Link Analysis — An Introduction — Part 1

Hello again everyone and welcome back to the underground. Today we're going to continue our series on structured analytic techniques by covering everyone's favorite link analysis. So get ready to channel your inner skitso and let's get started. So what is link analysis? Well, in simple terms, this is just a way of visualizing relationships between entities. So a very broad definition. You can think of this as more along the lines of the game six degrees of separation but for nerds, right? Every time The Field of Intelligence is featured in Hollywood, we inevitably have that one scene. One of the main characters standing alone in a dark room brooding over pictures or pieces of paper that are tacked all over their wall. All of course connected by red string or some other kind of uh fairly messy arrangement. And that's generally what we think of when we think of link analysis. And to some degree, this is a general rough idea of how it works. The main discrepancy is that link analysis is not really the face of intel work like it is in Hollywood. So, of course, Hollywood tries to play this up and try to make it out to look like link analysis is way more important and way more of a central focus point than than it actually is. But having a super spy scroll around Microsoft Word all day doesn't really look too good on camera. So link analysis, even though it's just one of the many tools that are used, tends to be the face of intel work in Hollywood. And because of that, even intel guys can sometimes place a little bit more importance on link analysis than there should be. So what are the main advantages of conducting link analysis? Well, for one, link analysis is a fantastic way to determine what you have already researched. It is easy to look at a graph and see, oh well, this one point here doesn't have any links to it, so maybe I should research that and see if I can link some of this stuff together. It's very easy and quick to see these missing links and either make the links yourself or conduct research in other ways, which we'll get to. Because of this, it helps to identify details that may have been missed earlier. It's really, really easy when you're juggling around a lot of random information. It's really easy to miss something. So, if you start off by organizing your thoughts and kind of doing a mind map, which is a form of link analysis, if you were to put all of this information just right onto a graph, even if you're not making any links, if you just put it down on paper somewhere, it makes it a lot harder to miss something later on. And as we know, investigations and intel work and even just research is not necessarily a linear path a lot of the times. And a lot of times, you're going to circle back around to details that you may have missed in the beginning. you're going to have to adjust priors, right? Such as in the case of more basian thinking. And link analysis is a way to reduce bias by putting everything down on paper so that we don't just ignore details that we haven't figured out. Often times during the investigative process or the intel cycle or whatever, often times we will have information or pieces of the puzzle that we can't really fit in just yet, right? We're trying to assemble a picture. We're trying to put together a puzzle and sometimes we've got to set pieces aside for a second because we don't know how they factor in just yet. Well, if you were to use another analytic technique, it may be easy to forget details or subconsciously or even intentionally forget details that you haven't figured out. Human beings naturally want to be biased in this way. If we can't see how something factors in, we just ignore that detail. And when it comes to investigations, that's maybe not the best way to do it. So link analysis forces us to keep details that we don't understand yet right in front of our faces until we can figure out a link later on. So what about the disadvantages? Are there any reasons why link analysis wouldn't work or maybe isn't the best fit? Well, it really depends on the type of data that you're working with. So if you have the wrong kind of data, then maybe link analysis isn't isn't the right solution. But one of the main disadvantages that I have come across personally over the years is that link analysis because of the Hollywood factor like I mentioned even professional intel analysts want to look at stuff like this sometimes and they might not understand that this is not the right tool. Sometimes it's better to understand that link analysis is not the tool that you need rather than try to spin your tires and just bog down and not actually get any work done at all. And we'll talk about that in a bit as it becomes a little bit more clear how it's very very easy to go way down deep in rabbit holes that aren't necessarily the most useful. But we'll talk about that in a moment because it's easier to have an example in front of us. Just know that for right now, one of the main disadvantages for link analysis is it's very easy to get trapped and sucked into one rabbit hole and go all the way down and follow that rabbit hole all the way to the very end only for you to have wasted a lot of time investigating something or researching something that actually isn't very helpful at all in the grand scheme of things. So that's the basic definitions of what link analysis is and the advantages and disadvantages of it. Now, when it comes to actually conducting link analysis, we don't actually use paper and string a lot of the times like in Hollywood. It's pretty rare these days, but I have done it the old-fashioned way. What is a far better solution, however, is to use software. And to broach a very highly controversial topic, here are two of the main software solutions that are used by the open- source community for link analysis. The first one is Maltiggo. This is usually what I prefer to use myself simply because of one little known detail. Maltiggo is basically identical to Palunteer, specifically Palanteer Gotham. Now, I know that this name will be very, very inflammatory to even mention because of the recent context of data security and data privacy and it's a very inflammatory company and I get it. It's not without good reason. But hopefully today by using Maltiggo a little bit, I can show you exactly what Palunteer is all about. Palanteer is a company that was built around one idea, link analysis and linking together a lot of databases. So if you want to be concerned about Palunteer, you absolutely should be. But you can only understand how and why to be concerned if you understand how the system works. Palanteer is of course a closed uh ecosystem, right? They only uh sell their product to government and military sources, law enforcement, things like that. And because of this, the only people who know what Paler actually is and what it does are people who have used it professionally. And trust me, that's a pretty short list. And I can tell you that as of 2025, Maltiggo is it's very it's much simpler. It doesn't have as many databases to pull information from. And it's obviously not tapped into the feds or anything like that. Maltiggo is basically just an open-source version of a lot of the feeds that Palanteer has organic to them. This distinction is important because of the extreme levels of fear surrounding Palanteer and people not actually understanding what it's all about. Palanteer Gotham is their version of a link analysis software suite. That's what it does. It was always suspected by myself and those who I knew who were Intel analysts at the time that Palunteer actually stole the idea from analyst notebook, which is the same thing, right? It's basically just a graphical software program that allows you to put dots on a chart and link them all together. It's a little bit it's a little bit antiquated nowadays, but you have to understand that's what Palanteer makes their bread and butter off of. They make their money. And the reason that they're such a a very influential company is not because they've developed Skynet, at least not yet, but because they're able to take a 20 or 30year-old software program, modernize it, make it slick and easy to sell to the government. Now, of course, this will change. They'll get better feeds. They're going to start incorporating AI into it, which is what Maltgo, I think, is going to do as well, but you see how it's all about building relationships and building links between entities. That's where