Page 429 - Handbook of Modern Telecommunications

3-220 CRC Handbook of Modern Telecommunications, Second Edition

• Provides cost reduction, implementation speed
• Preferred when above criteria are relevant
In case of in-band, traffic separation should be supported. Traffic shapers could take this responsibil-
ity. A dedicated band is always preferable for better security solutions.

3.8.8 Receiver Applications
LEAs or outsourcers are the receivers. They are expected to take advantage of collected data. It is assumed
that they may access all necessary data collected and maintained by telecommunications service pro-
viders. The nature of applications under consideration, the time of activating, executing and evaluating
data, and interpreting results are very different. Both targeted surveillance and strategic observations
are supported. This is a very dynamically changing area with many new applications. But in most cases,
suppliers of such applications do not market them aggressively. They are rather interested in playing the
role of a professional outsourcer to LEAs.

3.8.8.1 Support for Recognizing Criminal Activities
3.8.8.1.1 Search for Criminal Activities
This activity belongs to strategic surveillance due to the fact that there are no specific targets at the
beginning. The observation of communication directions and paths, and evaluating contents of various
applications may narrow down potential targets. Altogether, large amounts of data must be evaluated,
filtered, analyzed, sorted, classified, and selected in order to find conclusions about individuals, groups,
locations, and suspect activities.

3.8.8.1.2 Communication Analysis
In order to collect actionable intelligence, in-depth analysis of communication activities is required. It
does involve the correlation of time stamps, locations, communication relationships, authentications,
directions, communications forms, and volumes. As techniques for support, location tracking, geo-
graphical information systems, and data mining are under consideration.

3.8.8.1.3 Content Analysis
In order to collect actionable intelligence, in-depth analysis of communicated content is neces-
sary. It does involve the analysis and correlation of application identification, language recognition,
speaker recognition and identification, word spotting, topic recognition, optical character recog-
nition, logo recognition, and image recognition. Both text-based and audio-based analysis is fre-
quently used.

3.8.8.1.4 Automated Intelligence Support
Content is created from both text- and audio-based documentation elements. Results are generated by
combining and correlating multiple inputs, such as faxes, TIFF files, image files, eDoc files, HTTP, e-mail,
chat, and sound files. Figure 3.8.10 shows such a combination and correlation example (Axland 2004).
In a further step, languages and speakers may be recognized by using combined intelligence.
3.8.8.2 Analysis Procedures and Tools
Intercepting and collecting communications is just the beginning. This raw information must be ana-
lyzed and turned into actionable intelligence that can be used to further the investigation and seek con-
viction of the offenders. Intelligent analysis tools help both telecommunications service providers and
LEAs extract the important information from the intercepted data, find patterns and relationships, and
apply it more effectively to decisions affecting the entire criminal case.
The following types of tools are important for intelligently analyzing intercepted data.