Modernizing Analytics for Law Enforcement

By Steve Shirley, Captain Steve Serrao, Robert Morison, May 29, 2019

Download the PDF


Technologically, law enforcement is an exciting field these days. Vast new sources of electronic data and advanced analytical methods offer opportunities not only to resolve individual investigations in record time, but also to discover patterns of activity to exploit in crime prevention. To seize these opportunities, many agencies are modernizing their information and analytics platforms. To explore the pragmatic challenges and potential benefits of modernization, IIA spoke with Steve Shirley, Head of Customer Advisory for the SAS Justice and Public Safety Team, and Captain Steve Serrao, Senior Customer Advisor for the SAS Justice and Public Safety Team.

Let’s start with a day in the life of law enforcement investigators. What are their primary activities and objectives?

Steve Serrao: Investigators and supporting analysts engage in two categories of activities. The first is reactive, responding to crimes and incidents as they occur. They are trying to gather evidence, generate and follow-up investigative leads, identify suspects, and clear cases. That’s most of the day-to-day work. The second is more proactive, analyzing information about criminal activity in order to spot trends and patterns that help identify organized criminal activity or likely repeat offenders or high-crime locations and times of day. One goal of modern policing is not just to count and measure crimes but to assess the level of harm that specific offenders or crime groups are causing within a community.

It is important to distinguish those two responsibilities because investigators have no control over the first, and when they are consumed by the reactive case work, the more proactive and preventive activities get over-shadowed or reprioritized. Some law enforcement agencies find it effective to separate the two responsibilities so one unit can focus on developing new intelligence for crime prevention, which has greater long-term and strategic value.

Steve Shirley: In both those cases, we should keep in mind that the output of these processes are information products that are disseminated to others. These include evidence and case files for arresting officers and prosecutors to use or intelligence products that influence tactical and strategic decision- making. The faster and more accurate the investigative analysis, the better the chances of investigative success, improvements in case clearance, and potentially a reduction on associated costs. On the proactive side, investigators analyze data to form and test hypotheses around emerging threats, patterns of crime, and impact of resource allocation decisions. This information may be shared horizontally to help operations across the agency, and vertically to those making strategic decisions about organizational priorities.

The objective is developing and disseminating information that people can act upon, getting it to the right people at the right time. Doing that well requires utilizing the available data and collaborating across different expertise and areas of the organization. Supporting a front-line investigator may be specialists in sourcing, aggregating, and organizing information, as well as analysts who help interpret and package the information to be communicated effectively.

What technological challenges and constraints do investigators encounter?

Shirley: One major source of complexity in today’s world of law enforcement is the volume and variety of available data – which is continually growing and changing at an exponential pace. Agencies have long had computerized dispatch and records management systems that capture officers’ activities and interactions with suspects, victims, and the public. Those systems remain an important source for investigators, but now they have to deal with a plethora of “21st century” data sets and formats including geolocation and communication data from mobile devices, data from text messages and social media, financial transactions, dark web activities, and more image and video data than ever.

How can agencies optimize the capture, organization and analysis of this diverse range of data? Many agencies capabilities and investments in technology fail to keep pace with the volume and variety of data being presented. This can cause a real challenge for investigators and their support staff, resulting in missed opportunities to discover important relationships, observe trends and patterns, and identify threats in near real-time. If agencies are struggling today with the challenge of dealing with this dynamic landscape, it is only going to get worse as the data environment continues to change.

Serrao: I like to keep in mind that technology is an enabler as well as a constraint. People and technology are good at different things. For example, a lot of information that investigators work with is in the form of free text narrative, and humans struggle to process and recall information they read. Why not employ technology that is capable of scanning at the speed of light and never forgets?

The challenges of dealing with data are formidable, but law enforcement can make significant strides forward by deploying proven technologies against everyday needs and make investigative work faster and more accurate. Let technology do what it does best: it can scan text; it can extract people, places, and things; and it can link those entities and never forget the relationships. Let’s free up our time to do what we excel at: putting pieces of the puzzle together and developing strategies and investigative paths to follow. Investigative teams shouldn’t spend their time preparing data, reading reports, and searching through thousands of records to find a needle in a haystack when the computer can find that needle every time.

What does it mean to modernize the information platform, and what are the benefits?

Serrao: We’re in a digital world. The evidence investigators are dealing with is digital and their methods must be digitized to keep pace. Look at the recent Jussie Smollett case in Chicago, where his accusations became unraveled not necessarily by interviewing people, but by tracking his digital footprint and interactions. Modernization is largely about digital tools to work with digital data.

