Osint And Investigation Innovative Technologies For Security _ Giovanni Nacci

Osint and investigation: innovative technologies for security1 this article was published by "Intelligence e Storia Top Secret" n° 8/2008 – www.centrostudiintelligence.org

by Giovanni Nacci2

Until recently, the leitmotif of the political debates about "security" seemed to be focused on the theory - bipartisan - that for a more effective contrast to crime and terrorism troubling the today society would have been necessary "to do more intelligence". Roughly speaking, this thesis seems to be really difficult to refute, but just because it is presented in a so general way, becomes a useless theorization. Hardly ever in fact, after the proclamation, the issue was seriously studied in depth with an organized method and no clear, precise and flexible proposals were put forward. Doing so, there's the danger that we give too much importance to images - not too much truthful that the current perception of intelligence tends to evoke among people. And it's too easy and convenient to let intelligence pass as the "final solution" for the anxieties that other means of control, prevention and investigation - even if legitimate and legal - (as provided by a democratic system) can evoke in the collective imagination. Thinking to intelligence as something to replace any other function, procedure or institution entrusted with security is a cultural error and mainly a strategic one; it’s even worse to rely on its estimated low profile emotional impact. Doing more intelligence does not imply the reduction of other security activities in any way. Indeed - and is not a paradox - more intelligence we do, greater and more incisive the work of all other institutions, engaged of public order and citizens’ protection in different ways, could be. Intelligence is not a substitute to the investigative action of police or to its material and visible presence in the territory (checks, searches, holding for questioning, arrests, even maritime surveillance, etc..) or it cannot make this presence less necessary. Intelligence cannot be used as a "good" method, politically correct, almost homeopathic, to let all agree on problems that everyone tackles (when it happens) in diametrical opposite ways. The manipulation (more or less political) of intelligence3 is the most harmful thing that can happen to a democratic nation. In other contexts, however - especially certain academic circles, that in different ways are sheltered from the background noise too often generated by a too much self-referential policy – comparing research activities on the issue of possible similarities and potential points of contact between investigation and intelligence are rich. The conviction that it is necessary to arrive at some best form of integration between the two instruments, very different but complementary, urges scholars and researchers. Certainly institutional tasks of organizations, activities, practices and operational purposes - for many well-known reasons - continue to remain separated, but intelligence and investigation - even before being institutional functions of the state – are scientific disciplines that, as such, will use scientific methods. Therefore there is no reason not to think about mutual transfers of knowledge and experiences, at least from a methodological and technological point of view. If we forget for a moment the concept of intelligence as a governmental function or as a set of bodies and institutional activities generally attributable to the thought of the State security, we can focus on intelligence as a discipline and a method, whose main purpose is to provide the best 1 2

3

Translated by Paola Di Cairano - www.attitude2web.net Giovanni Nacci is a former Navy Officer. He started his career at 5° detachment “Cooperazione Internazionale e Infrastrutture NATO” at the Central Balance Department of the Italian Minister of Defence., he is a consultant in methods and systems for the strategic treatment of information and specialist in Open Source Intelligence applications. He is the director and founder of Intus Legere (www.intuslegere.it), a cultural network whose aim is the integration between the Italian Intelligence community and Intuslegere.EU , a cultural source for Italian and foreign scholars. Often linked to the other solution thought to be magical and crucial: “we need more prevention”

information to support decision-making. In fact we can say that anyone who is in charge of making decisions (more or less complex, more or less critical) can usefully take advantage of a methodological approach based on the methods and systems of intelligence, whether they are about viticulture or patents of high technology. In other words, where the coming to a decision should result from a deep analysis carried out on an exceptional large amount of information, or particularly complex, or in all those situations where the available information results inadequate in terms of quality and quantity, methods and systems of intelligence4 can make the difference between a decision based on a mere intuition or random choices and a decision taken with the best awareness of the effects and consequences that it will lead once applied to the specific context. The aptitude for the decision making and the intuitive abilities is an essential quality for both the investigator and the intelligence operator5, but become a strategic factor only if it is supported and we would say - "amplified and fortified" by a methodological super-structure aimed to infuse decisions with qualities such as "persistence" and " practicability". Without the scientific method the right decisions would become (at best) sporadic statistics episodes, that sooner or later would resemble too much to non-scientific predictive lines of reasoning or - worse – to mere lottery. From intelligence, especially open source intelligence, you can get to implement, even in conventional investigation, those methods, systems and technologies that allow to the detective to: 1. on one side give a clear, dynamic and detailed description of each informative element and the relationships between pieces of information, with the aim of achieving the highest possible level of awareness of knowledge available on a specific topic (in other words, that information although marked as confidential or at a high level of security – is a full available source for him and - therefore – become open source6); 2. on the other side exercise - when necessary - a more effective and efficient activity of discovery, acquisition and recovery of that information that is not available yet, but marked as necessary or useful. With regard to paragraph 1) Indeed, we have to say that the amount of information, like data, documents, reports, which is gradually collected during each phase of investigation (even better from the survey until the verdict) is often impressive. Unfortunately, not so impressive is the quality of knowledge that derives from that information. This is not caused, paradoxically, by the endogenous quality of each piece of information, rather by the "informative disorder" in which - in one way or another - that information is positioned, in other words by the limited "perception" of the informative environment. Let’s make it clear, not that operators, investigators and prosecutors are unorganized. The problem is that any order you manually try to give (perhaps it would be better to say humanly) to a large amount of information, then that will certainly be an inefficient order. Any human intelligence (even if it is organized in groups of scholars) will find enormous difficulties in the classification and categorization of tens of ring binders, hundreds of folders, thousands of documents and too many "concepts" expressed in texts produced even during the simplest investigation of all. Of course it is possible to identify concepts and very important elements through a good human analysis, connect them clearly, connect facts and people to more evident events and on this basis start investigative activities. But the human analysis is not able to consider all the possible latent relationships potentially traceable by a systematic intersection of any 4 5 6

