Annie Tat, Oculus Info, atat@oculusinfo.com
Rob Harper, Oculus Info, rharper@oculusinfo.com
The main tool we used to solve this challenge was GeoTime v2.6, released in 2008 by Oculus Info. GeoTime supports the visualization and analysis of entities and events over time and geography. Events are represented within an X,Y,T coordinate space, in which the X,Y plane shows geographic space and the vertical axis represents time. Entity movements, event, relationships, and interactions over time within a spatial context can be easily seen and understood. Events animate through this 3-D space as the time is played through. For analysts, GeoTime's combined spatiotemporal display amplifies the concurrent cognition of entity relationships and behaviors in space and time. Analysts can see the who and what in the where and when. GeoTime includes keyword search, link analysis, imagery display, geometry display, annotation and numerous other analytical functions. [See Kapler, T and Wright, W. GeoTime Information Visualization, IEEE Symposium on Information Visualization 2004.]
Another system we used was nSpace2 (beta2), a web-based version of the nSpace desktop application. nSpace is an analytical tool that integrates both TRIST (The Rapid Information Scanning Tool) and the Sandbox (a flexible sense-making environment) into one single system. For this challenge, we only used the Sandbox component. We used it for brainstorming, note-taking, analytical sense-making, and evidence marshalling. nSpace2 also includes a workspace sharing environment to exchange, link and view multiple Sandboxes online created by different people. [See Wright, W., Schroh, D., Proulx, P., Skaburskis, A., and Cort, B. The Sandbox for Analysis - Concepts and Methods, paper accepted for ACM CHI 2006.]
66 x 32.25
We looked at where the majority of casualties were located and drew a transparent purple circle in GeoTime to mark this area (Figure 1.1).
 |
|
|
Figure 1.1: 2D GeoTime scene at the end, after the explosion. Each differently colored circle represents a different person. We are making an assumption that the casualties are the people that stopped moving and did not make it through the exit door after the explosion and we drew a purple circle around these people. | |
We zoomed into the area and monitored movements prior to the explosion within this circle. We found that Katalanow (red) and Jimenez (navy blue) were the only two people that moved in that area prior to the explosion (Figure 1.2). Then we looked at which casualties were the first to stop moving and we found Welsh (light orange) and Staley (purple), who were in the same room together, stopped moving first, then Sparks (light blue) and Jimenez (navy blue), who were also near by. Based on these facts, we hypothesize that the bomb was left in the room where Welsh and Staley were. This also indicates Katalanow, who was the only person that went into that room prior to the explosion and managed to escape, set off or left the explosive device there.
 | |
|
Figure 1.2: A close-up GeoTime view of movements prior to the explosion. Each differently coloured circle represents a different person and each circle's placement corresponds to a location in time. Before the explosion, Katalanow and Cleveland Jimenez appeared to be the only two people moving in this area. Katalanow was in one room on the left, then went into the room on the right and then went towards the exit. We are inferring that the device was left in the second room. The black x circle in the second room represents where we believe the device was set off. | |
Note: Potential suspects and/or witnesses are people who were near the area just prior to the explosion and exhibit suspicious behavior.
1; 13; 18; 21; 28; 39; 50; 56; 59; 76
We identified three different groups through careful examination of geo-temporal behaviors:
 |
|
|
Figure 2.1: A view of movements prior to the explosion. Each line represents a trail from a different person. Vertical lines show very little or no movement and the diagonal lines indicate movement. In this image we see that Katalanow and Dennison moved a shorter distance over a long period of time compared to Graham, Jimenez, and Lopez. The names of each individual are shown in a tooltip by placing the cursor over the trails. | |
 |
|
|
Figure 2.2: Movements just after the explosion. Time is along the z-axis where the most current time is at the bottom. Each person is represented by a different color and each circle represents a recorded position. All circles for a given person are connected in chronological order by an entity trail. Details of each person's movement are described in the detailed answer. | |
1; 13; 21; 28; 30; 44
We looked at all the suspects and witnesses found in Question #2 and filtered them as shown in Figure 3. We were able to easily identify those who left the building based on their final location.
