The present invention relates and claims priority from a PCT application having serial number PCT/IL2006/000591 and filing date of May 18, 2006.
1. Field of the Invention
The present invention relates to a method and apparatus for a law enforcement monitoring center in general, and to the integration of data obtained from lawful interception with data retention reservoirs, in particular.
2. Discussion of the Related Art
Traditional lawful interception relies mainly on intercepting phone calls of known targets, for which warrants had been issued. Modern lawful interception comprises intercepting additional communication means used by the known targets, including computerized sources such as e-mails, chats, web browsing, VOIP communications and others. The process of monitoring a target includes analysis of the captured information and related meta data using a variety of technologies, displaying different data sources on the same platform, and managing the entire workflow of one or more investigators. However, all the information can be captured only for known targets through the issuance and usage of warrants.
On the other hand, traffic analysis, which may rely on a variety of communication traffic information, including data retention sources such as call detail records (CDR), IP detail records (IPDR), or data retention of any communication traffic, uses large volumes of meta data in order to deduce connections between entities, whether the entities themselves are a-priori known or not. In the lawful interception community, traffic analysis performed upon data retention sources can be used to draw meaningful conclusions related to additional targets, communication types, communication patterns, and the like. CDR, IPDR, or Data Retention of any communication traffic as collected by communication providers, and advanced data mining, analysis and visualization performed upon them, can be a powerful tool for law enforcement agencies. However, most of the data is banned due to security and privacy limitations. Only data items authorized through a warrant, which is specific to a known target can be provided to and used by the law enforcement agencies.
Thus, there is a significant gap between the available information as collected through lawful interception, as well as CDR, IPDR, or data retention of any communication traffic as collected for example by service providers, and those parts of the collected information that can be lawfully used for improving the work of law enforcement agencies.
There is therefore a need for an apparatus and method that will enable law enforcement agencies to use CDR, IPDR, or Data Retention of any communication traffic, as collected by service providers to enhance and provide insight and information to lawful interception, without violating privacy or security rules.
It is an object of the present invention to provide a novel method and apparatus for combining data collected through lawful interception, and data collected through usage of mining, analysis, or visualization tools. In accordance with the present invention, there is thus provided a method for integrating intercepted communication traffic data or communication traffic content with an at least one stored record, the method comprising the steps of receiving intercepted communication traffic data or communication traffic content from an interception source; receiving one or more stored record from a data retention source; and analyzing the stored records in association with the intercepted communication traffic data or communication traffic content. Within the method, the stored record can be a communication traffic stored record, or a non-communication traffic stored record, such as a customer record, a financial record, or a travel record. The method can further comprise a querying step for querying the data retention source or a data retrieval step according to one or more criteria. The stored record can comprises information which is a response to a query addressed to the data retention source. The method can further comprise a display step for displaying information to a user. The display step can display any one of the following: a result associated with the analyzing step, raw data, or information related to an operation performed by the user. The display step can provides graphic presentation of information, which can comprise one or more connection maps. The display step can also provide textual presentation of information. The method can further comprise an abstraction step for eliminating information from the stored records. The information being eliminated can be identifying information. The method can further comprise a formatting step for formatting intercepted communication traffic data or communication traffic content or a stored record. The method can further comprise a storing step for storing intercepted communication traffic data or communication traffic content, or a stored record. The storing step can store the intercepted communication traffic data or communication traffic content, or the stored record in a database.
Another aspect of the disclosed invention relates to an apparatus for integrating intercepted communication traffic data or communication traffic content with one or more stored records, the apparatus comprising: one or more storage devices for storing the intercepted communication traffic data or communication traffic content or the stored records; one or more servers comprising one or more engines for processing information stored in the storage device; one or more computing platforms comprising one or more display devices for displaying to a user one or more results obtained by the engines; and one or more connections to one or more service provider databases. Within the apparatus, the engines can be is any of the group of: an analysis engine; a query engine; a filtering engine; or a security engine. The apparatus can further comprise one or more interception engines for capturing one or more records from the service provider databases. The storage device can be associated with a monitoring center database or with a call detail record database or with an interne protocol detail record. The servers can be in communication with one or more databases of one or more service provider.
Yet another aspect of the disclosed invention relates to a computer readable storage medium containing a set of instructions for a general purpose computer, the set of instructions comprising: receiving intercepted communication traffic data or communication traffic content from an interception source; receiving one or more stored records from a data retention source; and analyzing the stored records in association with the intercepted communication traffic data or communication traffic content.
The present invention will be understood and appreciated more fully from the following detailed description taken in conjunction with the drawings in which:
The present invention overcomes the disadvantages of the prior art by providing a novel method and apparatus for the integration of stored records and products of analyzing the same, with data and meta data collected using lawful interception systems, and products of analyzing the same. The stored records can include communication traffic such as retained Call Data Records (CDR), Internet Protocol Data Records (IPDR), data retention of any communication traffic, or additional sources of non-communication related data including databases such as customers databases; financial records including for example transactions, accounts ownership or credit cards record; travel records including airlines, hotels, border control and additional sources or record types.
