The Analyzer℠

The Analyzer℠ module is a powerful data mapping tool that enables you to graph complex data relationships based on inmate calling activity and account funding activity in The ENFORCER® as well as inmate visitation activity in The Visitor™ visitation management system. Collectively, these three types of activity are referred to as interaction types.

The Analyzer℠ builds and displays detailed graphs based on user-specified input. The information displayed in a graph generated by The Analyzer℠ can be used to find commonalities that are useful in detecting fraudulent or suspicious activity by inmates placing calls using The ENFORCER®, by inmates participating in visitation sessions through The Visitor™, and by public users funding inmate calling accounts through ICSolutions® Point-of-Sale system as well as third-party point-of-sale systems.

The Analyzer℠ builds and displays graphs which show commonalities in calling, funding, and visitation patterns among Nodes. A Node is a point on the graph which represents one of the following:

• An inmate.
• A phone number which could represent a called telephone number, a number associated with an ICSolutions® prepaid collect account, Direct Billed account or a Payment account through a third party.
• The name of a public user (called party) outside of the correctional facility who funded an inmate’s debit account or an ICSolutions® prepaid collect account.

When you perform a search, you can specify a Node as the Primary Node, which is the starting point of all data mapped in the graph. A relationship is the commonality between two Nodes. Each relationship indicates a calling event, a funding event, a non-funding relationship (between a phone and a public user), or visitation event.

The Analyzer℠ module is accessible by selecting The Analyzer℠ under the Call Detail tab.

screenshot

Alternatively, The Analyzer℠ can be accessed by clicking icon on the Call Analysis℠ page, which will open The Analyzer℠ in a new browser tab with the same parameters searched on Call Analysis℠.

Several search options are available that enable you to help The Analyzer℠ find the exact information you are looking for. By specifying a combination of these options, you are telling The Analyzer℠ what information you want. The size and complexity of the graphed results is based on the options you specify, which may include the following:

• The Primary Node - Who (inmate/gang member/public user) or what (phone number) you want the search to be about.
• How many degrees of separation you want to include in the initial (automated) search.
• How many distinct inmates must have called a phone number (if a relationship has already been established between the phone number and both an inmate and public user it will still be included in the search).
• What Call Types are allowed to associate an inmate with a phone.
• If the phone call and/or visitation must have been completed/connected or just attempted.
• The date range are you interested in (i.e., in what timeframe do you believe the suspicious activity occurred, such as a two-week time period, a six-month time period, the last three days, etc.).

A search in The Analyzer℠ for the user-specified option or combination of options will display as a detailed graph which provides a visual representation of the search results. This search is interactive and based on the Primary Node. This information may include:

• All phone numbers called by an inmate.
• All inmates who called the number.
• What numbers were called by the other inmates.
• Calling patterns, or event chains, such as several inmates who called the same number or numbers, and other common phone numbers that may have been called by the same group of inmates, such as an organized gang.
• Who (public users) funded an inmate’s debit account.
• Who (public users) funded an ICSolutions® prepaid collect account (indicated by phone number).
• Who (public users) funded a Direct Bill account.
• Other inmates who called a funded number.
• Funding patterns such as several public users who funded the same ICSolutions® prepaid collect phone number or the same inmate.
• Who (public users) participated in a visitation session with an inmate or inmates.
• Other inmates who also participated in a visitation session with the same public user.

A graph resulting from a search in The Analyzer℠ is comprised of Nodes representing a combination of names, phone numbers, and relationships (interactions). Relationships are indicated by colored lines on the graph. The following table describes the various Nodes and relationship lines which display on a graph in The Analyzer℠.

A Node is distinguished by multiple graphical aspects to relay information to users when performing a search in The Analyzer℠. The color range of the Node indicates the Node Type and the hue within that color range indicates the Nodes fundamental property (i.e,. active inmate or inactive inmate). Nodes on The Analyzer℠ graph are comprised of three color ranges:

• Blue Range – Public User Node
• Brown Range (Orange, Brown, Purple) – Inmate Node
• Green Range – Phone Node

The border and size of a Node indicate the status of the Node. The following example shows the different statuses indicated by the different borders and sizes of the Nodes.

screenshot

A relationship (interaction) is the commonality between two Nodes. For two Nodes to be related, there must be at least one interaction of a specific type to have occurred within the dates specified for the search. Each relationship indicates a calling event, a funding event, a non-funding relationship (between a phone and a public user) or a visitation event. The Analyzer℠ graph can display more than one relationship between Nodes.

A Single Relationship would be one of the following, Double Relationships would be two of the following and Triple Relationships would be three of the following:

• A phone number called by an inmate (solid green line).
• A phone number associated with a funding event (solid orange line) and will always include a public user and a phone.
• A phone number associated with a public user (dashed orange line) (i.e., a contact phone number) which has not been directly funded through a Prepaid Collect account payment by the customer.
• A phone number associated with a visitation event (solid purple purple).

