Advanced Investigative Case Management: How to Put More Insight, Intelligence and Collaboration into Effective Law Enforcement Investigations

1. Advanced Investigative
Case Management:
How to Put More Insight, Intelligence
and Collaboration into Effective Law
Enforcement Investigations
November, 2011

2. About us
 We perfect analytical and investigative processes in subject matter
areas such as fraud detection and identity theft, automated
intelligence collection, incident management, document
digitization and search, so that our customers can increase
productivity and reduce costs
 We specialize in workflow / collaboration, data management,
and data analytics
 We support innovation and best practice in Case Management
 We make information manageable and actionable
 To be fast and efficient we use our agile platform,
WorkwareOne™, which runs in the Cloud, or appliance, or in a
commodity computing cluster, or virtualized on a data center
server (or any combination thereof)
 We do not disrupt existing systems
 We deliver the highest quality solutions at the most efficient cost
in the least amount of time—we use Agile Methods on our Agile
Platform to achieve these goals
 We use our proven Engagement Model that is fact-based, rigidly-
structured (in our approach), fast-paced, and problem statement
driven
 Our product is our capacity to think, to solve, and to quickly deliver
great collaboration solutions on a resilient and adaptive platform
© Workware Systems Inc. 2011 Proprietary Information 2

3. Common goals of law enforcement agencies
 Guarantee investigation integrity and completeness
 Ensure compliance with standard operating process
 Utilize advanced investigation techniques, but make
them easy to learn and use
 Ease reporting burdens, leverage team knowledge
 Maximize team efficiency, and do more with less
 Measure and report performance
 Maximize existing technology investments, yet
dramatically lower IT costs
© Workware Systems Inc. 2011 Proprietary Information 3

4. Common case requirements of law enforcement agencies
Data Management / Data Integration
Common Data Store with Enterprise-
wide Search and Discovery
Knowledge Management & Secure
Collaboration
Case Management, Workflow, Access
Controls, & FOI Management
Relative Strength
Reports & Performance Metrics
1. Case Processing / Workflow
2. Resilient Data Store / Search
3. Data / Knowledge Management
© Workware Systems Inc. 2011 Proprietary Information 4

5. A foundation for advanced investigation support
• Collaboration is actionable
• Investigation outcomes verifiable
• Results shareable
Workflow & • Compliance and quality are ensured
• Domain knowledge is captured
Collaboration • Best practices become the norm
• Entire data lifecycle is efficiency managed
• Indexing, storage, search, retrieval, and retirement
• All investigation artifacts become searchable
• New and existing data are integrated
• Case progress made visible
• Clear performance dashboards
• Associate people, objects, and
events with ease
Data Data • Reduce case complexity
through visualization
Management Analytics • Geo-spatial and link analysis
© Workware Systems Inc. 2011 Proprietary Information 5

6. Brought together on a single secure platform
 The case becomes the
secure repository of
trusted information
Workflow &  Collaboration and
Collaboration knowledge sharing
throughout all processes
 An out-of-the box
solution
 Advanced analytics
Data Data
Management Analytics  Application layer tailored
for each agency
 Custom solution at a
COTS price
“The first step in investigative process
efficiency is getting everything on a
single platform.”
© Workware Systems Inc. 2011 Proprietary Information 6

7. With investigation case management functionality
 Easy-to-use graphical web user interface
Aggregate  Single repository for all case related information
Case
Information
 Store, sort, and report on interrelated case data
 Access historical cases
 Security and access controls
 Allow for multi-user access
Analyze any device, any where (subject to access controls)
Case  Match agency’s standard terminology and SOPs
Artifacts
 Document and track evidence
 Manage interviews, case notes, artifacts
 Visualize and share link analysis, geo-spatial mapping,
and case timelines
Produce
Investigation
 Tap all sources of agency knowledge and experience
Results  Manage calendars and deadlines
 Standard and ad-hoc report generation
 FOI management and case compliance metrics
© Workware Systems Inc. 2011 Proprietary Information 7

