Osint and investigation: innovative technologies for security1

this article was published by "Intelligence e Storia Top Secret" n° 8/2008 – www.centrostudiintelligence.org

by Giovanni Nacci2

Until recently, the leitmotif of the political debates about "security" seemed to be focused on the
theory - bipartisan - that for a more effective contrast to crime and terrorism troubling the today
society would have been necessary "to do more intelligence". Roughly speaking, this thesis seems
to be really difficult to refute, but just because it is presented in a so general way, becomes a
useless theorization. Hardly ever in fact, after the proclamation, the issue was seriously studied in
depth with an organized method and no clear, precise and flexible proposals were put forward.
Doing so, there's the danger that we give too much importance to images - not too much truthful -
that the current perception of intelligence tends to evoke among people.
And it's too easy and convenient to let intelligence pass as the "final solution" for the anxieties that
other means of control, prevention and investigation - even if legitimate and legal - (as provided by
a democratic system) can evoke in the collective imagination. Thinking to intelligence as something
to replace any other function, procedure or institution entrusted with security is a cultural error and
mainly a strategic one; it’s even worse to rely on its estimated low profile emotional impact.
Doing more intelligence does not imply the reduction of other security activities in any way. Indeed
- and is not a paradox - more intelligence we do, greater and more incisive the work of all other
institutions, engaged of public order and citizens’ protection in different ways, could be.
Intelligence is not a substitute to the investigative action of police or to its material and visible
presence in the territory (checks, searches, holding for questioning, arrests, even maritime
surveillance, etc..) or it cannot make this presence less necessary. Intelligence cannot be used as a
"good" method, politically correct, almost homeopathic, to let all agree on problems that everyone
tackles (when it happens) in diametrical opposite ways. The manipulation (more or less political) of
intelligence3 is the most harmful thing that can happen to a democratic nation.
In other contexts, however - especially certain academic circles, that in different ways are sheltered
from the background noise too often generated by a too much self-referential policy – comparing
research activities on the issue of possible similarities and potential points of contact between
investigation and intelligence are rich. The conviction that it is necessary to arrive at some best
form of integration between the two instruments, very different but complementary, urges scholars
and researchers.
Certainly institutional tasks of organizations, activities, practices and operational purposes - for
many well-known reasons - continue to remain separated, but intelligence and investigation - even
before being institutional functions of the state – are scientific disciplines that, as such, will use
scientific methods. Therefore there is no reason not to think about mutual transfers of knowledge
and experiences, at least from a methodological and technological point of view.
If we forget for a moment the concept of intelligence as a governmental function or as a set of
bodies and institutional activities generally attributable to the thought of the State security, we can
focus on intelligence as a discipline and a method, whose main purpose is to provide the best

