Fourth International Symposium "Global Security and Global Competitiveness: Open Source Solutions" Washington, D.C. November 1995

USE OF OPEN SOURCES IN THE CRIMINAL INTELLIGENCE PROGRAM OF THE ROYAL CANADIAN MOUNTED

Presented by:

Lori Schnittker Civilian Member Open Source Analysis Unit Criminal Analysis Branch Criminal Intelligence Directorate Royal Canadian Mounted Police

253 INTRODUCTION

Good afternoon ladies and gentlemen. My name is Lori Schnittker. I am a civilian member of the Royal Canadian Mounted Police (RCMP), Canada's national police force. I work in the Open Source Analysis Unit (OSAU) within the Criminal Analysis Branch (CAB) which is part of the Criminal Intelligence Directorate (CID). I am delighted to be here today to speak with you about the expanding role of open source information within the RCMP's Criminal Intelligence Program.

THE RCMP

Let me begin by clearing up some general misconceptions about the RCMP. Our members do not patrol on horseback wearing stetsons and red serge. Rather they drive police cars equipped with on-board computers which can access central databanks for information on license plates, persons, or businesses. The only police officers who ride horseback and wear stetsons and red serge are members of the RCMP Musical Ride. Red serge is generally worn only for ceremonial duties, and only by a few selected members, such as during a visit of foreign dignitaries like the Queen of England or the President of the United States.

I am a member of the RCMP, but I am not a police officer. The RCMP has approximately 22,000 employees, most of whom are sworn police officers; but, there are between 20 and 25 % who are designated civilian members. We have all of the privileges of the 'regular' members, the term we use to refer to the police officers, but we have not been issued firearms, nor do we get involved in the front lines of investigations, spend six months in the training academy, or get transferred all over the country. Civilian members perform a number of specialized functions within the RCMP including:

* processing of evidence in our internationally-respected crime labs, * analytical work - both strategic and tactical, * operation of most computer systems, and * most of the administrative functions of the force.

STRUCTURE OF THE RCMP

The RCMP is mandated to function in English and French, and in many communities officers have the ability to communicate in native languages. We are almost totally responsible for many of the functions which are handled by a number of agencies in the United States including the

254 FBI, Bureau of Alcohol, Tobacco and Firearms, U.S. Immigration and Naturalization Service, U.S. Secret Service, and the Drug Enforcement Administration. The RCMP is the national police force of Canada with responsibility for the enforcement of laws made by, or under the authority of, the Canadian Parliament. The administration of justice within the provinces, including the enforcement of the Canadian Criminal Code, is part of the power and duty delegated to the provincial governments.

There are 14 divisions of the RCMP - one in each of the two northern territories and one in each of the ten provinces, with the exceptions of and Saskatchewan, which have 2 divisions each. National Headquarters is located in the nation's capital, Ottawa, Ontario.

In eight of our ten provinces, and in the and , the RCMP is the provincial/territorial police force, under contract to the provincial/territorial governments to provide policing services to the rural areas. The RCMP. under separate policing agreements, functions as the municipal police force to 200 municipalities. Therefore, in most regions of Canada, there is only one police force responsible for enforcing municipal by-laws, provincial laws and federal statutes. Large urban areas throughout the country are policed by municipal forces, sometimes in concert with the RCMP in matters relating to major drug investigations, criminal extremism, and other federal statutes. The provinces of Ontario and have their own provincial police forces. The RCMP has no jurisdiction within these two provinces except for enforcing the federal statutes, and by special agreements, policing of the major international airports. However, the RCMP has the sole responsibility in Canada for the protection of internationally-designated protected persons.

Although Canada has a population of only 27 million people it is, geographically, the second largest country in the world. We share almost 5,000 miles of common and undefended border with the United States. Our policing responsibilities range from major urban areas to the tundra of the Canadian north; our policing vehicles range from bicycles, snowmobiles and canoes to four by fours, airplanes and helicopters.

The responsibility of providing policing under these circumstances, and under a variety of government structures, is considerable.

