Developing PRISM: V2 is Here

For the past few weeks, the PRISM team has been diligently working to test the new version of PRISM. We are proud to announce that, after months of development, we have finally released PRISM V2. As we discussed in an earlier post, Version 1 was originally developed for internal users. In order to test our features and gain valuable feedback from external users, we launched a Pilot Program with select law enforcement agencies across the US. They found bugs, identified workflow issues, gave valuable critiques, and made feature wish lists, which allowed us to greatly approve upon PRISM in V2. Here are some of the big changes to the tool.

Faster Workflow

As analysts and investigators, we need to be able to more efficiently work throughout a project. Previously, it was cumbersome to search for usernames, scrape data, and build out user profiles. Our analysts and Pilot Program users identified ways to expedite these processes. PRISM now has additional buttons to add profiles, add usernames, edit projects, and upload documents directly from the workbench. This allows users to spend less time clicking between areas of the tool and more time reviewing content.

Improved Exporting & Authentication

Before, PRISM only exported data into Microsoft Word formatted Rich Text (.rtf), Microsoft Excel XML format spreadsheet (.xlsx), and Comma-separated Value Plain Text (.csv) formats. As many of our users have additional needs, we expanded this selection to include Microsoft Access database (.accdb) and Adobe Portable Document Format (.pdf) files. All of these files include the MD5 hash values associated with each individual result for authentication purposes.

In addition, users can now download individual search results and native files to their computer in .pdf and Flash Video (.flv) formats. When these files are downloaded, a record of each download is created in an uneditable system log. This log can then be exported into .pdf format and will include information such as the hash value for the content downloaded and which specific result it came from. We added this feature to assist law enforcement agencies with evidence gathering and authentication.

Topic Monitoring

Previously, PRISM was designed as a case management system for individual profiles and groups of individuals. Over the course of testing, we discovered that both our analysts and Pilot Program users desired the ability to search in real-time across social media sites to find information about topics pertinent to their projects. In response, we built a topic monitor. Users now have the ability to search real-time content originating from Facebook, Google Plus, Instagram, Reddit, Twitter, and YouTube. All of these results can be highlighted to showcase important words, filtered down by word exclusion, and saved both within PRISM and locally on the user’s device.

Subscribing to PRISM

Now that PRISM V2 is released, subscriptions are available to all organizations. To learn more about PRISM or to get a demonstration, contact Blake Haase at blake.haase@cesnb.com.

3 Key Takeaways from the SMILE Conference

It is fall, so it must be conference season. From September through October, members of the PRISM team will be in various locations across the country. Last week, three members of the PRISM team were in Omaha for the SMILE Conference. As we have a great relationship with law enforcement agencies, we thought it was pertinent to share some of the major takeaways from #smilecon.

Law Enforcement Agencies are Successfully Using Social Media

For those of you who are not familiar with SMILE, it is a conference at which law enforcement agencies network with one another and share best practices regarding the use of social media in law enforcement, from both a marketing and investigative perspective. It allows these agencies to learn new, innovative ways to harness the power of social media to build relationships with the community and combat crime. Throughout the conference, many speakers discussed how their agencies are successfully using social media to keep tabs on known offenders, curtail gang activity, monitor events, respond to disasters, and conduct undercover investigations. Officer Eric Draeger of the Milwaukee Police Department spoke about his department’s success doing a multitude of those things at once: They successfully use social media to disrupt gang activity and prevent incidents from occurring at large public gatherings.

Data Fusion is Imperative

As we wrote about from our experience at the i2 User Conference, agencies are integrating a variety of data sources into their process. With the proliferation of social media activity, law enforcement agencies now understand the fundamental need to incorporate social media data into their day-to-day operations. Social media records are now combined with traditional investigative data to conduct more thorough investigations. At SMILE, many agencies reported impressive results using social media information in their investigative processes.

Tools are a Must

In order to conduct social media monitoring and investigations, law enforcement agencies need tools. Nearly every presenter at SMILE was using some form of tool to assist them with the investigative process. The amount of readily available social media data is unfathomable and can be extremely overwhelming. Investigators and analysts must rely on tools to assist them with harvesting, processing, and analyzing social media data. Otherwise, they would be inundated with records and have difficulty making timely analyses.

