VAST2006 Submission - "your project here"

Oculus - Applied Analysis with nSpace and GeoTime

VAST 2006 Contest Submission
July 2006

Authors and Affiliations:

Pascale Proulx, Oculus, pascale.proulx@oculusinfo.com
Lynn Chien, Oculus, lynn.chien@oculusinfo.com
Adam Bodnar, Oculus, adam.bodnar@oculusinfo.com
Kaleb Ruch, Oculus, kaleb.ruch@oculusinfo.com
Bill Wright, Oculus, bill.wright@oculusinfo.com

Tool(s):

GeoTime and nSpace are two novel visual analytic applications that have been developed in collaboration with analysts and ARDA / DTO to support the investigation of large and complex datasets. GeoTime supports the visualization and analysis of entities and events over time and geography [2] and is currently in transition to deployment for analysts to use on a day-to-day basis. nSpace is used for triaging massive data and for analytical sense-making [1], [3], and is currently undergoing experimental evaluation with NIST and other government agencies.

nSpace combines the multi-dimensional linked views found in TRIST (The Rapid Information Scanning Tool) with the visible, cognitive mechanisms of the Sandbox. Analysts work with TRIST to triage their massive data and to extract information into the Sandbox evidence marshalling environment. The Sandbox is a flexible and expressive thinking environment that supports both ad-hoc and more formal analytical sense making.

GeoTime improves perception of entity movements, events, relationships, and interactions over time within a geospatial (or any conceptual) context. Events are arrayed in time along time tracks, which are located wherever events occur within the spatial plane. For analysts, GeoTime's single view representation of a combined temporal-spatial three-dimensional space amplifies concurrent cognition of entity relationships and behaviours in both space and time [2].

TOC: Who – What – Where – Debriefing - Process
VIDEO – 2 page summary

1. WHO: who are the players engaging in deceptive activities in the plot(s)?

Name	Most relevant source files (5 MAX)
John Torch	1101631275108, Voter’s registry, 1101163356001, picture 084, 1101243161950
Tom Seeger	1101163836903, 1101163888435, 1101243423452, 1101243511077, 1101242407742
George Greenway	1101163870045, 1101163836903, 1101163595494, 1101242941448, 1101243117496
Alejandro Von Ryker	Scientific Review 3, Scientific Review 4, 1101163595600, 1101163840166, 1101163977242
Delwin Sanderson	Scientific Review 3, Scientific Review, 41101163595600, 1101163018599, picture 080
Laurel Sulfate	1101163356001, picture 084, picture 085, picture 083
Philip Boynton	101243338500, 1101240332919
Bruce Rinz	101243338500, voter registry, 1101163452222
Rex Luthor	101243338500, 1101163356001, 1101163356500, 1101163595600, 1101163452222

(Note: ignore the file extensions)

2. WHAT: what is the time frame in which the plot(s) unfolded?
What events occurred during this time frame that are most relevant to the plot(s)?

Time Frame

August 2001 - November 2004

Provide a text list of events following the sample layout. Use short description (i.e. one or 2 lines per event)

Provide what you think is the best subset of events (20 events MAX)

