VAST 2008 Challenge
Grand Challenge

Authors and Affiliations:

Jason Dalton, SPADAC, jason.dalton@spadac.com [Primary Contact]

Chris Elsaesser, SPADAC

Frank Prats, SPADAC

Ben Holland, SPADAC
Lisa Kuchy, SPADAC
Thomas Dell, SPADAC

Student team: NO

Tool(s):

1. Google Earth 4.3 Google Earth was used to create the geospatial trends for the boat landings data. Arrows displaying the migration patterns were created in Microsoft Powerpoint 2007.

2. Signature Analyst 3.0 Temporally sequenced geospatial dendrograms were created using Signature Analyst ^TM. Signature Analyst, a software product created by SPADAC Inc. (www.spadac.com) in 2002, is a geospatial predictive model that utilizes deductive modeling, empirically-based pattern discovery and extrapolating geospatial data. Statistical metrics and signatures of spatial phenomenon are created in Signature Analyst.

3. R 2.7. 2008-04-18 The variograms were created in R. R is a free software environment for statistical computing and graphics available at www.r-project.org

4. ArcGIS 9.2 The interpolated map of landing success rate using the inverse distance weighted algorithm was created using ArcGIS. ArcGIS is a geographic information system software product line, produced by ESRI in 1997 with the latest version in 2006, which has capabilities to perform spatial analyses and manage spatial data.

5. ORA Organizational Risk Analyzer (ORA) v1.9.5.2.6 and Allegro Graph were used for assessing social networks inherent in the cell phone data. ORA is provided by the CASOS project at Carnegie Mellon University. ORA is a social network analysis system and was used to compute eigenvector centrality. Allegro Graph is a semantic web graph database management and analysis system produced by of Franz, Inc. Allegro Graph was used to produce social network visualizations as well as temporal and geospatial assessments.

6. OpenSceneGraph (OSG) SPADAC visualization experts used a C++ integrated development environment with OpenSceneGraph (OSG) to synthesize the building schematic and occupant data into an animation and select static graphics. Information about OSG can be found at the project website: http://www.openscenegraph.org/projects/osg

Two-Page Summary: NO

ANSWERS:

Grand-1. What is the social network of the Paraiso movement at the end of the time period?

GrandNodes.txt

GrandLinks.txt

Grand-2. What name or names can be associated with individual activities?

Activities	Names
Leads Paraiso Movement	Ferdinando Catalano
Coordinates high level Paraiso activities.	David Vidro
Key Paraiso Lieutenants	Estaban Catalano, Jorge Vidro, Juan Vidro
Prime Suspect of DOH IED Event	Ramon Katalanow (aka Ferdinando or Estaban Catalano)
Secondary Suspects of DOH IED Event	Maxwell Lopez, Marcelle Vigil, Carlos Vidro
Persons of Interest of DOH IED Event	Max Valdez and Montae Quintana
Paraiso Wiki Page Editor	Victoria V.

Table 1: Activities of Paraiso Members

Grand-3: What is the geographical range of the Paraiso Movement and how does it change over time?

The geographical range, or evolution of the Paraiso movement is best represented in the boat data of migrants between 2005 and 2007. We are assuming that most migrants are Paraiso members as this migration was precipitated by both an increasing crack down of the Isla del Sueño government on the movement, and also the appeal of the movement’s tenets (according to the wiki page heavily edited by Paraiso supporters) among elements of the populations in South Florida, and across the Caribbean.

We used a temporal variogram (which shows to what extent a set of points becomes more or less similar in time as they get farther away in space) to analyze the overall space-time correlation in the landings data as seen in (Figure 1). The variogram gave us an indication as to whether or not there is a significant relationship between time and space, and to what extent. Figure 1 shows a low variance (i.e. dissimilarity) at short distances and a progressively higher variance up until around 1.5 decimal degrees (around 165 KM) when the slope of the curve starts to flatten out. We can thus infer that there is a significant space-time correlation up to around 165 km away from a given landing site.

