icuworkbench - use cases

Confiden�al – Do Not Distribute

1

ICU Workbench

CustomerCustomerCustomerCustomers Success ands Success ands Success ands Success and Use CasesUse CasesUse CasesUse Cases

Introduc�on

The ICU Workbench is a so�ware tool used to analyze tracking data. It performs the data analysis in minutes and

provides a user-friendly interface to interact with the results. The so�ware is currently in use by State and Local

Police, Federal Police, Intelligence Organiza�ons, and Militaries in the Western world. In addi�on to a broad user

base, the ICU Workbench is also in the current Surveillance Training curriculum at the US DHS Federal Law

Enforcement Training Center (FLETC). The Suite of products is currently made up of a number of key func�onal

elements:

1. Core analy�cal product

2. External Events

3. Mul�-Target Analysis

4. Target Predic�ons module

5. Side-by-Side Track Compare

Over the 3 years that the so�ware has been opera�onal with our customers, a number of specific uses for the

technology have come to light. This document is an a9empt to capture some of those use cases, and where

possible, document the success directly from the customer. However, in most cases with customers in the Na�onal

Security and Intelligence market, we are unable to provide documenta�on that can be used for a reference.


2

Core Core Core Core Analy�cal Analy�cal Analy�cal Analy�cal PPPProductroductroductroduct

The ICU Workbench’s analy�cal engine is our core technology. It is used to iden�fy a target’s Pa9ern of Life (PoL): a

clear visual presenta�on of the travel pa9erns and des�na�ons that the target frequents. All of this intelligence is

provided in a way that is easy to understand, report and disseminate. We have a number of success stories about

the effec�veness of our technology.

Months into minutes – Federal Agency One Federal customer that does analyze tracking data in detail has told us repeatedly that our so�ware has taken

months of their team’s analy�cal efforts and condensed it to minutes, providing them the ability to focus on analyzing

the intelligence, rather than producing the base products. Another Federal Analyst indicates that our core so�ware

reduces the amount of manual effort she would otherwise have allocated to the analysis by 40 days per year.

Ge"ng Inves�gators back on the street, saving money – Major City PD Our tool provides enough �me savings for one City PD to offload the analy�cal work being done by an inves�gator onto

our tool – allowing him to get back on the street and perform his job. The �me savings in using our tool has been

quan�fied by numerous organiza�ons. We rou�nely hear from clients, including a Narco�cs Task Force, that our

so�ware saves them up to a day a week in manual effort per analyst/inves�gator.

Force mul�plier, Prac�ce Leader – Narco�cs Task Force We have a le9er of reference documen�ng a Narco�cs task force’s posi�on on our technology. They say that the ICU

Workbench is “a comprehensive tac�cal intelligence toolkit” that is now being used to exploit loca�on data from GPS

Trackers, exploited phones, naviga�on systems and Call Detail Records (CDR). They also say that because the ease of

use of the ICU Workbench, they are able to uncover intelligence that was missed before, because it was too �me-

consuming to iden�fy.

Iden�fying Home and Work of Targets – Military Police A customer bought a significant quan�ty of our tool a�er we were given tracking data and our so�ware found the

target’s actual home and work loca�ons within 90 seconds. This customer said that classifying those loca�ons took

them weeks to figure out using physical surveillance because of the target’s complex travel pa9erns.

Call Detail Record Analysis (Cellular CDR) – Major City PD A key data source for law enforcement surveillance is telephone call detail records (CDR). These records are generated

by the cellular providers when a cell phone interacts with the cellular network. A record is created for all interac�ons; ie

incoming call, outgoing sms etc. These records include the tower that the cell phone was communica�ng with as well as


3

the date and �me of the event. CDRs are stored by the cellular providers and can be accessed by law enforcement via

court order.

By the nature of how the records are generated (incoming or outgoing call/msg ac�vity) the data can have long

dura�on gaps between phone events. Using the ICU Workbench so�ware, ploHng and analyzing the data was made

much easier and faster. As the loca�ons are tower-based the target could easily be communica�ng with a number of

different towers. The ICU Workbench easily solved the difficulty of ploHng the tower loca�ons and organizing the data

into an i�nerary. It also generated a des�na�on list of where the target stayed and for how long. These des�na�ons can

then be grouped together to cluster loca�ons. This clarifies the inherent wander as the phone is passed from tower to

tower by the carrier providing insight into the geography the target is opera�ng in.

Having one plaJorm to view CDR data as well as tradi�on GPS data from tracking devices makes for efficient and

effec�ve analysis. Combining data streams into one program eases both the training requirements and provides one

output for the inves�gator/operator use.

Trainee Evalua�on (E&E) – Military Our so�ware is being used to evaluate trainees on an escape and evasion course. The trainees have a GPS tracker, and

are then sent out over a period of many days to move from one loca�on to another without being observed. They are

required to use specific tac�cs and technics during their travels. Our tool analyzes the data from the trainees to

illustrate tac�cal errors, and to help evaluate their progress.

De-conflic�ng Under Cover operators/opera�ons – Major City PD A Major PD with large drug, gang, and organized crime units opera�ng under cover in the same geography is using our

tool to report on all the UC and CI ac�vity in order to de-conflict opera�ons and enhance officer safety. The data being

used in this effort is a stock report that has each target’s loca�ons documented.