	Event	Date Can be a range	Most relevance source files
1	Alejandro Von Ryker being investigated in Switzerland	August 30, 2001	Scientific Review 3
2	Alejandro Von Ryker closes down institute	September 15, 2001	Scientific Review 4
19	BSE breakout in Alderwood and Mabton and investigation resulting in recommendation of national testing and plan put in place	December 2001 – February 2002	1101243511796, 1101243337295, 1101243424217, 1101243379764, 1101243314341
3	Phone calls made to Switzerland and Swiss Tourism Agency in Toronto from City Hall conference room	January 6, 2002 – January 26, 2002	Phone Log
4	Announcement of Boynton Lab opening and all its significant investors	February 2, 2002	101243338500
5	Laurel Sulfate’s job transition from mayor’s aide, to Boynton executive assistant, to spokesperson	February 2, 2002 – September 13, 2003	101243338500, 1101240332919, 1101163018612
12	Boynton being chosen as one of the labs for national testing of BSE using rapid testing when it opened	September 13, 2003 – December 31, 2003	1101240332919, 1101163018612, 1101243532358
6	Manipulation of Voter Registry	January 2003 – July 2003	Voter Registry
7	John Torch runs for mayor	July 12, 2003 – November 2, 2004	1101631275108, 1101162945890, 1101163727099, 1101163019147
8	Employees of Boynton making trips to South American Countries while breakouts in South America happen around the same time	September 10, 2003 – June 19, 2004	1101163018599, 1101163977242, 1101163595600, 1101163018612
9	Boynton Lab makes breakthroughs in prion research and cures cattle in Brazil even though only dead cattle can be tested.	January 20, 2004 – March 2, 2004	1101163840166, 1101163595600, 1101243250013
10	FDA investigation of Boynton Labs	April 26, 2004 – June 19, 2004	1101163356500, 1101163977242
11	Story of Torch caught in “steamy” photos with Laurel Sulfate published while Sulfate is in Switzerland, causing him to lose election	April 30, 2004 – November 2, 2004	1101163356001, Picture 084, Picture 085, 1101162945890, 1101242384461
13	Council passes ordinances that increases living standard of the city (limits vehicle repair in public places, noise, graffiti)	February 10, 2004 - May 22, 2004	1101243030730, 1101243050855, 1101243314654, 1101243227372, 1101243073106
14	Jennie Angel marginalized by city council, getting scolded and loses support from council.	January 2004 – November 2004	1101163888435, 1101163870045, 1101243423452, 1101243117246, 1101242940152
16	Privatization of Public Works and citizens saying no, especially after one million dollar federal grant.	July 12, 2004 – November 10, 2004	1101242407492, 1101242498164, 1101162507155, 1101242855932, 1101163776793
17	Annexation of land: law gets reversed by state, annexation approvals, land grabs in the works	February 2, 2002 – November 2004	1101163452222, 1101243337060, 1101242854448, 1101242678228
18	Fonfara’s resignation resulting City Manager search and Seeger, Torch, Greenway travels together to Utah and Colorado to interview candidates	April 6, 2004 – April 13, 2004	1101243117496, 1101243095965, 1101163904092,
15	Landscaping Ordinance passed without public discussion even though 14 businesses opposed. Discussion of expansion and public comments at Council meetings to be limited was passed.	January 20, 2004 – July 20, 2004	1101163045539, 1101242941448, 1101242940152, 1101163045539
20 max	People complain they don’t have a say against council members, they’re being controlled, and demanding apologies from council members	January 20, 2004 – Novermber 2004	1101242452180, 1101243423983, 1101242939886, 1101243161950, 1101243050855

3. WHERE: What locations are relevant to the plot(s)?

Follow this example layout. Use only one-line per item.

	LOCATION	Most relevance source files
1	Switzerland	Scientific Review 3, Scientific Review 4, Phone Log, 1101163356001, 1101163452222
2	Alderwood	1101243511796 , 1101243511077, 1101243489577, 1101243338500, 1101240332919
3	Argentina	1101163018599, 1101163018612
4	Brazil	1101163595600
5	Paraguay	1101163977242

4. DEBRIEFING

In January 2003, FBI was tipped off by a not-so-reliable informant to possible political shenanigans in Alderwood. The source states that “high-paying, high-tech employment is now a ‘sure thing’ in Alderwood” and it’s all supported by “the high rolling boys at the City Hall.” This new employment comes from a new private laboratory facility specializing in agri-business.

The new private laboratory is Boynton Laboratories. The opening of Boynton Labs at Alderwood in September 2002 came at a convenient time. In January 2002, cows imported to neighboring city Mabton were suspected to be infected with BSE. Although cows in Mabton and Alderwood were tested negative for the disease, it hurt the economy of the City. An international subcommittee of the Foreign Animal and Poultry Disease Advisory made up of five representatives, including two from Switzerland, recommended the US do national testing.

In 2003 Boynton Labs was chosen to perform national testing for BSE. In 2004, the lab announced two breakthroughs in prion research, one of which cured Brazilian cattle from BSE. Curiously, Brazil decided to keep the BSE breakout a secret until it was solved. Further, the only approved testing for the BSE agent is post-mortem analyses of brain tissue, how could Boynton Labs cure infected cattle without killing them first? Two weeks after this publication, FDA announced that it was investigating Boynton for scientific reasons.

The director of the lab is Dr. Philip Boynton, whose name brings recognition to Boynton Labs. The two chief scientists are Alejandro Von Ryker and Delwin Sanderson. The spokesperson for the lab is Laurel Sulfate, previously Mayor Luthor's assistant. Investors of this new laboratory include Boynton, Washington State, and the Washen Foundation.

