The challenge
Merseyside, particularly Liverpool, is a central hub for drug distribution in the UK. Its strategic location, with easy access to motorways and ports, makes it an ideal base for Organised Crime Groups (OCGs) trafficking drugs across the country. Known as ‘County Lines’, these operations are complex, spanning multiple counties, and often require collaboration between different departments and police forces.
These operations have become increasingly difficult to investigate due to the cross-border nature of the networks and their reliance on encrypted communications, burner phones, and the exploitation of children and vulnerable adults. These factors significantly complicate evidence collection and hinder the investigation process.
The solution
To tackle these challenges, Operation Toxic adopted the CIS, an end-to-end digital intelligence and investigation platform. The software provides an advanced toolkit for data cleansing, analysis, search, enrichment, and evidential reporting, enabling analysts and investigative officers to quickly extract actionable insights from complex datasets.
Since integrating the CIS, Operation Toxic has seen several key improvements, including:
Streamlined research and entity attribution
The CIS is equipped with a federated search and entity enrichment engine, allowing users to conduct comprehensive research across a wide array of subject types—such as individuals, phone numbers, social media accounts, businesses, organisations, bank accounts, and more— all through a single query within one unified platform.
This ability to bulk search hundreds of social media networks, consented databases (e.g., Companies House), third-party systems, and internal datasets at once has been a game changer for the force. The team has not only uncovered critical connections and actionable intelligence much faster but also saved valuable time by eliminating the need to access multiple systems manually.
In addition, searches can be executed anonymously using IP-obfuscation, ensuring users maintain operational security while gathering intelligence.
Query multiple data sources, direct from the CIS, in one bulk search
Advanced network analysis progresses investigations
The CIS features an advanced workspace and dashboard where users can pull in data uploaded to or sourced via the CIS, to be overlaid, visualised and analysed in multiple ways.
With the CIS, we’ve been able to link complex data sets, uncover hidden connections, and make real-time decisions that have directly led to arrests and safeguarding vulnerable individuals. It has become the backbone of Operation Toxic.”
Georgia Tyrer, Intelligence Analyst, Merseyside Police
Prior to having this capability, Merseyside Police would have to gather information from various systems and manually consolidate it into a network analysis tool, a time-consuming and fragmented process.
For Operation Toxic, this capability has been invaluable for investigating OCG networks as it supports the development of inferences and uncovering critical connections. For example, when analysing social media accounts, users can easily identify previously unknown associates and familial ties from the research results, immediately improving their understanding of the criminal network. They can then do further work to identify connections between entities and build dynamic network charts to visualise these. These charts are then continuously updated and refined as new information comes to light, ensuring that investigations evolve in real time.
Network analysis has also proven invaluable in strategic efforts to identify trends and hotspots for County Lines activity across Merseyside. The ability to apply hotspot filters directly to the map provides a clearer visual representation of high-risk areas, enabling more targeted and effective responses.
Overlay analytical, open-source and internal data. Visualise, expand and report in multiple ways to easily spot connections
Detecting connections, in Collections
The CIS houses an intuitive data ‘Collections’ tool, developed in partnership with Merseyside Police, which enables the secure upload of both structured and unstructured data stored in internal databases and files. Depending on the category, they can create data lakes for this data, which are then indexed and made searchable.
By centralising this data, it ensures all team members have access to consistent, up-to-date information, significantly improving collaboration and information sharing.
This is something the force had previously struggled with. Investigators often carried out their own telecoms analysis, which, while promoting autonomy, led to challenges in compiling strategic assessments and reports. The lack of centralised data made it difficult to accurately assess Threat, Harm, and Risk, or fully understand the impact of County Lines on the Force Control Strategy.
Using the CIS, investigators now create dedicated cases for each line, uploading relevant data and Chorus sessions directly into the system. As part of a shared user group, team members can access these cases and use the dashboard to perform analysis, seamlessly contributing to broader strategic efforts.
Centralise all structured and unstructured data for cross-case analysis
Merseyside Police successfully piloted the Collections tool and has since created comprehensive data collections for:
The ability to upload such a vast amount of data into the Collections portal has fundamentally transformed our investigative approach. To put it into perspective, we’ve successfully imported over 3 million rows of call data, more than 300,000 rows from master research and attribution, 600 investigation logs and trackers from the past five years of Operation Toxic. And this is just from our team—imagine the impact as more teams across the force begin utilising the CIS. The potential for further improvements in efficiency and insight is immense.”
Georgia Tyrer, Intelligence Analyst, Merseyside Police
- Investigation trackers –This allows the team to search an entity eg: person or phone number to see if it/they have previously been investigated, linked to or arrested in relation to a line. This has helped with inference development around OCG’s and establishing links between a nominal and a location.
- Investigation Logs – Officers in Charge manage these logs through a remote system rather than relying on niche occurrences, meaning they include historical investigation logs. The advantage of storing this data in a collection is the added context and “free text” details, which provide insights that are often absent in structured datasets like spreadsheets.
- Research Spreadsheets – These contain the master attribution for County Lines and Major Crime Unit investigations. The force often cross-references numbers with the attribution sheet, using a VLOOKUP between the master list and call data to avoid duplication. However, this format doesn’t provide context, such as how many grafts a number has appeared in, when contact occurred, or how often. To address this, they created a collection for Chorus Analyse Sessions.
- Phone Downloads – A challenge the force encountered prior to the Collections feature being added was that many devices were only briefly being reviewed to assist with charging decisions. However, the force soon realised that these devices contained valuable intelligence that could aid in attribution, intelligence development, and network analysis. With an integrated Review and Delete (RRD) function in CIS, the force was able to upload these downloads directly into the system, ensuring thorough analysis while maintaining compliance with MOPI regulations.
Conclusion
The integration of the CIS into Operation Toxic has truly revolutionised Merseyside Police’s approach to tackling County Lines and organised crime. By centralising intelligence, enhancing collaboration and expanding the capabilities for research and network analysis profoundly, the CIS has been pivotal in disrupting criminal networks and safeguarding vulnerable individuals. The force continues to explore the potential of the CIS to streamline operations and uncover even deeper insights, with the ongoing impact expected to be profound.
To find out more about the CIS and how it can help to transform your investigations, visit: https://info.chorusintel.com/getaheadwiththecis
