North Wales Police: A pioneering journey to the Chorus Intelligence Suite (CIS)

A partnership approach

NWP began its Chorus journey in 2017 with the roll out of Chorus Analyse, the industry’s leading data cleansing engine. The software was used by all Analysts to cleanse, format, map and report on communications data, such as Call Data Records (CDRs), handset downloads and Automatic Number Plate Recognition (ANPR). Proven to save 97% of time, the software quickly proved its worth in supporting Analysts to accelerate their investigations.

Whilst the benefits were significant, NWP was still experiencing investigative challenges across several areas. These included:

• Collection, interrogation, and attribution of data
• Evidential storage
• Disclosure and sharing of data and evidence

Chorus held extensive feedback sessions with its users UK-wide and found these challenges to ring true for many other forces also. In addition, a rapidly evolving issue was uncovered. Historically, all communications data analysis was completed by analysts within a police force. However, with data volumes increasing and the digital landscape changing, analysts were struggling to cope with the demands put on them.

With the requirements documented, Chorus tasked its software developers up with building a solution, and it was here that the idea of the Chorus Intelligence Suite (CIS) was born.

A demonstration of the software was provided to NWP in 2020 and, as one of the UK’s most forward-thinking police forces, it agreed to trial the CIS as a Proof-of-Concept (POC) across the force.

Advancing through lockdown

When NWP visited Chorus HQ in 2020, it was all systems go to adopt and roll out the CIS. One week later, the UK was thrown into lockdown in the wake of the Coronavirus pandemic.

However, NWP quickly overcame this barrier. The CIS is a Software as a Service (SaaS) tool and must therefore be deployed in a cloud-based environment. Working in partnership with Chorus, NWP migrated to a cloud-based service. This meant that it could continue with the POC because its Analysts were able to securely log on to the browser-based software from their laptops, whilst working from home.

Owen Preece, Head of Crime and Intelligence Analysis at North Wales Police said, “I was talking to a lot of my peers in other forces, and they were still on standalone machines or an on-premise environment. They were having to create rotas for analysts to go into the office and log on to their single access desktops, whereas we were all working from home. We could carry on with our usual analytical processes and were able to develop the POC with Chorus.”

Setting Priorities

To ensure the smooth running and overall success of the project, key stakeholders were assigned, and a strategic steering group created from both Chorus and NWP. Bi-weekly meetings were held to review progress, flag any issues and capture user feedback. These meetings proved crucial in accurately documenting the challenges, requirements, and priorities from NWP.

Fast forward 3 years and NWP has played an essential role in pioneering the development of the CIS via its detailed user input.

One platform, one workspace, one log in

The CIS is the first of its kind in the law enforcement industry to offer multiple capabilities all from one platform and one interactive dashboard. Comprising of data search, analysis, cleansing and evidence enrichment tools, end-to-end digital investigations can be managed via the CIS.

This presented a significant opportunity to NWP because one of the biggest challenges it cited was with the number of systems that its Analysts were having to log in to, to access and search for the data they need as part of an investigation.

Owen Preece said, “We don’t have any researchers within our analytical team and our analysts were spending so much time doing research rather than analysis. They were having to go into lots of different systems, with multiple logins, to attribute information. This was timely and impacted our efficiency.”

Chorus worked with NWP to understand what systems they required access to and developed a solution which would not only bring all these systems together in one place but also make them searchable. This would mean that Analysts would only need to perform one search query across all systems to obtain the information they needed.

NicheRMS365, a police records management system, and IBM i2 iBase, a modelling and analysis tool, were core internal systems that NWP uses to obtain data. A key priority was to integrate these systems into the CIS, something no other provider in the industry has been able to achieve. The integration was developed with all systems communicating, enabling NWP to improve its research capabilities whilst saving considerable time in the investigative process.

Security-first

NWP were extremely due diligent in its approach to connecting into and searching its systems via the CIS. It adopted a best-practice approach of conforming to Information Governance, ensuring that any sharing of data remained compliant. NWP also outsourced its security checks to an independent advisory firm, to ensure its systems could communicate with the CIS.

A smart approach to tackling county lines

NWP adopted the capabilities of the CIS as a phased approach. It firstly utilised the cross-case search capability. Simply put, it enabled Analysts to upload, store, and index all digital case data and make it searchable for cross-case analysis. For example, if a user has an entity that they need to attribute (name, phone number etc) this can be searched across all open and closed cases, to see if it has appeared before, revealing unknown connections.

This feature proved extremely beneficial when applied to the force’s biggest threat – county lines investigations. County lines crimes often involve repeat offenders. With cross-case analysis, NWP can identify key people of interest and develop a cohort of subjects that it knows are likely to be engaging with county lines. It can then be proactive in the way that it targets those lines, as they emerge.

The CIS also features an entity enrichment and attribution tool, which makes open-source research an automated process. It has provided significant support to NWP especially in relation to its county lines investigations and when used alongside the cross-case analysis tool.

