How a Storyteller Catches a Terrorist
May 7, 2019
https://www.youtube.com/watch?v=Rx41EYVF0aQ Peter de Kock is a film maker and former law enforcement professional. In 2014 he published his PhD thesis on predicting criminal behavior through a model based on narrative scenarios. With his company Pandora Intelligence, Peter de Kock works on applying this model to real-world situations. He presented his story, How a Storyteller catches a terrorist, at FRAUDtalks 2018 conference in Amsterdam. By profession, I consider myself a storyteller. I graduated from the Amsterdam Film School and worked all over the world as a documentary maker for fifteen years. Then I switched careers and became a law enforcement officer. While working in the police force I got my PhD, bringing together two different domains: film and police work. The central question for my thesis was: can we use scenarios as they are used in the film industry to better anticipate crime in general and terrorism in particular. The police were very interested in the results, but they couldn’t process them in a software application. So I decided to change my profession once again. I quit the police force and began my own company: Pandora Intelligence. Pandora Intelligence was founded a year and a half ago and recently we’ve been recognized as one of the most innovative, disruptive and fast growing companies in the Netherlands.
Police data: a hidden treasure
The Dutch national police work on a large number of cases every day. By my calculations, doing a single investigation by yourself would take up most of your entire working life. Unsurprisingly, the police end up with huge amounts of documentation on these cases, which contain a lot of information. Unfortunately, these documents need to be locked away in storage - either physically or digitally - so all that information is inaccessible. If you want to be a learning organization, as the Dutch police want to be, this is a setback.
From my background as a film maker I’ve learned how important narratives are. Throughout human history, we’ve passed on knowledge through stories. When we watch the news tonight, what goes on in the world is brought to us in the form of a story. Never underestimate the power of a narrative. I had a look at those cabinet files at the police from the perspective of a storyteller and I found that the narrative of a case fits in less than two binders. This was the birth of my idea: what would happen if we were able to condense all these police files into stories and structure all these stories in the same way so we can compare and contrast them? That was the basic idea behind my thesis.
What’s in a story?
Every single story can be told by means of a limited number of components, whether it takes place in ancient Greece or modern-day Amsterdam. There are twelve main components:
Arena
Time (frame)
Context
Protagonist
Antagonist
Motivation
Primary objective
Means
Modus operandi
Resistance
Red herring
Symbolism
Most of these components are self-explanatory, although the last two are different because they can be merged with other components. There’s no way to mix up Arena with Primary objective, or Means with Context, but Red herring and Symbolism can affect other components. Think of the Twin Towers attacks, where the Arena had a highly symbolic value. Terrorism and Symbolism are intricately connected. Without Symbolism, an attack is a mass murder or a killing spree, but not terrorism.
From theory to model
Underneath these top-level narrative components there are over 200,000 subcomponents that are intricately connected and become what in data science is called a graph. This gives us a graphic representation of the next terrorist attack, the next credit card fraud, or the next synthetic drug procurement. This is the basic outline of the next incident that is about to happen. To apply the model, we needed a data set consisting of incidents such as terrorist attacks and assassinations. When these narratives are structured in a similar way, it allows us to combine, compare, and contrast different incidents. At Pandora Intelligence we have created a data set with over 200,000 incidents, both from police data and from open sources. Right now, it’s the largest data set of terrorist incidents in the world. To account for creativity in the model, we have also created a data set of incidents that were conjured up by film makers, theatre writers and novelists. For example, the television series ‘Homeland’ is in the creative data set, as well as the complete works of Frederick Forsyth. The large amount of data makes it possible to apply AI techniques to the data set. Our AI tools detect knowledge rules from all these data sets and create new incidents based on the knowledge rules that they find.
Krakatoa in the Netherlands
This is an example of a case where we could use this theoretical model in a real-world context. I have altered several details to be able to share this in public. It was a 2015 incident in the eastern part of the Netherlands. People heard an explosion and noticed two severely damaged trees. The police investigated the scene and found this peculiar piece of copper. We entered ‘copper’ and ‘explosive’ into our model and it returned all the incidents that feature both copper and explosive. The model then pointed out the lines of similarities, other than copper and explosive, that bind all these stories. We found out that this could be a krakatoa, a canister filled with explosive and welded shut with a convex copper plate. This is something that any explosives expert could have told us. However, what none of the explosives experts could have told us is that a krakatoa is always made in sets of at least two. We got that information from our data set. And more importantly that the first krakatoa is always used in a test, while the others are used to carry out the actual attack. And what none of the explosives experts could have told us is that there is a time frame of four to eleven days between the testing of the first krakatoa and the execution of the attack. This is the added value of our system at Pandora Intelligence, which can connect different scenarios. Even though the first scenario and the final scenario might not be directly connected, they are connected through intermediate scenarios. For instance, we had the first incident featuring a krakatoa in Western Europe in our database, namely the assassination of German banking director Alfred Herrhausen by the RAF in 1989. Our system can link all these incidents far more efficiently and at a far greater speed than any human ever could.
Blast from the past
One of the incidents flagged by the model grabbed our attention, namely the dismantling of a bomb factory in Syria which involved a violent jihadist of Dutch descent. Open sources provided us with a lot of significant information about this incident, such as his nom de guerre and that he claimed to be an explosives expert trained by IS. Through open sources we also found out that he returned to the Netherlands two weeks prior to this particular explosion. Based on his phone records, the police could pinpoint him to the exact location of the explosion, exactly at the time the explosion occurred, and the suspect was arrested. At the time of his arrest, this would-be terrorist was twenty-four years old. To me, the value of a system like this lies in the fact that we can trace this jihadist back to an incident that occurred in 1989 (the assassination of German banking director Alfred Herrhausen by the RAF) when he wasn’t even born yet.