Shirley: It’s also about people and their skills and, as Steve said, processes that bring out the best of what people and technology can do together. Modernization begins when agencies and their leadership recognize the core value of their data assets and that data and analytics can change how they operate. They need skills and technology focused on maximizing the impact of the data they are collecting. That means both repurposing existing data and leveraging new data sources, and combining them in intelligence, investigative, and strategic crime prevention efforts.

Serrao: The benefits are largely about time, and we know that the longer an investigation takes, the less likely it is to reach a successful conclusion. Too often, investigators and support staff have to go to multiple data sets and perform various queries and then move that data around manually to try and paint the picture of the relationships among people, places, and things. It can take days or weeks before they are in a position to execute subpoenas or search warrants or conduct interviews. With a modern platform doing a lot of the searching and matching in real-time, investigations can often be accelerated to a matter of hours or days. The objective is giving people access to data and investigative tools that can help them get to an answer or decision earlier in the process.

Shirley: Saving time also saves money. The total cost of an investigation is reduced when investigators get answers to their questions quickly and make decisions faster while they are in the field. We should also think in terms of productivity benefits. A modernized platform raises the efficiency and amplifies the impact of investigative activities. It augments the capabilities of staff at all levels of experience. It adds capacity without increasing staff, which is increasingly important when recruiting is difficult and budgets are tight.

Speaking of budgets, what stands in the way of modernization?

Shirley: Funding priorities are a challenge to modernization. The largest line items in most police agency budgets are human resources and fleet acquisition and maintenance. When investment is needed, it tends to go there, even when a strong case can be made that better technology can relieve pressure on staffing and other resources. Under tight budgets, investments tend to be short-term and tactical.

Serrao: There are other common barriers. One is legislative restrictions on data use. For example, we helped North Carolina deploy a state-wide data sharing initiative. That would have been impossible without new legislation because it entailed changes to data handling policies in courts, probation, correction, and social services, as well as law enforcement. The second is turf battles, which still happen. “Right to know” and “need to know” remain basic tenets of information sharing, but some agencies err on the side of holding everything tightly. Third, and this also relates to information sharing, is that longstanding policies and procedures are out of date and can often tie the hands of the law enforcement community as they attempt to counteract modern criminal activities.

How aware are law enforcement leaders of the potential for improvement?

Serrao: They share information and experience regularly through organizations like the International Association of Chiefs of Police, so most are familiar with the landscape of both innovations and constraints. But, as Steve just said, they look to people rather than technology as the answer. We encourage them to be looking for the most productive combinations for people and technology. Law enforcement also tends to be risk averse. A given agency would likely rather follow the lead and lessons learned of others than be the first to make a significant move.

Shirley: That said, there are plenty of examples of progressive leadership and developments in this area. In the United States we have about 18,500 law enforcement entities, most with fewer than 100 officers. Yet some of the smaller ones are leading the pack in modernization. They may not have big budgets, but they have simpler contexts and more control over their destiny. We have “real-time crime centers” emerging at the municipal level, and there are discussions around the concept of “virtual fusion centers” as an alternative to bricks and mortar facilities that would take advantage of cloud services. Both of these are great candidates for a modernized analytics platform.

Serrao: Accessibility is key. Police agencies, other than the very largest ones, do not employ a lot of post- graduate degreed data scientists, statisticians, and data wranglers. They tend to have knowledgeable and versatile analysts. They need to deploy powerful, accessible technology and training that fit and elevate the skill sets of the staff that they can hire, afford, and retain.

Shirley: Leadership really matters. The largest law enforcement agency in a large state has six different investigative divisions that were not in the habit of sharing information or otherwise collaborating. It took the agency leader, equipped with vision and understanding about the value of data and technology, to drive implementation of a single data platform and, more importantly, change to the culture and the working relationships within it. When the new platform proved to make work easier and more productive, reluctant participants felt social and management pressure to get on board with the change.

What are some best practices in implementing a modernized platform?

Shirley: Start by recognizing that you’re on a path, a journey. You’re not going from basic data sharing to machine learning overnight. The agency needs to organize data, provide access and drive usage, and increase the automation of operational procedures. More complete and timely access to information makes a big difference to day-to-day activities. How often are suspects released because the investigators and interviewers lack the information they need to ask the right questions? So set realistic objectives and make the most of incremental successes.

