Supporting Variability in Criminal Intelligence Analysis: From Expert Intuition to Critical and Rigorous Analysis

Intelligence analysts frequently find themselves in situations of high uncertainty and ambiguity. The characteristics of those situations force the analyst to rely on creative generation of plausible explanations – ‘storytelling’. We argue that current interaction design approaches obstruct the storytelling process and impede analysts to perform well in their analytical reasoning process. Our Fluidity and Rigour Model combines storytelling with the interaction methods that are needed to support the variety of reasoning and thinking involved in the analytical process. We further contribute with an outline of how the model has informed our designs in the VALCRI project.


Introduction
Analysts in criminal intelligence analysis regularly face data from multiple sources that are often incomplete, possibly deceptive, un-reliable and messy. This creates situations with high uncertainty and ambiguity, which makes the generation of plausible, reliable arguments difficult or impossible. However, many visual analytics and machine learning systems require that data for analysis be available, with the system substituting, for example, system averages for missing data. This makes it difficult for analysts to deal with the reality of facing deceptive and missing data. Failures in the assessment of criminal situations or the inability to come to a conclusion as the result of an analytical process can lead to severe consequences. A lack of awareness, overlooking or not realising the need to locate a key piece of information because one does not know the data exist can also lead to human errors. One solution to this problem is the facilitation of storytelling. Storytelling requires data to be assembled and organised to tell a story that explains a situation or phenomenon. By externalising and making the storytelling process visible and tangible to the analyst via a computer display, it becomes possible for the analyst to inspect his or her own reasoning processes. This creates the possibility to check one's analyses and assumptions for omissions and contradictions. Analysts need a kind of user interface that allows them to easily explore different ways to organise and sequence existing data into plausible stories or explanations that can eventually evolve into narratives that bind the data together into a formal explanation. If an analyst is presented with limited data or even no data, then such a tool must allow the analyst to easily make assumptions and suppositions that could be used to initiate a line of inquiry or connect separate pieces of data to concoct a plausible explanation.
In this paper we describe the user interface for storytelling in a new criminal intelligence analysis system prototype and the principled basis for its design. In this interface, information (e.g. a report, snippets of the report, statistical analyses) are represented in tile-like interface objects that can be freely moved around like playing cards on a table top. Interacting through a multi-touch display, analysts can manipulate and freely arrange the information cards into meaningful sequences to create explanations. We also discuss the variety of thinking strategies in the storytelling and analytic reasoning process, and how it may be supported through the application of the Fluidity and Rigour Model.

Fluidity and Rigour
The Fluidity and Rigour Model, see Fig. 1.1, or FRM Wong (2016), is a model intended for interaction designers. It highlights the variability of analytic reasoning strategies employed by analysts during criminal intelligence and investigative analysis, and describes the range of visualisation and interaction methods needed for criminal intelligence analysis systems.
The reasoning strategies invoked by analysts range from making guesses and suppositions that enable storytelling when very little is known, to reasoning strategies that lead to rigorous and systematic evaluation of explanations that have been created through the analytic process. In the FRM, we define fluidity as the ease by which a system can be used to support the variability of thinking strategies expressed  in the analytic reasoning process; and by rigour we mean the extent to which analytic methods and processes produce results and conclusions that are valid and can stand up to interrogation.