The credentials of VonRyker and Sanderson are dubious since Von Ryker and Sanderson, who ran Von Ryker Institute of Research AG in Switzerland, had published two landmark papers and were accused of fabricating the papers, misusing research funds, and performing unethical experiments by injecting BSE virus into cows. The results of the investigations in Switzerland were inconclusive because the lab was closed down unexpectedly by the owners.

Boynton Labs is mired in controversy, suggested by:

The timing of covert phone calls from City Hall conference rooms to Switzerland
FDA opening an investigation
FDA closing the investigation
Visits to Argentina by a Chief Scientist coinciding with an outbreak of BSE in that country

Although there appears to be various links to Switzerland, the only person we know to have traveled there is Laurel Sulfate. Having been the mayor’s aide, before working at the lab as assistant and then spokeperson, she is a link of interest between Boynton and City Hall. Nevertheless, her trip was purportedly for vacations and occurred more than two years after the phone calls.

Regardless of Boynton’s legitimacy, luring a new high tech lab to Alderwood does wonders for the city. Boynton Labs shows people that the city is doing something about the BSE breakout. It also boosts land value and attracts young and talented people to the city. In fact, the enthusiasm at City Hall seems so optimistic that it is hard to be convinced that they see Boynton Labs as what it should be: very risky since breakthroughs are normally not guaranteed…

Bruce Rinz may have been the one orchestrating the Boynton scam. Rinz never confirmed his association with the Washen Foundation If he is involved, he would certainly reap financial gains from his substantial investment in a 'guaranteed' venture. The Voter Registry only shows one Rinz (Augustus) and he is born in Switzerland, so it is possible that the Rinz family has Swiss ties. Rinz could have brought in Boynton Labs to make land values increase, which then enabled him to encourage annexation decisions. Even Luthor could be involved based on his ardent defense of the lab and his rebuff of concerns about annexing so much land in very little time. Rinz might also have links to the Swiss developers, who were rumored to be interested in the newly annexed lands.

John Torch is also a suspect in this plot, as well as a participant in a number of suspicious events in Alderwood. He stands out for a number of reasons:

He predicted that, “in the next five to ten years, this community is going to see huge growth”
He lost the mayoral election due to speculations of an affair between him and an employee of Boynton Labs, who turned out to be Laurel Sulfate
He most likely rigged the voters list
He inflamed the town by denouncing Martin Luther King as an adulterer, in an attempt to protect himself
He tersely sent an email to the Alderwood Daily News providing reasoning for rejecting them as a partner
He submitted a poem to the editor of the Alderwood Daily News that depicted the City council as heroes for improving the City even when no help was available from outside agencies; the poem was disrespectful and offended a number of people in the town

A story was also published that steamy photos were taken of Sulfate and Torch while Sulfate was vacationing in Switzerland and the story led Torch to lose the elections. Voter Registry shows that Sulfate was 19 at the time. Sulfate could be having relationships with Torch, but the timing of the event seems to suggest that they were being set up. This set-up could have been arranged by Luthor, Torch’s mayoral competition, or John Panni, the author of the article. Torch had publicly expressed distaste for the publication and the data errors in the articles may suggest low credibility for the press.

Maybe Luthor, Torch, and Rinz were on the same page when they brought in the lab and things went awry when Torch announced he was to run as mayor. To confirm that, more background on the relationships and behaviors at City Hall is needed.

According the documents published by Hawk Press Incorporated, elected members of the City Hall include Mayor Rex Luthor, Mayor Pro-tem George Greenway, John Torch, Tom Seeger and Jennie Angel. In 2004, new members Alex de la Cruz and John Sarducci joined the team. City Council’s sole employee is the City Manager David Fonfara, who resigned a few days before his term ended. Bruce Rinz, who was both the Assistant City Manager and City Attorney, became the Interim City Manager and Fonfara was eventually replaced by Robert Rockford. Raul Martinez was appointed to replace Alex de la Cruz until the next election after De la Cruz accepted a promotion in another city.

A force within the council was created by an alliance that includes, Greenway, Torch and Seeger. The existence of this Alliance is in evidence through:

Voting the same way on controversial council motions
Passing a censure on council members before public input was given
Passing a landscaping ordinance without a public hearing even though 14 businesses objected
Marginalizing Jennie Angel for requesting public hearings, failing to secure REC funding and creating an Hispanic Chamber of Commerce
Hiring a City Manager of their choosing, while raising that positions salary and offering a large relocation allowance in the amount of $20,000.