the real fear comes in, not just with Palunteer, but Maltiggo and Analyst Notebook and some of these other platforms that are getting started, such as the other open-source alternative called Link Scope. I wanted to mention this one because one of the main benefits to Maltiggo is that it's commonly used. It's fairly uh available for everyone to kind of download for free. However, Maltiggo has gone the way of the government contractor idea, which is basically to jack up your prices by like 5,000%. A professional license to Maltiggo used to be pretty cheap. Now, it's over €6,000 a year just for a basic professional license. That's not even all they have to offer. So, it's out of the range of everyone, including myself. So, I just use the free version of Maltiggo. Now, understandably, there's a little bit of a social factor here. If you don't like what Maltiggo is doing, if you think it's pretty dirty and you want an open- source alternative, there is one. It's called Link Scope. There hasn't been that much development on it lately, but it's very similar. If you install Maltiggo and you install Link Scope and you compare the two, you're it's going to be very familiar. Once you learn how to use Link Scope, Maltiggo, Palunteer, Analyst Notebook, they're all basically within the realm of the same kind of ecosystem with each other. So, for my link analysis software of choice, I prefer to use Maltiggo when I do uh link analysis, which is not often, but I think I'm probably going to start getting more into it simply because I think that Maltiggo will work very very well with the notetaking and research application that I use, which is uh Obsidian. They don't talk together and they don't work together. It would be great if there was a plugin for either one that would allow you to bring in notes or search a database of notes. There may be. I haven't looked into it, but anyway, I use I like to use Maltiggo for more visual representations of links and link analysis and things like that, whereas I prefer to use Obsidian for roughly 99% of what I do. So, that leads us to the best use cases for using something like Maltiggo to visually represent networks on a map. For me, there are two main ways that I use Maltiggo. The first way is the most common way, which is just simply visualizing research in real time. I can throw a bunch of ideas on the graph. I can throw a bunch of entities, names, locations, addresses, phone numbers. I can throw it all on the graph and start working uh the network from there. And like I said at the beginning, it's also helpful for knowing what I've researched already. So if I've got a list of names and associations, and I have one on the list that hasn't been researched, I can very quickly see that uh both in a list format and also on a on a graph like you can see here. The second use for using Maltiggo specifically goes back to why it's important to understand what Palunteer does and what Link Scope does and what Analyst Notebook does, right? All those other platforms because Maltigo is not just a big whiteboard that you can scratch uh notes on, right? You can actually highlight things and use what they call transformations to conduct analysis of data points that you've put and an analyze relationships between the two, pull in information from the web and things like that. Again, this is why it's important to understand what Palunteer does because Maltiggo really relies on third-party API access. So, if you want to conduct a lot of research and you want to use specific tools, there's probably a plugin for it on Maltiggo. It's got a lot of resources, but you need to bring your own API key in a lot of a lot of cases. Once you've done that and once you have accounts with these other commercial companies, you can then ingest their data into Maltiggo. I know a lot of cyber security guys love this kind of thing and you can look at the plugins that are on Maltiggo and see that it's really heavily invested in the cyber security crowd. For me, I really just like visualizing the data. So, I don't use transformations as much as I probably should for a couple of different reasons. One, uh most of the links that I need to make between entities are manual links. So, I'm not really using Maltigo to its fullest potential, which is okay for now. We'll talk about the basics uh today and get into more of the advanced features at a later time. But the second reason is because it's not free. Uh you're going to consume credits. They have a credit based system, right? Like a lot of software companies are going to. They have credits that you get uh in your account. If you have a free account, you get I think 200 credits a month, which is not a lot. Anyway, that's more of an advanced thing. Let's stick with the visual stuff today. Let's stick with the documents and photos on a on a wall with string connecting them all. uh use for this platform which is fairly fairly helpful by itself. And to do that, let's get to a practical example. But before that, let's spend a little bit more time outlining the way that we need to think about things. I know it's annoying. Why don't you just get right to the chart? Well, this is important to understand because in the world of intelligence, there are few things more important than staying organized early on. You really want to organize your information early on so that you don't waste a lot of time. Time is not necessarily money, right? In the world of Intel, time is security. Time could be someone's life on the line. So, you want to make sure that you're approaching this with the right framework. Again, to prevent that disadvantage I listed way back at the beginning, going down rabbit holes that are not going to be helpful and may waste your time. You want to have a good starting framework and understand what you're doing before you get into it. more than any of these other analytic techniques. You really need to be cognizant and self-aware of what you're doing here. Trust me on this. I have wasted so much time myself going down endless rabbit holes that have been completely fruitless and now the day is gone and you know, you don't have anything to show for it. So, the starting framework that I like to use for link analysis is generally one of two things. In the Intel world, you're going to get two you're going to get tasked with things in two main ways. One, you're going to start with a question that needs to be answered. That's the easy one, isn't it? Somebody comes and asks you a very specific question, maybe even a vague question. Who knows? But they're going to ask you a question and you need to provide an answer for that. That's what the field of intelligence normally does. But more often, more commonly, is you're going to have a starting point that is not really tied to a specific question, but that starting point is going to allow you to find the answer later on. Raise your hand if you have ever been told by your boss, I don't know what I need to know, but I need you to figure it out kind of thing. So starting from a you don't know what you don't know perspective that's like your whole intel career for the most part or at least for most people your customer your client your boss whoever you're working for in the prepared citizenry community even you know your close family members or your community itself they're not going to know what they need right so you have to start with a lot of loose assumptions and bring that stuff together to kind of formulate the importance of what needs to be asked later on again this will make more sense when we get to the graph now you need to have a little bit of intuition here. I'm sorry. This is just something that you can't really teach. Uh the only way that you can figure this out is experience and and just working on this and working through this. You need to understand and you need to be able to identify when link analysis is beneficial to use. Otherwise, you're going to want to use link analysis for everything and it's a slow process and honestly from for a lot of the stuff you need to be researching and a lot of the information and intelligence you need to be processing, it's going to be a waste of time. So when is link analysis not a waste of time? When is it beneficial to do? Well, really anytime you have networks of people, places or things that can be linked together? If you've got a person and a business and a business address and a phone number and you've got a lot of that type of data, you can run it through your link analysis