Figure 1: Temporal Variogram of Migrant Boat Landings, 2005-2007

Next, a temporally sequenced geospatial dendrogram (which shows clusters of points with time stamps in geographic space) were created using a hierarchical clustering algorithm in SPADAC’s Signature Analyst program to analyze local clusters of landings by year. In contrast with the variogram, the dendrogram focuses on local (yearly, and by geographic region) patterns of space-time clustering. The time stamps are indices which correspond to a given time. In this case, an index of 1 corresponds with 01/01/05 while an index of 441 corresponds with 12/31/2007. By examining the time stamps on each individual node, we were able to discern whether or not a noticeably large proportion of values in a given time period are in a given region. For example, under the spatial cluster of Northern Cancun on the left side of Figure 2, the majority of the index values for the individual nodes were greater than 300, which means that most of the landings in that region took place in 2007.

Figure 2: Geospatial dendrogram using temporally sequenced landing events from 2005-2007

Another visual analytical tool that we used to find local geo-temporal patterns in the data is a proportional symbol migration map in Figure 3. The thicknesses of the arrows are proportional to the number of landings in a given area. This enabled us to coherently visualize the magnitude of the number of landings in comparison with where they occurred.

Figure 3: Proportional Symbol Migration Map: 2005, 2006, 2007

Geo-Temporal Characteristics of the Landings Sites – The Picture of Paraiso’s move to the U.S.

2005 Most landings in 2005 occurred around Miami and the Florida Keys, as seen by the arrows in the top left of Figure 3. This is expected, as the Florida Keys are geographically closer to Isla Del Sueño than the rest of Florida, and are therefore more convenient and safer for attempted landings. There are a relatively low number of landings that year with only 46 landings occurring in 2005. That number would increase dramatically (129 in 2006, 266 in 2007) over the next 2 years as the migrants expanded their geographic extent of migration. This increase was most attributable to increasing pressure from the government on the Movement's followers and leadership as well as the U.S. “wet foot, dry foot” policy for Isla del Sueño migrants

2006 There were fewer landings around Miami although much of the travel was still in the Florida Keys vicinity. Landings started to occur near Cancun as well as parts of southwest Florida. From May 2006 to October 2006, landings began to take place farther north on the west coast of Florida around Tampa. This trend starts up again from February 2007 to October 2007. The landings gradually shift away from the Florida Keys due to the proportionally large number if interdictions there that same year in this area. This forced the migrants to adjust their planned landing locations, assuming that they adjusted their routes to avoid the patrols. Furthermore, the USCG is less likely to patrol areas farther north like Tampa which are more difficult and dangerous for the migrants to get to from Isla Del Sueño. There is a clustering of boat landings in Cancun, which occurred from April to November. The fact that this destination became popular may be because the USCG does not patrol there and Mexican immigration rules may be more permissive. It is also likely that migrants simply switched to using Mexico as a land bridge to the U.S. as they perceived the probability of interdiction greater on the water near Florida than crossing the U.S. - Mexican border. All landings during this time period occurred on Isla Muerjes, near Cancun.

2007 The majority of landings happened in Cancun, and farther north along the east and west Florida coasts as compared with previous years (especially 2005). Between March 2007 and September 2007, many landings took place along the east coast of Florida (not including Miami). It is only during this time that there is activity near Daytona Beach and the rest of the central east coast. Between February 2007 and August 2007 there were widespread landings near Cancun (notice the thickness of the arrow pointing there on the bottom of Figure 3), and after this period the activity there drops off significantly, as is consistent with the trend of increasingly fewer landings in the fall and winter as compared with the spring and summer months. In 2007, for instance, the average number of landings per month from October through March was 7.8, as compared with 36.5 from April through October.

Grand-4: How do the major beliefs of the Paraiso movement affect their activities?

1) Video:

Get the Flash Player to see this player.

2) Debrief:

Ferdinando Catalano began the Paraiso Movement in 1992. The social network of the Movement’s leadership model reflects a central leadership similar to the base family unit that dominates Catalano’s philosophy. Based on the four main tenets of the Paraiso doctrine, Catalano:

· Strives to be the autonomous leader of his movement and ultimate authority (like a man in his household governing his family.)

· Controls through a small group of individuals, all male. It is a fraternal organization.

· Rejects the government’s authority to regulate any condition on a family member without the male head of household’s agreement. The individual and thus the movement are at odds with any government authority.

