Identify suspects with movement analysis

Add the data

You'll start by reviewing a fictitious dataset for the area of interest: Djibouti, the capital city of the Republic of Djibouti, located in the Horn of Africa. This data contains the movement of the cellular devices and their owners throughout the day that the crime was committed. It also contains the areas of interest where the crime syndicate is known to operate.

First, you'll download the data and add it to a project in ArcGIS Pro Intelligence.


All of the data used in this lesson is fictitious and designed for educational use only.

  1. Go to the Camp Lemonnier Intelligence Data item on ArcGIS Online and click Download.

    A zipped folder named Camp_Lemonnier_Intelligence.gdb is downloaded to your computer. The .gdb extension means the folder contains a geodatabase, which is a folder format for storing geographic data.

  2. Extract the zipped folder to a location you can easily remember, such as your Documents folder.

    Next, you'll create a project in ArcGIS Pro Intelligence and add the data to it.

  3. Start ArcGIS Pro Intelligence. If prompted, sign in using your licensed ArcGIS account.

    ArcGIS Pro Intelligence is an optional product that can be installed when you install ArcGIS Pro. To learn more about installing ArcGIS Pro Intelligence, go to the Install ArcGIS Pro documentation page. If you don't have ArcGIS Pro or an ArcGIS account, you can sign up for an ArcGIS free trial.

    When you start ArcGIS Pro Intelligence, you're given the option to create a new project or open an existing one. If you've created a project before, you'll see a list of recent projects.

  4. Under Blank Templates, click Map.

    Map template

    The Create a New Project window appears.

  5. For Name, type Compare Areas Project. Click OK.

    The project, which will contain all of the maps and data for this workflow, is created. Because you chose the Map template, the project includes a blank map.

    You'll add data about cell phone locations and the areas of interest where the crime syndicate is known to operate from the geodatabase that you downloaded. Because you're going to add multiple datasets from the geodatabase you downloaded, you'll add a connection to the geodatabase so you can access all of its content more quickly, instead of searching for and adding each dataset individually.

  6. On the ribbon, click the Data tab. In the Import group, click Connections and choose Add Database.

    Add Database option in the Connections menu

    The Select Existing Geodatabase window appears.

  7. Browse to the location where you extracted the Camp_Lemonnier_Intelligence.gdb geodatabase. Click Camp_Lemonnier_Intelligence.gdb to select it and click OK.

    Camp_Lemonnier_Intelligence.gdb geodatabase

    The geodatabase is added as a connection. You can access the connection using the Catalog pane.

  8. In the Catalog pane, expand Databases.

    If the Catalog pane isn't visible, click the View tab on the ribbon. In the Panes group, click Catalog Pane.

    Databases folder in the Catalog pane

    The Databases folder contains two geodatabases. One is a default geodatabase (Compare Areas Project.gdb) that was created when you created the project. The other is the connection you added.

    Next, you'll add the areas of interest and the cell phone data to the map from the geodatabase.

  9. Expand Camp_Lemonnier_Intelligence.gdb.

    Expanded geodatabase

    The geodatabase contains three feature datasets: Administrative_Data, Cell_Phone_Data, and Vehicle_Data. The Administrative_Data dataset contains the areas of interest, while the Cell_Phone_Data dataset contains the cell phone data.

  10. Expand Administrative_Data. Right-click Areas_of_Interest and choose Add To Current Map.

    Add To Current Map option

    The areas are added to the map. The map extent zooms to the city of Djibouti in Djibouti, a small African nation. This city and its surrounding area is your area of interest for this workflow.

  11. Expand Cell_Phone_Data. Right-click Cell_Phone_Data_All and choose Add To Current Map.

    The cell phone records layer is added to the map. The layer includes a large number of points (more than 1 million) concentrated around Djibouti. Each point represents the location of a cell phone at a certain point in time. Multiple points may correspond to the same cell phone as it moved throughout the day.

    Default map with cell phone records and area of interest


    The color of the features in both layers is randomly generated and may differ from the example images. The difference in color will not impact the workflow.