software. If you're tracking a terrorist, if you've got a terrorist and his buddies and their phone numbers and you've got it all tied to an address or a series of addresses, these kinds of data points are very very helpful. It doesn't necessarily need to be tied to a specific geographic coordinate. That would be helpful, but it's not necessary at this stage. Just know that when you see a lot of, you know, names, addresses, phone numbers, contact information, uh, data points that we can put on a map, lots of different numbers that you may not see any pattern to, but there may be a pattern, right? That kind of stuff. Uh, that's when you're going to really get the most bang for your buck out of link analysis. When you don't want to use link analysis is when you're just doing a basic research project where there's going to be very very complex ideas, theories, concepts, philosophy, anything to do with that, that's really not going to be useful for link analysis because you're going to put one point on your graph and then there's going to be everything linked to that one point. Right? If you're trying to examine who's this guy's friends and who are his friends and the friends of friends and what about their family and where they work, do they work in the same building? You see how we're starting to think analytically and think along the lines of making links? Yeah, remember when I said that uh link analysis was pretty simple? Well, it can get pretty complicated. So, if that doesn't scramble your noggin enough, let's actually look into the specific example I wanted to cover today, which is the Harender Singh murder investigation. So, let's walk through this. I'm going to walk you all the way through this and show you what I have done over a period of I don't know 8 to 10 man hours and we'll see exactly what information I can do and how I can develop out this problem set. So for those of you who are watching this in the future, uh the brief summary of this incident is that last week, last Tuesday, this individual was involved in a fatal traffic accident on the Florida Turnpike. Three people were killed due to his uh negligent driving tactics where he was trying to pull a U-turn on on the interstate and a minivan was not able to stop in time. Three people uh dead at the scene. Now, right up front, I personally identified this case as a good candidate for a link analysis due to a few different reasons. Right. So, overall, I have quite a few questions that I am very interested in investigating the answers to with regards to this case. I want to know what's this guy's history? Was this a preventable accident? Can we prevent similar things from happening in the future? Things like this, right? And the way to get to a lot of the questions that I may not have answers to is to start somewhere. So, what is the starting information? Well, we know the individual's name. Harender Singh. So, we have a name. We already have an advantage, right? You would not believe the number of times I've had to start a link analysis by using John Doe, right? The fact that we have a name to start with is something. It doesn't sound like much, but it's a lot. And from there, we also have crime scene photos in this case, which give us the ultimate jackpot, a US Department of Transportation number. For those of you who are not aware, semi-truckss all around the United States are required to have a US DOT identification number. Usually, it's going to be stencled or painted on the door. And this number identifies the company that uh this individual or this truck belongs to. So, right up front before we touch any kind of link analysis software, what do we have? We have the driver's name. We have the name of the company that uh he was driving for and we have the US DOT number. In this case, we also have the MC number. MC numbers, they're an old system. I think they're going to be replaced by US DOT numbers. So, you can use that. We'll put it on the chart. But really, we just need that US DOT number because then we can run that number through a bunch of databases and start to develop out this network. So, now that we have the starting information, let me go ahead and bring up Maltiggo and we can run through this investigation in real time and see what we come up with. All right, everyone. Here we are in Maltiggo. So, I want to state right up front, this is not really a tutorial on this. This is more of kind of an overview, getting our feet wet with this uh type of platform. We just want to have a general framework for understanding a general overview for how OSENT software, which is usually just link analysis software, works when it comes to conducting investigations. So, I've got Maltiggo installed. Everything's good to go. I've logged into my account. You've got to create an account with them even just to download this software, but don't worry, it's all free. You don't need to put any personal information in. You can just uh put, you know, anonymous information and you can still download it. But the reason that they have uh that login feature where you have to log in to use this platform. The reason for that is because all of these tools that you see here are going to be consuming credits when you use them. But don't worry about all of this. We don't need any of this today. We're just going to be creating a new graph. So we're going to go ahead and open up new graph. And we're going to want to save this project. So I'm going to save as. Wait for it to load. Unfortunately, this is the downside of using a Java based system is that sometimes it takes forever to load. Uh, so you just kind of got to wait on it a little bit. So, I'm going to name this one Harender Singh investigation test. I have a legitimate investigation folder. Every investigation that I do, I try to put in a folder. And this is because uh I like to organize things based on investigation names, sometimes dates depending on what it is. But for this case, this is going to be a named investigation for me. And if I'm going to use a tool like Obsidian or some other kind of tool, if I need to download PDF documents or images, I need somewhere to save them. So, I like to keep it all in the same folder. In this case, I also want to add to that same folder my Maltiggo products. Again, Maltiggo is not a one-stop shop for everything. Uh, you're going to need probably a lot of other tools which need a place to save files, too. So, I'm going to go ahead and save that. And here we are. We have a blank page. Now we can get to work. We can start our investigation. And the first step that we're going to do is vomit all of the information that we have onto this page. Right? We're just going to data dump all of the information that we have right up front. It seems complicated, but it's really not. And in this case, what we're going to do is add a lot of entities, add a lot of things that we know to this blank page. And to do that, we're going to be using the entity pallet right over here. Uh now in the case that you accidentally close this out uh a lot of the things in Maltiggo are not very intuitive. So what you need to do if you accidentally close out a window is then go over here to windows and then you can bring it back. So just bring back the entity pallet here. Remember entity pallet is all the things that you can put on your uh graph here. One of the very first pieces of information that we have is the man who we're investigating. Right? we have his name and he is in fact a person. Now once you start putting these in here, you will have a recently used uh category here in your pallet. But let's just say you didn't have that. We can just search for person, an entity representing a human. So we're just going to grab that and drag it right to our graph. Now, before we go further, uh just as a point of clarification, again, one of those little sticking things is not very intuitive unless you play around with it and figure it out is your selection tool here. So, just like selecting anything on any, you know, PC or Mac, right? You're just going to grab and drag to select things. Well, in Maltiggo, you have the option to select entities or links. So, sometimes you might find that if you click the wrong thing, wait a minute, why is my why is my thing not working here? I can't select Mr. John Doe here. Well, it's because you have to go to the investigate tab and toggle back uh to entity selection. Same thing with links. We'll talk about that in a minute. But just as a little point of frustration