RAND-INITIATED RESEARCH CHILD POLICY This PDF document was made available CIVIL JUSTICE from www.rand.org as a public service of EDUCATION the RAND Corporation. ENERGY AND ENVIRONMENT HEALTH AND HEALTH CARE Jump down to document6 INTERNATIONAL AFFAIRS NATIONAL SECURITY The RAND Corporation is a nonprofit POPULATION AND AGING research organization providing PUBLIC SAFETY SCIENCE AND TECHNOLOGY objective analysis and effective SUBSTANCE ABUSE solutions that address the challenges TERRORISM AND facing the public and private sectors HOMELAND SECURITY TRANSPORTATION AND around the world. INFRASTRUCTURE Support RAND Purchase this document Browse Books & Publications Make a charitable contribution For More Information Visit RAND at www.rand.org Explore RAND-Initiated Research View document details Limited Electronic Distribution Rights This document and trademark(s) contained herein are protected by law as indicated in a notice appearing later in this work. This electronic representation of RAND intellectual property is provided for non- commercial use only. Permission is required from RAND to reproduce, or reuse in another form, any of our research documents. This product is part of the RAND Corporation monograph series. RAND monographs present major research findings that address the challenges facing the public and private sectors. All RAND mono- graphs undergo rigorous peer review to ensure high standards for research quality and objectivity. Out of the Ordinary Finding Hidden Threats by Analyzing Unusual Behavior JOHN HOLLYWOOD, DIANE SNYDER, KENNETH McKAY, JOHN BOON Approved for public release, distribution unlimited This research in the public interest was supported by RAND, using discretionary funds made possible by the generosity of RAND's donors, the fees earned on client-funded research, and independent research and development (IR&D) funds provided by the Department of Defense. Library of Congress Cataloging-in-Publication Data Out of the ordinary : finding hidden threats by analyzing unusual behavior / John Hollywood ... [et al.]. p. cm. “MG-126.” Includes bibliographical references. ISBN 0-8330-3520-7 (pbk. : alk. paper) 1. Criminal behavior, Prediction of—United States. 2. Crime forecasting— United States. 3. Criminal methods—United States. 4. Terrorism—Forecasting. 5. Terrorism—Psychological aspects. 6. Intelligence service—United States. 7. National security—United States. I. Hollywood, John S., 1973– II. Rand Corporation. HV6080.O97 2004 363.32—dc22 2003023703 Cover photograph by Kenneth N. McKay. The photograph is of the "Warabe- Jizo" statue in the Yusei-in Garden of the Sanzen-in Temple in Ohara, Japan. The statue is of a child bodhisattva-kshitigarbha. He is a figure from both the Hindu and Buddhist religions. Derived from the Mother Earth, he appeared in the world to help people. The RAND Corporation is a nonprofit research organization providing objective analysis and effective solutions that address the challenges facing the public and private sectors around the world. RAND’s publications do not necessarily reflect the opinions of its research clients and sponsors. R® is a registered trademark. © Copyright 2004 RAND Corporation All rights reserved. No part of this book may be reproduced in any form by any electronic or mechanical means (including photocopying, recording, or information storage and retrieval) without permission in writing from RAND. Published 2004 by the RAND Corporation 1700 Main Street, P.O. Box 2138, Santa Monica, CA 90407-2138 1200 South Hayes Street, Arlington, VA 22202-5050 201 North Craig Street, Suite 202, Pittsburgh, PA 15213-1516 RAND URL: http://www.rand.org/ To order RAND documents or to obtain additional information, contact Distribution Services: Telephone: (310) 451-7002; Fax: (310) 451-6915; Email: [email protected] Preface This monograph presents a unique approach to “connecting the dots” in intelligence—selecting and assembling disparate pieces of informa- tion to produce a general understanding of a threat. Modeled after key thought processes used by successful and proactive problem solvers to identify potential threats, the schema described in this document identifies out-of-the-ordinary, atypical behavior that is po- tentially related to terror activity; seeks to understand the behavior by putting it into context; generates and tests hypotheses about what the atypical behavior might mean; and prioritizes the results, focusing analysts’ attention on the most significant atypical findings. In addi- tion to discussing the schema, this document describes a supporting conceptual architecture that dynamically tailors the analysis in re- sponse to discoveries about the observed behavior and presents spe- cific techniques for identifying and analyzing out-of-the-ordinary