Oculus Info – nSpace and GeoTime

VAST 2007 Contest Submission

Authors and Affiliations:

Lynn Chien, Oculus Info, lynn.chien@oculusinfo.com

Annie Tat, Oculus Info, annie.tat@oculusinfo.com

Patricia Enns, Oculus Info, penns@oculusinfo.com

Winnifred Kuang, Oculus Info, wkuang@oculusinfo.com

Tom Kapler, Oculus Info, tkapler@oculusinfo.com

Bill Wright, Oculus Info, bill.wright@oculusinfo.com

Student team: [  ] YES  [X] NO 

Tool(s):

GeoTime and nSpace are two novel visual analytic applications that have been developed in collaboration with analysts and ARDA / DTO to support the investigation of large and complex datasets. GeoTime supports the visualization and analysis of entities and events over time and geography [2] and is currently in transition to deployment for analysts to use on a day-to-day basis. nSpace is used for triaging massive data and for analytical sense-making [1], [3], and is currently undergoing experimental evaluation with NIST and other government agencies.

nSpace combines the multi-dimensional linked views found in TRIST (The Rapid Information Scanning Tool) with the visible, cognitive mechanisms of the Sandbox. Analysts work with TRIST to triage their massive data and to extract information into the Sandbox evidence marshalling environment. The Sandbox is a flexible and expressive thinking environment that supports both ad-hoc and more formal analytical sense making.

GeoTime improves perception of entity movements, events, relationships, and interactions over time within a geospatial (or any conceptual) context. Events are arrayed in time along time tracks, which are located wherever events occur within the spatial plane. For analysts, GeoTime's single view representation of a combined temporal-spatial three-dimensional space amplifies concurrent cognition of entity relationships and behaviours in both space and time [2].

Data set used:   [X] RAW DATA SET     [   ] PRE-PROCESSED  SET

TOC:  Who – What – Where – Debriefing - Process - Video

          (ADD your links to the video – use a relative link so that it works everywhere)

1. WHO: who are the players engaging in questionable activities in the plot(s)?   When appropriate, specify the association they are associated with

*assuming the terrorist activities are illegal

2. WHEN /WHAT:   What events occurred during this time frame that are most relevant to the plot(s)? 

3. WHERE: What locations are most relevant to the plot(s)?

Follow this example layout.  Use only one-line per item.

4. DEBRIEFING

Darla Banks, a wildlife detective in South America who uncovers illegal trade in wild animals, is right when she says something rotten is going on in the tropical fish industry. After some investigations, Global Ways , an international import and export firm, seems to be a central hub in a series of misconducts surrounding animals.

The first illegal activity that is conducted through Global Ways is the transportation of cocaine through tropical fish shipments. The tropical fish originate from South America and are distributed to three different locations in the U.S. : Florida , New York , and California .

The locations for the distribution of tropical fish are demonstrated in two key pieces of evidence. First, Luella Vedric, a New York socialite, and r’Bear, a rapper in California , both reveal that they have a large tropical fish collection. Luella Vedric even openly stated that Madhi Kim supplies it. Second, in January 2004, warnings for tropical catfish shipments to Miami , Florida (one of the Global Ways reported address) are issued because the fish are covered in noxious substance. New York , California , and Florida are the three states making investigations and Global Ways is one of the companies being probed.

The fact that the tropical fish shipments contain cocaine is validated in many incidents. In September 2003, Global Ways advertises its services of shipping tropical freshwater fish from South America . A month later complaints are received by the editor of the newspaper that there is an 80% fatality rate in the fish. The cause of the deaths appears to be a noxious substance that covers the shipping bags and causes handlers’ hands to go numb.  Although Global Ways claim that the problem occurred in very few shipments, the incident occurs again in a larger scale in January 2004, as aforementioned. The symptoms resemble the symptoms of those who have come in contact with cocaine, including:

• numbing/tingling of hands
• dilated eyes
• breathing difficulty
• euphoria
• convulsions
• sometimes death.

