Virginia Tech - Analyst's Workspace
VAST 2010 Challenge
Text Records - Investigations into Arms Dealing
Authors and Affiliations:
Christopher Andrews, Virginia Tech, cpa@cs.vt.edu [PRIMARY contact]
Alex Endert, Virginia Tech, aendert@vt.edu
Chris North, Virginia Tech [Faculty advisor], north@cs.vt.edu
Tool(s):
Analyst's Workspace (AW) is an analytic tool developed at Virginia Tech by the primary contact over the last year and a half. AW is unique in that it was developed specifically for use on a large, high-resolution display (a 10240x3200 tiled display). The goal is to provide a process-driven, integrated, spatial workspace combining foraging and sensemaking with full-size documents. Interaction is akin to working with paper documents on a desktop, with the rapid access to the textual content a primary consideration. AW is also entity aware, allowing the analyst to browse all of the identified entities in a document by name or the frequency with which they appear in the dataset. Entities are also highlighted within the document, with additional "information scent" provided through tooltips. This allows the analyst to quickly see the major people, places, organizations, etc. in a document and recognize a document more rapidly through the pattern of highlights. The tooltips provide additional information, such as the occurrence frequency of the entity, allowing the analyst to focus on following more promising leads. Interaction is also designed to be very fluid, so to pursue a lead, the analyst just had to click the entity within the document to open up a collection of documents in which the entity appears. The goal is to create a fluid environment for working with documents, supporting the analyst where possible, rather than to build a tool that is outside of the core activity of reading documents and making sense of their contents.
Video:
Analyst's Workspace videoANSWERS:
MC1.1: Summarize the activities that
happened in each country with respect to illegal arms deals based on a
synthesis of the information from the different report types and sources. State the situation in each country at the
end of the period (i.e. the end of the information you have been given) with
respect to illegal arms deals being pursued.
Present a hypothesis about the next activities you expect to take place,
with respect to the people, groups, and countries.
Thailand
Bangkok appears to be the site of an arms deal between the Russians and the Shan State Army-South. This was uncovered because our tool informed us that Boonmee was one of the most common names in the dataset. The variants of his last name were determined to be anomalies through identification of common context (arms dealing) and association with the same people. Arranging the documents Boonmee appears in temporally, we see a sequence of Boonmee (suspected arms dealer) being contacted by Arkadi Borodinski and then immediately flying to Bangkok to meet with Lim Chanarong, financial contact of the Shan State Army-South. This is followed up by a call about arrangements, and another phone call from Borodinski in January. [Figure 1: the y-axis has been used to represent time and the x-axis indicates communication].
Opening up the Borodinski entity to see where else he is involved, reveals the possible explanation for this exchange. He is associated with the Ilyshin IL-76 cargo plane, which was seized at the airport in Bangkok full of weapons. As the phone call to Boonmee occurred a couple of months following the seizure, it is possible that Boonmee is taking over arrangements following a failed deal. This is further supported by the mention of Nicolai, potentially a fellow arms dealer, by both Chanarong and Borodinski.
Yemen
The name Nicolai led us to Yemen, where he is mentioned in a conversation between Saleh Amed and a Russian. The context of the Russian and the meeting in April in Dubai, lend credence to the belief that this is the same Nicolai and that the "farming equipment" is weapons. This is further supported by examining Ahmed and finding another document connection him to Leonid and Mikhail, who we later discovered to be other Russian arms' dealers. A deal seems to have been successfully negotiated and Ahmed was set to meet the Russians in Dubai. Scanning through our entities for similar names, we find a Salah Ahmed died in Yemen shortly after the meeting.
UAE
Dubai is the site of a meeting of arms dealers in April between the 17th and the 20th at the Burj hotel. The meeting is mentioned multiple times, with many references to Nicolai being there. Giving credence to this being the same meeting and a meeting about arms. Opening up the Dubai entity led to entry points in the investigation to each of the other countries of interest.
Turkey / Syria
Celik and Hakan appear to be middle men. We have phone records of Celik brokering a deal for Baltasar in Syri who is trying purchase "textbooks". He has also been negotiating with another person in Bosnia for the purchase of "farm equipment". This seems to be two side to the same deal since there is a common connection through an April meeting in Dubai, which also lends credence to the hypothesis that both transactions are for arms. Our last information is that the deal is set to take place in Dubai.
