Xiaoyu Wang UNC Charlotte Erin Miller START Center, U. Maryland

1. Investigative Visual Analysis of Global Terrorism Xiaoyu Wang UNC Charlotte Erin Miller START Center, U. Maryland Kathleen Smarick START Center, U Maryland William Ribarsky UNC Charlotte Remco Chang UNC Charlotte

2. Disclaimer • Definition of Terrorism • “The threatened or actual use of illegal force and violence by a non-state actor to attain a political, economic, religious or social goal through fear, coercion or intimidation[1,2].” • Definition of Terrorists • Any non-state actor engaging in terrorism is defined to be a terrorist in the Global Terrorism Database (GTD). • 1. LAFREE G., DUGAN L.: Introducing the global terrorism database. Terrorism and Political Violence 19, 2 (2007), 181–204. • 2. NATIONAL CONSORTIUM FOR THE STUDY OF TERRORISM AND RESPONSES TO TERRORISM: Global terrorism database. http://www.start.umd.edu/data/gtd/, 2007

3. Collaborations

4. Global Terrorism Database (GTD) • Terrorism activities throughout the world between 1970-1997 • Contains over 60,000 incidents • 119 dimensions for recording the events (weapons used, number of injuries, etc) • Approximately 2,000 unique entities

5. Visual Analysis of Terrorism • Understanding terrorism is a grand challenge for the Dept of Homeland Security (DHS) and the National Visual Analytics Consortium (NVAC). • Other agencies such as DoD, STRATCOM, and JIPOE are also interested in the area. • 1. GUO D., LIAO K., MORGAN M.: Visualizing patterns in a global terrorism incident database. Environment and Planning B: Planning and Design 34, 1 (2007), 767–784.

6. Existing Work • Visual Analysis of Terrorism != Social Networks • Social network on terrorism • OntoVis by Shen, Ma, and Eliassi-Rad • Social Action by Adam Perer and Schneiderman • Geospatial approach • Guo, Liao, and Morgan from Penn State • GeoVista by Penn State • Improvise by Chris Weaver • Other Tools • Sandbox and GeoTime by Occulus • Why aren’t there more?

7. Our System Design • Big Picture: • Event-based investigative analysis • Visually analyze the activities of entities • Trend comparison using dimensions • Identify trends and patterns of events • Search-by-example of temporal patterns • Look for similar behaviors

8. Visual GTD Flow Chart Entity Relationships (Investigative Vis) Dimensional Relationships (ParallelSets) Entity Analysis (Search By Example) C. Ziemkiewicz, X. Wang, A. Godwin, W. Dou, R. Chang, R. Kosara, and W. Ribarsky. Global Terrorism Visualization.  Poster Presented at DHS University Network Summit, 2008

9. Visual GTD Flow Chart Entity Relationships (Investigative Vis) Dimensional Relationships (ParallelSets) Entity Analysis (Search By Example) C. Ziemkiewicz, X. Wang, A. Godwin, W. Dou, R. Chang, R. Kosara, and W. Ribarsky. Global Terrorism Visualization.  Poster Presented at DHS University Network Summit, 2008

10. The 5 W’s • Fundamental investigative concept: • Where : a certain geo-location or region on map. • When : a spot or continues span along time line. • Who : individual entity or a group of entities • What : any physical tool or method. • Why: motivations or reasons. • Highly interactive exploratory tool • Flexible entrance points. • Swift updates in coordinated views. • Details on demand

11. System Overview WHO WHAT WHERE Comparison and Shoebox WHEN

12. Where • Designed to be easy and intuitive. • Illustrates the activity patterns of entities. • Multi-group selection helps in comparing activities of different entities.

13. When • Use of ThemeRiver to display categorical information. • Understand groups’ temporal patterns and trends over time.

14. Who • Dual Roles: • Selection of entities (“terrorist names” tab) • Displays selected entities (“intermediate results” tab)

15. What • Organizes categorical dimensions • Allows for filtering of activities

16. Shoebox and Comparison • Shoebox provides a container for collecting entities that are under investigation • Comparison view supports temporal comparisons between entities.

17. Scenarios • Scenario One : • Linking Incidents to Reveal Global Strategy • Who -> Where -> When -> What - > • Scenario Two : • Discovering Unexpected Temporal Patterns • What -> Who -> Why

18. Scenarios 1:Revealing Global Strategy This group’s attacks are not bounded by geo-locations but instead, religious beliefs. Its attack patterns changed with its developments. WHY ?

19. Scenario 2: Discovering Unexpected Temporal Patterns A geographically-bounded entity in the Philippines. Domestic Group The ThemeRiver shows its rise and fall as an entity and its modus operandi.

20. Conclusion • Contribution • Created a comprehensive set of tools for visually analyzing global terrorism activities. • Our tool models after one of the principles of investigation, the 5 W’s. • Using coordinated views and high interaction to allow an investigator to explore the data and discover trends and patterns.

21. Questions? Thank you! rchang@uncc.edu http://viscenter.uncc.edu

22. Backup

23. Visualizing Analytical Process • Can operational or investigative processes and methods be modeled into an exploratory visualization? • Example: • Occulus Sandbox models after the use of “post-it” notes • Investigative GTD models the 5 W’s • How can we integrate visual exploration with process modeling? • Bank of America • Department of Transportation

24. Future works • Support reasoning systems. • Provide online version for mass audience. • Combine knowledge from Social Science perspectives.