in this case those mainly derived from open source intelligence We can say the same for the manager, for the surgeon and so on. “...from the moment that the information of a source, even reserved, has been obtained that same information would be used as a osint ....”, Prof. Marco Giaconi (CeMiSS) private correspondence.

data, any piece of information of each concept, perhaps expressed in a non-Orthodox7 way. The best approximation that detectives may have about the informative and documentary environment that surrounds them is directly proportional to their capacity and those of their collaborators. But it still remains - just - an approximation. It’s scientifically proven that the human brain cannot view concepts and ideas related to more than 10 elements8. This means that we have a clear mental image of what ten pencils, ten apples, even ten atoms are but not in any way we mentally visualize concepts as seventy-eight steps, or seventyeight cucumbers or seventy-eight pieces of information about seventy-eight different investigative cases. One of the qualities of the human mind, apart from the adapting feature, however, is its ability to search – very often invent - solutions that can help its difficult tasks, including that of reasoning and deciding. Here the advent of supporting tools such as language and writing, to arrive to - for what interests us more closely under a purely investigative aspect - the visual diagram making, to inferences, to the layouts liaison, to connection schemes, to association matrices and those of frequency. All these instruments are known very well by each detective and used in almost every phase of an investigative action. However the problem of seventy-eight cucumbers still remains: we raised the level of our perceptual and representative capacities of the world that surrounds us but, in our current society so divided, complex and heterogeneous, characterized by an unstoppable flow of information, this is no longer enough. Maybe it’s true that now we are able to manage the “information overload” interpreted as a "blocking" phenomenon, avoiding to remain immobilized under a mountain of information (it doesn’t matter if it is in the form of paper or of a sequence of bits) but we cannot do anything more with that mountain anymore. We see, we perceive its existence, we appreciate its size and its intrinsic strategic value. We simply brush its surface. An area that - as easily attainable - is obviously brushed by many, perhaps all, and therefore it rarely reserves really significant or advantageous elements. The advantage – as at the era of the first gold and oil seekers - would be the ability to dig below the surface to see what is underneath9, the ability to explore and extract from that mountain the relevant information: the nugget that assures our competitive advantage over others. It is no coincidence that one of the main technological tools (and methodological) that characterizes most methods of the Open Source Intelligence is the Text Mining. The Text Mining, namely the analysis and automatic understanding of texts, is a valuable aid in investigating because it allows - together with other very important features - the categorization of the concepts expressed in the text and therefore the automatic indexation of arguments, facts, places and individuals mentioned in them. Once done, the consequent “weighed”10 visual map of relations between all these elements, which are also indexed and clustered within uniform and coherent sets, shows to the operator in a dynamic way as an evolving image of information at his disposal. This map may finally be looked in up in a graphic form or - thanks to the ability of the language understanding provided by the text mining - not examined by computer queries, but simply through questions putted in a absolutely natural language. Italy with its experts, its researchers, its companies and its technologies is at the top in this field. Due to the Italian genius, or perhaps more likely to its ancient cultural tradition in the fields of 7 8 9

If I say “..this car is a bomb” would I always mean that I’m talking about a car filled with explosives? Or it is not able to do it in a efficient way In subsurface geology we would talk about log or “...the taking of a sample of rock from the underground, in order to analyze its chemical and physical characteristics...” taken from the on-line dictionary De Mauro Paravia 10 Where it is explained the "weight", the relevance, the importance of entities and relationships in different ways