Sources of Variability in Analytic Reasoning
The Law of Requisite Variety, states that "… R's capacity as a regulator cannot exceed its capacity as a channel for variety" (Ashby 1958). Re-stated, "… the variety of variability of a process to be controlled must be matched or exceeded by the variety of variability of the controlling entity…". This refers to the variety of situations a system designed to control or support a process must be capable of controlling or supporting. The lack of compatibility between the variety of situations a process can produce, and the ability of a controlling system to support or accommodate that variety will invariably lead to system failures or sub-optimal performance. Systems designed to support intelligence analysis need to support not only the observable tasks of information search and retrieval and data analysis, but also the much less observable but crucial thinking and reasoning processes. These are the cognitive processes that determine the logic and how sensible are the narratives created to explain the clues that present themselves in an investigation.
Analysts make use of various inference making strategies -induction, deduction and abduction -depending upon what data they have, the rules for interpreting the data they are starting with, and the conclusions they would make or would like to make . The early stages of an investigation are often characterised by a lack of information and the need to imaginatively create plausible stories or explanations, such as abductive inferences to initiate possible lines of inquiry. Analysts also practise a mix of critical thinking and storytelling. In this process they elaborate, question, and often reframe and discard explanations (Klein et al. 2007), with some evolving into stronger, well-justified explanations that are robust enough to withstand interrogation (Rooney et al. 2014). Wong and Kodagoda (2016) present other aspects of the analytical reasoning process: anchoring, laddering, and posing associative questions. Analysts engage in a process of anchoring to gain traction and initiate inquiry. They then engage in a laddering process where they develop explanations to extend or elaborate their ideas into new understanding. They complement the anchoring and laddering activities by associative questioning to discover what else might exists. Police analysts are taught, for example, the 5WH model -who, what, where, when, why and how -to activate divergent thinking pathways that may lead to un-expected associations; which through intuition, could spur the recognition of un-anticipated patterns (Gerber et al. 2016) across different data sets. Often the problem is not 'joining the dots' -but to imagine more informative ways to connect them to create better insights under information-sparse, uncertain, and ambiguous conditions. This requires some degree of creativity when trying to imagine plausible explanations, and for getting the cognitive traction required for gaining further insight.
We use the x-axis of Fig. 1.1 to illustrate the range of analytic rigour that may be applied to the analytic reasoning process. At the start of an inquiry there is usually very little known about a case. It is therefore of little use to treat information and inferences rigorously as the analyst is still trying to understand what the data means and whether it is sensible to create an argument. The type of thinking and reasoning employed by the analyst at this stage may be characterised as being creative, having to deal with high uncertainty as there are many unknowns and missing data. The need at this stage is to gain traction and to get the investigation started. Analysts engage in the tentative and playful generation of plausible stories and hypotheses that may account for their observations. They tend not to commit to a single explanation and are likely to explore alternatives.
At the high rigour end of the spectrum, the type of thinking and reasoning required may be characterised as 'critical thinking', evaluative, deliberate, and final. As an investigation approaches the closing stages, most of the data required will be known. It is then possible to rigorously structure, organise, or analyse the data, and to make sure that every conceivable logical discussion can be evaluated. By this stage, analysts would have employed a variety of structured analytic techniques (see for example, Heuer and Pherson 2014) to establish strong and rigorous arguments. Then usually having done all the analyses and checks -would be committed to an explanation.

Fluidity to Interact with the Variety of Analytic Tools
Fluidity is the ease by which a system can be used to support the variability of thinking strategies demonstrated by analysts in the analytic reasoning process (Wong 2016). To achieve this, the interaction and visualisation methods need to enable the analyst to seamlessly transition within and between the tools needed by the different analytical reasoning strategies. Elmqvist et al. (2011) has explained that the basic requirement for fluidity is for users to feel that they are directly participating in the interface, where users feel that are able "… to directly 'touch' and manipulate the visualization instead of indirectly conversing with a user interface". Fluidity in a user interface therefore "… involves achieving a sense of immersion, a first-personness and direct engagement with the objects and the visualizations" creating an embodiment with the user interface to create a sense of 'being in the flow', directly benefiting analytic performance (Bederson 2004). Pike et al. (2009) advocates that visual displays must be "embedded in an interactive framework that scaffolds the human knowledge construction process with the right tools and methods to support the accumulation of evidence and observations into theories and beliefs". To achieve this level of interactivity, we also ensure that real-time responses are close to the 100 ms recommendation (Kalawsky 2009). The aim is to create a tight loop between query and analysis to support Neisser's (1976) perception-action cycle to achieve a level of engagement that may be interpreted as a real-time dialogue between the user and the machine. Impediments in the interaction would obstruct the analytic discourse (Dykes 2005), making the interface frustrating to use, leading to higher cognitive loads, activation of cognitive biases (Munzner 2014), and poorer situation awareness.

Requirements for Fluidity and Rigor
In what ways might technology assist in supporting the variability of the analytic reasoning process? Based on a number of studies we conducted: e.g. focus group studies with 20 intelligence analysts (Wong and Varga 2012); think-aloud studies with analysts and librarians performing simulated intelligence tasks (Rooney et al. 2014;Kodagoda et al. 2013); and cognitive task analyses with analysts from three major police forces in Europe (e.g. Wong and Kodagoda 2016;Gerber et al. 2016), we summarise below the key design requirements for fluidity in analytical reasoning.
The tools at the 'loose story' end of the rigour spectrum should be different from the tools supporting more rigorous approaches on the other end of the spectrum. At the 'loose story' end, the tools should enable the analyst to express the creative, generative, chaotic and tentative nature of reasoning by enabling playful experimentation that is needed for one to gain cognitive traction with which to start an idea to pursue a line of investigation. It should facilitate associative and divergent thinking by anticipating and presenting information that might be needed next. We next focus on how analysts can transition fluidly between critical thinking methods, and methods for creative exploration, hypotheses formulation, and storytelling. The tools should enable the analysts to transition seamlessly from early analyses that led to tentative possibilities, to assemble data and ground the explanations so that narratives could be developed into strong arguments. Analysts should also be able to transition fluidly between different forms and assemblies of explanations, outcomes, assessments, and analyses, to uncover other possibilities that may lie with in the data.