Serrao: Here’s a simple example. An agency was incurring over a half million dollars a year of overtime expense associated with very simple data processing tasks. An upgraded platform with some embedded analytics eliminated the need for that work and the associated overtime budget. Nothing fancy here. They automated what was easily and reliably “automatable.” With results on two fronts – costs are lower and staff can spend more time doing more useful work.

Shirley: As the data foundation incorporates a rich mix of internal and external sources, start exercising it more proactively to understand patterns and take more strategic actions in preventing crime and improving community safety. Take the opioid crisis, one of our most pressing social, medical, and criminal challenges. It’s far more than a frontline tactical issue. Law enforcement has to partner with community, health, and educational organizations to develop more strategic responses. With resources stretched thin on all fronts, we have to look at the shared data, apply strategies, and measure their effects.

Serrao: One more success factor – adoption with agility. The best data and technology in the world is not going to help an agency unless people really embrace it and put it to work. A lot of the implementation journey has to be about enabling and ensuring adoption at every step, while at the same time being flexible enough to make adjustments when things are not working out right. Training, measurement, and reward have got to encourage both adoption and flexibility.

How do the challenges and solutions we’ve discussed apply outside the United States?

Shirley: The principles – and many of the experiences – are relevant to law enforcement agencies around the world. They have different legal constructs, different approaches to public safety, and different approaches to data. But they are recognizing the power of data to provide them with greater insight for tactical and strategic decision making, as well as the need to modernize their technology platforms.

Legislation about information security and sharing, particularly in the European Union, proves challenging, given that operational success – identifying threats, gathering evidence, solving cases – so often depends on agencies or departments sharing data. As we mentioned earlier, policies often lag behind practical needs and new opportunities in law enforcement. There have to be controls, but it’s possible to configure an agile platform to share selected information and apply advanced analytics while still complying with local data and privacy rules.

Serrao: Let me underline the fact that, while police have similar objectives and operate in similar ways around the globe, there are significant local differences. So the technology platform needs to be able to adapt to local methods, restrictions, and customs – without a big overhaul of the software.

And how does our discussion apply to investigative processes outside of law enforcement?

Serrao: We see a lot of consistency across the ways that other organizations investigate things. That includes government departments of health, insurance, motor vehicles, and child welfare, and other units focused on fraud detection and prevention. They conduct investigations just as law enforcement does, their staff is largely drawn from retired law enforcement professionals, and they have working relationships with law enforcement agencies. So there is a lot of crossover.

We also see many similarities in the private sector – insurance companies, corporate security divisions, supply chain, brand protection. These operations all benefit from modern investigative approaches. It may be a large corporate campus that needs comprehensive security and incident reporting, or an organization tasked with making sure there is no copyright infringement or intellectual property theft. They need to integrate different data sources and take informed investigative steps. A law-enforcement-type technology platform and analytical investigative methods can serve them well.

Shirley: I’d like to add that corporations, like government agencies, have tight budgets. With the exception of large insurance companies, their investigative groups are generally small and underfunded. It can be very difficult for them to conduct investigations efficiently and detect patterns that shed new insight. Modernized technology that amplifies the capability and impact of their staff can be a very good investment.

Please review the key capabilities of a modern technology platform.

Shirley: The magic word is “platform.” Standalone technology solutions required a lot of orchestration and integration effort to allow that data to become part of an agency’s broader data access and analysis environment. A true platform is architected to be both integrated and flexible. It should enable you to leverage the data you’ve already got, including what may be vast amounts of historical data, and incorporate new data in new formats as it comes available. The platform should also support a range of investigative and analytical tools to meet the needs and responsibilities of people at different tiers of a law enforcement organization. Frontline investigators and their support staff, managers making daily prioritization and resource deployment decisions, planners devising crime prevention strategies, and executive leaders trying to make lasting improvements to the agency – their needs are different but they all depend on consistent and robust data.

Serrao: Let me detail some of the data and analytical capabilities needed. First is content or text analysis because so much investigative information is free- form text. Second is the ability to extract entities from the data – people, vehicles, groups, locations, phone numbers, other identifiers. Third is entity resolution – finding references to those entities in different data sets and the patterns in their relationships, including subtle and non-obvious connections. And finally, having an enterprise search capability across all data, enabling people to make simple inquiries with minimum effort. Those capabilities put your data to work at all tiers of the organization.

To sum up, what are your top pieces of advice to law enforcement leaders who are modernizing their platforms?

Serrao: In your modernization efforts, pay as much attention to “future proofing” as to immediate data and analytical capability. The platform has to be extensible and configurable because your needs and strategies will change, and new data and technologies will be able to do new things for you.