What further establishes that the noxious substance is indeed cocaine is that British Columbian native Christopher Duane Bradley was caught at the border attempting to transport marijuana (using bears) in exchange for some cocaine in California . A little research into the method of transporting live fish reveals that there is plenty of room in the packaging to store powder cocaine, such as in the space between the thin bag and a thicker bag. Several official reports also corroborate these claims, including files in the Drug Enforcement Administration that describe creative ways of trafficking drugs, such as by hiding liquid or powder in objects and animals. Darla Banks’s report also states that illegal trade in wild animals is linked to drugs because drug cartels make use of animal fauna to transport their products.  Although there are reports generated that show chemical concerns found in fish, the concerns are only “for the potential long-term effects of eating chemically contaminated fish” [1] . The Fish and Wildlife Service (FWS), on the other hand, announced that "the source of the toxin is unknown, but it is not directly related to the imported fish themselves.” [2]

As honored guests of Madhi Kim at the “Night of Champagne and Tropical Fish”, r’Bear and Luella had expressed that they “are looking to add to their current tropical fish collections.” [3] If the tropical fish shipments are indeed packed with cocaine, then the two starlets’ keen interest definitely lies in receiving those cocaine shipments.

The motivations for importing tropical fish and drugs is profit. Rare fish alone generates a large sum of profit, as "trade in fish grows every year. At least US$ 215 million in tropical fishes are handled every year in the US ." [4] To pack drugs with fish multiplies the profit many-fold. The profit derived from the sale of rare animals and drugs is enticing and will also help supply organizations such as Wild Things and Shravaana, as demonstrated in the next illegal activity.

The second illegal activity conducted through Global Ways that’s related to animals is the smuggling and poaching of African and South American creatures. Exotic Animals from Africa are smuggled into America by Abu Hassan while Chinchillas are illegally poached in South America by Rosalind Baptista, both affiliated to Global Ways .

On the surface, Abu Hassan, or Professor Assan, runs the Assan Circus in Africa . However, every couple of months, he applies for permits to import animals into the U.S. When he received his last permit, complaints were made that he abuses animals, like chimpanzees and parrots, and smuggles them out of Africa .  His guilt intensifies when he flees the country after his animals are confiscated. His link with Global Ways is shown through his animal import permit applications. He applies for import permits through Global Ways after arriving in each African country. Suspicion is also confirmed through looking at the patterns of his imports. It can be seen that unlike most other import applications, Abu Hassan does not stay in a single place and import his animals to several locations in other countries. Instead, Hassan travels around to different countries and imports everything to one location: New York . Interestingly, Luella Vedric is located in New York and it is claimed that she is helping SPOMA track down Hassan. But if Vedric is involved with Global Ways , her efforts for tracking down Hassan becomes questionable at best; in fact, it might be even more plausible to say that Vedric is Hassan’s New York contact.

Reports reveal that smuggling operations of chinchillas out of Chile and Peru are well-financed and efficiently run and “wild chinchilla from Chile or Bolivia have become a prize possession. An individual chinchilla can fetch $700 from frenzied buyers.” [5] Images of Rosalind Baptista illegally poaching chinchillas in Chile are secretly filmed. Although there appears to be no connection between her and Global Ways , a April 2004 image of a suspicious meeting between “MN & RB” in what looks to be a Spanish speaking town is made available. It is probable that RB is Rosalind Baptista and the man is possibly Navarro Mercurio, who is registered as the Office Manager for Global Ways in Florida on the list of tropical fish importers. Although his initials would be in reverse, there are currently no other suspicious characters in this collection of data that matches these initials. It is also plausible that the reversed initial might be a result of Murcurio’s attempt to hide his name and avoid investigations. However, further exploration is needed for a definite conclusion in this matter.

Nevertheless, the motivations for Global Ways to illegally import exotic animals are abundant. Not only would the smuggling of chinchillas generate profit, Madhi Kim, the owner of Global Ways, also owns a Texas hunting ranch, Wild Things, that provides exotic animals for big game hunters willing to pay thousands of dollars. Thus, it is important for Madhi Kim to have the opportunity to acquire big game animals would help keep his ranch running. In addition, r’Bear also owns an exotic animal sanctuary named Shravaana and therefore also requires imports of these animals. It is also possible that the animal smuggling is related to drug trafficking and may be something to look into for the next step.

