Identify suspects with movement analysis
Add the data
You'll start by reviewing a fictitious dataset for the area of interest: Djibouti, the capital city of the Republic of Djibouti, located in the Horn of Africa. This data contains the movement of the cellular devices and their owners throughout the day that the crime was committed. It also contains the areas of interest where the crime syndicate is known to operate.
First, you'll download the data and add it to a project in ArcGIS AllSource.
Note:
All of the data used in this tutorial is fictitious and designed for educational use only.
- Download the Camp Lemonnier Intelligence Data.
A zipped folder named Camp_Lemonnier_Intelligence.gdb is downloaded to your computer. The .gdb extension means the folder contains a geodatabase, which is a folder format for storing geographic data.
- Extract the zipped folder to a location you can easily remember, such as your Documents folder.
Next, you'll create a project in ArcGIS AllSource and add the data to it.
- Start ArcGIS AllSource. If prompted, sign in using your licensed ArcGIS account.
Note:
ArcGIS AllSource is an optional product that can be installed when you install ArcGIS Pro. To learn more about installing ArcGIS AllSource, go to the Install ArcGIS Pro documentation page. If you don't have ArcGIS Pro or an ArcGIS organizational account, see options for software access.
When you start ArcGIS AllSource, you're given the option to create a new project or open an existing one. If you've created a project before, you'll see a list of recent projects.
- Under Blank Templates, click Map.
The Create a New Project window appears.
- For Name, type Compare Areas Project. Click OK.
The project, which will contain all of the maps and data for this workflow, is created. Because you chose the Map template, the project includes a blank map.
You'll add data about cell phone locations and the areas of interest where the crime syndicate is known to operate from the geodatabase that you downloaded. Because you're going to add multiple datasets from the geodatabase you downloaded, you'll add a connection to the geodatabase so you can access all of its content more quickly, instead of searching for and adding each dataset individually.
- On the ribbon, click the Data tab. In the Add group, click Connections and choose Database and then Add Database.
The Select Existing Geodatabase window appears.
- Browse to the location where you extracted the Camp_Lemonnier_Intelligence.gdb geodatabase. Click Camp_Lemonnier_Intelligence.gdb to select it and click OK.
The geodatabase is added as a connection. You can access the connection using the Catalog pane.
- In the Catalog pane, expand Databases.
Note:
If the Catalog pane isn't visible, click the View tab on the ribbon. In the Panes group, click Catalog Pane.
The Databases folder contains two geodatabases. One is a default geodatabase (Compare Areas Project.gdb) that was created when you created the project. The other is the connection you added.
Next, you'll add the areas of interest and the cell phone data to the map from the geodatabase.
- Expand Camp_Lemonnier_Intelligence.gdb.
The geodatabase contains three feature datasets: Administrative_Data, Cell_Phone_Data, and Vehicle_Data. The Administrative_Data dataset contains the areas of interest, while the Cell_Phone_Data dataset contains the cell phone data.
- Expand Administrative_Data. Right-click Areas_of_Interest and choose Add To Current Map.
The areas are added to the map. The map extent zooms to the city of Djibouti in Djibouti, a small African nation. This city and its surrounding area is your area of interest for this workflow.
- Expand Cell_Phone_Data. Right-click Cell_Phone_Data_All and choose Add To Current Map.
The cell phone records layer is added to the map. The layer includes a large number of points (more than 1 million) concentrated around Djibouti. Each point represents the location of a cell phone at a certain point in time. Multiple points may correspond to the same cell phone as it moved throughout the day.
Note:
The color of the features in both layers is randomly generated and may differ from the example images. The difference in color will not impact the workflow.
From a quick visual inspection, each area of interest contains several cell phone records. Some areas, such at the one to the northwest, have a large number of records, while some, such as the one to the southwest, have relatively few.
You can learn more about a layer by opening its attribute table.
- In the Contents pane, right-click All Cell Phone Data and choose Attribute Table.
The attribute table appears. Attributes are textual or numeric data associated with each feature. In the table, each row represents an individual feature, while each column represents an attribute field.
This table includes fields describing the shape, latitude, longitude, and unique ID (OBJECTID) of each cell phone record. It also has a Time field, which has the date and time that the cell phone's location was captured, and a POI (person of interest) field, which identifies the person to whom the cell phone belonged. In a real dataset, the POI field would include the person's name, but because this data is fictitious, a number was used instead.
In the example image, the first four cell phone records all belonged to the same person, identified as Person-102. These records were taken on September 9, 2017, with the first record occurring at 10:19 p.m. and the fourth at 11:44 p.m.
- Close the table.
Track cell phone records in areas of interest
Now that you've added the data to the map, you're ready to perform analysis on the three areas. These areas are the known locations where a crime syndicate operates. People who have a lot of activity in these areas may be connected to the crime syndicate. By running the Compare Areas tool, you'll summarize the cell phone activity by the areas of interest and be able to identify potential syndicate affiliates.