· This conflict is specifically manifested in regards to public health services where fraternal approval for medical contact is required and where key medicines to combat and control communicable ailments are forbidden. This tenet is the key motivation for possible Paraiso involvement in a 9/9/06 incident involving Department of Health (DOH) intervention and confrontation and a 9/19/06 shooting of six doctors and nurses.

Paraiso members begin migrating to the U.S. in 2005. A crack down by the Isla del Sueño government increases this migration in 2006 and 2007. The spread of the members and propaganda efforts of the Movement lead to a spreading of the Paraiso ideology throughout the Caribbean, Mexico, and Florida.

An IED attack takes place on a U.S. DOH building in Florida during 8/07. We discerned that a Ramon Katalanow is the attacker from a reconstruction of the attack using RFID card data of all building occupants at the time. Three other individuals exhibit suspicious behavior. We hypothesize that the attack group could be comprised of one the Catalano and one the Vidro brothers from the Movements leadership. Information provided and an examination of cell phone communications indicates that Ferdinando’s close communication network of individuals and leadership of the Movement are:

Activities	Names
Leads Paraiso Movement	Ferdinando Catalano
Coordinates high level Paraiso activities.	David Vidro
Key Paraiso Lieutenants	Estaban Catalano, Jorge Vidro, Juan Vidro

A similarity in names from persons who escape from the DOH building with the above are:

Activities	Names
Prime Suspect of DOH IED Event	Ramon Katalanow (aka for Ferdinando or Estaban Catalano)
Secondary Suspects of DOH IED Event	Maxwell Lopez, Marcelle Vigil, Carlos Vidro
Persons of Interest of DOH IED Event	Max Valdez and Montae Quintana

By examining the migrant landing and interdiction records we discover the following about similarly named individuals;

· Eduardo Catalano tried to reach the US by boat, but was interdicted twice on 8/1/05 and 7/4/06. He succeeded on 2/23/07 in reaching Cancun.

· Jesus Vidro tried to reach the US by boat, but was also interdicted twice on 8/1/05 and 7/4/06. He also landed on 2/23/07, the same day, location, and boat as Eduardo Catalano.

· Benedicto Vigil landed in the U.S. on 6/24/06.

· Lopez and Katalanow do not match any of the family names from the passenger list of encounters, interdictions or landings.

We deduced that Eduardo Catalano and Jesus Vidro are of higher interest in that they could each be one of the brothers comprising the Paraiso leadership, but travelling under aliases. We would suggest that Ramon Katalonow and Carlos Vidro, from the list of DOH building occupants, be detained for further questioning and investigation. Katalonow should be detained for his actions in the DOH facility. Katalanow and Vidro should be detained for their respective potential relationships to the Eduardo Catalano, Jesus Vidro, and the Paraiso Movement. We would suggest an effort be made of immigration records to see if the Eduardo Catalano and Jesus Vidro ever entered the U.S. and particularly Florida. We would suggest that Maxwell Lopez, Marcelle Vigil, Max Valdez and Montae Quintana be investigated for their potential connection to the Paraiso Movement; Lopez and Valdez for their suspicious behavior in the DOH building; Valdez and Quintana since they may be related to potential Paraiso migrants also identified on the migrant boat data.

3) Detailed Answer:

Ferdinando Catalano began the movement in 1992. The social network of the movement’s leadership model reflects a central leadership similar to the base family unit that dominates his philosophy. Based on the four main tenets of the Paraiso doctrine as presented in the wiki, its organization exhibits the following characteristics:

· Catalano strives to be the autonomous leader of his movement and ultimate authority (like a man in his household governing his family.)

· He probably prefers internal disputes be resolved first at their level of origin, but he retains ultimate authority to change the resolution should he not agree with the outcome, or decision.

· Leaders with authority throughout the organization will be men, not women. Women likely perform key functions, but do not hold key positions.

· Since the movement rejects the government’s authority to dictate family behavior, the individual and thus the movement is at odds with any government authority.

o A 9/9/06 wiki entry of DOH intervention and confrontation. (No other confirming information)

o A 9/19/06 wiki entry to the shooting of six doctors and nurses. (No other confirming information)

o The 8/07 IED attack on a US DOH building in Miami, Florida.

