors as Vendors 300
Corporate Expenses 304
Duplicate Payments 308
Human Resources 313
Gift Card Fraud 317
Additional Examples 324
Pharmaceutical 325
Phishing/Click Fraud 325
Tax Evasion 329
Medicare Claim Fraud 332
Conclusion 346
PART 3 INFORMATION SHARING AND FUSION CENTERS
8 Information-Sharing Protocols 349
Introduction 350
Global Justice XML Data Model (Global JXDM) 351
Data Dictionary 352
Data Model 353
Component Reuse Repository 356
National Information Exchange Model 362
28 CFR Part 23 364
Conclusion 370
9 Information-Sharing Systems 371
Introduction 372
Automated Regional Justice Information System (ARJIS) 376
Citizen and Law Enforcement Analysis and Reporting (CLEAR) 377
Comprehensive Regional Information Management Exchange System
(CRIMES) 379
Factual Analysis Criminal Threat Solution (FACTS) System 381
Florida Information Network for Data Exchange and Retrieval (FINDER) 382
Ohio Local Law Enforcement Information Sharing Network (OLLEISN) 383
Law Enforcement Information Exchange (LInX) 385
OneDOJ, R-DEx, N-DEx 386
Law Enforcement Online (LEO) 388
Joint Regional Information Exchange System (JRIES) 389
Joint Terrorism Task Force (JTTF) 389
State-Level Fusion Centers 392
viii
C O N T E N T S
High Intensity Drug Traffi cking Area (HIDTA) 395
High Intensity Financial Crime Area (HIFCA) 397
Regional Information Sharing System (RISS) 404
Conclusion 405
Summary 407
Index 411
ix