Although Angel has been, to some extent, marginalized, she often has either de la Cruz or Luthor voting on her side, such as the ordinance on graffiti selling. However, neither of them votes with her on a consistent basis and the alliance always wins. Angel is an active member of the society, always trying to help out different committees, but she doesn’t have much power on council, most evident in city council pulling out their funding on the community outreach program that Angel supports. The censure that monitors council member debts seems to have been designed to embarrass Angel, suggested by the irritation of her Brother-in-law. An E-mail written by Torch hints that the reason for Angel’s mistreatment might be linked to the interests of the Chamber of Commerce. Maybe they did not want to share their power or deal with a Hispanic Chamber of Commerce—or maybe, she may be the only one not in the know of the Boynton scam. The Switzerland calls could have been made covertly to hide the scam from her. It is apparent that the Alliance is trying to force her out by making her life miserable.

It seems like the Alliance slowly weeds out people that are not on their side and brings in as many people as they can to strengthen their power. The position of the City Manager seems to support that; the turnover rate for City Managers is exceptionally high. The first City Manager who resigned had worked for the council for 18 years but was “forced out of his job”. The next city manager resigned after 6 months and the last city manager left to pursue a similar job in Chelan but with less pay. Thus, it is no surprise that the current city manager, Robert Rockford, was carefully selected by the alliance. Greenway, Torch, and Seeger had taken a trip to Utah and Colorado to personally interview the two final candidates for the position. Were the substantially raised salary and the 20k for relocation done given insure blind loyalty?

Another way that the alliance is attempting to further solidify their power and influence is their effort in taking over the mayoral position. Torch announced his mayoral candidacy in the 2004 General Election in July 2003. Coincidentally, there was an increase of registrants in the voter registry from January to July 2003. This is much greater than the numbers prior to previous elections. Further, all the voters on the registry who have “undeclared” as their party were registered during this period. What makes this pocket of voters even more suspicious is that they are all male and are either born in California, been naturalized, or have an unknown place of birth. It seems plausible that the voter registry was manipulated in preparation for Torch’s mayoral campaign.

What is their motive to gain power? An analysis of the ordinances and motions that the alliance supported and passed show that the alliance wants to control the city in order to ameliorate the quality of life—according to their own standards. It is evident that they often make self-centered decisions that they believe are good for the city, despite oppositions from other city residents or city council members. These examples include ordinances banning selling graffiti material to people under 21, banning repairing vehicles in public places, and landscaping standards on all businesses. The alliance also does not like to support low income housing complexes and community outreach programs probably because that won’t increase the value of their city. Moreover, Torch even votes against giving out liquor licenses. Given these evidence, it is likely that alliance would be willing to take illicit actions for self-centered reasons. And thus, it is probable that they were the ones who brought Boynton Laboratories in the city because the lab boosts the economy and attracts more wealth and prestige.

In order to finance what they believe are important changes in the city, the alliance look for ways to increase profit, legally or not, as suggested by Torch’s E-mail to Bob Johnson. The discussions of Privatization might have been such a way. City Council discussed privatization of many subsidiaries, including Waste Water Management despite it received a $1 million upgrades grant from the federal government 6 months prior. Reselling the Monson feedlot once land value has increased might also be another way.

However, there is not enough evidence to incriminate anyone. More collection would be needed to answer questions such as: Who is responsible for registering voters and are there ties between the person and Torch? What exactly was FDA investigating at Boynton Labs? Torch mentioned a list of organizations in his poem, is it possible that deceptive activities are going on at a higher level? Further evidence need to be brought in to make dependable convictions.

5. VISUALS and Description of ANALYTI C P ROCESS

Triaging and Scanning with User-Defined Dimensions – who? what? where? when?
First, the dataset was indexed to be searchable from nSpace. However, since TRIST scales well to the 1200 documents in the VAST dataset, it was advantageous to simply pull in all the results at once and use TRIST linked dimensions to explore the full result set at once. The plugged-in NER server provided by Fair Isaac automatically extracted people, places and organizations from the results loaded into TRIST and those appeared in the Entities pane.

Figure 1: TRIST loaded with the VAST dataset.