language and linguistics, that among the implementations of Open Source Intelligence systems, the best security oriented solutions are Italian, with an Italian technology. Solutions and technologies that - for those who still have some doubts - are rewarded and held in esteem abroad. If it is true that we are xenophilous people, at least we can be proud of the "Osint investigating" project which has already been fully operational for some time and that is the first tangible example of how investigative practices and methods of intelligence can merge together obtaining laudable results. On the 15th February 2006 the Italian Ministry of the Interior has launched an innovative program creating the first system in the world of "Police Station on line"11. The commissariatodips.it is not what may seem, a simple and trivial website for information. The website is just the user interface of a much more complex and extensive application, forming part of a larger plan contained in the "guidelines for the digitization of the public administration"12 This project, with its technological and innovative importance, was voted as "Most inspiring good practice for creative solutions to common challenges" during the 2007 European eGovernment Awards. This doesn't seem to be a suitable place for studying the many innovative features of the commissariatodips.it project13 in detail so I will analyze only those features that are more directly linked to the concept of open source intelligence. A strategic part of the commissariatodips.it plan is a component14 that is based on text mining technologies to provide search functionalities and the dynamic classification of a wide range of information collected from various sources. The text mining engine works on a large amount of raw data (complaints and reports submitted online by citizens, requests for information via mail, up to more purely investigative material available in digital form, etc.) operating an automatic language analysis - based on morpho-syntax, functional and statistical criteria - phrases, dates, documents, web pages and other sources15 extracting concepts and meaningful relationships, which are then classified into thematic clusters and graphically represented through a conceptual interactive and dynamic map (picture below).

11 www.commissariatodips.it 12 The Guidelines for the digitalization of Public Administrations approved by the Committee of Ministers for the Information Society at its meeting on February 13th, 2002 13 Please visit http://www.epractice.eu/cases/olps website 14 The system is implemented by Sytnema Text Mining Solutions of Pisa. Www.synthema.it 15 For example databases, chats, forums, blogs, mailing lists, emails or texts derived from speech to text functions of the spoken language etc.

This allows the deep exploration of enormous quantity of documentary information operating a certain type of research, which is always language independent16, based on the functional role of each concept, semantic relation or word and not - as happens in the current Internet search engines only through the simple matching of words or keywords. The canonical example in these cases is the following sentence: «ti piace la pesca?» Well then the system can identify subjects and objects, disambiguate concepts and also interpret whether the sentence is interrogative or affirmative, turning it into four ontologically pure cases17: 1. question [acceptance [pesca [fruit of peach]]] 2. question [acceptance [pesca [the activity of fishing]]] 3. question [acceptance [pesca [quantity of draught]]] 4. question [acceptance [pesca [type of lottery]]] Besides allowing a significant efficiency and reliability in the categorization and clustering of the information, this also allows an increased capacity of the operator to explore less obvious aspects of the information at his disposal, letting him identify relationships between objects that otherwise would remain latent. The ability to interpret some texts and recognize and represent the concepts (including people, objects, events, places, etc.) and relations in a database, is a very important mean of help to detectives, always struggling with the need to discover, understand and make a logical sense to the famous five "W": who, when, what, where, why. From an investigation point of view, such an instrument is useful - as mentioned before - to increase the perception of the appearance and performance quality of the information that the operator has at his disposal. The clearer the framework of knowledge is, the better you can use the information to make decisions. From a point of view of pure intelligence, (but always oriented to investigation) it is important to underline the possibility that these technologies give access to an inexhaustible spontaneous and cooperative source: individuals. The project of the Italian Ministry of Interior, structured in this way, either puts the citizens at the heart of the institution, classifying them both as users of the services (assistance, complaints online, information, etc..) or - far more important from a strategic point of view - as suppliers of information or, in other words, as a privileged source. Just think about the value of that incredible base of knowledge that will be built thanks to the complaints that citizens daily fill online and how important it is for the detectives’ activity - especially in particular cases of crime – to have access to all that information with the analytical capabilities of the instruments we mentioned18. The transformation of the role of the citizens from simple users of security to proactive subjects integrated into the information security system, is perhaps the greatest innovation in recent years. For years experts have been examining – through an Open Source point of view - about what may be or become the concept of Citizen Intelligence, how and how much the citizen can somehow become a distributor of security for himself and his family, for his neighbourhood, for his country 16 In other words independent from the language the document or information is expressed in 17 The example was made using the Italian version of Wordnet, available at this address: http://www.ilc.cnr.it/iwndb/iwndb_php/wnit.php? word=pesca 18 Especially when dealing - for example - to investigations related to child pornography offences, fraud on the Internet, recycling and cybercrime in general

and also of how this can be framed in a broader concept of eDemocracy19. The commissariatodips.it example is emblematic. It is the first step toward a collaborative integration of methods and systems that hopefully will grow and develop putting the importance of citizens at first place. This time Italy certainly is the first in Europe for sure and probably in the world. A clear demonstration of absolute excellence in Italy among others that exist - in institutions such as in factories - even in this area. Let us be proud of it and persevere.

19 For further information: “L'Intelligence, le reti e... l'e-Democracy” di Giovanni Nacci, in RDEGNT, Rivista di Diritto, Economia e Gestione delle Nuove Tecnologie”, anno III, n° 2 – Aprile ~ Giugno 2007, Editore Nyberg – www.nyberg.it