    From a quick visual inspection, each area of interest contains several cell phone records. Some areas, such at the one to the northwest, have a large number of records, while some, such as the one to the southwest, have relatively few.

    You can learn more about a layer by opening its attribute table.

  12. In the Contents pane, right-click All Cell Phone Data and choose Attribute Table.

    Attribute Table option

    The attribute table appears. Attributes are textual or numeric data associated with each feature. In the table, each row represents an individual feature, while each column represents an attribute field.

    Fields in the attribute table

    This table includes fields describing the shape, latitude, longitude, and unique ID (OBJECTID) of each cell phone record. It also has a Time field, which has the date and time that the cell phone's location was captured, and a POI (person of interest) field, which identifies the person to whom the cell phone belonged. In a real dataset, the POI field would include the person's name, but because this data is fictitious, a number was used instead.

    In the example image, the first four cell phone records all belonged to the same person, identified as Person-102. These records were taken on September 9, 2017, with the first record occurring at 10:19 p.m. and the fourth at 11:44 p.m.

  13. Close the table.

Track cell phone records in areas of interest

Now that you've added the data to the map, you're ready to perform analysis on the three areas. These areas are the known locations where a crime syndicate operates. People who have a lot of activity in these areas may be connected to the crime syndicate. By running the Compare Areas tool, you'll summarize the cell phone activity by the areas of interest and be able to identify potential syndicate affiliates.

  1. On the ribbon, click the Analysis tab. In the Geoprocessing group, click the arrow to expand the tools gallery.

    Arrow to expand the tools gallery

  2. In the list of tools, in the Movement group, click Compare Areas.

    Compare Areas tool

    The Geoprocessing pane appears. The pane displays the Compare Areas tool. The tool requires several parameters. First, it requires input point features and input areas features.

  3. For Input Point Features, choose All Cell Phone Data. For Input Area Features, choose Areas of Interest.

    Next, you'll choose the name of the output dataset.

  4. For Output Feature Class, replace AllCellPhoneData_CompareAreas with Cell_Phone_Compare_Areas.

    Next, you'll choose the attribute fields that represent the names, or unique identifiers, of the point and area features.

    When you looked at the attribute table for the cell phone data, you noticed the POI field, which gave a unique identifier to each cell phone. This field helps track records that were made by the same person. You'll use this field as the name field, as it'll identify whether a single person has multiple cell phone records inside the areas of interest.

  5. For Point Features Name Field, choose POI. For Area Features Name Field, choose Name.

    Compare Areas tool parameters

    The final parameter, Relationship, defines which relationship between the points and areas is analyzed. You can choose Location Only or Location and Time. The former only tracks whether the points occur inside the areas, while the latter also considers the time when the points and areas coincide. The latter option might be useful if you knew the crime syndicate only operated at specific hours of the day in the areas of interest. In this scenario, the syndicate operates in these areas at all times, so you'll keep the default value of Location Only.

  6. Click Run.

    Because your dataset has a large number of features (more than 1 million), the tool may take several minutes to run.

    The tool runs. When it finishes, a notification appears at the bottom of the Geoprocessing pane.

    Completion message for the Compare Areas tool


    To learn more about the analysis, including how long the tool took to run, click View Details.

    Additionally, the Cell_Phone_Compare_Areas layer is added to the map and Contents pane. The output layer covers the exact same areas as the Query By Locations layer, so the map doesn't look much different than before. However, the output layer's attribute table contains new information about the POIs who were recorded in the areas of interest.

  7. In the Contents pane, right-click Cell_Phone_Compare_Areas and choose Attribute Table.

    The table appears.

    Cell_Phone_Compare_Areas attribute table

    The output table includes the name of each area of interest (Area_ID), the name of each POI whose cell phone was recorded in an area of interest (Track_ID), and the number of times each POI had a cell phone record in an area of interest (count). More than 2,000 unique POIs were recorded in an area of interest, but many were only recorded a small number of times. POIs who were recorded many times are more likely to be syndicate affiliates.