Although the purpose behind r’Bear’s Shravaana is to breed endangered species, his friendly relationship with Madhi Kim who evidently does not care for animals make r’Bear’s intentions suspicious. Further, r’Bear’s actions are not supported by many animal activists, who believe “r'Bear's exotic animal captive-breeding program located in Southern California works against the genetic variability necessary for species long-term survivability.” [6] And despite their different beliefs towards animal rights, two weeks after Abu Hassan fled the country, Madhi Kim pays r’Bear a visit at Shravaana. It is possible that the two may be discussing their next steps to acquire animals.

It might be ironic that r’Bear gets his just desserts for aiding in trafficking drugs and smuggling animals through his chinchillas. In July 2004, almost immediately after r’Bear announces that he recently acquired some chinchillas for his sanctuary, it was reported that he broke out in monkeypox-like symptoms. Days after his employee explains that “his face was all bumpy, and he had a fever,” reports are issued in California that a second wave of monkeypox, contracted through chinchillas, broke out. At first, his symptoms seem to match the symptoms of an individual who suddenly developed an allergic reaction to cocaine; however, further investigations indicate that his symptoms also match that of the smallpox, which means he might have contracted monkeypox, since “monkeypox…is from the same family of viruses as smallpox.” [7] r’Bear was importing chinchillas around the same time his symptoms broke out and an outbreak of monkeypox is reported not long after. Evidence suggests that the monkeypox pandemic is instigated by animal activist Cesar Gil.

Several indicators substantiate Cesar Gil as an animal activist. Cesar Gil calls himself a Chinchilla lover and is unhappy about Chinchilla being a new fad pet, especially when owners don’t know how to take care of these pets. When the new fad began, Cesar Gil begins a blog to raise awareness and becomes a breeder himself.  The blog publishes a cartoon called “Chinsurrection” in an attempt to point out the “idiocy” of the ways of the general public. In the blog, Cesar Gil claims that he’s pretty fanatical about animal rights and posts a poem that supports Jeffrey Luers, who is arrested for vandalizing car dealerships and burning SUVs. Similarly, when PetSmart stores are vandalized and ransacked by Faron Gardner and other members of the Animal Justice League (AJL), Cesar Gil reveals that “if the harm to animals can be stopped, that outweighs the wrongs of breaking a law or two.” [8]   He also reveals that he is good friends with Faron Gardner in his blog. Cesar Gil does not make any posts in May 2004 and monkeypox breaks out in mid-west in mid-May. Cesar Gil also publishes his last post talking about chinchillas frolicking happily and his Chinsurrection is “accomplished.” It would be easy for Cesar Gil to plant the monkeypox in the chinchillas since he is a breeder who sells chinchillas through his store Gil Breeders. The timeline given by his blog posts and the events that led to the outbreak of the monkeypox also places more suspicion on Cesar Gil.

Cesar Gil’s motivations are simple. Several news stories have been published about the continuing decline of chinchilla population, especially because of the new fad pet craze. It is said that " Chile had laws against trapping the animal. Now that populations have increased, poaching has increased again as well….Often half of the chinchilla smuggled out of these countries die enroute to the States. Steps must be taken to stop the decimation of the wild populations before they truly become another creature hunted to extinction" [9] It is reasonable to surmise that Cesar Gil has affected chinchillas with monkeypox, as "the monkeypox outbreak has frightened people who own chinchillas," [10] but it is questionable that a chinchilla lover like Cesar Gil would be willing to hurt chinchillas. This is also a point that must be further investigated.

Darla Banks hits the jackpot with this case. There is a network of individuals who are committing crimes and it is evident that Madhi Kim, via Global Ways , is the mastermind behind most of the illegal activities. Nevertheless, although scandals involving drugs trafficking, animal smuggling and ecoterrorism have been uncovered, there are still several inconsistencies that need to be reviewed and investigated to answer more questions. For example, is r’Bear truly an endangered animal guardian or is this a front? What is Luella Vedric’s relationship with Abu Hassan, if any? Is R.B. and M.N. really Baptista and Mercurio? And is Cesar Gil really the perpetrator behind monkeypox outbreak?

However, despite more investigation required in many areas, two things are certain: Global Ways needs to be shut down and Cesar Gil needs to be found!

5. VISUALS and Description of ANALYTICAL PROCESS

The latest versions of GeoTime and nSpace, with new advanced capabilities, were used in the analysis. GeoTime supports the visualization and analysis of entities and events over time and geography. nSpace is used for triaging massive data and for analytical sense-making.