1 Translated by Paola Di Cairano - www.attitude2web.net

2 Giovanni Nacci is a former Navy Officer. He started his career at 5° detachment “Cooperazione Internazionale e Infrastrutture NATO” at the
Central Balance Department of the Italian Minister of Defence., he is a consultant in methods and systems for the strategic treatment of
information and specialist in Open Source Intelligence applications. He is the director and founder of Intus Legere (www.intuslegere.it), a
cultural network whose aim is the integration between the Italian Intelligence community and Intuslegere.EU , a cultural source for Italian and
foreign scholars.
3 Often linked to the other solution thought to be magical and crucial: “we need more prevention”
information to support decision-making. In fact we can say that anyone who is in charge of making
decisions (more or less complex, more or less critical) can usefully take advantage of a
methodological approach based on the methods and systems of intelligence, whether they are about
viticulture or patents of high technology.
In other words, where the coming to a decision should result from a deep analysis carried out on an
exceptional large amount of information, or particularly complex, or in all those situations where
the available information results inadequate in terms of quality and quantity, methods and systems
of intelligence4 can make the difference between a decision based on a mere intuition or random
choices and a decision taken with the best awareness of the effects and consequences that it will
lead once applied to the specific context.
The aptitude for the decision making and the intuitive abilities is an essential quality for both the
investigator and the intelligence operator5, but become a strategic factor only if it is supported and -
we would say - "amplified and fortified" by a methodological super-structure aimed to infuse
decisions with qualities such as "persistence" and " practicability". Without the scientific method
the right decisions would become (at best) sporadic statistics episodes, that sooner or later would
resemble too much to non-scientific predictive lines of reasoning or - worse – to mere lottery.
From intelligence, especially open source intelligence, you can get to implement, even in
conventional investigation, those methods, systems and technologies that allow to the detective to:
1. on one side give a clear, dynamic and detailed description of each informative element and
the relationships between pieces of information, with the aim of achieving the highest possible
level of awareness of knowledge available on a specific topic (in other words, that information -
although marked as confidential or at a high level of security – is a full available source for him
and - therefore – become open source6);
2. on the other side exercise - when necessary - a more effective and efficient activity of
discovery, acquisition and recovery of that information that is not available yet, but marked as
necessary or useful.
With regard to paragraph 1) Indeed, we have to say that the amount of information, like data,
documents, reports, which is gradually collected during each phase of investigation (even better
from the survey until the verdict) is often impressive. Unfortunately, not so impressive is the quality
of knowledge that derives from that information. This is not caused, paradoxically, by the
endogenous quality of each piece of information, rather by the "informative disorder" in which - in
one way or another - that information is positioned, in other words by the limited "perception" of
the informative environment. Let’s make it clear, not that operators, investigators and prosecutors
are unorganized. The problem is that any order you manually try to give (perhaps it would be better
to say humanly) to a large amount of information, then that will certainly be an inefficient order.
Any human intelligence (even if it is organized in groups of scholars) will find enormous
difficulties in the classification and categorization of tens of ring binders, hundreds of folders,
thousands of documents and too many "concepts" expressed in texts produced even during the
simplest investigation of all. Of course it is possible to identify concepts and very important
elements through a good human analysis, connect them clearly, connect facts and people to more
evident events and on this basis start investigative activities. But the human analysis is not able to
consider all the possible latent relationships potentially traceable by a systematic intersection of any
4 in this case those mainly derived from open source intelligence
5 We can say the same for the manager, for the surgeon and so on.
6 “...from the moment that the information of a source, even reserved, has been obtained that same information would be used as a osint ....”, Prof.
Marco Giaconi (CeMiSS) private correspondence.
data, any piece of information of each concept, perhaps expressed in a non-Orthodox7 way. The
best approximation that detectives may have about the informative and documentary environment
that surrounds them is directly proportional to their capacity and those of their collaborators. But it
still remains - just - an approximation.
It’s scientifically proven that the human brain cannot view concepts and ideas related to more than
10 elements8. This means that we have a clear mental image of what ten pencils, ten apples, even
ten atoms are but not in any way we mentally visualize concepts as seventy-eight steps, or seventy-
eight cucumbers or seventy-eight pieces of information about seventy-eight different investigative
cases.
One of the qualities of the human mind, apart from the adapting feature, however, is its ability to
search – very often invent - solutions that can help its difficult tasks, including that of reasoning and
deciding. Here the advent of supporting tools such as language and writing, to arrive to - for what
interests us more closely under a purely investigative aspect - the visual diagram making, to
inferences, to the layouts liaison, to connection schemes, to association matrices and those of
frequency.
All these instruments are known very well by each detective and used in almost every phase of an
investigative action. However the problem of seventy-eight cucumbers still remains: we raised the
level of our perceptual and representative capacities of the world that surrounds us but, in our
current society so divided, complex and heterogeneous, characterized by an unstoppable flow of
information, this is no longer enough. Maybe it’s true that now we are able to manage the
“information overload” interpreted as a "blocking" phenomenon, avoiding to remain immobilized
under a mountain of information (it doesn’t matter if it is in the form of paper or of a sequence of
bits) but we cannot do anything more with that mountain anymore. We see, we perceive its
existence, we appreciate its size and its intrinsic strategic value.
We simply brush its surface. An area that - as easily attainable - is obviously brushed by many,
perhaps all, and therefore it rarely reserves really significant or advantageous elements. The
advantage – as at the era of the first gold and oil seekers - would be the ability to dig below the
surface to see what is underneath9, the ability to explore and extract from that mountain the relevant
information: the nugget that assures our competitive advantage over others. It is no coincidence that
one of the main technological tools (and methodological) that characterizes most methods of the
Open Source Intelligence is the Text Mining.
The Text Mining, namely the analysis and automatic understanding of texts, is a valuable aid in
investigating because it allows - together with other very important features - the categorization of
the concepts expressed in the text and therefore the automatic indexation of arguments, facts, places
and individuals mentioned in them. Once done, the consequent “weighed”10 visual map of relations
between all these elements, which are also indexed and clustered within uniform and coherent sets,
shows to the operator in a dynamic way as an evolving image of information at his disposal. This
map may finally be looked in up in a graphic form or - thanks to the ability of the language
understanding provided by the text mining - not examined by computer queries, but simply through
questions putted in a absolutely natural language.
Italy with its experts, its researchers, its companies and its technologies is at the top in this field.
Due to the Italian genius, or perhaps more likely to its ancient cultural tradition in the fields of
7 If I say “..this car is a bomb” would I always mean that I’m talking about a car filled with explosives?
8 Or it is not able to do it in a efficient way
9 In subsurface geology we would talk about log or “...the taking of a sample of rock from the underground, in order to analyze its chemical and
physical characteristics...” taken from the on-line dictionary De Mauro Paravia
10 Where it is explained the "weight", the relevance, the importance of entities and relationships in different ways
language and linguistics, that among the implementations of Open Source Intelligence systems, the
best security oriented solutions are Italian, with an Italian technology. Solutions and technologies
that - for those who still have some doubts - are rewarded and held in esteem abroad. If it is true
that we are xenophilous people, at least we can be proud of the "Osint investigating" project which
has already been fully operational for some time and that is the first tangible example of how
investigative practices and methods of intelligence can merge together obtaining laudable results.
On the 15th February 2006 the Italian Ministry of the Interior has launched an innovative program
creating the first system in the world of "Police Station on line"11. The commissariatodips.it is not
what may seem, a simple and trivial website for information. The website is just the user interface
of a much more complex and extensive application, forming part of a larger plan contained in the
"guidelines for the digitization of the public administration"12 This project, with its technological
and innovative importance, was voted as "Most inspiring good practice for creative solutions to
common challenges" during the 2007 European eGovernment Awards. This doesn't seem to be a
suitable place for studying the many innovative features of the commissariatodips.it project13 in
detail so I will analyze only those features that are more directly linked to the concept of open
source intelligence.
A strategic part of the commissariatodips.it plan is a component14 that is based on text mining
technologies to provide search functionalities and the dynamic classification of a wide range of
information collected from various sources. The text mining engine works on a large amount of raw
data (complaints and reports submitted online by citizens, requests for information via mail, up to
more purely investigative material available in digital form, etc.) operating an automatic language
analysis - based on morpho-syntax, functional and statistical criteria - phrases, dates, documents,
web pages and other sources15 extracting concepts and meaningful relationships, which are then
classified into thematic clusters and graphically represented through a conceptual interactive and
dynamic map (picture below).