Gaza
The Martyr's Front of Judea appear to be planning for an "event" in May 2009, for which the seem to be buying arms. We uncovered this by examining all of the references to Muhammad Kasem and Abdullah Khori, who were revealed through their discussion of being at the Burj in Dubai April 18th. Our last intelligence was that they were planning to fly out of Lebanon to Dubai after their car got stolen.
Kenya
There appears to be some smuggling of weapons through Kenya into Southern Sudan. Three arrests were made following the discovery of a large cache of weapons that appeared to have been appropriated from the Ministry Police armory. There is some hints that the MP officers are involved. A related incident is the arrival of the M/V Tanya, a ship delivering a shipment of military hardware from the Ukraine. This was coming into the port of Mombasa, identified as a key smuggling conduit for getting arms in Southern Sudan. Thabiti Otieno and Nahid Owiti appear to have been the main players in these deals, as is suggested by their arrests and the reference to "Tanya's Jewels". The pair were acquitted and then called to Dubai for the April meeting to discuss their situation. They both died shortly after.
Pakistan
Our information about centers around the Lashkar-e-Jhangvi group. We picked up the trail here through the purchase of three tickets to Dubai for the period of April 18 to the 20 by Akram Basra. Basra is the driver and bodyguard of Maulana Haq Bukhari, a suspected leader of the Lashkar-e-Jhangvi. Three tickets on the same date later turned up in the pocket of Mudassar Mausherwani for Mausherwani Azeem Bhutani and Mohammed Mengal. Bhutani is another suspected leader of the group, lending weight to the suspicion that these are the same three tickets. A financial transaction of Bukhari's also seems to have followed a path through several accounts ending up in a Russian account. This, in combination with the visit to Dubai in April leads us to suspect that they intend to buy arms from the Russians. [Figure 2: a pair of suspicious transaction streams.]
Venezuela
An unknown group is looking for a new source of weapons after their stash was raided. They worked out a deal using automotive and travel web forums. The deal appears to be with the Russians, as their contact mentions being in Dubai, and we have a financial trail that appears to move money from Venezuela bolivar's to rubles [see Figure 2]. The need seemed short, and the transaction complete, so we expect some kind of action soon.
Russia
Russia appears to be taking over as a major source of arms - seemingly involved in most of the incidents we have uncovered. The connections are both obvious (e.g., direct communications from Russians to buyers or dealers) and obscure (calls to come to Dubai, tangled financial transactions). We know that they have had some setbacks recently (the seized plane and a couple of deaths), but still have a lot of connections. They have recently closed a lot of deals and the meeting in Dubai in April appears to be the transaction point. We would anticipate this groups involvement to continue to escalate.
Nigeria
Engineers in Nigeria have siphoned off $3.6 million in misappropriated funds and have been in communication with the Russians, presumably to purchase arms. They are also intending the come to Dubai in April for the meeting.
Iran
There is a potential arms deal going on with an Iranian. The details are sparse, but he has been told to come to the Dubai meeting after some issues with the deal through Igor Sviatoslav.
MC1.2: Illustrate the associations among the players in the arms dealing through a social network. If there are linkages among countries, please highlight these as well in the social network. Our analysts are interested in seeing different views of the social network that might help them in counterintelligence activities (people, places, activities, communication patterns that are key to the network).
Thailand
Boonmee Khemkhaeng is an arms dealer who appears to have conducted an arms deal on the behalf of Arkadi Borodinski with Lim Chanaron of the Shan State Army-South [Figure 1]. Boonmee has also been seen with Nicolai Kuryakin, another suspected arms dealer. As seen in the phone intercept of january 10, Borodinski knows Nicolai (we may suspect that Nicolai recommended Boonmee, since he claims to be a friend). A further Russian connection is potentially Gunter, who is mentioned as having been "notified". This may be Georgiy Giunter, a money launderer who works in Russia and the Middle East.
