North Wales Police

NWP began its Chorus journey in 2017 with the roll out of Chorus Analyse, the industry’s leading data cleansing engine. The software was used by all Analysts to cleanse, format, map and report on communications data, such as Call Data Records (CDRs), handset downloads and Automatic Number Plate Recognition (ANPR). Proven to save 97% of time, the software quickly proved its worth in supporting Analysts to accelerate their investigations.

Following the success of Chorus Analyse, NWP’s Serious and Organised Crime (SOC) team and Criminal Investigation Department (CID) adopted Chorus Investigate, a self-serve data analysis tool that helps Investigators to quickly get answers from data.

Whilst the benefits of both solutions were significant, NWP was still experiencing investigative challenges across several areas. These included:

• Collection, interrogation, and attribution of data
• Evidential storage
• Disclosure and sharing of data and evidence

Chorus held extensive feedback sessions with its users UK-wide and found these challenges to ring true for many other forces also. In addition, a rapidly evolving issue was uncovered. Historically, all communications data analysis was completed by analysts within a police force. However, with data volumes increasing and the digital landscape changing, analysts were struggling to cope with the demands put on them.

With the requirements documented, Chorus tasked its software developers up with building a solution, and it was here that the idea of the Chorus Intelligence Suite (CIS) was born.

A demonstration of the software was provided to NWP in 2020 and, as one of the UK’s most forward-thinking police forces, it agreed to trial the CIS as a Proof-of-Concept (POC) across the force.

When NWP visited the Chorus HQ in Woodbridge in 2020, it was all systems go to adopt and roll out the CIS. One week later, the UK was thrown into lockdown in the wake of the Coronavirus pandemic.

However, as technologically advanced as NWP is, it quickly overcame this barrier due to its early adoption of cloud-based deployment. Initially Chorus was deployed on standalone desktop machines. However, working in partnership with Chorus, the force moved to a more beneficial cloud-based service, and were one of the first police forces to migrate to cloud.

The CIS is a Software as a Service (SaaS) tool and must therefore be deployed in a cloud-based environment. NWP were in a privileged position to continue with the POC because its Analysts were able to securely log on to the browser-based software from their laptops, whilst working from home.

Owen Preece, Head of Crime and Intelligence Analysis at North Wales Police said:

“I was talking to a lot of my peers in other forces, and they were still on standalone machines or an on-premise environment. They were having to create rotas for analysts to go into the office and log on to their single access desktops, whereas we were all working from home. We could carry on with our usual analytical processes and were able to develop the POC with Chorus.”

To ensure the smooth running and overall success of the project, key stakeholders were assigned, and a strategic steering group created from both Chorus and NWP. Bi-weekly meetings were held to review progress, flag any issues and capture user feedback. These meetings proved crucial in accurately documenting the challenges, requirements, and priorities from NWP.

Fast forward 3 years and NWP has played an essential role in pioneering the development of the CIS via its detailed user input.

The CIS is the first of its kind in the law enforcement industry for offering multiple capabilities all from one platform and one interactive dashboard. Comprising of data search, analysis, cleansing and evidence enrichment tools, end-to-end digital investigations can be managed via the CIS.

This presented a significant opportunity to NWP because one of the biggest challenges it cited was with the number of systems that its Analysts were having to log in to, to access and search for the data they need as part of an investigation.

Owen Preece said:

“We don’t have any researchers within our analytical team and our analysts were spending so much time doing research rather than analysis. They were having to go into lots of different systems, with multiple logins, to attribute information. This was timely and impacted our efficiency.”

Chorus worked with NWP to understand what systems they required access to and developed a solution which would not only bring all these systems together in one place but also make them searchable. This would mean that Analysts would only need to perform one search query across all systems to obtain the information they needed.

Niche RMS, a police records management system, and IBM i2 iBase, a modelling and analysis tool, were core internal systems that NWP uses to obtain and interpret data. A key priority was to integrate these systems into the CIS, something no other provider in the industry has been able to achieve. The integration was developed with all systems communicating, enabling NWP to improve its research capabilities whilst saving considerable time in the investigative process.

NWP were extremely due diligent in its approach to connecting into and searching its systems via the CIS. It adopted a best-practice approach of conforming to Information Governance, ensuring that any sharing of data remained compliant. NWP also outsourced its security checks to an independent advisory firm, to ensure its systems could communicate with the CIS.