 |
|
|
Figure 3: A view of movements some time after the explosion. The lines that are labeled are the suspects and/or witnesses who escaped the building based on their final location. | |
18; 19; 36; 39; 47; 50; 56; 59; 60; 65; 69; 76; 78
We assumed everyone that remained completely stationary inside the building after the explosion was either dead or injured. We determined who these people were by looking at straight vertical lines and their final location (Figure 4.1). There are two people that managed to escape but remained completely still awhile later as shown in Figure 4.2: Just outside the exit door, Ramon Katalanow (21) and Ulysses Hood (32) formed a straight line where the rest formed zig-zag movement. We are not sure if he is dead or injured or if he had taken off his RFID tag and left. As a result, we excluded these two people because we felt that there was not enough supporting evidence.
 |
|
|
Figure 4.1: A view of movements after the explosion with casualties in pink. A vertical line indicates no movement, thus, anyone with a vertical line is possibly dead or injured. People we think are casualties are highlighted in pink and circled in black. | |
 |
|
|
Figure 4.2: A close up view and back view of movements at the north east corner of the building. Once people were outside the building, people started forming a zig-zag pattern which might suggest panicking and pacing back and forth. Our focus here was on Katalanow and Hood, who formed straight vertical lines compared to the rest of the people. At this point, we are unsure if he is dead or injured or if he had taken off his RFID tag and left. | |
The following describes our overall approach and methodology for all the requested answers, as well as, the detailed answers describing the evacuation.
The two text files, "OCCUPANTS RFID ASSIGNMENTS.txt" and "RFID PATHWAY DATA v2.txt" were combined into a spreadsheet and imported into GeoTime. Each person was mapped as a GeoTime entity and the movement of every RFID updated record as an event. Time is shown in the vertical Z-axis, with the most recent event on the ground plane. We do not know how long time is, so we currently have one tick mapped to one second for an approximation. The movement paths are overlaid on a plan of the building, which was converted from the binary text file, "BUILDING DATA.txt". 0 was mapped as a white square block of pixels to represent space, and the 1 was mapped as grey blocks of pixels for walls. Here we found the building plan to be rectangular with four exits leading to an open area outside.
Once the data was imported into GeoTime, we were able to immediately determine when the explosion was set off by seeing a sudden change in the patterns of movement shown in Figure 5.1. Before the explosion, the majority of the occupants were not moving and most likely sitting in their offices. However, there were five people moving prior to the explosion as we see circles arranged diagonally.
 |
|
|
Figure 5.1: A view of the movements of occupants over time in GeoTime, where the most recent events are at the bottom. Each person is represented by a different color and each circle represents a recorded position. Circles that are stacked vertically indicate no movement and circles that are arranged diagonally denote movement. In this case, we were able to identify when the explosion occurred based on when the sudden change in movement occurred. We used the time slider to filter and isolate a time range of events and explore them over time. Dragging the time slider causes the movements of people to animate forward and backward in time. | |
We used a time dividing terrain (Figure 5.2) and found that the explosion occurred at ~370 ticks (~6:10 minutes in GeoTime). Right after the explosion, we see a large amount of people evacuating out the four exit doors and then remaining outside. The upper range shows normal work activity before the explosion and the lower range shows evacuation activity after the explosion.
 |
|
|
Figure 5.2: The upper range shows normal work activity before the explosion and the lower range shows evacuation activity after the explosion. Each line represents a trail belonging to one person where vertical lines show very little or no movement and the diagonal lines indicate movement. The names of each individual are shown in a tooltip by simply placing the cursor over the trails. | |
We first identify people's movements prior to the explosion and observed them in detail (Figure 2.1)
The question that comes to mind is did these potential suspects know the explosion was about to happen and had already planned an escape route or was it a coincidence that some were moving and happened to be near the exit? All these suspects were recorded in the Sandbox for further investigation (Figure 5.3).