8. And out-of-the-box investigative case
management capabilities
1. Log and report all source incidents, search historical records
Incidents
2. Create an investigation from an incent
Reports
3. Link any incident to any case(s) Complaints
4. Make allegation information accessible and editable from within the
investigation
5. Assign cases to investigators, make collaboration effortless Investigation
Initiation &
6. Create secure electronic case repository
Data
7. Securely manage scanned supporting case notes and attach them to cases Collection
8. Perform full text searches and retrieval of documents related to cases
9. Visualize and display people, object and event association and linkages
10. Chronologically display events associated with a case Investigation
11. Support data interchange with MS Word, Access and Excel Data
12. Track activities of investigators working a case Discovery &
Analysis
13. Track case milestones
14. Track and summarize time charged by individual investigators to a case
15. Track expenses associated with each case
16. Track the referral of cases to other agencies
Investigation
17. Track recoveries associated with a case Report
18. Track Freedom of Information (FOI) requests associated with a case Production &
19. Track investigators progress in meeting performance objectives Performance
Measurement
20. Track District Attorney coordination
© Workware Systems Inc. 2011 Proprietary Information 8

9. Using powerful analytics for best investigation outcomes
People Objects
Weapon
Victim Document
Witness Property
Reportee Vehicle
Suspect Business
Arrestee Entity
Link Geo-spatial
Events
Analysis Analysis
Comprehensive analysis tools give case
managers visibility across all information
types to assess and act quickly
• Unique content analytics to discover deeper
case insight
• Intelligence made actionable
• Real-time dashboards to understand issues
Case Performance Metrics before they become a problem
© Workware Systems Inc. 2011 Proprietary Information 9

10. And a comprehensive case management approach
Aggregate Analyze Produce
Comprehensive Aided Investigative Report Generation
Data Management Discovery & Analysis
Repository
Reports of
Wide
Investigations
Search &
Retrieval
• Historical case files Take
• Agents notes Action
• Witness statements
• Forensic reports Geo-spatial Real-time
• Evidence descriptions Mapping & Operational
• Other case artifacts Analysis Performance
Metrics
Aggregate: Assemble all case material in a centralized,
repository that is searchable across all cases and online
agency data. Access and role controls enforce Guided Link
compartmentalization, when required Analysis of
Analyze: integrated, easy-to-use investigation tools for People, Administrative &
search, geo-spatial and link analysis Objects & Management
Produce: Automated investigative report generation Events Reporting
with background QA and policy enforcement. Real-
time operational performance metrics for case
progress and expense tracking (including alerts,
escalations, and action-response). FOI management
and tracking
© Workware Systems Inc. 2011 Proprietary Information 10

11. For proven and sustainable investigation advantage
 Investigation integrity
 Compliance with SOPs
 Efficient techniques
 Effective reporting
 Measured performance
 Maximized team efficiency
 Lowered costs
© Workware Systems Inc. 2011 Proprietary Information 11

12. Background Information
12

13. Case: a container of trusted information
 A Case is a managed collection of information
 A Case can be used to support an analytical
process, study an individual or group, follow up on
an incident or set of incidents, or accomplish many
other analytical and operational activities
 Cases contain both structured and unstructured
data and can be conducted through both manual
and automated processes
 Forms, workflows, automated processes, and other
aspects of a Case are controlled by the Case’s type
 Each Case is an optimal mix of formal and ad hoc
actions for each activity
 Each Case artifact has its own access management
controls. Read, write, and manage permissions can
be set for both roles and individuals
 A complete audit log is maintained for each Case Common Resilient Data
and contains every change made to the Case data
and access controls during its lifespan
Repository
© Workware Systems Inc. 2011 Proprietary Information 13