Yemen
The main contact here is Saleh Amed. He mentions two associates, Haik and Aden. Haik may be Haik Hosain, a suspected Yemeni arms dealer, and Aden is likely to be Aden as-Sallal, the Yemen contact of arrest American arm's dealer Tolah Raleigh. In one conversation, the caller identifies as Mikhail Dombrovski who says he is taking over from Leonid, who is likely to be Leonid Minsky, a recently deceased Russian arm's dealer. Another conversation mentions meeting Nicolai in Dubai, so this is likely to be Nicolai Kuryakin.
Turkey / Syria
Piecing together phone numbers and names, we can identify Celik (90-242-244-8945) and Hakan(90-0212-516-90-24) in Turkey. They are setting up a deal for Baltasar (963-21-4569261) in Syria. They are also buying from someone in Bosnia at 387-33-770-731. The communication flow would seem to indicate that they are purchasing the weapons for Baltasar from the Bosnian. The Bosnian potentially has connection to the Russians since he talks farm equipment (also used in Yemen conversations) and sets the deal up to happen during the Dubai meeting. [Figure 3: the conversation flows laid out in space]
Gaza
The main players here are Muhammad Kasem, new leader of the Martyr's Front of Judea, Abdullah Khouri, and Muhammed Anka. Khouri arranged for the purchase, and Kasem and Anka took care of the other arrangements. There is a slight connection back to the Russians (the arms are Russian, and they are going to Dubai for the purchase), but as this appears to be their first contact with whoever the dealer is.
Kenya
The main players are Thabiti Otieno and his wife Nahid Owiti. Otieno is employed at the military base and was arrested with his wife and Wanjohi Onyango, a senior MP officer in connection to the weapons cache. There may also be a connection to Ita Adoyo, an MP commandant. There is a fairly strong connection back to the Russian arm's dealers evidenced through the phone call from Moscow. The call mentions their difficulties (arrests) and Tanya's jewels arriving safely (the shipment of Ukrainian weapons that was held up several months by pirates). Nicolai is also directly mentioned as wanting to meet the pair. [Figure 4: the important elements of this relationship]
Pakistan
There are several players in Pakistan, apparently members of the Lashkar-e-Jhangvi. Maulana Haq Bukhari is suspected to be a top leader of the group. He is often seen with Akram Basra, who acts as bodyguard and driver for him. Bukhari has met with several people, including Iman Ullah, who has also met with Azeem Bhutani, another suspected top leader of the group. Bhutani has been seen with a man suspected to be Madassar Mausherwani. Mauserwani was picked up for fighting and had three tickets to Dubai in his pocket: one for him, one for Bukhari, and one for a third man, Mohammed Mengal. These may be the same tickets purchased earlier by Basra. There is a vague connection back to the Russians through the travel to Dubai in April and a string of financial transactions that seem to show money laundered from Bukhari to a Russian account [Figure 2].
Venezuela
There are at least to key players in Venezuela, Jhon and Pillo. A third name, Jorge, is mentioned in connection to a raid that cleaned out their weapons cache. Jhon made contact with someone on the web forums alternately using the name jtomski and jt. This is probably a Russian since the deal is setup to take place in Dubai in April. There is also a close similarity between jtomski and joetomsk, the email address used by Mikhail Dombrovski.
Russia
The two main actors here appear to be Nicolai, who comes up in many conversation about the meeting in Dubai and Mikhail Dombrovski (7(095)230-6169, joetomsk@au.ru). Mikhail has contacted the Nigerians and Ahmed following the death of Leonid Minsky, a Russian arm's dealer (who had documents connecting him to both Nigeria and Kenya). We have already mentioned the connection between Nicolai and Borodinski. Nicolai is also mentioned in connection to Igor Sviatoslvich, a Russian gangster killed in November. Igor connects to Sattari Khurshid of Iran, who also appears to making a purchase in Dubai.
Nigeria
The main players here are Funsho Kapolalum and George Ngoki (2347093189546). These two share the same email address, so they work closely together (if they are not the same person). Their main contact is Mikhail.
Final workspace state
To show all of the various images in context, here is the final state of the workspace at the end of the investigation. [Warning, this is a large image]