DEVELOPMENT OF THE CRIMINAL INTELLIGENCE DIRECTORATE

As the national police force, it is the responsibility of the RCMP to protect the citizens of Canada and the integrity of Canadian borders from national and transnational organized crime threats. Since the 1950s, law enforcement and other government agencies in Canada have been involved in an ad hoc fashion in the collection, evaluation, storage and analysis of criminal information and intelligence in varying capacities in an attempt to identify major criminals as

255 well as organized crime groups. In the early 1960s, the National Criminal Intelligence Branch was established to assume the responsibility of directing the criminal intelligence program within the RCMP in relation to organized crime. Unfortunately, over the years, this branch failed to fulfil its mandate for a variety of reasons, one of which was lack of a strong centralized information management system. As a result, various departments within the RCMP began developing their own intelligence units which led to:

* fragmentation and isolation between program areas; * duplication of effort; * lack of comprehensive policy guidelines for management of criminal information and criminal intelligence; and, * significant deficiency in strategic and tactical analytical capabilities, primarily due to an absence of proper training.

The failure of the criminal intelligence program was hindering the Force's effectiveness in managing its criminal operations program and deploying its resources to control the detrimental effects of organized crime in Canada. Without a well-developed intelligence component the law enforcement program was totally reactive. However, senior management believed that a well- developed, functioning and effective intelligence program could significantly increase the productivity of a law enforcement organization through the effective and efficient allocation of resources. They hoped that such a program would enable the RCMP to become more proactive than reactive in regards to confronting organized crime.

The current Criminal Intelligence Program of the RCMP was developed largely in response to the Air India disaster of 1985. More than 300 people, the majority of them Canadians, were killed when their plane exploded over the North Atlantic off the Irish coast. This incident is still under investigation, but its lessons have influenced how the RCMP polices on a national level.

In 1991, The Criminal Intelligence Directorate was created with the following mission statement:

TO PROVIDE A NATIONAL PROGRAM FOR THE MANAGEMENT OF CRIMINAL INFORMATION AND INTELLIGENCE WHICH WILL PERMIT THE RCMP TO DETECT AND PREVENT CRIME HAVING AN ORGANIZED, SERIOUS OR NATIONAL SECURITY DIMENSION IN CANADA, OR INTERNATIONALLY AS IT AFFECTS CANADA

In a time of increased government restraint, resources, both physical and manpower, were amalgamated from all parts of the Force. The result is a grouping of some of the top investigators in the country, some of them functioning as analysts in the divisions, complemented by civilian member analysts recruited from a variety of professions and academic backgrounds. These analysts would be equivalent to intelligence research specialists here in the U.S. The analysts, both at headquarters and in the divisions, work in teams with investigators who

256 specialize in a number of enforcement areas including organized crime, drug investigations, immigration and passport offenses, customs and excise, and criminal extremism. Most under the auspices of the Criminal Intelligence Directorate.

CRIMINAL ANALYSIS BRANCH

At the National Headquarter level, the Criminal Intelligence Directorate (CID) is comprised of 4 Branches:

1) Criminal Analysis Branch (CAB) 2) Criminal Organizations Branch (COB) 3) Security Offenses Branch (SOB) 4) Systems Services Branch (SSB)

As I am a member of the Criminal Analysis Branch (CAB), I will focus my discussion primarily on CAB. Its Mandate is:

TO EMPLOY THE INTELLIGENCE PROCESS TO PROVIDE SUFFICIENT STRATEGIC AND TACTICAL ANALYSIS AT BOTH HEADQUARTERS AND DIVISION LEVELS NECESSARY FOR IMPLEMENTING LONG RANGE ENFORCEMENT POLICY AND STRATEGIES AIMED AT CONTROLLING SERIOUS AND ORGANIZED CRIME IN CANADA

CAB is comprised entirely of civilian members under the direction of a civilian member. CAB is divided into four sections and one unit:

DRUG ANALYSIS SECTION (DAS): These analysts concentrate on issues concerning drug smuggling and drug trafficking. There are separate desks for heroin, cocaine, cannabis and chemical drugs.

GENERAL ANALYSIS SECTION (GAS): The analysts in this section address a wide variety of issues conc.rning various organized crime groups, customs and excise offences such as the smuggling of tobacco, alcohol and firearms, and illegal migration.

ECONOMIC ANALYSIS SECTION (EAS): The analysts in EAS examine issues concerning fraud such as money-laundering, counterfeiting, credit card or securities fraud, computer crime and telecommunications fraud.