- On the ribbon, click the Analysis tab.
- In the Tools group, in the Movement group, click Compare Areas.
The Geoprocessing pane appears. The pane displays the Compare Areas tool. The tool requires several parameters. First, it requires input point features and input areas features.
- For Input Point Features, choose All Cell Phone Data. For Input Area Features, choose Areas of Interest.
Next, you'll choose the name of the output dataset.
- For Output Feature Class, replace AllCellPhoneData_CompareAreas with Cell_Phone_Compare_Areas.
Next, you'll choose the attribute fields that represent the names, or unique identifiers, of the point and area features.
When you looked at the attribute table for the cell phone data, you noticed the POI field, which gave a unique identifier to each cell phone. This field helps track records that were made by the same person. You'll use this field as the name field, as it'll identify whether a single person has multiple cell phone records inside the areas of interest.
- For Point Features Name Field, choose POI. For Area Features Name Field, choose Name.
The final parameter, Relationship, defines which relationship between the points and areas is analyzed. You can choose Location Only or Location and Time. The former only tracks whether the points occur inside the areas, while the latter also considers the time when the points and areas coincide. The latter option might be useful if you knew the crime syndicate only operated at specific hours of the day in the areas of interest. In this scenario, the syndicate operates in these areas at all times, so you'll keep the default value of Location Only.
- Click Run.
Note:
Because your dataset has a large number of features (more than 1 million), the tool may take several minutes to run.
The tool runs. When it finishes, a notification appears at the bottom of the Geoprocessing pane.
Tip:
To learn more about the analysis, including how long the tool took to run, click View Details.
Additionally, the Cell_Phone_Compare_Areas layer is added to the map and Contents pane. The output layer covers the exact same areas as the Query By Locations layer, so the map doesn't look much different than before. However, the output layer's attribute table contains new information about the POIs who were recorded in the areas of interest.
- In the Contents pane, right-click Cell_Phone_Compare_Areas and choose Attribute Table.
The table appears.
The output table includes the name of each area of interest (Area_ID), the name of each POI whose cell phone was recorded in an area of interest (Track_ID), and the number of times each POI had a cell phone record in an area of interest (count). More than 2,000 unique POIs were recorded in an area of interest, but many were only recorded a small number of times. POIs who were recorded many times are more likely to be syndicate affiliates.
- Right-click count and choose Sort Descending.
The entries in the table are organized from highest to lowest count. The POI with the most records in the areas of interest, Person-294, has 12,680 records. Several others have more than 1,000 records.
Chart activity in areas of interest
Just because a person has appeared in one of the areas of interest a large number of times does not immediately make them suspicious. After all, the three areas (Camp Lemonnier, Chabelley Airfield, and the Chinese People's Liberation Army Navy base) have legitimate military functions. Person-294, who has 12,680 records in the Chinese military base, may simply be base personnel and not involved in the syndicate's criminal activities.
You'll investigate further by creating a chart. In it, you'll compare how many of the three areas of interest each POI recorded activity in. POIs who recorded activity in all three areas may be suspicious.
- In the attribute table, right-click Track_ID and choose Statistics.
The Chart Properties pane and a chart called Comparison of data counts by Track_ID appears. This chart shows how many times each POI appears in the result dataset. A POI can appear a maximum of three times, once for each area of interest. POIs with only one appearance were only recorded in a single area of interest, while those with three appearances were recorded in all three areas of interest.
Because there are thousands of POIs in the chart, the chart may be difficult to read. However, it's clear from a glance that the vast majority of POIs only appear in one area of interest. This result makes sense. The areas of interest correspond to three military bases: an American base (Camp Lemonnier), a French airfield used by unmanned American aircraft (Chabelley Airfield), and a Chinese naval base. It's unlikely that a legitimate worker in one base will have a reason to go to the other bases.
You'll adjust the chart to focus on the POIs who appeared in two or three of the areas of interest.
- On the chart, draw a box around the POIs with a count of 2 or 3.
The POIs around which you drew the box are selected. You'll filter the chart to only show the selected records.
- On the chart toolbar, click the Filter By Selection button.
The chart is filtered to only show the selected records. This number of records is much smaller, making the chart more legible.
Based on the filtered chart, there are only three POIs who appeared in all three areas of interest.
- On the chart, hover over each of the bars with a count of 3.
A pop-up appears for each of the bars, showing the ID of the POI. The three POIs are Person-1449, Person-2183, and Person-998. These POI are potentially affiliated with the crime syndicate that operates in the areas of interest.
Because you have reason to suspect these POIs, you'll select their cell phone records and export them to a new layer. Doing so will allow you to track their movements and potentially detect any other suspicious behavior.
- Close the chart and the Chart Properties pane. Close the attribute table.