Users can simply input a name, number, email address etc. and query over 200 social media platforms, consented databases, and internal systems, in one bulk search. This process accelerates the attribution process and ensures all evidential sources are covered, minimising the risk of undetected evidence. Any evidence found online can then be anonymously captured and saved to a case within the CIS instantly.

Owen Preece explained, “We will often query a phone number or address and use the bulk search function to attribute that to a person. Our Analysts can then use the cross-case tool to identify whether that person (and/or their cohorts) have appeared before and if they are associated with any other county line. If a person of interest shows up in a different town, we can ask ourselves, is this county line expanding, or are they attempting to encroach on a different drugs market? The CIS is a powerful tool for helping us to identity links and answer key investigative questions.”

Data analysis and enrichment made easy

The CIS enables users to overlay and combine all their digital data in one interactive dashboard, to build an advanced visual representation of a case. Call data, cell site, handset downloads, ANPR data, open-source evidence and more can all be visualised, to easily spot connections and answer key questions.

By connecting its police systems into the CIS, Analysts can expand on searches and draw this data together. Owen Preece added, “Having the capability to bring collections of data into the CIS and connect into our other crime recording data and intelligence systems, has made investigations so much easier in terms of making sure that we are reducing duplication of work and ensuring no stone is left unturned in identifying links.”

Case management and collaboration

Case management and collaboration was a major priority for NWP and the CIS delivers on this. Users can upload, store, index and search all investigative case data in a central and fully secure digital repository.

Security groups and access controls can be applied depending on the sensitivity of a case, and multiple team members assigned to work on, add and share data to a case file. Audit logs can also be maintained to document when any searches, web captures and activities are performed, by who and when. What’s more, the CIS also supports Review Retention and Disposal (RRD) controls, so users have peace of mind on how long data should be stored for and when it should be reviewed.

Owen Preece added, “We had almost 20 analysts, working on 20 different jobs, but they would work in silos, and we had no way of knowing if data in one case could be associated with another. There may be a person of interest across multiple investigations, but we had no way of knowing as we had no search ability for it. This would lead to duplication of work as one analyst would be building a case file for a subject whilst another was doing the same.”

Cross-border data sharing

The CIS makes data sharing, internally and externally, an automated and secure process and this is something NWP is taking full advantage of. It works very closely with Merseyside Police (also a CIS user), as many of its county lines investigations emerge from there.

At present, NWP and Merseyside Police share intelligence with each other manually, but as both forces are equipped with the CIS, there is a certain level of interoperability that benefits analytical teams. For example, NWP can automatically bring across any attribution from Merseyside (e.g. call data) and transfer it to their own case. They are then able to run reports, identify who the top contacts are, and then search these across their own data within the CIS. They can identify immediately if that contact has appeared in any other cases, identifying crucial links.

“Having access to Merseyside Police’s data just adds that extra layer of usability to the CIS,” said Owen Preece. 

Chorus is working with NWP and Merseyside Police to create a shared instance of the CIS where each can share their cases and make them searchable. This will open a whole new opportunity for cross-case analysis, enabling analysts from both forces to identify if there are any links between their county lines investigations and those that they are running from the other force. This insight will enable more proactive policing, disrupting county lines networks, faster. Chorus is confident of great outcomes and plans to invite other forces to participate.

Empowering multiple roles to get answers from data

A unique capability of the CIS is that it has been built with resourcing issues in mind and features intuitive, self-serve tools, so that multiple roles (not just Analysts) can use it to get answers from data.

To achieve this, Chorus replicated the features and functionality that exists within Chorus Investigate, its data cleansing and analysis tool for Investigators, into the CIS.

NWP has equipped its Digital Media Investigators (DMIs) and research teams within the Force Intelligence Bureau (FIB), Serious and Organised Crime (SOC) unit as well as its Threat, Risk, Harm and Firearms desks, with access to the CIS.

Owen Preece said, “The fact that the CIS is equipped with the full features of Chorus Investigate, is a real benefit. Previously these teams would need the assistance of an Analyst to do all their mapping, cell site analysis and attribution of call data. Now that can be done without an analyst, and we can optimise our resources. We have 35 licenses throughout the force now and expect this to increase overtime into additional departments.”

Looking ahead

The CIS has supported NWP in managing some of its biggest investigations, and as the platform continues to be developed and new functionality added, it will offer a powerhouse of capabilities for NWP and the wider law enforcement industry.

Owen Preece concluded, “What excites me is what we can work towards. We would like to connect our missing persons system (which currently doesn’t communicate with our crime reporting system) into the CIS and make it searchable.

The investigative opportunities that this will offer will be a game changer. For example, we know that youths who are drawn into county lines will often first come to our attention in a missing episode. Knowing where they went missing, who they were in contact with and where they were found is vital information to develop our intelligence picture to prevent their exploitation. Having this information available in the CIS would help bridge that gap.”

Looking ahead, NWP will also look to incorporate its prison data and ANPR database, into the CIS. The platform is also capable of tailoring integrations, where necessary.