  8. Right-click count and choose Sort Descending.

    Sort Descending option

    The entries in the table are organized from highest to lowest count. The POI with the most records in the areas of interest, Person-294, has 12,680 records. Several others have more than 1,000 records.

Chart activity in areas of interest

Just because a person has appeared in one of the areas of interest a large number of times does not immediately make them suspicious. After all, the three areas (Camp Lemonnier, Chabelley Airfield, and the Chinese People's Liberation Army Navy base) have legitimate military functions. Person-294, who has 12,680 records in the Chinese military base, may simply be base personnel and not involved in the syndicate's criminal activities.

You'll investigate further by creating a chart. In it, you'll compare how many of the three areas of interest each POI recorded activity in. POIs who recorded activity in all three areas may be suspicious.

  1. In the attribute table, right-click Track_ID and choose Statistics.

    Statistics option

    The Chart Properties pane and a chart called Comparison of data counts by Track_ID appears. This chart shows how many times each POI appears in the result dataset. A POI can appear a maximum of three times, once for each area of interest. POIs with only one appearance were only recorded in a single area of interest, while those with three appearances were recorded in all three areas of interest.

    Default chart

    Because there are thousands of POIs in the chart, the chart may be difficult to read. However, it's clear from a glance that the vast majority of POIs only appear in one area of interest. This result makes sense. The areas of interest correspond to three military bases: an American base (Camp Lemonnier), a French airfield used by unmanned American aircraft (Chabelley Airfield), and a Chinese naval base. It's unlikely that a legitimate worker in one base will have a reason to go to the other bases.

    You'll adjust the chart to focus on the POIs who appeared in two or three of the areas of interest.

  2. On the chart, draw a box around the POIs with a count of 2 or 3.

    Box around POIs with a count of 2 or 3

    The POIs around which you drew the box are selected. You'll filter the chart to only show the selected records.

  3. On the chart toolbar, click the Filter By Selection button.

    Filter By Selection button

    The chart is filtered to only show the selected records. This number of records is much smaller, making the chart more legible.

    Filtered chart

    Based on the filtered chart, there are only three POIs who appeared in all three areas of interest.

  4. On the chart, point to each of the bars with a count of 3.

    A pop-up appears for each of the bars, showing the ID of the POI. The three POIs are Person-1449, Person-2183, and Person-998. These POI are potentially affiliated with the crime syndicate that operates in the areas of interest.

    Because you have reason to suspect these POIs, you'll select their cell phone records and export them to a new layer. Doing so will allow you to track their movements and potentially detect any other suspicious behavior.

  5. Close the chart and the Chart Properties pane. Close the attribute table.

    First, you'll select cell phone records by the three POIs.

  6. On the ribbon, click the Map tab. In the Selection group, click Select By and choose Select By Attributes.

    Select By Attributes option

    The Select By Attributes pane appears. Like Compare Areas, you'll set parameters and then run the tool.

  7. For Input Rows, choose All Cell Phone Data. Confirm that Selection type is set to New selection.

    To choose which POIs to select, you'll create expressions.

  8. Click New expression.

    New expression button

  9. Build the expression Where POI is equal to Person-1449.

    Because there are a large number of POIs, it's recommended that you type Person-1449 instead of choosing it from the drop-down menu.

    Expression to select Person-1449

    You'll add clauses to select the other two POIs.

  10. Click Add Clause. In the new clause, create the expression Or POI is equal to Person-2183.

    Make sure you choose Or instead of the default And. Choosing And will cause the tool to select features that have a POI value of Person-1449 and a POI value of Person-2183 at the same time. Because no features have more than one POI value, the tool won't select any features.

  11. Click Add Clause and create the expression Or POI is equal to Person-998.

    Expression with three clauses

  12. Click OK.

    On the map, a large number of cell phone records spanning the entire region are selected.

    Map with selected cell phone records

    Next, you'll export the selected features to a new feature class.