CRIMINAL EXTREMISM ANALYSIS SECTION (CEAS): These analysts deal with criminal groups or issues which threaten the national security of Canada and Canadians abroad, such as right-wing extremism, left-wing extremism and environmental terrorism.

257 OPEN SOURCE ANALYSIS UNIT (OSAU): This unit provides specialized research services to the HQ Criminal Intelligence Directorate, primarily, and to Divisional Criminal Analysis Sections and other RCMP directorates, as the need arises. The primary responsibility of OSAU is to monitor open-source information for material related to CID's mandate as well as to ongoing projects and investigations in the divisional intelligence programme. Currently located in the RCMP's National Operations Centre, which operates on a 24/7/365 basis - 24 hrs. a day, 7 days a week, 365 days a year - the open source analysis unit takes full advantage of NOC's state-of-the-art equipment and exploits its multi-media facilities.

At the divisional level, there is a criminal analysis section in 12 of the 14 divisions. These sections are comprised of both civilian and regular member analysts.

STRATEGIC AND TACTICAL ANALYSIS

In the RCMP Criminal Intelligence Program analysts at headquarters provide strategic analysis to assist senior managers and managers in the field in determining manpower allocation and law enforcement focus. This strategic analysis is also provided to the field to assist in determining priorities and to provide national overviews of various crime areas. In the RCMP divisions, tactical analysts provide day to day analytical support to investigators and strategic analysts, chart division trends and contribute to national analyses of emerging concern and responsibility areas. Strategic analysis looks at the future in terms of trends and forecasts and fulfils a crime prevention function for the overall community when correctly utilized. Good intelligence provides police managers with a reliable assessment of a current crime situation and also accurate predictions of future crime conditions.

Strategic analysis gives a broader definition to targets or threats. It attempts to define criminal problems in terms of political, economic, social and legal implications, using information from investigators and a wide variety of other sources including other agencies, open information and the political, social and economic situations in other countries. Strategic analysts apply the intelligence process to identify trends, conditions and threats, to discover indicators of the need to change operational focus and tactical priorities and place a greater stress on laws, policies, strategies and programs.

Basically tactical analysis is aimed at crime that is occurring right now, today. Murders and bank robberies, credit card fraud and money laundering. What the strategic analyst is doing is taking the same information, plus a variety of open source information, and looking at the big picture - something the tactical analyst, and certainly the investigator, seldom have time to do. The big picture can show us is if we are seeing a national trend, or emerging crime groups or commodity targets.

258 In the RCMP divisions, tactical analysts provide day to day analytical support to investigators. Their responsibility is to process information collected as part of investigations and to draw conclusions from that information to support the investigation and prosecution. They identify specific targets, document specific operations and criminal acts. They also make their analysis available to strategic analysts charting and projecting crime trends. Both types of analysis are necessary for the successful operation of a police force.

Many big cases cracked by law enforcement against large crime groups owe their success to a combination of tactical and strategic analysis in support of complex investigations or joint-force operations. This is facilitated by multi-jurisdictional co-operation between police forces to detect, interdict and apprehend national, international and transnational organized crime activity.

THE INTELLIGENCE PROCESS

The intelligence process applies whether you are doing tactical analysis or strategic analysis. Intelligence is more than the initial information or raw data on which it was based -- it is the end product of information that has been subjected to the intelligence process:

· planning/direction · collection · collation/evaluation · analysis * reporting and dissemination

The intelligence process is merely a formalized method with which to gain knowledge. In the case of law enforcement, that knowledge can be utilized to develop and implement policy and/or strategy aimed at controlling criminal activity.

The absence of any of these five components of the this process could cripple the intelligence program. Each phase of the process represents equally important elements in the intelligence cycle, and there is much overlap between stages. As you plan, for example, you are already gathering data and doing analysis. As you gather data you are analyzing and probably planning your next step, especially if the information collected disproves your initial working hypotheses. And all along you are thinking of dissemination -- who could use this report?