To help you understand how the relationships work between the Nodes, the following examples describe Single, Double and Triple Relationships.

screenshot

screenshot

screenshot

Depending on the search parameters specified, The Analyzer℠ graph will continue building as additional Nodes/relationships are located. The search results continue to build and be displayed until the specified limits are reached, or until no further relationships exist for the given parameters.

Additionally, you can temporarily pause (then restart) the search at any time during the graph build process. However, if any parameters are modified, the search should be started again.

The following is an example of a simple graph from The Analyzer℠. This example displays only calling events (solid green line) and a non-funding relationship (dashed orange line) (no funding or visitation activity).

screenshot

The following example graph includes all the different types of relationships The Analyzer℠ can represent. These are relationships associated with funding events and visitation events in addition to including relationships associated with calling events. The relationships are indicated by the colored relationship lines:

• Calling events are indicated by the solid green lines.
• Funding events are indicated by the solid orange lines.
• Non-funding events are indicated by the dashed orange lines.
• Visitation events are indicated by the solid purple lines.

screenshot

The Path Enhancement mode is the way certain Nodes and relationships are enhanced when you hover over a Node, or when you click on a Node from the Node List or Node Detail panels. There are two Path Enhance Mode options: Trace Path and Neighbor. In both modes, any Nodes or relationships which do not match the enhancement criteria will be faded from view.

• Trace Path Mode is the default enhanced view which highlights the relationship path from the Node clicked or hovered over to the Primary Node.
• Neighbor Mode view highlights all Nodes and relationships within one degree of separation from the Node clicked or hovered over.

The following example shows the Trace Path Mode and the Neighbor Mode from the same Node (circled in red).

screenshot

When the Enable Grouping/Gangs checkbox has been selected, The Analyzer℠ graph will automatically rearrange the Nodes into groups/gangs if this information is available.

screenshot

The following example shows how The Analyzer℠ adds this group/gang information to the graph, while maintaining the integrity of the data from the original search. The original graph transforms into the graph shown inside the blue dashed box with the Grouping/Gangs feature enabled.

When the Grouping/Gangs feature is enabled, the groupings will highlight when you hover over a group/gang (indicated by red circle around cursor), and the name of the group/gang will be displayed at the top of the page (as indicated with the red box). Groups can also be seen in this example and could be ICSolutions® customer, Prepaid Collect phones, Direct Billed phones, Called Phones, etc.

screenshot

To access The Analyzer℠ search menu shown in the following example, select The Analyzer℠ under the Call Detail tab. The Analyzer℠ can also be accessed by clicking icon on the Call Analysis℠ page, which will open The Analyzer℠ in a new browser tab with the same parameters searched on Call Analysis℠.

An example of the search menu for The Analyzer℠ is shown in the following example. From the search menu, you can customize your search as described in the following sections.

screenshot

The Legend panel is interactive. Hovering your mouse over or clicking a Node icon not only explains what each item represents on the graph, but it also enhances any Nodes or relationships within the graph which match the aspect in the Legend. The number of matching elements (relationships or Nodes) is displayed in the bottom right of the Legend panel when hovering over or clicking an item.

In the following example, when you hover over the solid orange line, you can determine that it represents a funding event and there are no funding relationships shown in the current graph. For a detailed description of each icon represented in the Legend, see article.

screenshot

The Node List contains a listing of any graphed Nodes grouped by type (Public/Customer, Inmates or phones) with the number associated displayed to the right of the section label. The following attributes apply:

• Each line item includes a Node Color Badge icon, which represents the Node by the color and the degree of separation to the Primary Node by the white number inside the circle.
• A spyglass icon represents a Node that has not been searched yet for relationships. If you click icon, The Analyzer℠ searches that Node for interactions which may expand the graph.
• Hovering over a line item triggers the Path Enhance Mode, which defaults to Trace Path but can be changed to Neighbor Mode in the Graph panel.
• If you click anywhere on a line item, a context is displayed with additional options as described in article.

screenshot

The Node Detail includes interactive icons for the specific Node. You can view the Node Detail panel clicking on any Node and clicking Details from the context menu. You can close the Node Detail panel by clicking Details a second time. For more information on the options available in this menu, see article.

screenshot

The information displayed in the Node Detail panel is similar to the information found in the Node List; however, it has additional detailed information related to the specific Node. The difference in the list on the Node Detail panel is that it contains graphed and un-graphed items the Detailed Node has interacted with (calling, funding, and visitation events as well as non-funding relationships).

