Entry Name: giCentre-MC1

VAST Challenge 2014
Mini challenge 1

Team members:

Rafael Henkin, City University London, rafael.henkin.1@city.ac.uk PRIMARY
Alexander Kachkaev, City University London, alexander.kachkaev.1@city.ac.uk
Aidan Slingsby, City University London, aidan.slingsby.1@city.ac.uk

Student Team: NO

Analytic Tools Used:

Network visualization tool, developed internally by giCentre at City University London
Timeline and events visualization tool, developed internally by giCentre at City University London
Jigsaw, developed by the Information Interfaces Lab at Georgia Tech University

Approximately how many hours were spent working on this submission in total?

May we post your submission in the Visual Analytics Benchmark Repository after VAST Challenge 2014 is complete?

Yes

Video:

http://student.city.ac.uk/~abfc913/giCentre-MC1.mov

giCentre-MC1

Questions:

MC1.1

· Who are the leaders?

· Who is part of the extended network?

· How has the group structure and organization changed over time?

· Where are the potential connections between the POK and GAStech?

Provide novel visualizations appropriate for communicating key information to the busy leaders of the investigation. Please limit your response to no more than eight images and 500 words.

For this answer, we decided to construct a simple interactive graphical display based on a chalkboard (figure 1). Our idea was to replicate a real-life object that could possibly be used by investigators, instead of a complex interactive display that would require training. The chalkboard answers all 4 questions, with all known members of the POK and potential connections with GASTech. For each confirmed member, we marked the year they joined the POK and the date they left (when available). We identified three different leadership periods for the POK, therefore each leader is also marked with a star. One deceased member has a cross next to his name. We divided the screen into the POK and GASTech areas, with the sole member that is part of the POK and works for GASTech (Isia Vann) being the link between them. All other GASTech employees present in the chalkboard are identified as heavily (yellow) or lightly suspicious (green). It's possible to inspect each person in the chalkboard by clicking on the name, which will open a popup formatted as a handwritten card (figure 2), with personal information and known connections.
Confirmed POK members were identified using the supplied historical documents and articles, while the potential connections were identified through the emails provided or similar family names. From the emails we built a network with the messages and people participating in each message and also extracted a matrix of senders and receivers (figures 3 and 4). By reading the messages' subjects and looking for known names (such as Isia Vann) we identified potential connections such as Rachel Pantanal, who could be a target for investigators for having a possible personal relationship with Isia Vann. Employees participating in daily discussions with multiple potential POK members were not include in the chalkboard.
Figure 1:
Figure 2:
Figure 3:
Figure 4:

MC1.2After the Deadline. With the quality score we classified articles as originals. Then, through sentence pattern extraction, we identified the sources for rephrased or incomplete copies. This scheme is shown in figure 1. We were still unhappy with the way Jigsaw allows us to read time-ordered documents, so we decided to develop our own tool to read the documents, which also allows us to annotate important events along the timeline in a YAML file. By reading the timeline in this new application (shown in figures 2 and 3), we figured out the following order of events:
A reception celebrating the IPO was scheduled at the GASTech Abila HQ followed by a reception at the capitol building. At 10:15, a fire alarm goes off and the building is evacuated. At the same time, a helicopter is seen leaving the building. By noon, it's confirmed that it was a false alarm and the employees return to the building. Soon after, the police arrives at the HQ. However, none of the company directors arrive at the capitol building, only the president of the company, Sten Sanjorge. During the afternoon, the police closes the perimeter around the building and no employees leave the building again.
The directors cannot be found and kidnapping reports begin to appear at 17:00. During the afternoon, another story develops, with the jet of the CEO being spotted in Tethys and returning to Abila with unknown personnel, with reports of a second jet fueling speculations that the directors fled the country. By the end of the day, the police confirms that people are missing, but they do not confirm the kidnapping. The following morning, soon after the police announces that 10 people are missing, a ransom note attributed to the POK is released, confirming the kidnapping of the employees, but without specifying how many employees were kidnapped.
Figure 1:
Figure 2:
Figure 3:

MC1.3Provide your answer and corresponding images here. We could identify two explanations for the situation. One is that indeed a kidnapping occurred, with the members of the POK which are also security employees of GASTech participating directly. The supporting evidence is one email circulating through a small group of employees and all the events from January 20, from police actions to the ransom notice released on the next day. The fact that 10 people are confirmed missing matches the number of suspects who are employees of GASTech (6) and missing executives (4). The other possibility is a fake kidnapping used as a smokescreen for the directors to run away with company money. The supporting evidence is one piece of rumour released in the news and the fact that only the directors were kidnapped, with the president safely escaping and engaging in suspicious activity, flying from Abila to Tethys and back with supposed security experts.