The following is the process of analysis written in steps, where possible, to ensure ease of comprehension. Not all steps occurred consecutively and certain steps were repeated.

Brainstorming: A Look at the Dataset in the Sandbox

After reading the instructions for the scenario, the analysts wanted to brainstorm for ideas of how to begin executing the analysis. The Sandbox is a flexible and expressive thinking environment and so the analysts decided to begin there. One of the analysts dragged the contest instructions from Windows into the Sandbox to generate initial questions and keywords for querying. Using the tools, the analyst was able to save and annotate notes and thoughts while organizing the data using different layouts, as shown in Figure 1. Ideas are unrestricted and thoughts can flow freely and be recorded by pointing and typing anywhere in the Sandbox. This usage was valuable not only for the initial process but also throughout the entire analytical process.

Figure 1: Brainstorming – Instructions were imported and key questions such as “who are the key players engaging in questionable activities?” were saved. Keywords such as drugs, chinchillas, and fish were applied in the querying and document filtering process.

Querying: An Overview of the Dataset using Automatic Defined Dimensions and Entities in TRIST

The analyst next indexed the data and loaded the entire data corpus into nSpace. Not knowing any specific content within the dataset, the analysts wanted to get a general idea of the time frames and topics of the provided data.  TRIST provides rapid scanning over thousands of search results in one display, and includes multiple linked dimensions for result characterization and correlation. Without any extra work from the analysts, TRIST is able to provide a general overview of the entire dataset content with user-defined dimensions, automatic discovery dimensions, and entity extraction, as shown in Figure 2. The center results view provides multi-dimensional characterization of information objects in result sets that allows for fast, user controlled scanning. Users can construct tailored dimensions that can be brought into the analysis as desired by the analysts.

1.      nSpace is able to easily scale up to the corpus’s 1600 documents so the analyst uploaded the entire dataset into TRIST to ensure no information would be missed from the dataset.

2.      All documents that are called into the query dimension are represented by icons that indicate the file type and size to provide an idea of the nature of data at hand. A legend is provided for clarification.

3.      TRIST provides automatically defined dimensions including: Automatic Category, Date Published, Countries, Years, etc.

1. The “Date Published Dimension” groups all documents by published dates and thus provides an overview of the dataset timeline, which is from May 2003 – July 2004.
2. Automatic categories dimension groups all documents in categories using the most often occurred issues within the dataset.

4.      TRIST also displays these dimensions in three different types of visualizations: document icons, bar charts, and node and link diagrams. Node and links are mentioned in a later section.

5.      People, place, and organization entities are extracted from all the documents and can be viewed in the entity panel on the right side. Selecting a document highlights entities in the document. Alternatively, the analyst can also select an entity and see the documents containing the entity.

Figure 2: Overview - Bar chart indicates many documents are from January and February 2004. The Automatic Category shows popular themes in the dataset including fish, animals, dogs, pet, cow, wildlife, etc.

Triaging with User Defined Dimensions: Key Issues, Key Players, Key Organization, and Key Locations

The next step for the analysts is to filter out documents and entities that are irrelevant or less important for the task. This was done by the initial process of defining the key issues and then creating key players, key organization and key locations, as shown in Figure 3. With the dimensions feature, TRIST supports the exploration of data oriented to any particular line of thought. When working in collaboration, these dimensions can also be exported and saved for another analyst to modify.

1. Using keywords from the task and support files from the dataset, the analysts created a “Key Issues” dimension to group documents of interest together. The initial keywords included ecoterrorism, tropical fish, chinchilla, drugs, cocaine, heroin, transport, import, etc.
2. The analysts created more dimensions such as Key Players, Key Organizations, and Key Location. Using the entities extractions, the analyst can expand the dimensions by simply dragging and dropping important entities from the People, Organizations, and Places Entity Panel into the appropriate dimensions.
3. The analysts highlighted different bins of key issues to track all relevant associated entities and all other categories in which the documents have been placed. This method helps identify relevant entities for the task.  In later steps, the user-defined dimensions were continuously edited and expanded from further investigation by the analyst

Figure 3: When “tropical fish” bin was selected, a series of people, places, and organizations were highlighted. This involved Luella Vedric, Mr. Kim, California , New York , Florida , Global Ways , etc., and are dragged and dropped into their appropriate dimensions defined by the analysis earlier.