After a line item is searched and graphed, it will be displayed in this list with its color badge. If it is searched and not considered significant, the label for that line item will turn red. Hovering over that line item indicates the item does not have enough relationships to be deemed significant enough to be graphed (i.e., does not meet the minimum number of inmates and/or has no association with a public user and inmate).

Additional details displayed for inmates, may include the agency name, the inmate’s ID, location in facility, active status, gang affiliation, and the degree of separation between this Node and the Primary Node. Additional details displayed for public users include account information, address, email and the degree of separation between this Node and the Primary Node. Additional details for a Phone include the account type, geographical location, and billing ID.

If call records apply to the line item, icon is displayed. You can click icon to open the call records for both the phone number and the inmate.

The Graph panel contains options that enable you to manipulate different aspects of The Analyzer℠ graph and how the Nodes display, which nodes display, what information is shown as well as the size and formatting of the graph. The following example describes the graph settings which can be adjusted.

screenshot

The Search Limits panel enables you to specify numerous inclusion, exclusion, or limiting criteria to include in your search. These criteria are described in the following example.

screenshot

The Inmate/Phone Search panel enables you to specify an inmate, a called phone number, or a gang to be searched as the Primary Node. These search capabilities are described in the following example.

screenshot

The Public Search panel enables you to specify a public user to be searched as the Primary Node. These search capabilities are described in the following example.

screenshot

The interactive search enables you to click individual Nodes at any time during the search process to access additional options for individual Nodes. Clicking on a Node results in the Node transforming from a circle into a rectangle with a popup context menu displayed below the Node. A description of each option is described in the following sections. This context menu is also accessible by clicking on a Node or line item in the Node List and Node Detail panels.

screenshot

The Search option is visible when a Node has not yet been searched. When you click Search, The Analyzer℠ begins a search for the specific Node, and the border of the Node will change from icon to icon (yellow border indicates the Node is being searched).

The Details option toggles (opens and closes) the Node Detail panel in The Analyzer℠ menu. For more information see article.

The Lock in place option locks that specific Node in place, so as the graph continues to build, that Node’s position will not be affected by the growing graph. If a Node is locked, when that Node is clicked, the context menu option will be Unlock.

Any displayed Node that you want to highlight can be pulled away from the main graph. This action will lock the node at that position as seen in the red box in the following example.

screenshot

The Show option provides an alternative for tablet users to view Nodes in Enhanced Mode since hovering over does not work on a tablet.

screenshot

The Page Links options enables you to access to additional investigative tools directly from an individual Node. The options are different depending on the Node Type.

screenshot

• The Reverse Lookup option is available for public Nodes to enable you to access reverse lookup information for a specific public Node.
• Selecting Call Analysis℠ will trigger this module to open in a new tab and a search to begin based on the node from which this option was selected. This option does not display for public Nodes.
• Selecting Call Records will trigger this screen to open in a new tab with any call records associated with the Node from which this option was selected. From there, users with the appropriate permissions can access the call recordings. This option does not display for public Nodes.
• Selecting Graph as Primary will trigger a new interactive search to begin based on the Node from which this option was selected. This Node will now be the Primary Node.

The Remove Node option enables you to remove a Node from a graph if you determine that a selected node is irrelevant to your investigation. This option is not available for the Primary Node.

screenshot

Several search options are available from the Search Limits panel, as described below.

When you select one or more Call Types from the displayed Call Types list, you are selecting which call types you want to be included in The Analyzer℠ search results. Non-selected call types are excluded from the search.

screenshot

By default, the following Call Types are selected: Debit, Debit Card, Collect, Prepaid Collect and Free. However, you can clear this default list by clicking on any Call Type in the list.

To select more than one Call Type, hold down the Ctrl key on your keyboard while clicking each desired Call Type. To select more than one consecutive Call Type, click the first Call Type in the list, hold down the Shift key on your keyboard, and select the last Call Type.

The degree of separation is the distinct number of relationships separating one Node from another. When you select a value from the Deg. of Separation Search dropdown list, you choose the number of degrees of separation from the Primary Node which will be searched automatically. You can select the degrees of separation from zero (search only the Primary Node for interactions) to four. If one degree of separation is selected, The Analyzer℠ will automatically search the Primary Node and any Nodes directly linked to the Primary Node for interactions.

screenshot

When searching using Degrees of Separation, The Analyzer℠ searches for relationships (interactions) with the degree of separation specified from the Primary Node. You can also see the degree of separation between other Nodes on the graph.