11 www.commissariatodips.it
12 The Guidelines for the digitalization of Public Administrations approved by the Committee of Ministers for the Information Society at its meeting
on February 13th, 2002
13 Please visit http://www.epractice.eu/cases/olps website
14 The system is implemented by Sytnema Text Mining Solutions of Pisa. Www.synthema.it
15 For example databases, chats, forums, blogs, mailing lists, emails or texts derived from speech to text functions of the spoken language etc.
This allows the deep exploration of enormous quantity of documentary information operating a
certain type of research, which is always language independent16, based on the functional role of
each concept, semantic relation or word and not - as happens in the current Internet search engines -
only through the simple matching of words or keywords.
The canonical example in these cases is the following sentence:
«ti piace la pesca?»
Well then the system can identify subjects and objects, disambiguate concepts and also interpret
whether the sentence is interrogative or affirmative, turning it into four ontologically pure cases17:
1. question [acceptance [pesca [fruit of peach]]]
2. question [acceptance [pesca [the activity of fishing]]]
3. question [acceptance [pesca [quantity of draught]]]
4. question [acceptance [pesca [type of lottery]]]
Besides allowing a significant efficiency and reliability in the categorization and clustering of the
information, this also allows an increased capacity of the operator to explore less obvious aspects of
the information at his disposal, letting him identify relationships between objects that otherwise
would remain latent.
The ability to interpret some texts and recognize and represent the concepts (including people,
objects, events, places, etc.) and relations in a database, is a very important mean of help to
detectives, always struggling with the need to discover, understand and make a logical sense to the
famous five "W": who, when, what, where, why.
From an investigation point of view, such an instrument is useful - as mentioned before - to increase
the perception of the appearance and performance quality of the information that the operator has at
his disposal. The clearer the framework of knowledge is, the better you can use the information to
make decisions. From a point of view of pure intelligence, (but always oriented to investigation) it
is important to underline the possibility that these technologies give access to an inexhaustible
spontaneous and cooperative source: individuals.
The project of the Italian Ministry of Interior, structured in this way, either puts the citizens at the
heart of the institution, classifying them both as users of the services (assistance, complaints online,
information, etc..) or - far more important from a strategic point of view - as suppliers of
information or, in other words, as a privileged source. Just think about the value of that incredible
base of knowledge that will be built thanks to the complaints that citizens daily fill online and how
important it is for the detectives’ activity - especially in particular cases of crime – to have access to
all that information with the analytical capabilities of the instruments we mentioned18.
The transformation of the role of the citizens from simple users of security to proactive subjects
integrated into the information security system, is perhaps the greatest innovation in recent years.
For years experts have been examining – through an Open Source point of view - about what may
be or become the concept of Citizen Intelligence, how and how much the citizen can somehow
become a distributor of security for himself and his family, for his neighbourhood, for his country
16 In other words independent from the language the document or information is expressed in
17 The example was made using the Italian version of Wordnet, available at this address: http://www.ilc.cnr.it/iwndb/iwndb_php/wnit.php?
word=pesca
18 Especially when dealing - for example - to investigations related to child pornography offences, fraud on the Internet, recycling and cybercrime in
general
and also of how this can be framed in a broader concept of eDemocracy19.
The commissariatodips.it example is emblematic. It is the first step toward a collaborative
integration of methods and systems that hopefully will grow and develop putting the importance of
citizens at first place. This time Italy certainly is the first in Europe for sure and probably in the
world. A clear demonstration of absolute excellence in Italy among others that exist - in institutions
such as in factories - even in this area.
Let us be proud of it and persevere.

19 For further information: “L'Intelligence, le reti e... l'e-Democracy” di Giovanni Nacci, in RDEGNT, Rivista di Diritto, Economia e Gestione delle
Nuove Tecnologie”, anno III, n° 2 – Aprile ~ Giugno 2007, Editore Nyberg – www.nyberg.it