Entry Name: TUE-Elzen-MC3

VAST Challenge 2014
Mini-Challenge 3

Team Members:

Stef van den Elzen

Eindhoven University of Technology and SynerScope B.V.

s.j.v.d.elzen@tue.nl

PRIMARY

Paul van der Corput

Eindhoven University of Technology

p.n.a.v.d.corput@tue.nl

Martijn van Dortmont

Eindhoven University of Technology and SynerScope B.V.

m.a.m.m.v.dortmont@tue.nl

Roeland Scheepens

Eindhoven University of Technology

r.j.scheepens@tue.nl

Kasper Dinkla,

Eindhoven University of Technology

k.dinkla@tue.nl

Student Team: YES

Team Number: 53

Streaming User ID: s.j.v.d.elzen@tue.nl

Analytic Tools Used:

Custom text analysis tool developed by team members

Custom streaming control center tool developed by team members

Approximately how many hours were spent working on this submission in total?

240 hours

May we post your submission in the Visual Analytics Benchmark Repository after VAST Challenge 2014 is complete?

YES

Video: TUE-ELZEN-MC3.wmv

Questions

Please note - this challenge contains a question that is time-dependent. Within 3 hours of starting the final data stream, send an email to VASTChal2014MC3@vacommunity.org containing your answer to question MC3.1. Please include a copy of your answer to MC3.1 in your final answer form also. Your answers to MC3.2 and MC3.3, along with your video, are due July 8.

The responses to these questions should be incrementally built, as you (the contestant) acquire information from each streaming data segment you receive.  Your submission will answer these questions in consideration of all of the streaming data segments.

MC3.1 - Within 3 hours after start the final data stream, send an email to VASTChal2014MC3@vacommunity.org containing:

a. An image showing the streaming data in your visual analytics tool. In this image, identify an event of interest that you intend to investigate further.

b. The content of the final message in the data stream

Attached a screenshot of our prototype. The event of interest we would like to investigate further is the hostage situation. In particular the identity of the persons in the van, both the hostages and kidnappers. This could potentially be related to the disappearances of the GAStech employees.

The content of the final message in the data stream was:

mbdata 2014/01/23 [21:32:00]

gardener4958

RT @KronosStar There has been an explosion from inside the apartment building. Several people are down. #KronosStar #DancingDolphinFire #AFDHeroes

Attachment 1: Screenshot of our prototype with two screens. The left part shows all incoming messages which are automatically categorized. Messages can be investigated further in our text analyzer shown in the right part.

MC 3.2 - Describe the timeline of up to five major events that you discover in the streaming data. This timeline should include information from all three segments of the data stream if needed.    Use specific microblog records and call center data to support your description, but do not simply mimic back the data stream.  Provide a concise description of important participants, locations and durations.  Focus your response on the events themselves, rather than on the individuals reporting the events. Please limit your answer to no more than ten images and 1500 words.

In short, the main events that happened during the evening on January 23 were the following:

(1) The POK Rally took place at the Abila City Park from 17:00h to 19:00h.

(2) The Dancing Dolphin apartment building caught fire at about 18:30h.

(3) Several accidents involving a black van were reported in the South-East of Abila, starting at 19:20h.

(4) The black van was trapped by the police at 19:40h and it appeared that the two drivers had two hostages in the back of the van. Gunshots were fired, and at least one police officer was shot. In the end, at 21:15, the kidnappers (a man and a woman) surrendered. The hostages (two women) were unharmed.

(5) At 21:30h, the time the fire at the Dancing Dolphin is almost under control, there is an explosion.

Below is a detailed overview of the events with the participants, locations, and durations involved. References are made to messages to support the description. The content of these messages is below the descriptions. The POK Rally is considered not relevant for the disappearance of the GAStech employees, but we do analyze the events at the Dancing Dolphin and the suspicious black van.

Fire and explosion at the Dancing Dolphin [18:30h - 21:00h]

The Dancing Dolphin is an apartment building at the intersection of the Achilleos and Madeg street [2], and has 6 floors of which the two top levels are under construction. At 18:25h residents began to smell something [1], and eventually called the fire department at 18:38.

The fire department arrived at 18:47 [2], and rescued the last resident who was trapped on the 3rd floor at 19:02h [4]. The fire department found it hard to get the fire under control and had to expand the evacuation area later on [5].

The fire was so intense that one of the firefighters got injured and had to be rescued himself [6]. At 20:40h the fire suddenly escalated [7], and just when it seemed to be under control, an explosion was reported [8].

The suspicious black van [19:20h - 21:15]

At 19:20 a reckless riding van with partial license plate L829 [12] hit a car and a bicyclist in the South-East of Abila [10, 11]. A couple of minutes later, the police started a pursuit [12]. The van was spotted several times according to the call center data (SUSPICIOUS OCCUPIED VEHICLE-BLACK VAN).