 |
|
|
Figure 5.3: Analyzing who are the potential suspects and witnesses with the new web-based Sandbox. We used Assertion groups to weigh our hypotheses. A) Evidence that we thought supported the hypothesis was dragged in the group from the right side. B) Refuting evidence was dragged in from the left side and neutral evidence from the bottom. C) We used Links to connect to other Sandboxes for a more detailed analysis. D) The strength of evidence was adjusted depending on how strong it supported or refuted the hypothesis. E) Our final decision on whether the hypotheses were true was based on number of supporting and refuting pieces of evidence. | |
Our next step was to look for movements after the explosion. Fifty-two people left the SW exit, five people left the SE exit, two people left the East exit, and eleven people left the NE exit. By looking at the overall movement patterns, and with the aide of animation, we observed in detail individual movement patterns which clashed from the rest: Marcelle Vigil (13), Ramon Katalanow (21), Cecil Dennison (28), Phil Marin (39), and Olive Palmer (59). We recorded our detailed observations for each suspicious person in the Sandbox and questioned their behavior (Figure 5.4).
 |
|
|
Figure 5.4: : Movements of suspicious characters after the explosion. Note-taking detailed observations of each person moving inside the building and sense-making facts. | |
Next we looked at the pattern of casualty locations to approximate where the explosion took place (Figure 1.1). By looking at the final locations of the people that remained completely stationary after the explosion, and those that were not able to escape the building, we were able to assume who the causalities were (Figure 4.1). We found that almost all of the casualties remained at the North East corner of the building (Figure 1.1). We drew a transparent purple circle with the GeoTime drawing tool to focus on this area. Prior to the explosion, there were only two people that moved within this circle: Ramon Katalanow (21) and Cleveland Jimenez (56) (Figure 1.2).
To locate the exact location of the explosion, we looked at the time indices at which the casualties stopped moving. We noticed that not everyone died at the same time right after the explosion. We found Gale Welsh (18) and Lottie Staley (50), who were in the same room, were the first to freeze almost immediately after the explosion and then Fawn Sparks (76), who was in the room beside Welsh and Staley, seems to have stopped moving immediately shortly after. Cleveland Jimenez (56), who was moving previous to the explosion, stopped moving at the same place and time as Fawn Sparks. We saw this by playing the time slider animation and viewing the movements in Calendar View (Figure 5.5). Based on this, was the source of the explosion Welsh and Staley?
 |
|
|
Figure 5.5: Calendar View to investigate the order at which people stopped moving. Each line represents a trail and time goes downwards so that the oldest events are at the top. Starting from the top and moving down, when the trail becomes completely straight we may infer from the lack of oscilation that the person has stopped moving. We found Welsh's and Staley's trails were the first to turn straight, then Sparks and Jimenez. | |
To support this hypothesis, we found that Katalanow was the only person that was in the two rooms where Welsh, Staley, and Sparks were prior to the explosion (Figure 1.2) and then conveniently, Katalanow left the rooms just before the explosion (Figure 5.6). Based on these facts, we hypothesize the exact location of the bomb to be where Katalanow was located, as he stalls for a brief moment when he was inside Welsh's and Staley's room. To find more supporting evidence, we investigated Katalanow's speed of motion and speculated whether he had connections with others or not. We first tried looking at how fast Katalanow was moving in the rooms and down the hallway by looking at the slope of the trail in GeoTime. This set of observations did not yield much. We were also curious to investigate Cecil Dennison's movement in detail since he was also moving before the explosion and had the second most suspicious behavior after the explosion (Figure 5.6). The only thing we found was that Dennison moved a bit faster than Katalanow. Based on our analysis in the Sandbox, we still think Katalanow is the main suspect (Figure 5.3).
 |
 |
|
Figure 5.6: Movements of Dennison and Katalanow in the full length of time. The left image shows movements in 3D and the image on the right shows movements in 2D. The spaces between the circles show how fast he is moving, the more space in between the faster he was moving. In this case, Dennison moved a lot quicker than Katalanow. | |
Another suspicious coincidence is that Ramon Katalanow's surname sounds like Ferdinando Catalano's surname, author of the Paraiso Manifesto. If Ramon Katalanow is related to Ferdinando Catalano, then there is evidence to show incentive for Katalanow to destroy the Department of Health or to kill people working for them. If Katalanow's name is disguised it may very well be that there might be a connection between Marcelle Vigil and Vigro, an author who is also for the Paraiso Movement, based on the sounds of their last names.This may be a big stretch. However, further investigation is needed.