Operationalising Fluidity and Rigour
The design requirements summarised above have been implemented in the VALCRI prototype -Visual Analytics for Sense-making in Criminal Intelligence Analysis. The aim of the VALCRI project is to create an integrated visual analytics-based sense-making capability for criminal intelligence analysis that facilitates human reasoning and analytic discourse by being tightly coupled with semi-automated machine learning knowledge extraction technologies. This tight coupling enables VALCRI to respond to analysts in both a proactive and reactive manner. The design of VALCRI is based on the idea of a Joint Cognitive System. Rather than humans just working and interfacing better with technology, the intention is to create a system of human-machine co-agency where the human-machine team "can modify its behaviour on the basis of experience so as to achieve specific anti-entropic ends" (Hollnagel and Woods 2005) (p. 22). Johansson (2014) explains that to achieve such anti-entropic ends requires that systems abide by the Law of Requisite Variety, i.e. the system need to have the repertoire of methods for dealing with the variety of behaviours that the environment is likely to produce. To implement fluidity the interactions and visualisations enable the analyst to fluidly make transitions within and between the variety of analytic reasoning tasks. Visualisations that enable fluidity are those that, for example, morph from one representation format suitable for one task, and with minimal or no effort nor interruptions, into another. Interactions that enable fluidity enable effortless transitions between different states or representational formats of the data. In VALCRI this occurs when a user clicks or drags a specific dot in a scatter plot diagram and it immediately retrieves and presents the full crime report it represents. We next outline how these requirements have informed VALCRI designs.

Visual Persistence
Persistence occurs when data and the state of one's analysis and reasoning are made visible and remains in view. It enables the analyst to off-load memory challenging activities such as recalling facts to the interface. The VALCRI user interface design is based on the concept of the Thinking Landscape that comprises a flexible set of structured spaces. Analysts can externalise their thinking and leverage human spatial memory. Analysts can maintain the visibility of the storytelling process while concurrently working on different explanatory assemblies in the user interface. As in a landscape, nearby spaces enable one to see detail, while farther away spaces provide a sense of context. We introduce three main areas of work for the analyst: Places nearby to 'Assemble and Construct'; places to 'Park and Mull' are slightly further away, with information reduced or summarized so that incomplete ideas or partial explanations can be 'parked' temporarily where the analyst is still able to quickly continue to pursue them; and a Place for Context where situational and contextual information are located.

Tactile Reasoning for Tentative and Playful Interactions
We define tactile reasoning as an interaction technique that supports analytical reasoning by the direct manipulation of information objects in the graphical user interface (Takken and Wong 2015). Just as the alphabet tiles used in the game of 'Scrabble', VALCRI uses tiles to represent pieces of information such as crime reports, and stop and search reports. These tiles can be directly and freely manipulated, moved and arranged. Explained as epistemic actions (Kirsh 1995;Kirsh and Maglio 1994), these actions assist the analysts to modify their work environment to support the externalisation of their thinking and reasoning processes. This externalisation makes the complex mental tasks during investigative decision making tractable. The design of the interaction methods and how the information and tiles are visualised and laid out have been based on a variety of human factors principles (e.g. Emergent Features, Gestalt, Proximity-Compatibility). By coupling tactile reasoning with underlying machine learning functions, we enable reactive and proactive actions, e.g. to search for crime reports with similar characteristics in response to a direct request, or a search in advance of a request as the analyst works through an analysis. This enables the kind of analytic discourse that can potentially assist analysts discover new relationships.
Tactile reasoning supports the process of playful storytelling. It allows the analyst to create tentative sequences of data from which narratives might emerge. The information tiles and tile containing results from data analysis in the storytelling workspace can be freely re-organised to communicate different explanations. Intelligence analysts face many tedious and repetitive tasks, such as the reading and selection of crime reports to systematically extract common concepts to create a summary table to perform a Comparative Crime Analysis (National Policing Improvement Agency 2008). In VALCRI, the analyst can fluidly make the transition from playful storytelling to rigorous analysis with one click, eliminating many of the repetitive intermediate cut and paste steps.