Some dimensions such as 'Date Published', 'Size', 'Automatic Categories' and 'Referenced Dates' were automatically created for the analyst. (During the indexing of the VAST corpus, basic pattern matching is performed on documents to extract a document publication date, and to extract any dates referenced by the text. After this extraction, nSpace is able to organize corpus documents in a user-friendly hierarchy based on these dates.) User-defined dimensions were created manually in TRIST by the analyst to cluster and filter the data in a way particularly relevant for the task at hand. The first user-defined dimension created was a list of “Key Issues” generated from keywords in the task sheet.

Similarly, a dimension was made for the “Key Players”. The names found in the tasking and from the photos were used to create the dimension initially. All versions of those names found in the Entities pane were dragged onto the corresponding node in the Key Players dimension, assuring that all documents for a key player would be clustered together. It is clear that at this early stage, the list of key players is incomplete, but new players are added as the analyst identifies them, and matching results are categorized automatically on the fly.

One technique that was used to identify key players was to explore the data from the entities pane. The number of references connected to individual entities in the entities pane served as a heuristic indication of the weight a player carries in the plot. Selecting their names and scanning the highlighted corresponding documents (reading extracted snippets of text) verified their importance in context. These people included John Torch, Rex Luthor, Tom Seeger, Jennie Angel, George Greenway, Raul Martinez, Bruce Rinz, and Alex de la Cruz. The organization entities indicated the weight of the City Council in the plot, as well as Hawk Press Inc.

Figure 2 The variant spellings of individuals' name from the entities pane were dragged and dropped into the Key Players dimension.

To help explore topics through time, the dimension “Published Date” was dragged into the query pane. This gives insight to the time frame of the entire dataset, i.e., articles and reports published between 2001-2006. Furthermore, by selecting a key issue or a key player bin in one dimension, it was possible to see when it was mentioned over time.

The documents from Boynton Laboratories were scanned first because the new laboratory appeared to be the main concern in the task sheet. Viewing the documents about Boynton Laboratories in chronological order revealed the timeline of important events associated with Boynton, such as when the lab opened, made breakthroughs, and was under investigation. Fragments and dates from the important events were dragged into the sandbox and organized in chronological order. Scanning those documents also highlighted the characters central to the plot in the entities pane, such as John Torch, Rex Luthor, George Greenway, Jennie Angel, Bruce Rinz, Laurel Sulfate, Philip Boynton, Delwin Sanderson and Alejandro Von Ryker. If not already in the Key Players dimension, these entities were added to it.

Figure 3 Chronological key event scanning: Important events in 2002 at Boynton Laboratories happened in February and September.

At the same time, places in the Entities pane were closely monitored. Key locations were discovered by selecting entities revealed in the entities pane, then browsing the articles related to determine relevance.

Figure 4 Brazil was a location shown in documents related to Boynton Laboratories. Selecting it highlights the article as well as where Brazil is mentioned within the article in the document viewer.

Once the relevance of the locations are determined, they are dropped into the Key Locations dimension to gather further articles related to the location, which helps obtain further links.

Data Assembly – Preliminary assessment of relationships

In order to find out who the key players are and develop their profile, entities referenced in the Boynton Laboratories documents were dragged into the sandbox and a network of their relationships was made using links, each with a label and evidence for the relationship. Profiles of individual key players were also created by adding fragments of important details into their entity groups.

This network of social structure captured the findings that the location Alderwood, the person Laurel Sulfate and the organization Washen Foundation are the key links between members of the Alderwood City Council and Boynton Laboratory. Laurel Sulfate is also linked to Luthor, having been her assistant, and to Torch, in the steamy picture scandal. Boynton Laboratories and the von Ryker Institute of Research were also linked, having both employed Von Ryker and Sanderson.

Figure 5 Network of Key Players: Laurel Sulfate and the Washen Foundation are two links between Boynton Laboratories and members of the City Council

Reading through the key players documents allowed further development of the character profiles. Von Ryker’s result row revealed that he was under investigation for possible fraudulent events in Switzerland. These events were continuously added and organized in the sandbox in the Key Events timeline.

At some point, a structure was created to organize the information for one of the profile using groups such as Personal Background, Professional Background, Alliances, and Enemies. The structure was saved as a character profile template and then applied to each entity group, which automatically organized the existing fragments into the same structure. Then the automatic categorization was examined to ensure the information was in the right places. An assertion hypothesizing the character was engaged in deceptive activities was created under each profile and evidence such as motivations was tied there. All players were categorized as either ally or enemy against each other. When a person could not be clearly categorized, for example as an ally, assertions were also used to keep track of the evidence supporting or refuting that alliance.