for those of you who recently installed this, uh that's kind of how it works. But we've got a John Doe on our platform here. And what is John Doe going to be renamed to? Uh, we can do this one of two ways. We can just double tap the name here, Harender Singh. And we've simply named it. This is very handy if we're just, you know, hand jamming in a lot of people's names if you if you have to manually add a lot of different people. But you can also doubleclick this and you can see here that is subdivided by first name, surname, and you can actually add the guy's picture, which is exactly what we're going to do because we know what he looks like, don't we? So, clicking this plus down here, we're going to navigate to the file path where I have saved his image. And again, it's Java, so it's going to take us take it a little while to come up. Uh, but now we can go ahead and select his picture. Let's see if I've got it still. Yep, there he is. And we're going to attach. And boom, there he is. Now we can click okay. And his picture has been updated. So, we actually know what the guy looks like. And we can even add notes and attachments if we want to. And I do want to add one note here. Let's add the context for why this person is being added to the to to the chart here. It's always good to add context, right? It's it's helpful especially when you've got hundreds of points on your graph here and you're trying to think and wonder why did I put this guy on here again? Well, if we have uh before we find a link to a person, we can put a note which helps us figure out exactly what this guy was doing. In this case, I'm just going to put that he was involved in a MVA, motor vehicle accident in Florida on August 12th, 2025, which killed three people. So, he is our central point of focus for now. So, let's go back to our entity palette here and let's start adding some more stuff. So, he wasn't uh just joy riding around. He had a company, right? So, we're going to drag a company. We can again, of course, search for the word company and it comes up there. But again, I've been adding a lot of these lately. So, now one thing that I like to do if you've got multiple monitors, if you like to nerd out like that, you can resize your monitors, uh, which is what I like to do. I like to kind of squish everything together and then add in a web browser, uh, right next to it. so that I can have a better workflow here. So, let me go ahead and do that. All right. So, I've got my web browser up and running. We've got a a good internet browser here to use to Google stuff and do some research. Uh we've got Maltiggo up and let me bring up one more uh just kind of minimized and that is Obsidian. So, uh again, this shows the actual investigative process. I started off in Obsidian just taking notes uh regarding the carrier this guy worked for and uh the number and things like that. and a lot of those details regarding the companies and I I rapidly realized hey this would be a good job for Maltiggo. So having a canvas in uh Obsidian or even just a text note as well that's very handy for starting your initial brainstorming and then once you realize the type of data once you're able to identify that link analysis is a good candidate for your investigative process you can then transfer over. So, I've done some minimal research here in Obsidian. But before we get ahead of ourselves here, let me go ahead and finish putting in what I know. We don't want to uh start the investigation just yet. We don't want to start looking for links just yet. We want to put down all of the information that we have. And there's two things missing. One is the company name. In this case, we know that it is White Hawk Carriers Inc. And we know that this company employed Mr. Harender Singh. So now that we have clicked off of everything right uh we don't have any entities selected we can now drag uh click and drag to draw a link between uh this company and Mr. Harender Sync. Now how you want to run the links depends on you. In my case since this company employs him he is an employee of this company. I'm going to draw it from the company to him uh just in case we have any other co-workers or any other kind of uh employees that may come up. And in this case, I'm going to label this link employee. Okay. Uh I can just leave the color the standard default color. What I like to do personally, it's all just personal preference, right? And I personally like to leave it a sort of gray color just for a routine link that I'm not quite certain yet. Uh we can see now that we have uh Mr. Hargender Singh here. to again to move uh these items around on your graph, you have to click to select it and then you can click and drag to move it around. Otherwise, you're going to start drawing links if you just grab it like that. So, uh the same thing for uh the White Hog carriers here. Click, select it, and move it around. So, uh this is how we can or start to organize things. So, what other information do we have? Well, we have that very important DOT ID number, don't we? Well, unfortunately here in the Maltiggo pallet, there is no such listing. There is no entity for DOT ID number. So, we need to create one, right? And it's very simple. All we have to do is go to entities, new entity type, and put in all of the information. In this case, we're going to make it a US do number. And you can put a description, whatever you want. And then you can choose an icon. In this case, let's click browse here to choose some of the internal icons. Let's go with transportation. Looking for a truck. Let's make this one a truck. Ah, here we go. We'll make it a truck. And then we can uh click next. And you just click through all this stuff. You don't really need to put uh any of this information. You can bring in properties from other icons. So, basically, if you have a uh an icon that that's already on your chart or graph, you can copy all those features. We don't need that. All we need to do is click finish. Now, I've actually already done this. I'm going to click cancel. And what we're going to do is search for US DO. And there it is. We're going to drag in US DOT ID number with our icon that we just chose. And now we can put in the information. So, in this case, the number, let me grab it right quick uh from my PowerPoint here. And we'll put in this number right there. That's all I need to do. You can put in other details if you want, but it's not necessary. So, now we can start making links, right? How is this truck here linked to both of these things? Well, this company owns this truck. Owned by and we can say uh this person was driving this truck driver. So now we've got a sort of three-way link here. And from here we can start to get vastly more complicated because we can now take this link and go over here to our web page and check all of the safety measurement system data for this DOT ID number. So, we put it in the search box over here and we can search. Now, look at that. White Hawk Carriers Incorporated. It has the DOT ID number there. And would you look at that? It has a mailing address. So, we can go over here to our entity pallet and we can just go to town here. In this case, I like to use location. Uh, the default is Germany. You can change that preset if you want. Now, you may be tempted to just grab this address right here and uh just put it right into Maltiggo. And I'm going to do that. But what I'm going to do first is something that I have uh learned through over the past few years of doing this, which is if you have an address, just take a peek. You don't need to do much. Just take a peek in Google Maps. It doesn't need to be much, but this again if we're bringing in some of the other things that we have learned, this is just me getting a feel for terrain analysis, right? Oftent times the analyst has to work on a lot of different things at once. And you want to start building familiarity with some of these things that you're working on, right? And one of the things that I find helps me quite a bit is just because I'm slightly paranoid, drop that address into Google Earth and or Google Maps and just see what's there. In this case, nothing out of the ordinary. It's a residential address on a corner lot. But what is right next door? A church. Church is right next door. And uh this may uh come into play later on. Maybe, maybe not. Hard to say. It's also across the street from a high school. So, you see, we don't need to put this down. We don't need to write it down anywhere. You can if you