259 OPEN SOURCE INFORMATION USE WITHIN THE RCMP

Collecting and evaluating information is phase two of the intelligence process; a very important element of the process. Jurisdictional territorialism, inter-departmental conflicts and budgetary and personnel reductions can often work together to erect some rather large roadblocks for analysts endeavouring to collect sufficient data for strategic and tactical analysis. This is where open source information can help fill in the gaps. If classified information is not available, for whatever reason, from certain parts of the country, often open source information is. Utilizing the jigsaw puzzle analogy, which I first encountered at last year's conference, open sources are the outer pieces of the puzzle, without which you can neither begin nor complete the puzzle; classified intelligence provides the precious inner pieces of the puzzle, essential to getting the whole picture. Open sources, therefore, play an important role in Intelligence.

As previously mentioned, the primary responsibility of OSAU is to monitor open source information for material related to CID's mandate as well as to ongoing projects and investigations in the divisional intelligence programme. Currently, these open sources include daily newspapers, broadcast media and computer databases such as INFOMART-DIALOG, LEXIS-NEXIS, INFOGLOBE, as well as the INTERNET.

The data collected from these sources is used to aid branches of CID, field analysts and investigators in the divisions and other directorates, other police forces and government departments in the preparation of tactical and strategic analytical reports or investigations, or criminal intelligence briefs which are presented to the senior executive of the Force or to the Solicitor General of Canada.

The Open Source Analysis Unit has been asked to research topics ranging from environmental extremist groups, to cults involved in criminal activities, to organized crime, from securities fraud to smuggling of people, weapons, liquor, tobacco or drugs. In general, RCMP members, both in the field and at Headquarters, use open information to corroborate classified intelligence, to provide historical background of a situation or issue, and to aid in establishing trends and making predictions.

Here are some recent examples of how open source analysis has been used within the RCMP.

1) Members in British Columbia had an individual in custody claiming to be part of a middle eastern group called the Al-Jihad with which investigators were not familiar. They called and asked to have an open information search conducted to uncover any mention of this group, its mandate, its origin, its leaders, or its philosophy. I conducted an open source search, primarily using the international papers in the World Library of Lexis-Nexis, and uncovered hundreds of stories, which were subsequently reviewed. My analysis of this information regarding the origin of this group, including a brief history

260 of suspected leaders of the group and suspected current activities, was provided to members in B.C. Investigators were then able to use this information to verify the information being provided to them by the individual in custody.

2) In a similar scenario, RCMP members in Ontario contacted the Criminal Analysis Branch for assistance with a case. They were developing a confidential source who claimed to be a member of a middle eastern group and involved in a variety of illegal activities. Members required information on the group and its past activities in order to corroborate the information being supplied to them by this individual. A search was conducted, again using the international papers in Lexis-Nexis, and the requested information on this group was supplied to the investigators.

3) Members have also contacted the Open Source Analysis Unit for assistance in locating information on the Internet. Most recently, members from a detachment in Ontario contacted the Criminal Analysis Branch asking for assistance in locating publications on the Internet posted by particular groups, such as left-wing or right-wing groups. A search was conducted, the desired information located on the Internet, and provided to the detachment. The Internet data proved invaluable and the investigators will continue to check the Net for these publications to develop an understanding of the philosophies of these groups and follow their agenda of activities.

4) At the beginning of the 1990s, Canada was faced with a large influx of illegal migrants from the Guangdong (Canton) province of China which brought the problem of the Big Circle Boys to Canada. The Big Circle Boys are not a gang, nor a triad. They operate as cells of four to six people who group together for particular business transactions, such as credit card fraud, heroin trafficking, car theft, counterfeiting of cheques or money. Cell A could be involved in a counterfeit money operation with Cell B at the same time that it is involved in a heroin trafficking ring with Cell G. However, once the business venture has been completed, the group dismantles and each cell continues on its separate way.

In the mid-1990s Canada is now faced with another increased influx of illegal migrants from China, but this time from a different province. The analyst responsible for this area in the Criminal Analysis Branch recently asked for an open information search concerning the Fujian province of China and Fukienese illegal migrants. Specifically, she was looking for accounts and stories of kidnapping and blackmail. For example, recently, Fukienese illegal migrants in the United States were being kidnapped and their relatives in China were being blackmailed for their release. Some of these kidnapped victims escaped safely; others were found dead by local authorities. Unfortunately, these types of problems with Fukienese illegal migrants have surfaced in Canada during the past year. Our analyst is currently looking at the trends emerging in the United States involving Fukienese illegal migrants and the involvement of Fukienese gangs like the Fuk

261 Ching, in order to project, as a strategic analyst, the issues facing Canada in the immediate future, and alert investigators and senior law enforcement officials to the problem. Both canadian and international sources, Infomart and Lexis-Nexis respectively, were used for this query.