Figure 6 John Torch’s Profile: Many supportive evidence shows Tom Seeger is probably in alliance with John Torch

To further develop these assertions, such as the type of relationship John Torch has with Rex Luthor, the two entities were selected simultaneously in the entities pane to investigate their relationship through time.

Figure 7 Intersection: Mayor Rex Luthor votes against John Torch on property tax rate. The green highlights quickly help the Analyst locate the people of interest in the story

It was apparent from the profiles of their relationship that there were alliances in the Alderwood City Council and the members vote together to get their own decisions passed. The word “vote” was added to the key issues dimension. Selecting the documents clustered in this category and scanning the documents shown in the member of city council results helped breakdown the council decisions. A section in the sandbox was made to organize them.

Figure 8 Council Decisions: Jennie Angel is always singled out while John Torch, Tom Seeger, and George Greenway always vote on the same side.

To see how someone voted or acted in the council throughout the ordiances proposed, the analyst only had to select that entity and all its copies were highlighted across the Sandbox in the different contexts. The alliances between Torch, Seeger, and Greenway became more apparent after the breakdown. There appeared to be no animosity between Luthor and Torch throughout the time frame of the dataset. The only alteration within their relationship was when Torch announced his entry to the mayoral election.

Date and name discrepancies
While breaking down the council decisions, the timeline of important events were continuously being updated. One of the problems encountered was the fact that articles from each year between 2002 and 2004 announced City Manager David Fonfara leaving for a new job. Similarly, de la Cruz also left Alderwood twice in different years. From looking at the council decisions, the analyst knew that council meetings were held on Monday nights, so articles published about Monday meetings were compared to a calendar. It was eventually determined that all the articles about the City Council should have been dated in 2004. A dimension of City Managers and Councilmen were made to confirm this assertion.

Figure 9 Incorrect Dates: Highlighting Rockford’s name revealed that documents only referenced him between April and November, which is consistent with the data that he was hired in April. Notes were added to each article that needed a change in year.

Highlighting the documents in each person’s bin revealed that their names were only shown in the months that they were in position. For example, Fonfara’s bin revealed articles between December to February only, Interim manager’s bin revealed articles from January to April only, and Rockford’s bin revealed articles between January to July only. This was consistent with the timeline of their position. The dates of articles related to council decisions were therefore changed to 2004 on the events timeline so that they corresponded with the calendar.

But why are the dates wrong? There were several name discrepancies in the dataset as well, including Rockford being referred to as both Tom and Robert, Rinz being referred to both as Bruce and Mike. These discrepancies reflects badly on the reliability and maybe the credibility of the source of the articles, Hawk Press Inc. An assertion evaluating their credibility was later pursued and developed in the sandbox.

Voter’s Registry
The alliances in the City Council and the date mystery create a lot of suspicion about the City Council The Voter's Registry provided was next examined to determine whether it showed any sign of being tampered with. The analyst focused on the registration that occurred in the timeframe relevant to the coming city elections (November 2004). Voters who were registered in 2003, as well as 1999 for comparison to the 2000 elections, were isolated in Excel and then using a simple XML transformation the spreadsheet was tranformed into a data source from which entities could be imported into nSpace. Dimensions were automatically created for each column in the spreadsheet.

Figure 10 Entities from Voters Registry: Selecting the entities that registered as “Undeclared” for the party field revealed that they all registered between January to July 2003.

There was an increase of voters in 2003 compared to 1999. Further, all the voters that registered as “Undeclared” parties were all registered right before Torch’s announcement to run for mayor. The place of birth field for these voters were also all California, unknown, or naturalized. And all of them were male. This is highly suspicious data suggesting that someone may have manipulated the registry. Could it be Torch in preparation for his run for mayor?

Phone Logs
The next set of data from the set was the phone logs. GeoTime was used to analyse the significance of the phone calls. The timeline of important events developed in the Sandbox were also uploaded into GeoTime. Once in GeoTime, the analyst started to encode meaning in the layout of the events with ink and color. For example, looking at the phone numbers, those from out of town were separated from the other and grouped and labeled by their origin e.g. Seattle, Switzerland, Canada. City Hall’s conference room was placed at the approximate centre of the “Washington State” group, and the “Out of Town” contacts just to the side. Subgroups were organized and colored various shades to ensure clarity.