  13. In the Contents pane, right-click All Cell Phone Data, point to Data, and choose Export Features.

    The Export Features pane appears. Like many tools, this tool will only run on selected features if there are any selected features in the input dataset.

  14. For Output Name, type Suspected_POIs.

    Export Features parameters

  15. Click OK.

    The tool runs and a new layer, Suspected_POIs, is added to the map. Because it overlaps with the other layers, you can't see it.

  16. In the Contents pane, uncheck All Cell Phone Data and Cell_Phone_Compare_Areas.

    The map now only shows the cell phone records of the three suspected POIs.

    Map showing the cell phone records of suspected POIs

Animate the results

You've identified three POIs about whom you want to investigate further. As you saw when you looked at the attribute table for the cell phone data, all of the records have a time and date connected with them. Based on this, you can animate the cell phone records of the three POIs to see how they moved around the area throughout the day.

To animate the results, you'll first enable time settings for the Suspected_POIs layer.

  1. In the Contents pane, double-click Suspected_POIs.

    The Layer Properties window appears. In this window, you can set many settings relating to the layer. First, you'll set whether the layer has a single time field or start and end time fields. Your data has only one time field.

  2. Click the Time tab. For Layer Time, choose Each feature has a single time field.

    Layer Time parameter

    Next, you'll choose the time field from the list of attribute fields.

  3. Confirm that Time Field is set to Time.

    For a time field to be used to enable time settings, the field must follow certain rules. If you're performing this workflow with your own data and have trouble enabling time settings, try converting the time field into a date format.

  4. Click OK.

    The layer is time-enabled. A timeline appears at the top of the map. When you point to the timeline, it shows the earliest and latest dates for the data.

    Timeline for the Suspected_POIs layer

    Before you play the animation, you'll change the basemap to show satellite imagery of the area. Satellite imagery will help give a better idea of the terrain and surroundings of the areas that the POIs moved to.

  5. On the ribbon, click the Data tab. In the Import group, click Basemap and choose Imagery.

    Imagery basemap option

    The basemap changes. Next, you'll play the animation.

  6. Point to the timeline and click the play button.

    Play button

    The animation plays. It shows the cell phone records of the three POIs at various stages in time.


    You can adjust the interval of time displayed at each point in the animation, also called the time step, by dragging the sliders on the timeline.

    At some points in time, the patterns in the cell phone records suggest movement along roads or highways.

    Detail showing cell phone records in a line pattern

    Overall, how often do the POIs enter the areas of interest? Is it frequent enough to warrant suspicion?

    As an intelligence officer working with law enforcement, you may decide to observe these POIs more closely or not based on the movements you just analyzed. Alternatively, you may return to your Cell_Phone_Compare_Areas layer and search for other POIs who may exhibit suspicious behavior. For an additional challenge, try selecting, exporting, and animating the cell phone records of Person-294, who you found had an extremely high number of records in a single area of interest. Are their movement patterns more worthy of concern?

    Alternatively, there were many POIs who had records in two of the areas of interest. Perhaps one of those POIs also has a large enough number of records in areas of interest to draw suspicion. The results of your analysis can be probed much further than they are in this workflow; if you want, explore the data on your own and see what insights you can discover.

  7. If necessary, stop the animation. On the Quick Access Toolbar, click the Save button.

    Save button

In this lesson, you used ArcGIS Pro Intelligence to analyze cell phone data and find possible affiliates of a criminal syndicate known to operate in certain areas of interest. In the real world, this movement analysis can be performed on a variety of datasets, not just cell phone records.

The dataset you downloaded at the beginning of the lesson includes the Vehicle_Data_All_Vehicle_Data feature class (contained in the Vehicle_Data feature dataset). It contains vehicle locations over time. For an optional challenge, try performing the compare areas workflow on this feature class.

This workflow, in conjunction with other intelligence workflows that can be done in ArcGIS Pro Intelligence, can be used by law enforcement and military personnel to help track down offenders or insurgents.

You can find more lessons in the Learn ArcGIS Lesson Gallery.