5) The 1990s have seen the incredible growth of Eastern European organized crime on a global level as a result of the demise of the Soviet Union in 1991. Eastern European criminal organizations are no longer confined to Eastern Europe. Within the space of a few short years, Eastern European crime groups have established extensive international connections throughout Europe and are rapidly expanding their sphere of influence to North America. Canada has seen a dramatic and visible increase in Russian-based organized crime activity, particularly in the Toronto area. In response, a special Eastern European Organized Crime Task Force (EEOCTF) was established in 1993 to investigate and analyze Eastern European organized crime activity and counteract it.

Based in Toronto, this task force was comprised of RCMP investigators seconded from a variety of units and detachments representing an assortment of backgrounds and specialties including drugs, commercial crime, immigration, criminal intelligence officers and analysts, and customs and excise. All areas were covered since, at the outset, we were not certain what challenges we would be facing in the future. Since its inception, the EEOCTF has been involved in several joint force operations with other police agencies such as the Ontario Provincial Police, York Regional Police and Metro Toronto Police in the fight against Eastern European-based organized crime. The task force recently became a permanent unit within the Toronto Integrated Intelligence Unit (TIIU). The TIIU incorporates the Eastern European Organized Crime Enforcement Unit (previously the task force) and the Criminal Investigations Section, which are both strictly RCMP. It also includes a Combined Forces Special Enforcement Unit, which is a multi- agency unit.

In the summer of 1993, shots were fired at the Toronto home of Dmitri Iakoubovski, a Russian emigre who was allegedly connected to an assassination plot in Russia. Since that time, my unit has been asked to conduct several searches of open sources for the Task Force to gather information from around the world and throughout Canada about various individuals and companies, as well as the types of criminal activities engaged in by East European emigres and migrants. In the Toronto area, Russian organized crime groups have been involved in home invasions, insurance frauds, extortion, alien smuggling, gas tax scams and international theft rings. These groups are also involved in money laundering, contract killing, forgery, embezzling, black marketing, weapons smuggling, extortion, murder, prostitution, counterfeiting, car theft and narcotics smuggling. Open source research continues to be required as various investigations open up different avenues of inquiry and identify additional key players.

262 When the Task Force started they had little knowledge of the type of people they were dealing with; but, with open source material they were able to piece together various profiles and have a better understanding of the mind set of these people and their actions. Investigators and analysts have used this open information to provide historical background on the development of organized crime in Russia, before and since the downfall of the Soviet Union. They use open sources to confirm information supplied by sources, as well as to develop association charts between key players and key companies: who are they, how big are they, which companies are involved, and how are various people linked to them.

6) My final example demonstrates how bits and pieces of open information from various sources can be linked together, evaluated and analyzed, and used to produce strategic intelligence predicting potential areas of concern to law enforcement. One of the strategic analysts in Criminal Analysis Branch monitors the area of biological and chemical weapons. Early last year, I received a request from this analyst to locate all possible open source information on a poison known as ricin. In particular, he was interested in any published information on the origins of this poison, its production, symptoms, lethal dose and toxicity, as well as past uses of ricin either to assassinate persons or contaminate food or water. Ricin, extracted from castor beans, is 100 times more deadly than cobra venom. And we thought castor oil was bad. A minute quantity on the tip of a pin is enough to kill an adult human being. In addition to newspaper articles, my research uncovered several gardening articles and an OXFAM public health warning stressing the dangers of the castor bean plant. My report provided the analyst with background information on what the plant looked like, where it grew, how the poison was extracted, and how it had been used in the past as a weapon for assassinations. He used this information to alert senior management to the potential dangers of this common garden plant when it falls into the hands of criminal extremists. I would like to note that our analyst was researching this issue and its potential use as a weapon before terrorist use of chemical/biological weapons became a hot topic in the main stream media.