Scanning: Finding Relationships between Dimensions and Categories

After defining some possible key entities that may be involved in the plots and subplots, the next step the analysts took was to find relationships between the entities. Some of this information became apparent by viewing the dimensions with different visualizations available in TRIST. Using the MultiDimensions feature, as shown in Figure 4, the analysts moved two dimensions side by side for comparing dimensions and tracking relationships between them. When an analyst selects different category bins, all irrelevant documents were grayed out, leaving all documents related to the category selected stand out.

Figure 4: Global Ways is the organization selected in the lower right panel and associated documents are highlighted in the “Key Players” dimension. This included Madhi Kim, r’Bear, Luella Vedric, etc.; “Key Locations” included: California , Florida , etc.; and Key Organizations included Shravaana; and “Key Issues” included oryx, import, export, bear.

Two dimensions can be viewed together using a Node and Link dimension to visualize relationships between dimensions. By selecting two different dimensions, the analysts were able to pick out relationships between different categories in the node and link diagram, as shown in Figure 5.

A	B

Figure 5: Node and Link

A) Highlighting unmatched results showed the players who were not associated with the key issues and were later deleted from the Key Players” dimension.

B) “Tropical fish” was selected and by looking at the highlighted blue lines, it becomes evident that Global Ways is directly linked to Madhi Kim, r’Bear, Luella Vedric, and Navarro Mercurio through documents regarding tropical fish.

Collaboration: Exploring Discovered Relationships using GeoTime

When an interesting connection between two seemingly unrelated entities, i.e., Abu Hassan and Global Ways , showed in the links and nodes view, the document of interest turned out to be a database for import permit applications. One of the analysts transferred the database to GeoTime to look for patterns from the massive database, as shown in Figure 6. GeoTime improves the perception of events, relationships, and interactions over time within a geospatial (or any conceptual diagrammatic) context. Once in GeoTime, the analyst added structure and context by classifying related entities into groups. “Places”, which are normally geo-spatial locations, in this case were defined as more abstract locations in a diagram.

1. The Permit for Import spreadsheet was loaded into GeoTime, with each record of a represented as a single movement arrow, pointing from where the animal was exported (from) to were it was imported (to). This was overlaid on an abstracted diagram of countries in order to simplify the layout. The color coding of the countries was as follows: Africa=yellow, North America=blue, Central America=purple, Middle East=orange, Europe=green, Asia =red
2. The color of the movement arrows corresponds to the color of the source and destination countries. For example the permit for an animal being transported from Africa to Asia was represented as an arrow with a yellow tail and a red point.
3. Animal exporters (Permitees) and importers(Consignees)  were represented as entities in GeoTime, with trails connecting each of their respective shipping and receiving events

Figure 6: The dense cluster of activity overtop of Africa (in yellow) shows that all of the imports originate from Africa ; however, the destinations for the imports are scattered in all other continents.

In GeoTime, an overview of all exporter and importer activity was generated. Using GeoTimes link analysis tools, the history of any individual exporter can be quickly reviewed. A quick exploration revealed that Abu Hassans activity stood out as unusual, consisting of a significant amount of business in North America and several African countries. The analyst was especially interested in seeing connections between Abu Hassan and Global Ways , the results of which are shown in Figure 7.  This led to the question, “Why is Abu Hassan’s pattern different than the rest of the people?” The analyst took notes of Abu Hassan’s anomaly in Sandbox to explore these issues later.

A	B	C

Figure 7: Abu Hassan’s import pattern is different than the rest of the people.

A) The pink line is Abu Hassan moving around through African countries at different times. The blue dotted lines are the import permits he obtained, all originating from different locations in Africa but arriving in the exact same location in North America (New York exclusively).

B) Kerneels Ige stays in the same city in Africa and exports to several different areas within the same area, with one exception of the blue line to North America .

C) Isoke Gunji also stays in the same City in Africa and exports to several different areas within the same country, with the exception in North America demonstrated by the blue line as well.