Because the phone logs range only over a month-long period – as opposed to the timeframe of the entire scenario – to focus on that specifically the “fit to time” tool was used to spread the data out in the time dimension. Selecting the phone log events then clicking “FT” turns Figure 11 into Figure 12.


Figure 11: Before time fitting.	Figure 12: After time fitting.

This data show a wide range of communications, from which patterns can be identified and isolated. One such discernable pattern was the timing of the “out of town” links. As opposed to the other phone calls, the links to the Canadian and Swiss country/area codes appear only on weekends or holiday Mondays, days when no other calls were logged. A quick Internet search in TRIST returns who the phone numbers belong to: each of the Swiss numbers are restaurants, two of which are in Lucerne; and the Canadian number is a Tourism Switzerland branch in Toronto. This activity goes to suggest that there might have been someone at the City Hall planning a covert trip to Switzerland. Furthermore, whatever the purpose of the calls, the covertness meant that some members of the City Council were not involved. The “show” and “show only” tools were used to isolate the events from Figure 13 to Figure 14. Once isolated, these events can be dragged in a new GeoTime layer for quick future referrals.

Figure 13: All phone log records. Figure 14: Weekend phone log records

Figure 15 Phone Logs and Events: The proximity of the phone calls made to Switzerland from the City Hall and the opening of Boynton labs allowed a hypothesis that the phone calls from the City Hall were made to Von Ryker and Sanderson in Switzerland.

Capturing Hypotheses in Reports to Import in Sandbox
In an attempt to root out the suspicious phone log findings above, the “find” tool built into GeoTime was used to execute searches for “Switzerland” and “Swiss.” Results turned in a host of events, targets and places all with links to Switzerland. These were dragged to a 'Switzerland layer' which is how you can isolate and form hypotheses in GeoTime.

Evidence Marshalling – assertions and competing hypotheses
As the analysis progressed, thoughts, questions, and hypotheses were capture in the Sandbox. Several evidence marshalling methods were used.

One of the major questions that arose from the analysis was “Who made the phone calls to Switzerland?” A few hypotheses were made to determine who was most likely the caller and what the motive was for making the calls and doing that covertly. Evidence from the dataset as well as arguments and conclusions derived from the analysis so far were used in the assertions to support or refute the theories.

Figure 16 Assertions: The green bars represent supporting evidence while the red bars represent refuting evidence. Selecting a piece of evidence will highlight it through all assertions. Here the access to City Hall on weekends was supporting evidence for all the assertions and thus was not really diagnostic. The analyst used emphasis to encode the low diagnosticity.

Similar methods were used to answer questions like was the research conducted at Boynton Labs fraudulent, if it is, whether some or all Council member knew and even planned for it, etc.

One of the arguments that support Boynton Labs is fraudulent is the similar events between the lab and Von Ryker’s Institute of research. To further solidify the argument, a template of the events at Von Ryker Institute was made and applied to the timeline of events at Boynton Labs.

Figure 17: Boynton’s Events Timeline before templates are applied.

Figure 18: Events from Von Ryker’s Institute of Research used as template. Words were added to the template to further train the system to get better automatic placement of the Boynton Labs events into the structure of the Von Ryker Institute events.

Figure 19: nSpace automatically place the fragments from the original groups into the new groups and the empty group showed that the two cases are extremenly similar, the biggest difference being that Boynton Labs did not close down, yet anyway.

Similarly, to determine whether the motivations for being involved in a fraudulent lab, templates of motivations for research fraud were applied to individual player’s profile and it was observed that Von Ryker and Sanderson have financial motivations while Boynton had reputation motivations.

Collaboration Same-Time Same-Place in GeoTime and in the Sandbox
During the course of this analysis, various people lended their mind. That was possible without everyone having to explore everything since nSpace and GeoTime support collaboration. Playing key events through time in GeoTime quickly brought a colleague up to speed with the overall story. Since the Sandbox provides an explicit representation of much of the analyst thinking, this facilitated presenting the analysis and susciting specific feedback on particular hypotheses.

TOC: Who – What – Where – Debriefing - Process – VIDEO – 2 page summary


Figure 13: All phone log records.	Figure 14: Weekend phone log records