14. Collaborate through common resilient data repository
 Securely manage, store and search ALL files, documents,
case materials, media, and artifacts
• The Common Resilient Data Repository can store, manage
and make searchable almost any type of digital information
• Simple process to get information into the Repository in an
orderly and secure way
 Comprehensive, Case-specific access controls
• Completely definable, secure, and dynamic
 Accessible anywhere, on any device (web, pad, phone)
• All HTML5 / WebGL
 Near unlimited scalability and built-in redundancy
• Automatic redundancy of all data (Terabytes!)
 Very low-cost hardware and software footprint
• Commodity class hardware
• No Microsoft®, Oracle™, etc. license fees
• In step with Gov 2.0 initiatives
© Workware Systems Inc. 2011 Proprietary Information 14

15. Agile investigative case management support
System Wide Features
 Manage large numbers and types of cases quickly and efficiently
 Record activities, identify case bottlenecks, manage resources
 Attach any type of document / artifact securely to case
 Add notes, comments, wiki-style collaboration
 Cross-case search & retrieval
 Real-time insights, follow ups and early corrective action
 Complex case life cycle management
 Audit trails, discovery, and redaction (when necessary)
Closure &
Initiation Processing Future
Reference
Initiation Rules & Alerts Document Authoring Life Cycle Management
 Manual  Assignments & Reporting  Closure Discipline
 System-  Notifications  Document Authoring  Prepare for Discovery
Generated  Confirmations  External Reporting  Reference to Searchable
 Reminders  Discovery / Redaction Tagging Knowledge Base
 Escalations  Case Management Status  Retention Policies
 SOP Compliance Reporting  FOI Management
Approval & Review  Management Reporting
& Operational Metrics
© Workware Systems Inc. 2011 Proprietary Information 15

16. Easy to use web-based user interface
Case & Repository-wide Case Collection
Search
Roles & Task Assignments Case Details
Common Resilient Data
Repository
Reporting Statistics Access Controls
Geo-Spatial
© Workware Systems Inc. 2011 Proprietary Information 16

17. Scalable, fast, redundant data storage
 The Common Resilient Data Repository is a highly
modified Cassandra-based, distributed storage and
retrieval system for managing structured data (forms and
records) and unstructured data (notes, documents, email,
transcriptions, images)
 Designed to scale to a very large size across many
commodity servers, with no single point of failure
 Data storage is encrypted, secure and redundant with a
very small footprint. Inherent continuity ops capability
 Reliability, at this scale, is an expensive challenge for prior
▪ Data are distributed across the nodes in the cluster generation database technologies
using consistent hashing based methods and on an
order preserving hash function so that agency  In contrast, the Common Resilient Data Repository runs
analysts can perform range scans over the data for on top of an infrastructure of potentially dozens of nodes
analysis at some later point
▪ Cluster membership is maintained via a “Gossip”
(optionally spread across different enterprise data centers)
style membership algorithm. Failures of nodes within  Small and large components can fail without impact. The
the cluster are monitored using an accrual style
failure detector repository manages its persistent state in the face of these
▪ High availability is achieved using replication and possible failures ensuring reliability and scalability for
the platform actively replicates data across data
centers
stakeholders who rely on this service, at a low cost
▪ The platform exhibits incremental scalability structure never before achieved
properties which can be achieved as easily as
dropping nodes and having them automatically
 Design goals achieved – scalability, high performance, high
bootstrapped with data availability and applicability with a simple data model that
supports dynamic control over data layout and format
© Workware Systems Inc. 2011 Proprietary Information 17

18. A custom solution at a COTS price
 A complete package for managing
Investigative Case Management
collaboration, analysis and workflow
 Flexibility of a custom solution at a
commercial-off-the-shelf price
 Change as required, when
requirements change
 Extendable through a simple
contract at pre-defined rates, or
support for agency technical staff to
make changes and enhancements
© Workware Systems Inc. 2011 Proprietary Information 18

19. Business Contact: Phone: (888) 291 9015
Email: info@workwaresystems.com
Corporate Mailing Address: 815 1st Avenue, #375
Seattle, WA 98104