Data fusion: Non-tracking data becomes a Tracking dataset – Federal Law Enforcement Agency The data that our tool can analyze is not limited to only GPS fixes. One large organiza�on has challenged us by providing

data from financial transac�ons (Credit Card and ATM), subway records, Automa�c License Plate recogni�on data, and

cellular and landline phone informa�on. Using sparse data from these disparate sources, our tool builds a complete and

integrated track.

Analyst in a Box – Federal Government Organiza�on In situa�ons where operators are forward deployed and have limited access to analy�cal resources (Disadvantaged

Users), or where communica�ons are difficult and �me is of the essence – the ICU Workbench can serve as an “analyst

in a box” allowing operators to process tracking data in the field and then plan/execute missions based on the results.

This allows for the intelligence results to be as current as possible, increasing future mission effec�veness.

Changing How Orders Are Wri<en – Federal Police

The administra�ve process to install a tracker has become more challenging. A�er using the ICU Workbench, this

Federal Agency con�nues to do the difficult work to get tracking warrants/orders because they know that the value of

the intelligence product our so�ware delivers far exceeds the administra�ve effort to get the court order.


4

External EventsExternal EventsExternal EventsExternal Events

External Events is a capability that allows an operator/analyst to add external data in order to understand if and

how targets are related to the specific event. For example, if an IED detonated at a specific �me and place that

informa�on would be entered as an external event and the ICU Workbench will help the user see if the tracked

target could be associated with that event.

Catching Break and Enter suspect – Major City PD During their ini�al training on the so�ware, a Major Canadian city PD entered in break-and-enter events into our

External events module. Our so�ware iden�fied a suspect that was within a few hundred meters of a property that was

robbed. This suspect had given a Police statement that said he was not in the area at the �me of the break-in. Ac�on

was taken to immediately apprehend the suspect.

Mul�Mul�Mul�Mul�----TargetTargetTargetTarget

Mul�-Target is a capability to find correla�ons between mul�ple tracks. The ICU Workbench ships with the

capability to do 1xN correla�ons – which means that when selec�ng a track you can find any of the other tracks in

a group that are related to that one. Our Advanced Mul�-Target module provides full NxN correla�on extrac�on. It

also iden�fies poten�al dead-drop ac�vity and common loca�ons across mul�ple targets.

Discovering mee�ngs between two previously unrelated narco�cs gangs – Narco�cs Task Force Using opera�onal data for their training on the ICU Workbench, a Narco�cs Task Force iden�fied mee�ngs between two

groups of criminals that had been previously thought to not work together. It was further iden�fied, because of the

nature of the mee�ng, that the physical surveillance teams may have been observed. The teams were no�fied of the

poten�al observa�on in an effort to maximize the safety of the surveillance unit.


5

Understanding Organized Crime Hierarchies and priori�zing missions – Narco�cs Task Force A Narco�cs Task Force unit using our standard mul�-target analysis tool (while they eagerly await our Advanced Mul�-

Target module) described the 1xN func�onality as: “By far the most beneficial feature has been the mul�-track report

that has allowed us to iden�fy common residences and targets previously unknown. These have directly led to the

crea�on of high priority targets and ini�a�on of new and larger conspiracy cases.”

Predic�onsPredic�onsPredic�onsPredic�ons

Predic�ons provides a summary of the targets behavior based on past tracking data. It determines the most likely

ac�vi�es and loca�ons of a target at any specific �me based on a user-defined predic�on thresh hold. The

predic�ons are listed from most likely to least likely. This provides surveillance teams with a ranked list of likely

loca�ons of the target. The data is presented in the “Pa9ern-of-Life” User Interface that is common in our

applica�on.

Maximize the efficiency of deploying surveillance teams – Major City PD Due to budget constraints, many Police Departments are concerned with the cost and effec�veness of their surveillance

teams. Our predic�ons module can allow teams to priori�ze and find the most likely loca�ons of all the targets they are

watching instead of using a more tradi�onal “shot-gun” approach to target acquisi�on.


6

Ba<ery planning for other surveillance equipment installa�ons – Military Advisor The Predic�ons module provides a target’s typical Pa9ern-of-Life Summary. This summary can be very effec�ve in

calcula�ng ba9ery requirements and managing ba9ery consump�on for deep audio and video installa�ons. The

Predic�ons modules delivers a very clear picture of how o�en, and for how long a target visits a specific loca�on –

thereby allowing a team to quickly do ba9ery calcula�ons based on the desired mission dura�on.

Providing best �mes/places for Tech Ops (Mission Planning) - Federal Law Enforcement Agency Intelligence Analysts are frequently asked “what is the safest �me for me to recover the tracker from the vehicle”,

change ba9eries, or install audio/video equipment. Our Predic�ons module is used to plan these types of missions to

ensure maximum officer safety and mission success by quickly iden�fying the best mission opportuni�es.

Mul�Mul�Mul�Mul�----Track CompareTrack CompareTrack CompareTrack Compare

Mul�-Track Compare (Mul�View) is a new module that allows a user to see the daily ac�vity from mul�ple tracks at

the same �me.

Iden�fying Related Network Behaviour - Federal Law Enforcement Agency Mul�View can be used to see where a large number of targets were at a specified �me. This is valuable to iden�fy

linkages from temporal events to targets by evalua�ng targets behavior a�er an event has taken place. As an example,

a Gang leader was apprehended at 11am. By looking at all the target’s travel immediately following 11am, an analyst

can see how the targets reacted a�er the arrest. The inves�gators were able to confirm by the targets behaviours which

of them were directly related to the gang.

icuworkbench - use cases

Technology