Conclusion

Every time we go to a conference, we learn something new that allows us to improve our products and services for our clients. SMILE was no exception. We have been following trends of the use of social media, embracement of data fusion, and need for social media tools in law enforcement for some time now. It is one of the main reasons we developed PRISM. Both the i2 User Conference and SMILE reinforced our use of social media, data fusion, and PRISM in our investigative process.

Developing PRISM: The Journey from a Concept to Version 1

Due to the increasing usage of social media, it has become essential to collect open source information for investigations, intelligence, and legal proceedings. Federal agencies like the FBI and FEMA have begun to embrace the power of social media data for investigations, situational awareness, and disaster response. The NYPD launched its social media unit in 2011 and has since used social media data to identify murderers and gang activity and curtail juvenile crime. Similarly, both criminal and civil court cases have increasingly utilized social media data for eDiscovery. While the willingness to harness the power of social media data is growing, not every organization has access to the tools necessary to conduct thorough open source social media research and analysis. Our need for a more efficient social media research and analysis tool initiated the development of PRISM.

The Creation of PRISM

Before discussing the tool, it is important to understand CES as a company. CES is a professional firm which provides analytical, investigative, intelligence, and eDiscovery services to both the public and private sector. The primary focus of our business is fraud investigations. The company’s leadership and investigators come from a diverse array of intelligence and investigative backgrounds, including the FBI, DEA, OIG, NCIS, and federal and local law enforcement agencies. These individuals are a rich source of expertise on matters ranging from healthcare fraud to organized crime to computer and network forensics. To support their work, our analysts are trained experts in fusing together disparate data sources, such as public records, news media, and social media data. We combine this data to identify individuals, build networks, and monitor and track emerging and current threats using our data FUSION approach.

In order to provide our core services and enhance our data FUSION capabilities, CES President Carl Florez determined CES investigators and analysts needed a more efficient way to conduct open source research and analysis across various social media platforms. In July 2012, he assigned the task of developing a new tool to Project Manager and Legal Counsel Blake Haase. The goal was to create a tool which adhered to current legal standards and decreased the manual search time expended gathering open source social media data. After many rounds of testing and tool changes, the first version of PRISM was completed in March 2013.

PRISM V1.0

At the end of development, the result was PRISM V1.0. PRISM is an API-driven (Application Programming Interface) browser-based social media research and analysis tool. It allows investigators and analysts to search across 24 social media, blog-based, and news-based sites. PRISM decreases the labor-intensive processing time spent identifying social media profiles and relevant data sources. These custom search results can be saved for future use with an assigned hash value for authentication purposes. After individual social media account profiles are identified, usernames can be entered into the tool for an API-based profile search.

PRISM pulls publicly available API profile data from nine popular US social media sites. The API profile search quickly populates individual and organizational profiles with a wealth of data for filtering and analysis. These results are automatically saved with available metadata and are hashed for authentication. The available metadata information typically includes date, time, unique identification, and geo-location data. All of these results can be exported into three formats for additional analysis outside of the tool and for reporting purposes. Once these searches are saved in the system, analysts have the ability to compare connections between individuals, plot geo-location data, and obtain word counts.

The Future of PRISM

Currently, PRISM is used by CES’ investigators and analysts to provide services to our customers. Select law enforcement agencies are also testing the tool and providing valuable feedback for future development. Social media open source data has become an integral part of CES’ day-to-day and future operations. As the company expanded into the social media realm, we realized a need for continuous evaluation of social media sites, trends, and changes in data structures and laws. By being abreast of these trends, we can modify our data FUSION process and further develop PRISM.

In response to the rapidly changing social media landscape, CES is beginning the development of PRISM V2. It is our goal to enhance our work product by tweaking the tool to make it easier to use, adding new features to capture additional relevant data, and enhancing the tool’s built-in analytical capabilities. Throughout the development of V2, CES will be focused on creating a more comprehensive solution to meet the needs of our clients and testers.

Learning Together

The CES PRISM blog is the place where we share the newest developments in social media sites and tools, data analytics, eDiscovery, investigations, and intelligence. We will also share workflow tips and tricks, case studies, and the developmental progress of PRISM. Our goal is to open a dialogue with the community which allows all of us to learn together.

Have any ideas, questions, or comments? Drop us a line by contacting CES’ resident blogger, Melody Ross.