30 G E O W O R L D / O C T O B E R 2 O O 5

eographic profiling is a proven techniquethat police investigators use to search forserial criminals. It helps to define where acriminal might live or work, based on the lo-cations of the crimes committed and other

evidence collected about the crimes. Human spatial behavior in many forms can be ana-

lyzed and profiled, including where victims were picked upor dropped off, where phone calls were made, credit cardand ATM use, where graffiti or posters appear, and wheresupplies were purchased.

Geographic profiling uses these and other factors toformulate a “hunting ground” as well as the most likely lo-cations of a criminal within the hunting ground. Geographicprofiling has been effective even when criminals areaware of the technique and attempt to behave randomly.

For these and other reasons, geographic profiling hassignificant potential as a tool for counter-insurgency. TheU.S. National Technology Alliance (NTA) completed anevaluation of whetherthese types of analysistools would be usefulto aid in the hunt forinsurgents, weaponscaches and sourcesof bomb materials,t h e re by re d u c i n gcivilian and military casualties.

The NTA is a federal program designed to motivatecommercial firms to address national technology chal-lenges in product development. Rosettex Technology &Ventures Group, supported by more than 70 partners,translates technologies that address broad national secu-rity needs into solutions using a unique business model.

The software evaluated was Rigel, which was devel-oped by Environmental Criminology Research Inc. andbased on the work of Kim Rossmo, the originator of geo-graphic profiling for police investigation (see www.geoplace.com/gw/1999/0399/399crim.asp).

How Does Geographic Profiling Work?According to Rossmo, the core of geographic profiling isan algorithm that analyzes a pattern of events (such as at-tacks by insurgents) within the context of transportationroutes, topography and local geography. Rigel receives asinput the locations of evidence in various forms, permitsusers to establish links among evidence in a variety of

ways and generates a probability map that prioritizes alist of suspect locations or geographic areas. Investiga-tors can use the probability map to narrow the search forperpetrators, attempt displacement of perpetrators orotherwise reduce harm from criminal activities.

Evidence that doesn’t at first seem to be spatial stillcan be useful. For example, an investigator may knowwhat type of weapon and ammunition was used in acrime. Such information can be combined with a geo-graphic profile of gun shops and the types of ammunitionthey carry to prioritize shops for further investigation.

How Was the Evaluation Conducted?The NTA evaluation assumed that geographic profilingwould be of some use in investigations of insurgency. Theunanswered questions centered on its strengths andweaknesses, whether military use bore special require-ments, whether results were reliable enough to use themto prioritize investigations and whether modifications

were required to suit military needs.An evaluation team was formed with staff from the

U.S. Army Topographic Engineering Center; the U.S. Ma-rine Corps Intelligence Estimates Branch; and the Bureauof Alcohol, Tobacco and Firearms.

Actual data from Iraq were acquired to examine theuse of geographic profiling for a range of purposes, andthis article describes two test cases.

Test Case OneThe first test case uses data that describe a series of Im-provised Explosive Device (IED) attacks linked by forensicevidence. The incidents occurred in a two-square-milesection around Baghdad during five months in 2004.Specific locations and times are known, and extensivecorroborating evidence is available from a variety ofsources. A potential suspect was identified.

The corroborating evidence includes 50 incidentsof interest in the geographic area and timeframe. The process of geographic profiling included the following

Crim

e M

appi

ngBY HENRY KUCERA

Geographic Profiling Adds a New Weapon

HUNTINGG

31O C T O B E R 2 O O 5 / W W W . G E O P L A C E . C O M

INSURGENTSINSURGENTS

Crim

e M

appi

ng of apparent neighborhood knowledge, and likely signifi-cance of the sites to perpetrators. Considerable trainingand experience are required to make such judgments.

The forensic evidence that linked the eight candidateevent sites was considered definitive, although it wasimpossible to know whether a single person or group wasresponsible. Three of the candidate event sites were ulti-mately excluded from the geographic profile.

Two of the excluded sites were second attacks on thesame day, which means that they may not have been theresult of independent journeys. A third excluded site wasclose to previous attacks, and its exclusion improved over-all spatial diversity. Decisions to include or exclude sitesare judgments based on training and experience.

Figure 1 shows the resulting geographic profile. The areacovered is 2.04 square miles. The “high” locations, wherethe center of operations is likely to be found, cover 13.9percent of the area—approximately 0.28 square miles.The suspect’s location wasn’t one of the model’s inputs.

The next step was to verify the results. Going back tothe original 50 incidents of interest, those that fell withinthe timeframe of the eight candidate events were analyzed,

and a strong correlation was found. Significant insurgentactivity occurred within the peak areas of the profile.

Additional corroboration was provided by informationabout the suspect and his capture. The individual whowas identified as a suspect had been recognized fleeingthe site of one of the events and was tracked to the placewhere he was captured. The location of the capture waswithin the top 8 percent of the profile, which was consis-tent with the statistical prediction (see Figure 2).