want. We don't need to be that uh crazy about it, but just take a peek and see see what's there at the address. Also, when when you drop these addresses into Google Maps, uh you get the Google coded uh street view here. So, a lot of times when some agencies or companies in other countries will put addresses in the the address won't actually be accurate and you may have to use uh the special geolocation code here. Um, but in this case, it's perfectly fine. And I can grab this, copy it, and uh double tap here in Maltiggo, drop it right in. No problem whatsoever. Right. And if you want to double double check to make sure that this address is correct, uh you can of course double click on it, see the information that is uh in there with it. And yeah, it's you don't really need much more information. You can break it out like this if you wish. Um that might be helpful for more data analysis, but for now again, we're keeping things simple. So what is the context for adding this address to this chart here? Well, again, we're starting to add links. So this is the mailing address and in this case uh it's a residential address. Isn't that very interesting? So a trucking company is registered to somebody's house. Not entirely uncommon, exceptionally common for a lot of LLC's and businesses, especially out in California. Uh but we can start to see that maybe that might become a factor later on. So if we just take a step back here, we can already start to see how how our investigation is progressing. Right? We started with this information. From that starting information, we have created links and we have conducted research to start to build out the network. Now we can add in even more information because obviously Mr. Hargender Singh here does not own this company. Who does? Well, what I can do is grab the name of this company here using the analyst favorite. Ctrl C to copy and CtrlV to paste on your keyboard. And where do I want to put this name? I want to put this name in bisprofile.net. This company, this agency allows us to search to see who owns this company. So, let's go ahead and controlV to paste it in the box. Search. And would you look at that? This is our company. Now, we want to prevent bias, don't we? We want to make sure that this is in fact the correct company. So, take a look at this. you've got the same name, but there's also, you know, other companies that may or may not be affiliated. But we can cross reference this with the registered mailing address. And as we can see here, in this case, it's 2521 Acorn Lane, the same that was registered with the DOT. So now we know that this is the right company. And would you look at that? Navit cower. We have a new person to add. So let's go ahead and drag a new person here. Navnit cower cur cower don't know how to pronounce it but either way now we have a person to draw this to now from this person we can draw a link because they are the registered agent for this company we're starting to add things out and this mailing address is associated with them so they are associated with this company at this mailing address in two different places. Right? So now we've got a this company is registered at this address and this person uh is linked there too because they used this address when they filed for uh creating that company. So maybe redundant, maybe not, but it's about making links, right? So So from here, we've got a few different options, don't we? It's all based on personal preference. Well, in this case, what I want to do because I'm more concerned not necessarily about the employee who started all of this. I'm more concerned about the person who they were working for because this guy this guy's in jail, right? And why is he in jail? Because it is assessed that he killed someone. So I can even put a crime in here such as murder. Let's see here. The template is Germany Florida Turnpike MVA and that can be the let me give it a name. It is it is being investigated as a vehicular homicide which for categorization purposes is murder. So uh we'll we'll list it there. It sounds kind of harsh but that's the way that it is right. So we will call this one involved in incident. Okay, just to draw that link there. So you can see how we have a lot of different uh things we can add to the map. Now let's turn our attention to Miss Navit Cower here. C I think is how you pronounce it. Let's grab that name and let's do a search because uh this wonderful website called Biz Profile will let us search by name as well. And when I do a quick little search like this, you can see that this person has a lot of uh businesses registered in their name. Now, this could possibly be a red herring. So, we got to we got to tread carefully uh because again, let's do this uh the analyst trick here of just googling something and see what comes up first. Yeah, a lot of people. We've got doctors, College of Agricultural Sciences, uh somebody on on Instagram, and apparently an actress. Okay, so this name is fairly common. I would assume or I can surmise rather from this Google quick little Google here that this person that this name is a very common name. So we want to use a little bit of analytical discretion, right? Use that old gut feeling that we have here. And we can see that uh the person who registered this company, White Hawk Carriers, there's somebody with the same name registering an awful lot of other uh transportation and cargo companies. So, we can see where we're going with this. From this one person, we now have a lot of different links to investigate. And you can hand jam all of these in and cross reference them. Uh but really what you're probably going to want to do is use a little bit of analytical discretion in determining which ones go on here. Now, of course, you're interjecting yourself. You're interjecting your own uh analysis and bias potentially. So, you want to make sure that you're making a good decision here, but remember, human beings are not perfect, right? So, we've got to use a little bit of analytical discretion from time to time. And for instance, uh this person here who is a registered doctor in San Diego, uh they may be the same person. Um but maybe not. I don't know. Uh this freight company in Union City, California. H that's probably more likely. American Auto and E Solutions. H probably probably more more along the lines of what we're looking for. But let's go ahead and just add the first one in here, which is another company called Schube Express. Let's see if we can just add this in real quick. Shou Express Incorporated. And again, we can add a link registered agent. There we go. And again, Shub Express Incorporated. Look at that. They have an address. Quick little uh analyst tool here. Take a look at it on Google Maps. All right, let's take a peek. Yeah, residential uh looks like single family dwelling maybe. Yeah, single family residential business here in central Oh, yeah. Central California, just south of Sacramento. So, all right, we're starting to kind of get a better picture here. So, let's go ahead and grab that address. uh drag a location over, paste the address and mailing address. Now, I know that for Maltiggo users who use this quite routinely, I may be annoying you greatly. Uh because this is all just personal preference, right? Most of this, all of this actually, I'm hand jamming in. I'm I'm putting this in my hand. I'm doing all this manually. You can, if you so choose, use Maltiga more as an investigation platform. So for instance, this is a person uh named Nevnit Cower. And if I select their name, rightclick, now I have all these transformations. I can search Google with their name. I can try to find email addresses associated with that name. I can do all this kind of stuff from within Maltiggo. Now, we'll get to that. I don't want to downplay those features of this platform because that's kind of what sells this platform and warrants the uh you know thousands of dollar subscription to this per year for big companies. But for now, let's keep things simple. Right? Let's just do some link analysis uh the old school way, just digitized. Right? Now, as we can see here, I've gotten uh quite a few links here just from based off of our starting information here. I've gotten a few different things uh that we can link to. So, uh what I can do is change the way this data is visualized by clicking these layout uh things over here. And I can choose different ways of uh organizing the data. See, I can make it seem a little bit more organized here. This is