in- formation. We believe the monograph would be of greatest interest to peo- ple in the homeland security community who are interested in con- necting the dots across disparate analysis groups and databases to detect and prevent terror attacks. However, it should also interest anyone who needs to monitor large and disparate data streams look- ing for uncertain and unclear indicators that, taken together, repre- sent potential risks. Thus, we can see the schema and architecture described in this paper having an application in computing security (which involves recognizing indicators of an impending cyber attack) iii iv Out of the Ordinary or in public health (which involves recognizing indicators of an im- pending disease outbreak), for example. This monograph results from the RAND Corporation’s con- tinuing program of self-sponsored independent research. Support for such research is provided, in part, by donors and by the independent research and development provisions of RAND’s contracts for the operation of its U.S. Department of Defense federally funded re- search and development centers. This research was overseen by the RAND National Security Research Division (NSRD). NSRD con- ducts research and analysis for the Office of the Secretary of Defense, the Joint Staff, the Unified Commands, the defense agencies, the De- partment of the Navy, the U.S. intelligence community, allied for- eign governments, and foundations. The RAND Corporation Quality Assurance Process Peer review is an integral part of all RAND research projects. Prior to publication, this document, as with all documents in the RAND monograph series, was subject to a quality assurance process to ensure that the research meets several standards, including the fol- lowing: The problem is well formulated; the research approach is well designed and well executed; the data and assumptions are sound; the findings are useful and advance knowledge; the implications and rec- ommendations follow logically from the findings and are explained thoroughly; the documentation is accurate, understandable, cogent, and temperate in tone; the research demonstrates understanding of related previous studies; and the research is relevant, objective, inde- pendent, and balanced. Peer review is conducted by research profes- sionals who were not members of the project team. RAND routinely reviews and refines its quality assurance proc- ess and also conducts periodic external and internal reviews of the quality of its body of work. For additional details regarding the RAND quality assurance process, visit http://www.rand.org/ standards/. v Contents Preface............................................... iii The RAND Corporation Quality Assurance Process ................v Figures .............................................. xi Tables .............................................. xiii Summary............................................. xv Acknowledgments..................................... xxvii Acronyms ...........................................xxix CHAPTER ONE Introduction ...........................................1 Prologue: Something Bad Happened on November 9th .............1 The Problem of Connecting the Dots in Intelligence ...............3 Cognitive Processes for Connecting the Dots.....................6 A Solution for Connecting the Dots—The Atypical Signal Analysis and Processing Schema ...............................12 Key Attributes of ASAP.................................16 Near-Term Implementation of ASAP .......................18 An Evolutionary Path for ASAP ...........................23 Summary of the Schema ................................23 Outline of the Monograph.................................24 CHAPTER TWO Data Analyzed in the ASAP Schema .........................27 Types of Data .........................................27 Sources of Data ........................................29 vii viii Out of the Ordinary Intelligence Networks ..................................29 Information Reported as Out of the Ordinary .................30 Information on Critical Industries .........................30 Open-Source Information ...............................31 Commercial Databases .................................32 Partitioning Intelligence and Domestic Investigative Data.........32 CHAPTER THREE The Atypical Signal Analysis and Processing Architecture ..........35 The Scope of an ASAP System ..............................35 Levels of Analysis in the ASAP Architecture.....................37 Major Functional Components Within the Architecture............39 Data Interception, Storage, and Distribution ..................39 Finding Dots ........................................40 Linking Dots ..........................................43 Generating and Testing