Also make sure that the technology you choose is “white box” rather than “black box.” Investigators and other decision makers have to understand how data is being used and what the analytics – even advanced and complex analytics – are doing with the data. How are conclusions drawn and recommendations reached? Are there hidden biases at work? The technology must explain itself in order to be trusted and adopted, especially where data and decisions must be very accurate. Which is, of course, very much the case in law enforcement.

Shirley: Be realistic about how much you need to change and how fast you can do it. That starts with taking a hard look at your current infrastructure and how you’ve made technology decisions in the past. Try not to perpetuate the issues caused by implementing isolated or point solutions that have fixed capabilities and require further IT investment to integrated with the rest of the enterprise.

The onslaught of data will continue. Will your infrastructure be ready? And will you be able to turn that data into an onslaught of opportunity in investigative performance and crime prevention?

About the authors

Author photo

Steve is in his 25th year at SAS, all of which has been dedicated to designing and delivering solutions to government and non-government entities who have intelligence and investigative responsibilities.

His career working with Law Enforcement began in 1995 when he was assigned to the London Metropolitan Police’s Criminal Intelligence project. He lived and worked alongside members of Scotland Yard’s intelligence teams developing the enterprise-wide solution that would eventually support over 30,000 users and formed the technical foundation for the agency’s Intelligence-Led Policing program.

Leveraging that knowledge, Steve’s role morphed into the emerging public security consultancy practice and he traveled extensively, implementing solutions that combined optimization of processes and data in support of both investigative and intelligence analysis activities.

In 1998, Steve traveled to the United States to manage intelligence solution projects that were being delivered at state and national level. Post 9/11, and after relocating to the US permanently, he became involved in the development and deployment of intelligence applications that are used by the fusion center community across the US.

Today, Steve has the honor of leading a team that combines former law enforcement leaders and solution architects with significant experience in public security domain. The SAS Justice and Public Safety Team works alongside our customers to design and apply a range of operational and analytical capabilities that are configured to solve modern investigative challenges. Steve’s goal is to educate the investigative community in the value of developing a culture of analytics so that data-driven decisions can be made at all levels of the business.

Author photo

Steve Serrao is Senior Customer Advisor for the SAS Justice and Public Safety Team. His role involves balancing a client-facing position working externally with customers and working internally with the product development team to understand market needs and desires and ensure that the company’s product offerings meet those demands.

Serrao has over 38 years of experience working in the law enforcement field with a focus on criminal investigation and intelligence management. He was an active duty state trooper and high-ranking intelligence commander with the New Jersey State Police for 25 years before joining SAS in 2006.

Serrao held several assignments with the NJSP, including Intelligence Management & Analysis, Counter- Terrorism, and Special Assistant to the Superintendent. Serrao has significant experience investigating traditional organized crime. He has also supervised the State Police participation with the FBI - Joint Terrorism Task Force and held the position of Assistant Director of Operations at the NJ Office of Counter- Terrorism. He has held top secret security clearances and has been involved in communicating with the US National Intelligence Community regarding intelligence on terrorists and support cells.

Serrao served as a Special Assistant to Colonel J.R. Fuentes, Superintendent of the NJ State Police where he was instrumental in the early design and set-up of the State of New Jersey Fusion Center known as the Regional Operations and Intelligence Center (ROIC). Serrao was the Project Manager for the design, purchase and deployment of the multi-million dollar Statewide Intelligence Management System in New Jersey.

Over the past 13 years Serrao has developed significant senior level private sector experience working for SAS Institute Inc., the leading global information technology and analytics provider. Serrao has also served on several government advisory committees and working groups, including the USDOJ Global Advisory Committee - Privacy and Information Quality Working Group. He has travelled extensively throughout North, Central, and South America, as well as the United Kingdom working with police, military, and government intelligence agencies to provide solutions to help increase effectiveness of intelligence programs.

Author photo

Robert Morison serves as IIA’s Lead Faculty member. An accomplished business researcher, writer, discussion leader, and management consultant, he has been leading breakthrough research at the intersection of business, technology, and human asset management for more than 20 years. He is co-author of Analytics At Work: Smarter Decisions, Better Results (Harvard Business Press, 2010), Workforce Crisis: How to Beat the Coming Shortage of Skills And Talent (Harvard Business Press, 2006), and three Harvard Business Review articles, one of which received a McKinsey Award as best article of 2004. He holds an A.B. from Dartmouth College and an M.A. from Boston University.