great for sharing your information. Remember, Intel is a client-based structure, right? Career. So, you've got to make your information uh disseminatable or presentable to somebody who's not an Intel person. So, if I were to, you know, uh move these things around here and kind of make it messy and uh not really professional, like what is this? This is this is stupid. Like, this looks horrible. But I can go ahead and click these different ways of visualizing this data. And depending on what the client wants or what they need, uh you can you can flex it that way. Uh so really it's just kind of an easy way, one click to kind of do this sort of stuff. What I what I like to do is leave a nice clear space over whoever I'm working on. So in this case, I'm trying to add in Nev Neat Kors businesses, right? So uh I want to uh leave some open space here. So I can just drag over and then make the links. And then every now and then just tap that uh tap the organize button to kind of put everything into perspective here. But now again uh we can just continue on because I'm trying to put in the businesses for Neav and I can show you what I' I've come up with over the past few hours uh of doing this. But again, we want to make sure that we're keeping the right perspective here. We want to make sure we're not wasting our time and just going down needless rabbit holes. If you're trying to develop a hierarchy to find out who really owns something or who's really in control, you see how the news the news media might be tempted to just stop at the driver. No, he's not. He's the end of the he's the end of the line, right? The the actual person calling the shots is probably higher. And we haven't even gotten uh past this person yet. So this is why all of this emphasis on organization and why it's necessary to talk for so long about being aware of rabbit holes because you can go down and you can start researching every little bit here, every little icon, every little thing and then just waste a lot of time, right? So what I'm really trying to find out is who's ultimately responsible for this guy and what's the deal with this? Because I've already identified many different companies. I need to put all of these in. But check this out. I can grab that address for the for the other company and say Shub Express Incorporated. Let's grab that address and put the address into Biz profile and let's see if there are any other companies registered at this address. And as we can see, yeah, there are quite a few companies registered at this address. So if you recall uh when we were searching uh Miss Navit Cow's name, American Auto India Solutions came up, right? and it was associated with her and now it's registered at the same address. Check that out. Is that not interesting? So, now we have we're starting to develop these uh companies. So, let's go ahead and drop this in American Auto and E Solutions LLC. Sounds like a board here. And and some of you may know where I'm going with this as to why this is worth doing uh here in just a second, but let's go ahead and drop in the location. It's the same address actually. So, we don't actually need a new one. They're at this address. So, the mailing address for American Auto and East Solutions and the registered agent is Navnet Cower. So, there we go. Now, we're starting to build these links here. Now, let me go ahead and click the organize button again. Do you see? We may be starting to map an enterprise perhaps. And maybe those of you who look into this, you'll know exactly where I'm going. What do we have going on here from this one guy who got into a car crash with this number on the side of his truck? We have identified, ladies and gentlemen, what I suspect to be the classic LLC shell game. That's right. It's probably a bunch of companies running under a bunch of different LLC's so they can get different DOT identification numbers. And to confirm that theory, let's just grab a name of one of these companies here. Let's uh yeah, let's grab White Hawk, the original company we started with, and let's um I want to check something really quickly. Let's instead of checking it in SMS, let's check a different database, the SAFER database. The US Department of Transportation, Federal Motor Carrier Safety Administration Safety and Fitness Electronic Records Safer System. Wow, what a mouthful. Anyway, this is the DOT database that you can search for US DOT ID numbers. the MC or MX number again which is being phased out I think but also the name if you don't know the US DOT ID number uh you can search by name which is pretty helpful uh for those people who may not be in compliance with making their US do number very visible on the side of their trucks. So if you have an investigation to conduct into a you know logistics or trucking company and you you don't know what their DOT number is but you know their name you can search by name which is helpful. So, let's see here. We have White Hawk Carriers Incorporated out of Steras, California, which jives with the address uh that we have registered here. But there's also another one registered as Sparks, Nevada. Hm. Maybe that's something else we can look into, right? Well, let's start with this one for instance, and let's see to confirm here. Is that the same DOT identification number? It is 286642. Uh, and we can see uh all of the information about this particular carrier. So, we can confirm. Yeah, same address. Uh, we can see the number of mileage that they have, what they're authorized to carry. A lot of stuff is not particularly useful, but we've got some other names to check, don't we? And I don't know the uh DOT identification number for SHU Express Incorporated. So, let's go ahead and drop that one in. Okay, there's one in Lup, California. All right. So, there we go. Now, we've got some stuff to put in there. All right. Check it out. The address, the physical address for this company, 1793 Holborn Drive. Look at that. Same address. And now we have a US DOT identification number. Check that out. So, we can add another one. And we can give this DOT number. Oh, and look at that. We've got a phone number, too. It's pretty helpful. Got a phone number. Not a physical handset. Just the number is fine for now. Check it out. Got a phone number. What do you think the chances are of this being a cell phone number? This is just some driver's uh phone number that they've probably used for other things, too. Interesting. Uh but anyway, yeah. So, you can see how we can start adding these these things in. Let's try American Auto and EC Corporation just to see if this one comes up. It does not. So, my suspicion is that it probably has that and symbol impacting the system. Yeah, it's not there. Interesting. So, they are not a registered carrier. They may be actually like a repair place or something to do with trucking. But you can see how we're starting to develop the network now. It's getting bigger, isn't it? So, let's just take a break for a minute here. As fun and as interesting as this stuff is, we got to remember or we've got to take a step back occasionally and ask ourselves, are we getting closer to the truth or are we getting further away? Are we getting closer to answering the question? Are we are we getting closer to completing the task we were given or are we getting further away uh from the situation? And as you can see here, it's very easy for me to just take these uh addresses here and go back to say biz profile and just start running through these and I can start adding names. See there's data vault LLC is another company and we have a whole different name here. So, you know, if I get caught up in myself here, what I can do is I can just start adding in all these, you know, random companies and linking these to the same address, you know. Um, and it's not particularly helpful. So, that's just something to be mindful of. You want to make sure that you're not just sitting here and just crunching these numbers in. I mean, sometimes it helps, but this is the kind of thing that a junior analyst is going to be tasked with a lot of the time. So, you just want to make sure that your guys aren't uh wasting their time here by going down these endless rabbit holes. You can do this all day long. Look at this. You can like it's just one to the next to the next to the next. Again, this is the LLC shell game. This is what the whole thing is designed for. They nest these LLC's uh within each other and it just keeps going around in a circle. I guarantee you if I search