Narrowing down Key Entities and Events and Generating Plots using Document Browser and Sandbox

After looking at the relationships and connections between the entities and issues in various visualizations shown in Figure 8, the analysts began reading the documents associated with the key entities and issues noted in TRIST dimensions and the Sandbox. The Document Workspace is a rich browser-based application in which the user can work directly with the document itself.  It facilitates scanning through highlighted terms and entities and allows identification of key content elements (e.g. text or images) and then saving to the Sandbox.

1. An analyst double-clicked on a document, opening the default web browser, putting the document in view.
2. All entities within a document are extracted in the Entities Pane with the number of times the word/phrase occurred in the document. The analyst selected the entities to highlight the words in the document so relevant information can be read quickly and efficiently. The highlighted entities also helped the analyst skim through documents and instantly pick out irrelevant documents.

Figure 8: An article about Madhi Kim and his relationship with r’Bear and Global Ways is in view.

Throughout the triaging process, a variety of relevant information was discovered, including key events, people, relationships, sources, etc. The analyst saved these relevant fragments of information by dragging them into the Sandbox. The text fragment in the sandbox is automatically sourced to the document and double-clicking on the text in the sandbox would bring the document into view again, as shown in Figure 9.

Figure 9: The entity Global Ways and the snippet on Cesar Gil’s connection to the monkeypox breakout seemed like important information and were sent to the Sandbox.

With snippets of text from different documents and entities dragged into the Sandbox, the analyst organized the text and entities with different tools provided in it, such as creating groups, using icons to represent different entities, drawing links to show relationships, etc. Figure 10 shows two different analysts’ understanding of the plot.

A	B

Figure 10: Two different layouts by two different analysts.

A) One of the analysts’ Sandbox notes on the plot while reading the documents. This layout also helped the analyst remember details of the plot with the document linking capability.

B) Another analyst’s Sandbox notes that show connections between the key players and their profile in a zoomed out view.

Assemble: Rearranging Entities and Activities using a Social Network Layout and Set Connections

In the previous steps, an analyst saved snippets of important players and events into the Sandbox while scanning through TRIST and reading through the documents.  These important objects gathered in the Sandbox are next used to construct meanings, interpretations, analytical frameworks, and arguments. The analyst re-organized and rearranged this saved data using various methods provided by the Sandbox, as shown in Figure 11. When important entities are found in association with one another, links are drawn and labeled to show the relationships. A structure of social network begins to take shape. The analyst arranged the entities and connected them with different lines to visually represent the different types of relationships. Notes and evidence can also be added to links and entities.

1. These lines allow the options of choosing strength, valence, and direction. Luella Vedric claims to be helping track down Abu Hassan and so a link with negative valence is drawn between them, represented by the red X. However, her claim is never substantiated by evidence and so the strength of the link is weak, represented by a thin line.
2. Similarly, the secret meeting between Nevarro Mercurio and Rosalind Baptista is not substantiated either and therefore the bidirectional link between them is also thin. Entities are then emphasized to discern the important entities and delineate the structure more clearly.

Figure 11: Social Network - Global Ways appears to be the hub of all the activities as many players are associated with the organization.

After seeing that Global Ways appears to be the hub of many events, the analyst goes back to TRIST and Document Workspace to continue following Global Ways ’s thread by making another social structure to better examine the intricate networks of Global Ways .  This time the analyst documented all the contacts Global Ways seems to have around the world, as shown in Figure 12.

Figure 12: It is apparent from this social network that Global Ways have contacts in Texas , California , New York , Africa, Florida , and South America , which corroborates the initial locations generated by the entities pane. Important images are also added.

Entities can be visually connected to each other without using actual links. Sets can be made, labeled, and color-coded. In this case, given Global Ways connections, sets are made for the possible three plots that are within the dataset: animal smuggling, drug trafficking, and ecoterrorism, as shown in Figure 13.  Entities associated with the sets are decorated with colored elements to show their connections. Color-coded bands can be set around the entities to visualize their connections with the plots. Set bands act like Venn Diagrams to make plot organizations stand out at a glance.

A	B	C

Figure 13: Sets

A) There appears to be multiple subplots, since three spheres seem to emerge around Global Ways , and sets are generated. Madhi Kim’s connection with Global Ways makes him a suspect of drug trafficking and animal smuggling; however there doesn’t seem to be evidence for a connection with ecoterrorism. On the other hand, r’Bear shows three colors in his element because it is possible that he might have caught monkeypox from chinchillas.