A good understanding of the leadership social network of the Paraiso Movement was gained by using a variety of network analytics. Though some leaders appear to have migrated out of Isla del Sueño in 2007, the Movement’s leadership social network structure on 10 June 2006, is likely the same by the time of the Department of Health (DOH) IED attack. Greater changes in the Movement’s macro social network surely occurred as there was significant migration – transforming from a localized island group to be dispersed to areas throughout the Caribbean, Mexico, and the U.S. from 2005 to 2007. Besides the geospatial migration patterns discussed in Grand 3 and the Movement’s basic emphasis on the paternal family, there is little detailed information to make further explicit network connections on a larger scale beyond the leadership level model.

Social Network Identification of the Leadership Using Analysis of Cellular Communications

Beginning with the intelligence of medium confidence provided that Person-200 was Ferdinando Catalano, we generated a link chart of Person-200’s social network based on calls he made and received. That small network is shown in Figure 4.

Figure 4: Social Network of Person-200 (suspected Ferdinando Catalano)

We next examined the call volume between Person-200 and the others in this network, as well as the eigenvector centrality (or “authority”) and connects-group ranks for each of these persons. That information is presented in Figure 5. Combining this information with the intelligence provided, we deduced the following identities:

· Person-1 has the top ranking in Eigenvector Centrality as well as 4^th in Connects Groups. Consequently, we believe Person-1 to be David Vidro, who coordinates high level Paraiso activities.

· Person-2 and Person-3 are likely Juan Vidro and Jorge Vidro, but we are uncertain which is which.

· Person-5 is likely to be Estaban Catalano based on the intelligence that Ferdinando Catalano most frequently calls his brother.

Network Change Detection

Notice in Figure 5 that the key individuals made and received no calls from Person-200 after 6/7/2006. The handset 200 remained active, albeit at a much lower frequency, until 8:18 p.m. on 6/9/2006 and the other key handsets were in use all 10 days. One explanation for this change in communication patterns is that the organization’s leadership started transitioning to different handsets on or about 6/8/2006.

Figure 5: Call frequency with Person-200 and his network

Our method for detecting handset changes is first to plot eigenvector centrality of each of the key handsets. That plot, shown in Figure 6, indicates a simultaneous drop in Eigenvector Centrality on 6/8/2006. This led us to conclude that it is likely all five individuals acquired new phones the evening of 6/7/2006 or early morning of 6/8/2006. Their new identifiers would likely be among those that had an Eigenvector Centrality spike on 6/8/2006. These were identified by finding which identifiers had a high standard deviation in their Eigenvector Centrality scores across the 10 days. The original identifiers (1, 2, 3, 5 and 200) had a high standard deviation, as did five other handset identifiers: 300, 306, 309, 360, and 397. Figure 4 shows spikes in Eigenvector Centrality for these handsets beginning 6/8/2006.

To determine who is who of the new identifiers, two techniques were used. First, we compared Eigenvector Centrality. This was especially useful in associating Person-1 with Person-309, since both have the top Eigenvector Centrality scores. Second, spatial analysis was used to compare which cell towers the identifiers were spending most of their time near and to find similarities between the old identifiers and the new identifiers. Per day average was used for the comparison since they were not spread across the same amount of days in the data. By comparing the per day averages the old and new identifiers could easily be associated with one another.

Figure 6: Eigenvector Centrality by day for initially identified handsets.

Figure 7: Eigenvector centrality by day for handsets subsequently used by leadership.

Using this information, we plotted the one-hop social network of Person-300 who we think is Ferdinando Catalano who we previously identified as Person-200. That network, which is the social network of Ferdinando Catalano at the end of the ten day period, is depicted in Figure 8. Notice the similarity to the network in Figure 4; with the exception of a few unidentified persons, the networks are nearly identical in structure.

Figure 8: Catalano social network at end of the period.

Using social network analysis, visual analytics, and geospatial correlation, we conclude with moderate confidence that the Catalano network is as depicted in Figure 8. There is some uncertainty due to the initial intelligence and anomalies in the data.