Creative and Generative
The usual starting point for investigations in VALCRI is a search. The design enables multiple searches to be initialised on a single canvas. Results may be analysed in the 'Assemble and Construct' place, or parked in the 'Park and Mull' places. This enables the analyst to conduct multiple independent searches, giving the analyst freedom to creatively pursue alternative pathways, while organising the search space to cater for one's thinking and reasoning approach. The VALCRI user interface is customisable and based on the principle of dynamic visual querying (Shneiderman 1994), enabling the analyst to gain an "overview first, zoom and filter, then details-on-demand" (Shneiderman 1996). Filtering in VALCRI has been implemented via direct interaction of data in multiple coordinated views. For example, crime reports may be presented within the boundaries of a zoomed-in map. By changing one view, e.g. the boundaries of the map view, the system will present a revised set of crime reports on the map, a revised timeline view comprising the corresponding data, or a revised summary table of the crime reports. This provides the analysts with easy access to alternative perspectives that may be playfully and tentatively investigated without having to redefine their search from scratch each time.
Because of uncertainty and ambiguity in intelligence analysis, analysts often need to playfully experiment with data to generate hypotheses and explanations based on little or no information. One approach to gain traction is to create anchors that enable new ideas about the kinds of actions that one can take (Klein 2014, p. 148). In addition, VALCRI design encourages the use of imagination to generate new possibilities, ideas or concepts beyond what is presented. Kodagoda et al. (2013) discovered that during the early stages of analysis, once the participants discovered patterns or semantically meaningful connections in the data set, they were able to identify anchors from which to spawn new searches.

Associative and Divergent
Insight pathways can also be activated through divergent thinking. This involves retrieving data that could be associated in some way and then by presenting such data together in the same visual space, analyst may activate unanticipated associations. For example, by presenting information about solved and unsolved crimes in a given district in the same visual space, we create opportunities for analysts to ask questions about similar crimes, or whether the offenders and their known cooffenders could have committed some of crimes that are currently unsolved? In this way, we create opportunities for the human to make plausible links -associationsthat may not be possible or feasible for the computer to predict.

Gaining Traction During Uncertainty
Uncertainty in the analytical process poses a major risk for the analyst to miss information and can quickly lead to errors. In VALCRI, we have taken the approach of turning uncertainty into opportunities for the analyst to ask questions. For example, due to the way information is recorded in police systems, the same person can be registered under different reference numbers, and different spellings of names (e.g. Smith vs. Smythe). Most analysts address this problem with prior knowledge or experience. For such problems, VALCRI can provide sets of certain and uncertain matches for the analysts to compare and to assess for themselves the correctness and relevance of the data. This way, we make the analyst aware of information that can immediately confirm or explain ambiguities. Another type of uncertainty stems from the un-awareness that there are missing data. One method to address the missing data problem was proposed in Wong and Varga (2012), called 'black holes', or gaps in a sequence of data. These gaps or black holes create opportunities for the analyst to ask "why?"; why was there a gap in activities between this time to that time? Did our sensors fail to pick up the events? Did the criminals go into hiding and initiated a 'radio silence' procedure? In VALCRI, analysts can choose to show or not show the black holes in data represented in timeline sequences or story sequences based on laws of argumentation.

Conclusion
Intelligence analysts frequently find themselves in situations of high uncertainty and ambiguity. The characteristics of these situations force the analyst to rely on creative generation of plausible explanations -'storytelling'. We suggested that current interaction design approaches obstruct the storytelling process and impede analysts in performing well in their analytical reasoning process.
In this paper, we presented and discussed the Fluidity and Rigour Model (Wong 2016) as an approach for combining storytelling with the interaction methods that are needed to support the variety of reasoning and thinking strategies involved in the investigative and analytic process. We commonly regard analytic reasoning -the thinking, cognitive acts and inferential strategies we use in the tradecraft of intelligence analysis -as mainly requiring structured, critical and rigorous analysis methods (Heuer and Pherson 2014). While absolutely essential, we have neglected the fact that investigators and analysts also engage in a considerable level of abductive inferential reasoning (Josephson and Tanner 1996;Walton 2005) that is speculative and tentative, to generate plausible explanations that provide a basis for formulating an initial hypothesis that can be subsequently tested. This process draws very much on the analysts' expert intuition to make leaps of faith that may lead to moments of insights that enable the making of suppositions. In this paper we do not advocate systems design that support either one extreme or the other. Instead, we propose that it is important to support both extremes of analytic reasoning. It is vitally important that we make it possible for the analysts to employ their expert intuition while recognising the limits of it; and to make it possible for them to fluidly transition to scientific methods, with an emphasis on empirical testing and peer review. We believe the Fluidity and Rigour Model of interaction design, provides one approach that can guide the design of systems capable of supporting such variability.
We also discussed the Law of Requisite Variety. Failing to achieve such a level of compatiblity between the variability in the processes we wish to suuport and the systems we design to support them, especially in the context of intelligence analysis, the systems we produce will continue to be inadequate for supporting the variability of thinking and reasoning strategies invoked by investigators and intelligence analysts.
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.