B) Set bands are visible and it is evident that r’Bear, Madhi Kim, Navarro Mercurio are in the thick of the plots as they are within all three colors of the Venn diagram. They may possibly be the masterminds orchestrating the events, whereas others are only involved on smaller scales.

C) Links are hidden for better visibility.

Assemble: Temporal pattern detection using GeoTime

The analysts also wanted to find out when important events took place and to see which events were associated with one another. To do this, an events timeline was created in a spreadsheet by one analyst and uploaded into GeoTime for pattern identification, as shown in Figure 14. The events were plotted with time in the vertical axis and a map is laid beneath these events. Different colored lines represent different players and the dots connecting the lines are their activities. Activities surrounding individual characters or subject matters can be isolated for a clearer view, as shown in Figure 15. Discovered patterns are noted in nSpace and hypotheses are generated and supported through these discoveries.

Figure 13: Key events in GeoTime.

A	B	C	D

Figure 15: Subject matters were isolated and events that happen around the same time are examined, generating hypotheses of linked events. Time is shown in the y-axis and location in X-axis.

A) Events surround ecoterrorism are isolated. Events that are close in proximity or overlapped are to be examined more closely.

B) Cesar Gil is represented in red and the news stories are represented in yellow. Isolating the two subjects shows that Cesar Gil started his blog about chinchillas around the same time the news announced chinchillas are the new fad pet.

C) Cesar Gil is represented in red and the news stories are represented in yellow. Cesar Gil did not blog for a month and monkeypox broke out in the mid-west within that month.

D) r’Bear is represented in green and the news stories are represented in yellow. R’Bear receiving chinchillas is an event that is immediately followed by an outbreak of monkeypox, as well as Cesar Gil’s last post indicating Chinsurrection is accomplished.

Assemble: Generating Hypothesis with Assertions

The Sandbox supported the analysts in the development and assessment of meaningful hypotheses, which were captured as assertions. These assertions make explicit the points the analysts were trying to prove or disprove. The analysts needed to find out who was involved in criminal activities. With gathered evidence, there were several possible hypotheses, including: 1) R’Bear is involved in all the Global Ways Criminal activities and 2) Madhi Kim is the Criminal mastermind.

In Figure 16, two assertions were created in the Sandbox. Evidence from the analysis, including notes, events, ideas, and concepts that support or refute these hypotheses, were continuously added to the assertion, helping weigh the strength of the hypotheses. The type of evidence (whether it is supporting or refuting) is determined when added. Dragging evidence into the assertion from the right side makes the evidence a support and left makes the evidence a refutation. The analyst was also able to change or adjust the weight, if needed.

1. Pieces of evidence that refute the assertion have a red “-“ signs on their icon
2. Pieces of evidence that support the assertion have a green “+” sign on their icon.
3. Evidence weight bar on the top of an assertion shows the strength of the hypothesis.
4. Assertions can be embedded to provide “if this is true, then that must be true” multi-hypotheses. Embedded assertions only bring weight to the parent assertion if it is proven to be positive or negative on its own.

Figure 16: Assertions – Evidence shows that the hypothesis of Madhi Kim being a criminal is stronger based on the supporting evidence marked by the number of “+” signs and the green weight bar.

Assemble: Analysis of Competing Hypotheses

Sometimes hypotheses may compete with each other and one evidence may support or refute multiple hypotheses. One of the analysts used the Analytical Competing Hypotheses (ACH) tool in the Sandbox and the ACH matrix help clarify evidence “diagnosticity” as well as diagnose most probable hypothesis. The analyst created an ACH group (in grey) with an ACH matrix, as shown in Figure 17. The diagnosticity of the evidence can be seen in both the hypotheses, shown by density of color, and the ACH matrix, shown by the order from most to least.

1. Inside the ACH group, three different hypotheses were created using assertions.

Hypothesis 1: Cesar Gil planted monkeypox in chinchillas.

Hypothesis 2: r’Bear developed allergy from cocaine exposure.

Hypothesis 3: r’Bear has the flu.