This test case supports a conclusion that geographicprofiling could help focus the military response to insur-gent attacks, because it could help reduce the areasearched for those responsible.

Test Case TwoThe second test case analyzed a 30-day incident datasetthat describes 2,368 attacks during a 30-day period inSeptember 2004. The attacks involved 799 homemade

32 G E O W O R L D / O C T O B E R 2 O O 5

activities:• Track migration of similar events (temporal flow).• Identify demographics along with temporal flow (identify

activity space). Demographics include religious, eth-nic, neighborhood, tribal and external factors.

• Analyze temporal patterns and trends of key activities.• Analyze patterns and trends in actions and reactions

among friendly and enemy activity.Multiple intelligence sources were accessed to acquire

all possible forensic data. This was a realistic test of mili-tary usage, because the intelligence came from activecombat units rather than developed specifically for soft-ware tests and evaluation. The acquisition of data fromactive combat units delayed the evaluation, but it addedauthenticity to the results.

Examining EvidenceThe first step in analysis was to select which of the 50 inci-dents of interest were candidates for a geographic profile.Eight candidate event sites were selected from the 50 in-cidents of interest—seven attack sites and one cache site.Selection factors included the timing of the events, acces-sibility of the locations, ingress and egress routes, degree

Figure 3. A map (left) indicates the location of insurgent attacks on or near Airport Road in Baghdad,Iraq, for September 2004. A geographic profile (right)displays the top 2 percent probabilities for the locations of insurgent operations.

Figure 2. An image depicts the peak area of ageographic profile.

Figure 1. A geographic profile for a test case didn’tinclude the suspect’s location as part of the profile.

profiling has been identified as one of themost promising new technologies for thispurpose (see “Something Old, SomethingNew—Guerrillas, Terrorists, and Intelli-gence Analysis,” Military Review, July-August 2004).

These evaluations indicate that theU.S. military can deploy geographic profil-ing software immediately to reduce casu-alties from insurgency in Iraq and else-where. Geographic profiling can providean indication of the “anchor points” of at-tacks (e.g., headquarters of a cell, homeof a cell leader, homes of those pickingtargets, locations where IEDs are con-structed, etc.).

Using evidence collected during thecourse of an investigation, geographic pro-filing techniques can predict the mostprobable home base of serial criminals orterrorists based on the geographic patternof crime sites. In addition, the existing soft-ware fits well into the software and dataenvironments typically used by the intelli-gence community.

Plans are underway to “fast track” theuse of a geographic profiling capability intooperations with U.S. forces. Based on theresults of this evaluation, a program of re-search and development is being definedto address the military’s specific needs inconjunction with the Center for GeospatialIntelligence and Investigation at TexasState University, San Marcos.

37O C T O B E R 2 O O 5 / W W W . G E O P L A C E . C O M

FPO AD

Henry Kucera is a principal in SwiftsureSpatial Systems; e-mail:

henry.kucera@swiftspace.com.

bombs, 664 mortars and rockets, 527handguns and rifles, 272 rocket-propelledgrenades, 40 vehicle bombs, 39 handgrenades, and 27 land mines. A total of995 of the incidents occurred in andaround Baghdad. The evaluators used thedata to map 511 distinct incidents withinBaghdad for analysis.

The spatial patterns suggest two typesof attacks. The first type seems to be drivenby spatial constraints in the surroundingarea, particularly the route to the airport.The frequency of travel by U.S. militaryconvoys likely is driving the pattern of at-tacks. Geographic profiling of this type ofevent is unlikely to reveal the location of in-surgent bases, but it could indicate whichintersections are used as access points(see Figure 3).

The second group of incidents appearsto be less constrained by the street pat-tern or neighborhood. For example, the at-tacks within Sadr City appear to be bettersuited to geographic profiling, and thepeak areas could potentially be targets forincreased security (see Figure 4).

Insurgents often work in teams, whichhave a meeting place or a supply centerfor weapons or explosives. The geographicprofile for a team is more likely to indicatepossible sites of these types of locations,rather than the residences of individual in-surgents.

The second test case showed the prom-ise of geographic profiling for aspects ofmilitary intelligence that differ from policework. It also established the need for re-search to extend the approach to addressspecific challenges.

Challenges include a high volume ofevents; a large number of insurgents; thedevelopment of community expertise; and aneed for information resources to describegeographic constraints, potential suspectlocations, and cultural factors that affecthunting methods and travel-range limits.

Adopting Geographic Profiling TechniquesMilitary investigators need better tools totrack down those who are kidnapping,maiming and killing U.S. forces, allies andcivilians. These types of actions have paral-lels to serial crimes. Therefore, policingmethods should become part of intelligenceefforts in counterinsurgency. Geographic

Figure 4. A map displays the geo-graphic profile (top 3 percent) for SadrCity insurgent events, Baghdad, Iraq,September 2004.