Based on these messages, we have drawn a possible route which is shown in Figure 1. The van was eventually blocked by the police at 19:40h, however, there seemed to be hostages involved and the driver did not want to surrender [14]. At the same time bullets were fired between the driver and the police, and one police officer was shot. A SWAT team comes in at 20:00h to negotiate with the driver [15], but this did not result in a quick surrender. At 21:00h, the driver stepped back in the van and started to fight with his partner [16]. After 7 minutes, they surrender by dropping their guns. The kidnappers appeared to be a man and a woman, and the hostages were two women.

Figure 1: The track that the suspicious black van followed from the first micro blog message till it was blocked by the police at the Gelatogalore. The pink dots indicate locations from which the micro blog messages were sent.

MESSAGES:

[1] 18:25:00, GreyCatCollectibles: Smell something funny upstairs - wish this renovation work would get finished!

[2] 18:47:00, AbilaFireDept: Abila Fire Department on the scene of Dancing Dolphin fire at Achilleos & Madeg assessing the extent of the fire #AFD

[3] 18:45:47, AbilaPost: second floor of six of the Dancing Dolphin appears engulfed in flames #AbilaPost

[4] 19:02:00, martaflores: Thank Abila Firefighters for saving me! #AFD

[5] 19:26:13, KronosStar: The fire marshal has decided to evacuate additional buildings. #KronosStar #DancingDolphinFire

[6] 20:05:00, AbilaPost: injured firefighter is pulled from the flames #AFD #AbilaPost

[7] 20:40:00, InternationalNews: Dancing Dolphin Fire has suddeny escalated. #abila #IntNews

[8] 21:30:00, AbilaFireDept: Abila Fire Department reports an explosion at the Dancing Dolphin fire at Achilleos & Madeg #AFD

[10] 19:20:00, hennyhenhendrix: Some moron in a black van just hit my car!

[11] 19:21:01, brewvebeenserved: Oh no!! That crazy driver hit a guy on a bike outside our shop!!

[12] 19:23:54, AbilaPoliceDepartment: Abila Police Department issues description of hit and run vehicle: a black van with partial license plate L829 #APD

[13] 19:40:22, megaMan: Better than expected - cops block van at Gelato. Moving to get a better view.

[14] 19:58:13, protoGuy: dude in the van says he's gonna shot a hostage if they dont let him go

[15] 19:55:00, AbilaPost: #APD SWAT team has arrived at the scene of the stand off at Gelatogalore at Alexandrias and Ithakis?#AbilaPost

[16] 21:01:00, panopticon: the screaming guy is back in the van looks like hes in there screaming too - fighting with his partner maybe?

MC 3.3 – Select one of your five major events from question MC 3.2 that you consider to be most likely to provide additional clues to the investigation of the GASTech disappearances.   Describe the roles of the participants.  Describe how other events you identified in MC3.2 may have influenced your selected event. Provide a hypothesis and evidence as to whom you suspect as being directly involved in the GAStech disappearances, either as perpetrators or victims.  Please limit your response to no more than five images and 500 words.

Hypothesis: We believe the kidnappers are five employees of the Security Group: Osvaldo, Bodrogi, Ferro, I. Vann, and M. Mies. We suspect them of abducting Barranco (CFO), Campo-Corrente (CIO), Strum (COO) and Vasco-Pais (ESA) (and possibly Dedos). As supporting evidence, we have the following observations:

- They email to each other with POK propaganda (ARISE) (see MC1)

- They have all close connections (family ties) to POK members. (see MC1)

- They live very close to each other, except for M. Mies. (see MC2)

- They structurally visit several places in Abila that no other GAStech employee visits. (see MC2)

- They visited as the only GAStech employees the home addresses of the missing GAStech executives. (see MC2)

Furthermore, we suspect that several managers were targets of either kidnapping or assault. As evidence for this, we have:

- A police report stating an ASSAULT IN PROGRESS in front of Onda’s home at 17:25h. (see Figure below)

- The explosion at the Dancing Dolphin residence where both Bergen and Ovan live (both group managers) (see Figure below).

- Dedos is possibly also kidnapped because he is visited like the executives by the possible perpetrators. (see MC2, and Figure below)

Based on the van incident, we also suspect that the female kidnapper is Ferro, because this is the only female within the group of possible kidnappers. Also, as both abductees are female, we believe that these must be Barranco and Campo-Corrente. This means that both Strum and Vasco-Pais are still held hostage, possibly at one of the structurally visited places mentioned earlier.

We have reasons to believe that the security employees are responsible for the fire at the Dancing Dolphin. Maybe something did not go according to plan, causing them to be in a hurry leading to unnecessary accidents such as hitting a car and a bicyclist. In between causing the fire and the accidents the suspects may have picked up two of the hostages from the nearest suspicious locations (C, D and possibly E). Location E could also have been used as preparation for the fire/explosion caused in the Dancing Dolphin.