A unit with a national remit is trying to put useful intelligence in the hands of a wider operational pool

Data analytics used to be the preserve of specialists. This was not just a notion based on skills but on layers of restricted access that meant that only some officers and staff within police forces and law enforcement agencies had access to PND intelligence reports or that only certified financial investigators could have access to Suspicious Activity Reports (SARS).

But to achieve the goal of a digitally enabled police service this mindset needs to change if legal and procedural safeguards can be put in place around widening access to the vast ‘data lakes’ that exist within policing. 

For example SARS are not only provided by banks but by casinos, bookmakers and auction houses and are not simply restricted to financial information. The reports also contain IP and email addresses and other personal details.

It is no longer the case that only accredited financial investigators who work within Economic crime units can access the reports. Financial Intelligence Administrators (FIAs) can also now view them as long as they have undergone the relevant training which only takes a day to complete..

The drive to widen the pool of intelligence available to law enforcement is being driven by a unit within the National Crime Agency.

The National Data Exploitation Capability (NDAC) unit is a key part of the intelligence command within the NCA was set up to provide an “industrial scale data analytics” capability that could be shared across law enforcement.

Alex Campbell works for the unit. “We have created a valuable capability that allows most of the key SOC data sets to be exploited in a single place,” he told the NPCC’s National Intelligence conference this week.

He said there was “real value” in joining up SOC-specific data sets within the wider intelligence picture. It is also building new law enforcement analytics tools which require “proper reflection on what is ethically right”. 

One example is the SOC threat radar which involves exploiting data on an unprecedented scale.

It now needs to share some of those capabilities and has started some partnership projects. “Stepping up our collaborative work is key,” he says.

Organised crime is increasingly a complex environment to operate in and the NCA and wider law enforcement agencies need the capabilities to deal with its threats.

The NCA itself has inherited a disparate landscape of databases and datasets that were not integrated into a single unique platform. This is similar to the rest of law enforcement and no one deinies that more data is being acquired and collected on a daily basis.

What happens to that data is now becoming a crucial issue for police force as well as specialist officers involved in the investigation of serious organised crime. 

The amount collected by the NCA has doubled over the last five years.and large investigations require a knowledge of how criminals and their businesses operate at both a strategic and tactical level.

New capabilities are needed to understand the threat and be of use to front line officers.

“If criminals are communicating on a new platform we need to be agile in knowing how to best exploit that data, ” says Campbell.

The NDEC grew out of a function used by NCA internal teams that used to be known as DataLab. It developed a small niche capability to bring relevant intelligence together for analysis in order to produce some key capabilities for law enforcement including the ARENA portal used by accredited investigators.

“This created a pocket of knowledge on how to deal with many different data problems,” says Campbell. “At the heart of a centre of data excellence are officers who problem solve on a daily basis.”

He said in order to bring about “the type of thinking that is required” a significant amount of innovation is needed. The challenges were that the NCA did not have the standards and processes to deliver this.

NDEC has developed a series of data exploitation services. Acquiring data has been a continual challenge. Internal police data sets are notoriously difficult to adapt and transform. Many other external datasets have taken years to develop into a reliable feed.

“Often law enforcement data is complex and not built to be transferred or understood in another environment,” says Alex Campbell. “It therefore takes considerable time and money to pay for the mechanisms to make that happen.”

The NCA is fortunate in having unique legislation that applies to some of its activities and any data acquisition that may be involved. It is granted Police Act authorisations to interfere with property, for example, across the UK and internationally. It can re-use this data within a statutory framework within Section 7 of the Crime and Courts Act.

This states that information obtained for one purpose can be used for another. As an interception agency it can carry out interception on behalf of others and under its tasking powers within Section 5 of the Crime and Courts Act it can direct other UK forces.

The NCA is also exempt from Freedom of Information Act requests  which it describes as a “significance advantage” and it also has a statutory information sharing gateway that allows third parties to share data without breaching any confidentiality rules.

The agency is not required to establish any memorandums of understanding (MOUs) around information sharing.

NCA officers hold triple powers – that of a police constable, revenue and customs officer and immigration officer.

All this allows the agency to build key data initiatives within the SOC and wider UK law enforcement landscape.

“This helps us to grow capacity, tradecraft and potentially share data,” says Campbell.

It is looking to develop a service catalogue of data tools which can be shared with its partner agencies within policing and wider “so officers know what they can get and how to access those services.”

One of those services already up and running is the ability to search across 41 data sets in one single place. “That’s really vital in our efforts to make access to data as wide as possible,” he adds.

NDEC offers an automated i2-style charting based on a number of data sets. It can also automate subject profiles having worked closely with the Home Office. It can also ‘bulk match’ those data sets and as long as they don’t go over 500 million rows of data this can be done in a relatively short period of time.

The single intelligence picture

The NCA merged 19 different data sets which included its own intelligence, prison intelligence and nationally-held data on OCGs. “We mirror the rules around our core systems in the configuration of an entity,” says Campbell. “We built a strong logic for what creates a person or an address.

“This allows an analyst to see an amalgamation on screen of intelligence information from structured and unstructured material.”

The concept of a ‘golden nominal’ provides a strong base for intelligence development and the same logic is currently being used to design the NCA’s new enterprise databases and case management systems. It  is also trying to automate these feeds where possible.

But this is often a challenge as data providers within law enforcement and across government were never set up to transfer data in a smooth or efficient manner.

Nonetheless NDEC increasingly has started to import more data “which was of interest” and allowed exploitation but did not reside in a single ‘data lake.’ An example of this is communications data which is taking a significant amount of time to develop.

“Many of the barriers lay in the interpretation of the legislative framework in which this could be done,” Campbell adds. “Importantly this work identified inconsistences across the agency as to how this information was stored and retained. So the development of this activity will hopefully establish a more consistent process.”

NDEC currently receives around 500 tasks per year often to triage information for retention purposes. 

In theory all data being brought into the organisation should be stored once and exploited many times in a secure and legal manner.

Significant initial investment to the tune of £30m has enabled rapid expansion. In the last 12 months NDEC has gone from 50 staff to 123. There is a lot of investment this year on technology to support the infrastructure of NDEC’s future size.   

Its data information project is helping it acquire access to the Police National Database and digital forensic repositories.

But this is not straightforward as territorial policing has also found.  It is sponsoring an API (a computer software patch that allows two separate systems to connect) for the PND. “This is something that is close to the heart of many in the policing intelligence community,”  Mr Campbell said.   

Amanda Blakeman at the Home Office is helping to develop the project which requires a “significant amount of investment” and input from other partners including  the NPCC and CGI, the company contracted to manage the PND on behalf of the Home Office.   

The NDEC is currently running two proof of concept projects looking at CSA and county lines threat areas.

“We are looking to see how we can maximise the intelligence gained back from PND,” says Campbell. “The intention is that this API is not just of use to the NCA but for wider partners. It is challenging – there are many barriers to making a success  of this piece of work.”

They include governance, operational priorities and security “which is why progress has been sower than hoped, “ he says.

“The ambition is to ask dynamic questions of PND that use it for what is it was intended to be used for and link information that may be already held on other systems that are not automatically connected.”