The current situation results in increasing legislation which forces service providers, such as telephone, cellular, internet, network operators, service providers, financial institutes, airlines, or other companies for higher degree of data retention than in the past. For example, it is now becoming mandatory by law in the European community countries for telephone, cellular and internet service providers to retain meta data on their systems for a fixed amount of time. The retained data comprises communication traffic stored records and generally consists of meta data related to a communication, rather than the communication itself Even partial meta data, excluding identifying details of the communicating entities, when combined with data, meta data and analyzed data collected through lawful interception can provide valuable information, without violating the security or privacy of entities for which no warrant exists that allows interception. Suppose for example, that a law enforcement investigator suspects that a person A is in contact with a person B, but no direct communication is detected when lawfully collecting communications of A and B. However, analyzing CDRs of a telephone company can show that A communicated with C, followed by C communicating with D, and D communicating with B, wherein neither C nor D are targets. Another possibility is that C and D did not communicate directly, but via additional one or more non-targets. The communication between C and D is a link that is thus unavailable to the investigators, in the case that C, D, or any other entity on the communication chain, is not a target. Thus, presenting the communication chain details, even without revealing the identities of the non-targets on the communication chain, provides valuable information to the investigator. Analyzing data from data retention sources is sometimes called traffic analysis. Fusing intercepted data or its products, with data obtained from traffic analysis, can thus enrich the understanding of an investigator, and provide important information related to targets. Displaying in a convenient, possible graphic manner the fused information may also provide an investigator with valuable information, while enabling him or her focus on those parts that are of interest for them and not be overwhelmed by access irrelevant information. Combining traffic analysis techniques can thus assist in identifying suspects based on communication patterns, identifying additional communication devices of known targets, identifying groups related to targets and relations within a group, and finding direct or indirect links between targets.
Referring now to
Referring now to
Referring now to
Referring now to
It will be appreciated by a person skilled in the art that the three examples are provided to merely demonstrate possible uses of various tools in the system, including content analysis tools on MC data 200, such as word spotting, and analysis tools such as such as I2 (www.i2inc.com) or Tom Sawyer (www.tomsawyer.com) on both MC data 200 and CDR/IPDR data 204. It will be apparent to a person skilled in the art that additional tools exist, and additional situations in which different tools and tool combinations are used to detect communications, entities and other data items relevant for the law enforcement agency.
Reference is now made to
Referring now to
Server 400 is further responsible for processing the information comprised in storage device 404, using both content analysis tools for MC DB 436 information and traffic analysis tools for data retention database 432 information and MC DB 436 information. Server 400 comprises engine components, preferably implemented as software applications or as additional computing platforms connected to server 400. The engines are designed to process information stored on storage 404. The engines comprise content analysis engines 416, which can comprise one or more content analysis tools for processing intercepted communications stored in MC DB 436, such as speech-to-text, word spotting, emotion detection, call flow analysis, and the like. Server 400 further comprises traffic analysis engines 418 for processing or analyzing meta data stored in data retention database 432, optionally in conjunction with data from MC DB 436. Such analysis can be used to reveal direct or indirect communications between targets, documents or the like, identify communication patterns, group structure or the like. Data obtained form content analysis engines 416 of traffic analysis engines 418 can be stored in storage device 404, hence the bidirectional arrow connecting server 400 and storage device 404. Another engine is display engine 422 used for constructing a display of the obtained information, which will enable a user to receive clear and yet valuable information. Alternatively, display engine 422 or parts thereof can be a part of workstation1408 or workstation2412. Yet another engine is filtering engine 424 for filtering information, designed to limit the quantity of data received by a user to a manageable level. Sometime, a user may be faced with information overflow, in which case content based information filtering can help him or her concentrate on the important parts. For example the user may ask to see only connections between targets or data items that were labeled as relevant, only items having a high certainty degree, or the like. Filtering can sometimes be viewed as limiting the number of vertices or edges in a graph as shown in association with
The disclosed invention describes methods and apparatus for combining conventional monitoring center techniques and methodologies related to lawful interception and analysis of the intercepted communications, with analysis of data collected by service providers, in order to reveal connections and communications between targets or other entities, which could not be identified otherwise. Combining traffic analysis techniques with monitoring center interception can thus assist in identifying suspects based on communication patterns, identifying additional communication devices of known targets, identifying target groups and relations within a group, and finding direct or to indirect links between targets. The disclosed methods provide a user with a high degree of flexibility, in order to let him or her concentrate on persons, communication or other entities that seem important, without losing the greater picture.
It will be appreciated by persons skilled in the art that many alternatives and variations exist to the described methods and apparatus. The distribution of the different analysis functions between the components shown in
It will be appreciated by persons skilled in the art that the present invention is not limited to what has been particularly shown and described hereinabove. Rather the scope of the present invention is defined only by the claims which follow.