First, you'll select cell phone records by the three POIs.
- On the ribbon, click the Map tab. In the Selection group, click Select By Attributes.
The Select By Attributes pane appears. Like Compare Areas, you'll set parameters and then run the tool.
- For Input Rows, choose All Cell Phone Data. Confirm that Selection type is set to New selection.
To choose which POIs to select, you'll create expressions.
- In the expression box, build the expression Where POI is equal to Person-1449.
Tip:
Because there are a large number of POIs, it's recommended that you type Person-1449 instead of choosing it from the drop-down menu.
You'll add clauses to select the other two POIs.
- Click Add Clause. In the new clause, create the expression Or POI is equal to Person-2183.
Note:
Make sure you choose Or instead of the default And. Choosing And will cause the tool to select features that have a POI value of Person-1449 and a POI value of Person-2183 at the same time. Because no features have more than one POI value, the tool won't select any features.
- Click Add Clause and create the expression Or POI is equal to Person-998.
- Click OK.
On the map, a large number of cell phone records spanning the entire region are selected.
Next, you'll export the selected features to a new feature class.
- In the Contents pane, right-click All Cell Phone Data, point to Data, and choose Export Features.
The Export Features pane appears. Like many tools, this tool will only run on selected features if there are any selected features in the input dataset.
- For Output Feature Class, type Suspected_POIs.
- Click OK.
The tool runs and a new layer, Suspected_POIs, is added to the map. Because it overlaps with the other layers, you can't see it.
- In the Contents pane, uncheck All Cell Phone Data and Cell_Phone_Compare_Areas.
The map now only shows the cell phone records of the three suspected POIs.
Animate the results
You've identified three POIs about whom you want to investigate further. As you saw when you looked at the attribute table for the cell phone data, all of the records have a time and date connected with them. Based on this, you can animate the cell phone records of the three POIs to see how they moved around the area throughout the day.
To animate the results, you'll first enable time settings for the Suspected_POIs layer.
- In the Contents pane, double-click Suspected_POIs.
The Layer Properties window appears. In this window, you can set many settings relating to the layer. First, you'll set whether the layer has a single time field or start and end time fields. Your data has only one time field.
- Click the Time tab.
- Under Filter using time, select Filter layer content based on attribute values.
- For Layer Time, choose Each feature has a single time field.
Next, you'll choose the time field from the list of attribute fields.
- Confirm that Time Field is set to Time.
Note:
For a time field to be used to enable time settings, the field must follow certain rules. If you're performing this workflow with your own data and have trouble enabling time settings, try converting the time field into a date format.
- Click OK.
The layer is time-enabled. A timeline appears at the top of the map. When you point to the timeline, it shows the earliest and latest dates for the data.
Before you play the animation, you'll change the basemap to show satellite imagery of the area. Satellite imagery will help give a better idea of the terrain and surroundings of the areas that the POIs moved to.
- On the ribbon, click the Map tab. In the Layer group, click Basemap and choose Imagery.
The basemap changes. Next, you'll play the animation.
- Point to the timeline and click the play button.
The animation plays. It shows the cell phone records of the three POIs at various stages in time.
Tip:
You can adjust the interval of time displayed at each point in the animation, also called the time step, by dragging the sliders on the timeline.
At some points in time, the patterns in the cell phone records suggest movement along roads or highways.
Overall, how often do the POIs enter the areas of interest? Is it frequent enough to warrant suspicion?
As an intelligence officer working with law enforcement, you may decide to observe these POIs more closely or not based on the movements you just analyzed. Alternatively, you may return to your Cell_Phone_Compare_Areas layer and search for other POIs who may exhibit suspicious behavior. For an additional challenge, try selecting, exporting, and animating the cell phone records of Person-294, who you found had an extremely high number of records in a single area of interest. Are their movement patterns more worthy of concern?
Alternatively, there were many POIs who had records in two of the areas of interest. Perhaps one of those POIs also has a large enough number of records in areas of interest to draw suspicion. The results of your analysis can be probed much further than they are in this workflow; if you want, explore the data on your own and see what insights you can discover.
- If necessary, stop the animation. On the Quick Access Toolbar, click the Save button.
In this tutorial, you used ArcGIS AllSource to analyze cell phone data and find possible affiliates of a criminal syndicate known to operate in certain areas of interest. In the real world, this movement analysis can be performed on a variety of datasets, not just cell phone records.
The dataset you downloaded at the beginning of the tutorial includes the Vehicle_Data_All_Vehicle_Data feature class (contained in the Vehicle_Data feature dataset). It contains vehicle locations over time. For an optional challenge, try performing the compare areas workflow on this feature class.
This workflow, in conjunction with other intelligence workflows that can be done in ArcGIS AllSource, can be used by law enforcement and military personnel to help track down offenders or insurgents.
You can find more tutorials in the tutorial gallery.