The following example shows the degrees of separation between Phone 1 and Inmate 1, which may be seen on a graph. These degrees of separation are described below:

• First Degree of Separation: A non-funding relationship (dashed orange line) between Phone 1 and Public 1 (i.e., a called party phone number).
• Second Degree of Separation: A funding event (solid orange line) between Public 1 (i.e., a called party phone number) and Phone 2 (Primary Node).
• Third Degree of Separation: A calling event (solid green line) between Phone 2 (Primary Node) and Inmate 1.

screenshot

When you select a value from the Min. Distinct Inmates dropdown list, The Analyzer℠ search results will include only called party numbers that have been called by a minimum number of Inmates.

screenshot

When you select the Completed Calls Only checkbox, The Analyzer℠ search results will include only called party numbers to which the call was connected between the inmate and the called party.

This selection will also restrict visitation events to those which have been completed.

screenshot

The default date range is set to the past seven days (one week), with the default time for start being midnight and end being 11:59:59. However, you can specify any date range for a search.

screenshot

The Analyzer℠ search menu includes the Inmate/Phone Search panel and the Public Search panel, allowing users to specify a Primary Node for their search.

screenshot

Searching for a specific inmate using his/her inmate ID or searching for a specific telephone number requires you to enter the exact information. You must enter the exact inmate ID, the 10-digit phone number (area code and number), or the 11-digit phone number (1 + area code and number) for the called party. You do not need to enter parentheses or hyphens when specifying a phone number.

From either the Inmate/Phone Search or Public Search panel, you can enter a string of characters in the appropriate fields to search for a name or email address (complete or partial search strings. If you enter a partial string of characters, The Analyzer℠ will automatically search and provide a pick list from which the Primary Node can be selected.

The Analyzer℠ enables you to search for:

• A partial string of characters from the inmate’s first or last name. Your search must begin with the first few letters of the name.
• A partial string of characters from the public user’s first or last name. Your search must begin with the first few letters of the name.
• A partial string of characters from the called party’s email address. Your search must begin with the first few letters of the email address.
• A partial string of characters from the Gang name. Your search must begin with the first few letters of the name.

When you enter a partial string of characters to search for a name or email address in a Name field or the Email field and click Search, a results list is displayed. From this list, you can click on any row to select an inmate or public user to search as the Primary Node. When you click on a row to select a name, you do not need to click Search again.

screenshot

After you click Search to initiate The Analyzer℠ search, a progress pane displays at the top of the page.

screenshot

The information displayed in the progress pane changes as the graph is being built. This includes the Counts/Progress items described in the following tables.

The Analyzer℠ module is connected to the ICS Point-of-Sale system to access account funding activity. If this connectivity is interrupted for any reason, the message shown in the following example will display to the left of the page title.

screenhsot

The Analyzer℠ graph size is based on certain criteria and may be excessively large. It can be reduced by:

• Degree of Separation – Decreasing the value will help reduce the levels at which the search will execute automatically.
• Minimum Distinct Inmates – Increasing the value will have a moderate to significant effect on the size of the graph. The smaller this number is, the more phones are included in the graph, in addition to phones having a large number of inmates.
• Completed Calls Only – Enabling this feature will have a moderate to significant effect on the size of the graph.
• Call Types – Decreasing the number of Call Types to be included in the search can have a moderate to significant effect on the size of the graph. A phone may be called by multiple Call Types and may or may not be included in the graph depending on which Call Types are specified.
• Date Range – Decreasing the range to be searched will have a significant effect on the size of the graph based on the interactions that occurred within a shorter time span.

To reduce size of the graph, you may want to reduce the parameters selected for the automated search. If you are still not returning the desired results, you can manually expand the graph or remove Nodes as needed.

The following two examples show how changing some of the Search Limits can affect the graphed results (size of the graph) by conducting the same search with different Search Limits.

Graphs 1 and 2 have the same parameters specified in the Search Limits panel, with the exception of Graph 2’s search not including Completed Calls Only. Without Completed Calls Only specified, the search for Graph 2 resulted in 161 additional Nodes with 665 additional relationships (interactions).

Graph 1

screenshot

Graph 2

screenshot

The graphed results for the two searches are displayed in the following example, which produced extremely large graphs for both but much larger when Completed Calls Only was not enabled.

screenshot

Graphs 3 and 4 were conducted for the same search as used for Graphs 1 and 2 in the first example above. However, the Degree of Separation Search was changed from a value of 2 to 1 in the Search Limits panel. Additionally, Graph 3 includes Completed Calls Only whereas Graph 4 does not. By not specifying Completed Calls Only, the search for Graph 4 resulted in 60 additional Nodes with 88 additional relationships (interactions).

Graph 3

screenshot

Graph 4

screenshot

The resulting graphs for Graphs 3 and 4 are shown in the following example. By lowering the Degree of Separation for the same search, which returned the extremely large graphs used in the previous example, the graph was reduced from 1,415 interactions (Graph 1) down to 167 interactions (Graph 3).

screenshot