Filing Document | Filing Date | Country | Kind | 371c Date |
---|---|---|---|---|
PCT/IL2006/000591 | 5/18/2006 | WO | 00 | 6/2/2006 |
Publishing Document | Publishing Date | Country | Kind |
---|---|---|---|
WO2007/135656 | 11/19/2007 | WO | A |
Number | Name | Date | Kind |
---|---|---|---|
4145715 | Clever | Mar 1979 | A |
4527151 | Byrne | Jul 1985 | A |
5051827 | Fairhurst | Sep 1991 | A |
5091780 | Pomerleau | Feb 1992 | A |
5303045 | Richards et al. | Apr 1994 | A |
5307170 | Itsumi et al. | Apr 1994 | A |
5353618 | Roper et al. | Oct 1994 | A |
5404170 | Keating | Apr 1995 | A |
5491511 | Odle | Feb 1996 | A |
5519446 | Lee | May 1996 | A |
5734441 | Kondo et al. | Mar 1998 | A |
5742349 | Choi et al. | Apr 1998 | A |
5751346 | Dozier et al. | May 1998 | A |
5790096 | Hill, Jr. | Aug 1998 | A |
5796439 | Hewitt et al. | Aug 1998 | A |
5847755 | Wixson et al. | Dec 1998 | A |
5895453 | Cook et al. | Apr 1999 | A |
5920338 | Katz | Jul 1999 | A |
6014647 | Nizzar et al. | Jan 2000 | A |
6028626 | Aviv et al. | Feb 2000 | A |
6031573 | Maccormack et al. | Feb 2000 | A |
6037991 | Thro et al. | Mar 2000 | A |
6070142 | McDonough et al. | May 2000 | A |
6081606 | Hansen et al. | Jun 2000 | A |
6092197 | Coueignoux | Jul 2000 | A |
6094227 | Guimier | Jul 2000 | A |
6111610 | Faroudja | Aug 2000 | A |
6134530 | Bunting et al. | Oct 2000 | A |
6138139 | Beck et al. | Oct 2000 | A |
6167395 | Beck et al. | Dec 2000 | A |
6170011 | Beck et al. | Jan 2001 | B1 |
6212178 | Beck | Apr 2001 | B1 |
6230197 | Beck et al. | May 2001 | B1 |
6295367 | Crabtree et al. | Sep 2001 | B1 |
6327343 | Epstein et al. | Dec 2001 | B1 |
6330025 | Arazi et al. | Dec 2001 | B1 |
6345305 | Beck et al. | Feb 2002 | B1 |
6427137 | Petrushin | Jul 2002 | B2 |
6549613 | Dikmen | Apr 2003 | B1 |
6553217 | Kundorf | Apr 2003 | B1 |
6570608 | Tserng | May 2003 | B1 |
6604108 | Nitahara | Aug 2003 | B1 |
6628835 | Brill et al. | Sep 2003 | B1 |
6704409 | Dilip et al. | Mar 2004 | B1 |
7076427 | Scarano et al. | Jul 2006 | B2 |
7103806 | Horvitz | Sep 2006 | B1 |
7441271 | Fiatal et al. | Oct 2008 | B2 |
20010052081 | Mckibben et al. | Dec 2001 | A1 |
20020005898 | Kawada | Jan 2002 | A1 |
20020010705 | Park et al. | Jan 2002 | A1 |
20020059283 | Shapiro et al. | May 2002 | A1 |
20020087385 | Vincent | Jul 2002 | A1 |
20020129140 | Peled et al. | Sep 2002 | A1 |
20030033145 | Petrushin | Feb 2003 | A1 |
20030059016 | Lieberman et al. | Mar 2003 | A1 |
20030163360 | Galvin | Aug 2003 | A1 |
20040098295 | Sarlay et al. | May 2004 | A1 |
20040141508 | Schoeneberger et al. | Jul 2004 | A1 |
20040161133 | Elazar et al. | Aug 2004 | A1 |
20040249650 | Freedman et al. | Dec 2004 | A1 |
20050094651 | Lutz et al. | May 2005 | A1 |
20050127171 | Ahuja et al. | Jun 2005 | A1 |
20060034198 | Makinen et al. | Feb 2006 | A1 |
20060072550 | Davis et al. | Apr 2006 | A1 |
20060089837 | Adar et al. | Apr 2006 | A1 |
20060093135 | Flatal et al. | May 2006 | A1 |
20080165940 | Fiorillo et al. | Jul 2008 | A1 |
20080216158 | Imbimbo et al. | Sep 2008 | A1 |
20080276294 | Brady | Nov 2008 | A1 |
20090016526 | Fiatal et al. | Jan 2009 | A1 |
Number | Date | Country |
---|---|---|
1 035 833 3 | Jul 2005 | DE |
1 484 892 | Dec 2004 | EP |
9529470 | Nov 1995 | WO |
9801838 | Jan 1998 | WO |
0073996 | Dec 2000 | WO |
0237856 | May 2002 | WO |
03013113 | Feb 2003 | WO |
03067360 | Aug 2003 | WO |
03067884 | Aug 2003 | WO |
2004091250 | Oct 2004 | WO |
Number | Date | Country | |
---|---|---|---|
20090007263 A1 | Jan 2009 | US |