NWP adopted the capabilities of the CIS as a phased approach. It firstly utilised the cross-case search capability, which it distributed to several analysts. Simply put, it enabled them to upload, store, and index all digital case data (including sessions from Analyse and Investigate) and make it searchable for cross-case analysis. For example, if a user has an entity that they need to attribute (name, phone number etc) this can be searched across all open and closed cases, to see if it has appeared before, revealing unknown connections.

This feature proved extremely beneficial when applied to the force’s biggest threat – county lines investigations. County lines crimes are committed across wide geographical areas and often involve repeat offenders. With cross-case analysis, NWP can identify key people of interest and develop a cohort of subjects that it knows are likely to be engaging with county lines. It can then be proactive in the way that it targets those lines, as they emerge.

Owen Preece added:

“The potential of cross-case analysis is huge, and we still have so much that we can do with it that we expect it to assist us in our investigations even more as we progress our use of the CIS. The more information that we put into the CIS, and systems we connect into, the more we will get out of it.”

The CIS also features an entity enrichment and attribution tool, which makes open-source research an automated process. It has provided significant support to NWP especially in relation to its county lines investigations and when used alongside the cross-case analysis tool.

Users can simply input a name, number, email address etc. and query over 200 social media platforms, consented databases, and internal systems, in one bulk search. This process accelerates the attribution process and ensures all evidential sources are covered, minimising the risk of undetected evidence. Any evidence found online can then be anonymously captured and saved to a case within the CIS instantly.

Owen Preece explained:

“We will often query a phone number or address and use the bulk search function to attribute that to a person. Our Analysts can then use the cross-case tool to identify whether that person (and/or their cohorts) have appeared before and if they are associated with any other county line. If a person of interest shows up in a different town, we can ask ourselves, is this county line expanding, or are they attempting to encroach on a different drugs market? The CIS is a powerful tool for helping us to identity links and answer key investigative questions.”

The CIS enables users to overlay and combine all their digital data in one interactive dashboard, to build an advanced visual representation of a case. Call data, cell site, handset downloads, ANPR data, open-source evidence and more can all be visualised, to easily spot connections and answer key questions.

Owen Preece elaborated on this, explaining that:

“The biggest benefit we’ve seen with the CIS is certainly efficiency, especially in terms of being able to progress and solve investigations quicker. Analysts can save significant time in the data search, attribution, and analysis stage and this has helped them to get to a resolution much faster.”

What’s more, by connecting its police systems into the CIS (such as Niche RMS and IBM i2 iBase) Analysts can expand on searches and draw this data together also. Owen Preece added:

“Having the capability to bring collections of data into the CIS and connect into our other crime recording data and intelligence systems, has made investigations so much easier in terms of making sure that we are reducing duplication of work and ensuring no stone is left unturned in identifying links.”

Case management and collaboration was a major priority for NWP and the CIS delivers on this. Users can upload, store, index and search all investigative case data in a central and fully secure digital repository.

Security groups and access controls can be applied depending on the sensitivity of a case, and multiple team members assigned to work on, add and share data to a case file. Audit logs can also be maintained to document when any searches, web captures and activities are performed, by who and when. What’s more, the CIS also supports Review Retention and Disposal (RRD) controls, so users have peace of mind on how long data should be stored for and when it should be reviewed.

Owen Preece added:

“We had almost 20 analysts, working on 20 different jobs, but they would work in silos, and we had no way of knowing if data in one case could be associated with another. There may be a person of interest across multiple investigations, but we had no way of knowing as we had no search ability for it. This would lead to duplication of work as one analyst would be building a case file for a subject whilst another was doing the same.”

The CIS makes data sharing, internally and externally, an automated and secure process and this is something NWP is taking full advantage of. It works very closely with Merseyside Police (also a CIS user), as many of its county lines investigations emerge from there.

At present, NWP and Merseyside Police share intelligence with each other manually, but as both forces are equipped with the CIS, there is a certain level of interoperability that benefits analytical teams. For example, NWP can automatically bring across any attribution from Merseyside (e.g. call data) and transfer it to their own case. They are then able to run reports, identify who the top contacts are, and then search these across their own data within the CIS. They can identify immediately if that contact has appeared in any other cases, identifying crucial links.

“Having access to Merseyside Police’s data just adds that extra layer of usability to the CIS,” said Owen Preece.

A work in progress, Chorus is working with NWP and Merseyside Police on creating a shared instance of the CIS where each can share their cases and make them searchable. This will open a whole new opportunity for cross-case analysis, enabling analysts from both forces to identify if there are any links between their county lines investigations and those that they are running from the other force. This insight will enable more proactive policing, disrupting county lines networks, faster. Chorus is confident of great outcomes and plans to invite other forces to participate.