Earlier this year, following the sarin nerve agent attack in the Japanese subway, concern was raised about the safety of Canadian subways. Our analyst provided an intelligence brief to senior officers about the potential use of chemical and biological materials in Canada. An open source search provided him with background information on the origins, symptoms and production of sarin as well as previous incidents of sarin poisoning. This search confirmed that there is indeed information in the public domain that we would prefer was not readily available, such as the technical information needed to obtain precursors and manufacture almost any chemical warfare agent. Anyone can access this information to build a chemical weapon, providing they don't kill themselves in the process.

263 OPEN SOURCE INFORMATION SURVEY RESULTS

From these examples, it is apparent that an increasing number of RCMP members are striving to take full advantage of open source information; however, it is often limited to hard copy newspapers and magazines, and news broadcasts. During a review of the Criminal Intelligence Program in 1994, several comments were received affirming that open source information is increasingly becoming more important as a daily working tool, and inquiries were made into creating a centralized service for this type of material.

As a result of these comments, the Criminal Intelligence Directorate (CID) developed a survey to address this issue. The survey aspired to assess:

1) to what extent RCMP members in the field were utilizing open source information (OSI),

2) the attitudes of the members in the field in relation to the concept of a nation-wide news information service, centralized in one physical location, and

3) the costs associated with any current usage of open source information.

Survey results indicated that most divisions were currently utilizing open source information, but not to its full potential. There were no full time resources dedicated to monitoring open source information, most of which originated from hard copy newspapers and magazines that members perused on their own time. The Internet and commercial electronic on-line databases such as Infomart or Lexis-Nexis were used by only a few. Overall, members in the field were receptive to the concept of a centralized news service. A media monitoring working group, comprised of the Criminal Intelligence Directorate and several other program areas, has been established at National Headquarters to research the issues surrounding copyright, and to examine the possibilities of developing a centralized open source information system for access across Canada in divisions and detachments that are connected to the RCMP wide area network.

CONCLUSION

In my opinion, the use of open source material is probably the most under used resource available to the law enforcement community. As the type of investigations we deal with in this day and age increase in complexity and diversity, it is of paramount importance to understand the subject being dealt with, whether it be criminality from emerging organized crime groups or the complex area of corporate structure and finance. Open source information, specifically the media, can provide investigators with insights to be better equipped to deal with the complexities of today's investigations.

264 Like all police forces, the RCMP can no longer afford to respond to current or future problems with the solutions of yesterday. We have to continue to develop an understanding of societal issues to facilitate social change and develop and implement more proactive and long-term strategies aimed at reducing and preventing crime, rather than reacting after the fact. In conclusion, I believe that open source information is one of the solutions for tomorrow.

265 BIBLIOGRAPHY

Nicol, Wendy "The RCMP Criminal Intelligence Analyst Program" (1995). A speech presented to the International Association of Crime Analysts, Los Angeles, California.

Royal Canadian Mounted Police (1990). Criminal Intelligence Directorate Task Force Study Report, Ottawa, Ontario, Canada: Royal Canadian Mounted Police.

Royal Canadian Mounted Police (1991). Criminal Intelligence Program Implementation Guide, Ottawa, Ontario, Canada: Royal Canadian Mounted Police.

Royal Canadian Mounted Police. Criminal Intelligence Program Roles and Functions. Ottawa, .Ontario, Canada: Royal Canadian Mounted Police.

Royal Canadian Mounted Police (1995). CISC 1995 Annual Report on Eastern European Organized Crime, Ottawa, Ontario, Canada: Criminal Intelligence Service Canada.

Royal Canadian Mounted Police (1995). "A Draft White Paper outlining the framework for the development of a National Strategy and a structure to effectively combat trans-provincial and trans-national organized crime in Canada.", Ottawa, Ontario, Canada: Criminal Intelligence Directorate.

266 OSS '95: THE CONFERENCE Proceedings, 1995 Volume II Fourth International Symposium on Global Security & Global Competitiveness: O - Link Page Previous Mr. Tim Campen. Deputy Director (Technical). National Drug Intelligence Center Next Royal Canadian Mounted Police

Return to Electronic Index Page