The Palantir platform interacts with real geospatial and temporal information, allowing clients to easily delve into data that has been gathered on the ground. Our team, therefore, transformed the relative spatial and temporal data provided to us according to reasonable, imaginary parameters. We chose 12:00PM as “time zero”, considered each click of relative time to be 5 seconds, and set the date to August 15; we also constructed a building conforming to the layout provided and placed it in a parking lot in Miami where such a building might very well be located. The lower-left of the building was designated (0, 0), giving all (X, Y) values real latitude and longitude values. In retrospect, the clicks were probably much less than 5 seconds apart, but the scale of the timestamps has minimal impact on the investigation.

Palantir’s backend is based on a Dynamic Ontology that confers incredible flexibility and allows us to import and link nearly any kind of data without hard-coded changes. Leveraging this flexibility, our team was able to import the evacuation data, modeling each RFID report as an event and each RFID tag as a person. The tag numbers remained divorced from their associated names for initial evaluation to ensure objective analysis—adding the list of names and resolving them to existing persons based on tag number is an easy process. Our platform is also open and able to interact with a wide variety of tools, including ESRI’s ArcGIS and, in this case, GoogleEarth. We exported the reports associated with each tag number to a single KMZ file and constructed a KMZ with an imaginary building conforming to the data provided (figure 1).

Figure 1.1: Entity ‘0’ linked to all his RFID reports in the Palantir Graph Explorer

Figure 1.2 RFID 0 viewed geospatially

We were then able to analyze the evacuation as a time-lapsed animation in Google Earth: Nearly every individual in the Department of Health building begins in a room, not in the hallway. The bomb explodes or a bomb threat goes out at approximately 12:31PM in our real time metric, or between 370 and 380 on the relative timescale provided. We base this estimate on the time that individuals begin to flee the building (see figures 2.1 and 2.2 for before/after). For information on the resulting casualties, see short answer four.

Figure 2.1: before

Figure 2.2: after

Although the vast majority of RFID tags begin reporting movement around 12:31PM, several individuals begin moving much earlier. Ramon Katalanow [21], Cecil Dennison [28], Maxwell Lopez [29], Karissa Graham [44], and Cleveland Jimenez [56] are all moving long before the explosion; Lopez is up as early as 12:01PM (relative time 19). Of course, it is possible that some of this early movement was due to normal work-related activity or people leaving the building. Nevertheless, those subjects who survived from this list are good starting points for investigators. We also believe that Jimenez [56] was responsible for setting off the explosive and was a possible suicide bomber. He starts in the middle left of the building but is moving toward the right by 12:06PM (relative time 80). At relative time 331 (12:27PM though it is unlikely he spent 20 minutes crossing the building), he locks into position in a corridor on the right side of the building relatively close to most of the casualties (55.9, 28.3) and stays there until time 377 (12:31PM).

Figure 3.1: The prime suspect

Figure 3.2: The prime suspect in full context

At this point he flies forward a short distance before ceasing to move, presumably having died. This movement falls perfectly into the estimated time range of explosion based on when people start fleeing (370-380), making it highly likely that Jimenez is the bomber and was killed by his own explosion. However, one aspect of the explosion that presents some ambiguity is that most of the people in the upper-right when Jimenez died escaped from the building; it is primarily those who entered that region later (relative time 560, 12:46PM) who fill the casualty list. Examining the region where these tags began, however, produced a dead end, as there was no questionable activity prior to the explosion in the top-middle of the building. We suggest two possible explanations: first, there might be a higher than expected number of “Good Samaritans” stopping to help the injured. Second, in addition to killing individuals within a blast radius, the bomb would have created fire, smoke, and debris. People to the left of the bomb are protected by a solid block of wall, and those in the left, upper-right, and lower-right have easy access to exits; those in the upper-middle, however, are far away from both the lower-left and upper-right exits, so they would be the most likely to die as a result.

There are several important notes for an investigation going forward. First, in addition to questioning those early-movers detailed earlier who survived, several ostensibly innocent individuals were near the suspected location of the bomb or along the path of suspicious individuals, making them good witnesses. Those near the explosion site include Lindsey Bowles [1], Fawn Sparks [76] (probable casualty), and Joshua Sanchez [80]. Individuals who may have noticed something odd as suspects moved include Abel Snow [73] who may have witnessed Dennison [28] and Dian Kenney [7] / Edwardo Lassiter [11] / Jerome Culver [79] / Loretta Middleton [38] who all lay along Jimenez’s path.

Second, it is very possible that the Paraiso movement was involved with this explosion. Beyond the fact that the religion opposes state-provided healthcare, two suspicious individuals were present. Carlos Vidro [62] shares a surname with several brothers in Paraiso leader Ferdinando Catalano’s innermost circle. Although we cannot guarantee that they are related, it is entirely possible. Also, Ramon Katalanow [21] has an alternate-spelling of “Catalano” for his last name, suggesting another possible connection. Katalanow was also flagged for suspicious movement during the initial stage of analysis when only tag numbers were visible. RFID tracking combined with visual analytics has, thus, provided a springboard for a traditional investigation with much more information available to investigators.