2. As evidences were assigned to the hypotheses, the evidences were automatically sorted according to the “diagnosticity” of the evidence in the ACH matrix. Ranging from top to bottom, the most diagnostic evidence item appeared at the top and the least at the bottom. The more diagnostic pieces of evidence are also darker in color in the assertions.
3. Hypotheses were also automatically sorted horizontally from left to right in the table from the strongest to the weakest.

Figure 17: ACH Matrix – From the sorting matrix, “monkeypox broke out a few days after r’Bear got sick” is located at the top because it is the most diagnostic evidence. This evidence supports one hypothesis and refutes the remaining ones. R’Bear appears most likely to have contracted monkeypox planted by Cesar Gil because it has the most supporting evidence and the least refuting evidence.

Assemble: Proving Assertions and Using Alternative Perspectives with Processing Model Templates

According to the news, there were a number of people who got sick and the analyst wanted to find out why people were getting sick. There were several possibilities and templates were used to help the analyst organize the symptoms in order to see from what illness the sick people suffered. Templates are models of processes that provide a structured framework to think about subjects of interest. nSpace allows the creation, importation and the application of models to sets of objects in the Sandbox. Normally, evidence (e.g. text fragments, observations, documents) is organized in a specific way to support the analyst's put-this-there cognition. A different model of organization can be applied to the existing evidence and the evidence will automatically re-organize to conform to a new layout.

Using supporting files provided by the task, the analyst made a template, shown in Figure 18, that contains symptoms for several chemically induced illness. The analyst then applied the
“Chemical Illness” template to the fish handlers’ symptoms to find out what chemical caused their illness, as shown in Figure 19.  The observed symptoms are automatically organized to the various illnesses, which showed cocaine as the most probable cause.

Figure 18: Chemical Illness Template

Figure 19: Chemical Illness Template applied to fish handlers with symptoms – The applied template reveals that fish handler’s sickness was most likely caused by cocaine.

When the same template was applied to r’Bear’s symptoms, most symptoms were uncategorized, which indicated a lack of evidence that strongly supports r’Bear getting sick from chemically induced illnesses. Since templates can be exported from a file and imported into a different file, a template about pandemic disease that was created by some analysts working on a different case was imported and applied, shown in Figure 20.  The “Pandemic Disease” template was then applied to r’Bear’s symptoms to see if it would be relevant, as shown in Figure 21.

Figure 20: CDC Pandemics Template

Figure 21: The “CDC Pandemics” template applied to r’Bear’s symptoms. R’Bear’s illness is most likely induced by smallpox, which corroborates with him getting monkeypox since it’s the same strain of virus.

Collaboration: Presenting and Reporting Findings – Reinforcing Analyses

As plot elements became more tangible, the visual representation and layout of the Sandbox began to match the mental model of the analyst. However, multiple analysts were working on the dataset simultaneously and often needed to get together and present their findings, as well as to verify their conclusions. nSpace supports this step of the workflow in various ways.

Dimensions and templates can be exported from one file and imported to another, as shown in Figure 22.

Figure 22: Key Issues dimension and Chemical illness templates are exported so other analysts can use them.

Presentation mode can be selected and all nSpace menu items become hidden during presentation, as shown in Figure 23.

Figure 23: nSpace is set at presentation mode so that all the menus and toolbars are hidden.

Powerful Finger can be used to temporarily emphasize material in the Sandbox even when object is at low zoom, as shown in Figure 24.

Figure 24: Darla Bank’s Profile is highlighted using powerful finger so that the analysts can view a lot of information all at once without missing the finer details.

Bookmarks allow desired views to be set and floating the Bookmarks ensure the views can be located quickly, as shown in Figure 25.

1. Double-clicking on the floating bookmark will move the screen to the desired place and zoom level
2. Sandbox thumbnails shows the entire Sandbox and highlights current location

Figure 25: Social network location is bookmarked and is quickly located.

Objects in the Sandbox can be dragged and dropped into Microsoft Word quickly and easily. Sources for text fragments are automatically added when the text is dropped into Word, as shown in Figure 26.

Figure 26: An assertion is dragged into Word and all supporting and refuting evidence, along with their sources are automatically moved into Word.

Through the collaboration of multiple analysts, the final analysis was reiteratively checked for soundness, which acted as a safeguard against flawed conclusions.

TOC:  Who – What – Where – Debriefing - Process - Video

          (ADD your links to the video – use a relative link so that it works everywhere)