five more times, I'll end up with either Bin Laden or Hitler at the end of this sort of thing. So you see how we can kind of get farther and farther away from the goal we were trying to uh reach. But if we just stick with the second degree of separation, which is uh the guy who caused the crash, the person who was a registered agent for his company, we can start to get a little bit more uh clear picture here because this person seems to be quite central to this whole thing. And the cool part about Maltiggo is if we just zoom out uh you can see how the icons become uh uh colorcoded based on this legend down here at the bottom. So this is very early on in the investigation. I've taken you know just a few minutes to do this and this is what we've got. So this is the basic overview for how Multiggo works, right? This is the basics of any link analysis software from Palunteer to Maltiggo analyst notebook or whatever else is out there. Most of them operate like this and most of them have features so that you can click on things and use other kinds of uh utilities and tools to bring in external data and do all kinds of cool stuff like that. But really the heart of the the heart of the issue here is this link analysis part, right? Just visualizing all these links and having a quick way to kind of organize them in a way that's pretty pretty cool to see. So with this in mind, let me continue working on this for a few more hours and I will cut back when I have developed this out a little bit further uh than I have now because obviously this takes some time. So let me give it some time and I'll show you what I was able to come up with after a few hours worth of work. All right. So, here we are after a couple hours worth of work. And as we can see, the network is quite a bit larger. And we can see the benefits of conducting link analysis because even without me zooming in to show you what each of these things are, you can look down here at the legend to see what types of little bubbles here are on the on this chart on the graph. And we can see I'll just give you a little bit of a cheat here. This is the one that we started with. This is Mr. Harender Singh and as we can see he is actually out on the periphery of all of the information that we have. So in the grand scheme of things we can actually see that Mr. Singh here is actually not that important. So if he's not the one that's important or we should kind of focus on who is well we can see here that one person one of those green dots seems to be at the center of most of this. And who is that person? Well, we can see that this is one Navnet CR. So, as we can see, even without knowing exactly who this is, we can just look at this and see that this is kind of a tangled web of what types of entities do we have? We have locations, we have companies, we have people, and as we can see, it's a pretty tangled web so far. But there's one central point of focus. This person right here, Navnet Cower. Now, we have to keep in mind that this is largely just due to my own research, right? So, if I were to take any one of these other random people, could I possibly build out the same thing? Maybe. I don't know. Remember, work expands to fill the time allotted. If you have a lot of time to work on something, you're expected to produce more. And if you don't have a whole lot of time at all to to do very much, then expectations should be managed appropriately, right? But overall the analyst themselves has to be responsible for their own time and you have to justify why you were looking into something or why something has taken too long or it's uh you're going to need more time to complete a task. Right? In this case I spent a lot of my time focusing on Navnet Cower. And if somebody if I was working for say a client and they asked well why did you pick that person to spend the time to uh focus on so much? I can say well they were the registered agent for the company who uh of the individual who we started investigating. So I started from there. That's a good justifiable uh research method or or point of investigation. Right? This is why this kind of thing matters quite a lot. Right? And if we were to zoom in a little bit and start looking at some of these points here, uh we can see why just one missing link can kind of derail your your whole system here. So I left one link not made and maybe if I pause here for just a moment you can see the link that I have not made for the purposes of example. So the link that I have not made is the link that needs to be made between Harender Singh the guy we started with and the location of India. I did not make this link because I wanted to show you how this changes the graph. So let's go ahead and make that link now because uh the authorities in Florida and the federal authorities have also confirmed that Mr. Singh here was an illegal immigrant. So So let's go ahead and put him in as an illegal immigrant from India. And let's go ahead and back out and refresh our graph. And we can see where did he move? He moved from the periphery to kind of a central part here, right? So he's now kind of associated with a lot of these other people and linked to a lot of these other people who are linked to him. So again, this whole spiderweb of an existence here can get pretty crazy. But once again, what's the whole point of this? What's the biggest danger I've been trying to prevent uh when talking about this? Focusing on the wrong thing. For right now, we can see that the guy who killed those people in Florida is really just kind of a pawn, which should come as no surprise, but all of the media focus, all of the investigative focus, all the social outrage is focused on this guy here, and he's just part of a much bigger systemic problem. I know that this is quite an overwhelming topic to cover, especially when we start getting into larger networks. And trust me, this is actually a pretty small network comparatively. you imagine if you had tens of thousands of dots here on your map that you could cross reference and uh use a lot of these uh transformations on. But anyway, I know that for right now, keeping things as simple as possible is probably for the best. So, let's go ahead and jump back to the slides and we'll see if we actually got any closer to our goal by doing this line of work. All right, so wrapping things up here. What have we learned? Well, from our very basic investigation, it may seem to be complicated, but it's still a basic investigation. From our basic overview, we have identified that Nevnit K is a central figure in this entire thing because this person served as the registered agent for many different trucking companies. It may be very likely that someone at a different company also has the same level of risk. Right? So, we've identified a key person to investigate further. We've also found out that this uh most of the people involved in all of this are carrying out the LLC shell game, which is a common thing that you'll find in most private investigations. People will nest LLC's within each other. They'll use different mailing addresses for different LLC's, but they're all doing the same kind of work and they're all associated with the same person. It doesn't cost very much to register a company name. And if you've got 50 different relatives who will all let you use their address to do so, it's very easy to have 50 different companies in the same exact area as a way of trying to obfuscate things either for tax evasion purposes or to keep uh in business when one of the LLC's gets shut down due to safety violations, for instance. And in this case, this appears to be exactly what this company is doing. Again, this is private investigation. I'm not working for anybody. It's just me on my own. But even I can look at this and say, "Yeah, this is what they're doing." When one of the when one of their companies gets rolled up or gets banned from operating, all they got to do is just switch to another company, change the ownership of the trucks over, the trucks are probably registered in one person's name anyway. So, they just switch that over and now they can begin operating as a new carrier. Same vehicle, same driver, same owners, but to the DOT, it's a completely different company that's never existed before, ever. So they get a brand new fresh DOT ID number to register uh with authority to serve as a logistics carrier in the United States and the cycle continues. Right? So we've already identified the threats that may come out uh later on. And