DOH IED Attack

We then focused on the above family names to discover matches of key figures in the Department of health (DOH) building during the August 2007 IED attack. Our visualization expert used a C++ integrated development environment with OpenSceneGraph (OSG) to synthesize the building schematic and occupant data into an animation of the event. We examined the tracks of employees and visitors to the building from the RFID data provided

Based on an analysis of the movements, we believe that Ramon Katalanow [21] (possible alias for Ferdinando or Estaban Catalano) is the individual who detonated the IED, since he traverses the area of the first two victims just before moving to a safe position before detonation. Maxwell Lopez [29] moves to the southeastern corner of the building. He almost runs into Karissa Graham [44] and adjusts his path as if to avoid her. His behavior could indicate that he distracted some building occupants (2; 44; 27; 81; 16) so that Ramon Katalanow could detonate the IED without interference. Marcelle Vigil [13] and Olive Palmer [59] were following similar paths. Vigil is a witness (and a suspect) with regard to why Palmer stopped moving suddenly. Carlos Vidro is also present in the DOH building at the time. He immediately exits the lower left of the screen soon after the probable detonation time. He is named as a person of interest because his family name is a possible match of Paraiso members who may have migrated from Isla del Sueño. The suspects and persons of interest for this event are shown in their initial positions in Figure 9.

flipbook_frame00

Figure 9: Prime Paraiso suspects for IED bombing of DOH facility

Boat Landings

We then compared the family names of Catalano (Katalanow), Lopez, Vigil, and Vidro from the both the cell phone and DOH building strings against the passenger names from the boat ‘encounter’ list of passengers to discern any matches. Most of these passengers are assumed to be Paraiso members as many in the Movement was migrating from Isla del Sueño at this time. Those with female first names were dropped as there were none with associated family names in the DOH building as were those names associated only with interdictions and no landings.

· Eduardo Catalano tried to reach the US by boat, but was interdicted twice on 8/1/05 and 7/4/06. He succeeded on 2/23/07 in reaching Cancun.

· Jesus Vidro tried to reach the US by boat, but was also interdicted twice on 8/1/05 and 7/4/06. He also landed on 2/23/07, the same day, location, and boat as Eduardo Catalano.

· Benedicto Vigil landed in the U.S. on 6/24/06.

· Lopez and Katalanow did not match any of the family names from the passenger list of encounters, interdictions or landings.

We then compared last names of others in the DOH building at the time of the IED explosion with the boat encounter list. No significant associations were found from the matches below.

· Eloy and Gotzone Valdez both landed on 7/11/07 at Cancun, probably travelling together.

· Archibaldo Valdez arrived in the U.S. on 6/13/06.

· Rey Valdez landed in the U.S. on 7/16/05.

· Galeno Quintana landed near Cancun 8/12/06.

· Montae Quintana landed near Cancun 6/5/07.

Figure 10: Landing and Interdictions of Interest

We deduced that Eduardo Catalano and Jesus Vidro are of higher interest in that they could each be one of the brothers comprising the Paraiso leadership, but travelling under aliases. Even though this would geographically displace the leadership social network it would not necessarily change its structure. We did not weigh any particular importance to dates as the two individuals of primary interest had tried two times before to reach the U.S. together.

Wiki Page

In addition to the Paraiso movement using pirate radio programs for mass communication, it also tries to control a Wiki page. An original hypothesis was that the wiki may serve as some form of internal communications for the Movement. Analysis of wiki entries does not support this. Wiki user profiles and names were examined for similarities to Ferdinando Catalano’s leadership node and that of the suspects in the DOH bombings. No content indicates the context providing directions to the movement, individuals, or actions.

Of the 40 active editing participants on the site for the data given, 14 can be classified as pro-Paraiso, 13 neutral, and 13 anti-Paraiso. This evaluation was done by a qualitative comparison and interpretation of the entry content and its tone. The most dominant pro-Paraiso figure in the editorial process of the wiki is “VictoriaV” It can only be speculated if her family name is Vidro, or Vigil. The two other most frequent editors are “Amado” and “Sara”. These two appear to work often as a team in editing, but their respective affiliations to Paraiso cannot be accurately determined from these entries, although Amado seems more pro-Paraiso and Sara more neutral. Based on the information available, “Victoria V.” is listed in the major activities section with propagating the Movement’s message, but has no other linkage into the leadership’s social network.