even more than that, if we look at our chart, we can see that a lot of the places that are registering as addresses, a lot of these companies are registered at addresses that are right next door to immigration services. Considering that this individual has already been identified as being an illegal immigrant and therefore not supposed to be doing what he's doing, we can see that maybe there's a little bit of immigration fraud involved in all of this. So, you can see how we've maybe identified a much larger network just based off of dropping uh entities on a graph and clicking to make links between uh different entities. So we can see how just from me using the free version of a software uh package and to open government databases and just doing this manually without using any transformations without using any of the tools that Maltgo is supposed to do. I just use the very basic functions. This is what I could find. But again to bring this back to the world of intelligence we have to remember what the overall goal is here. Our goal is to help with operational planning. If we recall intelligence is not journalism. Journalism should be just the facts, right? No analysis or any kind of theory or context or anything like that. It should be just the raw information. Intelligence, however, is processed information. And what does it mean to process this information? Well, it means to take raw information and run it through an analytic process, right? using these analytic techniques such as link analysis to not just explain what has already happened but to hopefully figure out patterns to help us figure out what's going to happen in the future. That's the whole point. Link analysis has a very real danger of encouraging backwards thinking. It is very very easy for me to sit here all day long and just put in addresses and company names and people's names into Maltiggo and not actually get to the meat of the matter. Diminishing returns is a huge thing with the with link analysis and we have to remember that because what are we trying to do? We're trying to predict future threats. And so far, I've got enough information. If I was working for someone, I have enough information to take to my boss and say, "Look, you've got a bunch of different companies. They're all using different mailing addresses. They're all trying to play the LLC shell game to hide their drivers and their vehicles. When one company gets banned from operating, a new one miraculously sprouts up with a sim with a very similar sounding name. Sometimes in in some cases, just one letter is different uh in the name, and they get a new DOT ID number. They jump through all the paperwork hoops that they need to jump through uh once they get that LLC and they're back on the road again. And no one is holding the companies accountable. They're arresting the drivers, of course, uh if they commit a crime on the road at the scene of the crime, they're being arrested. But the companies are not. They're they're getting away scot-free. Oh, and just so you know, a lot of these companies are operating either at personal residences of family members or they're operating in business parks where the business across the hall from, say, a trucking company happens to be an immigration services company. Oh, and the person who runs that company has the same last name. So, we can see how this is all very much a hot bed of risk when it comes to say logistics and trucking, which again should not be surprising. But what is the overall assessment here? What is the overall piece of information that we can run with? Well, we now have a list of companies and persons of interest that may cause future fatal accidents. That is the very basic level of what we have done here today. We have gone from one guy who caused a traffic accident to identifying all of the other companies and persons of interest running those companies who may be engaging in similar behavior. And as we can see from this big yellow arrow here, now the work of Intel is done or mostly done. Work of Intel is never done. But we can see now that this is no longer an S2 problem. This is now in the S3 shop, otherwise known as operations. So if you were working professionally, you would roll this up to a client or a boss and whatever way that they wanted the information. But for me, I'm coming at things from the perspective of the prepared citizen. So when I say send it to S3, right? Send it to the S3 shop. Really, I just mean myself, right? Because if you're a company out there and you are trying to ship something freight across the country, you might want to know the companies that are engaging in behavior that is number one illegal, but also endangering people, right, and not being safe. So, you want to know this because currently a lot of the safety standards that trucking companies have to abide by, they don't factor in all the details they need to, right? Because again, going back to what we learned during the investigation, which is new DOT ID number, new company, right? New carrier. So even if it's the same guy behind the wheel working for six different companies, you know, you need to know about this sort of thing. And there's no way to know that unless you investigate. Same thing if you're living in a community. You know, you want to know if there's 50 different LLC's registered to your neighbor's house, especially if those LLC's or if those businesses are kind of shady, right? You know, trucking is, you know, perfectly innocuous by itself, but what if it was something else? What if it was a different kind of business, right? If I found out this stuff, then other people can find out about it, too. So, knowing your surroundings, knowing enough information to be able to mitigate risk effectively, that's pretty important. And the social implications are also important, too, right? Because let's face it, this guy Harender Singh, he his name is going to be in the media for a while. Uh, everybody hates this guy because, well, I mean, just look at the horror of the story, right? Nobody in the journalistic uh, career field has pointed out, hey, uh, yeah, this guy committed a crime. Okay, this guy was driving negligently, but here's the company who allowed him to do that. If you're going to be mad at this guy for killing all those people, then maybe it might be a good idea to be aware of the company that he worked for and the the fact that those companies are just going to roll up and they're going to start again and the same people are going to be involved. So, that's why it's worth investigating a lot of this stuff a lot of the time because, you know, you don't know what you're going to find. I had a hunch about what I was going to find, but I wanted to run through this exercise anyway because I think that it'll be very helpful again for identifying the other companies that are still out there. They're still just as dangerous. They're still employing the same exact people. You get one driver off the road, fine. But if there is a dozen people just like this guy who have the same level of driving skill and they work for the same companies, you know, the risk is still pretty great. So I thought this was a good way to talk about link analysis and not just how it all works but also some of the tools that we use and more importantly some of the pitfalls. I myself over the years have been very hesitant to use uh link analysis for very much because link analysis looks cool. We've got to be a little bit more cognizant of what's going on. Same thing with basian analysis, right? you hear that term and you know it's really easy to uh realize that well it's not really best suited for everything and just because it sounds smart and there's a TED talk uh discussing it it doesn't necessarily mean that it's the best thing ever. So same thing with link analysis but now hopefully we have a better understanding of what this is used for, how we can best employ it, the pitfalls of using it and some of the tools uh that we can use for it too. So hopefully this has been helpful. I will continue this series uh with more content on Multiggo in in due time. I want to let this one sit for a bit and cover some other stuff uh in the meantime with regards to structured analytic techniques. But for now, this gives us a pretty good start using a fairly fresh in our minds news story to kind of get the ball rolling. So, thank you guys for all of your support. Hopefully, this was helpful and I will see you next time. And as always, fight in the shade.