Register for our next deep dive! Learn how to equip your team with strategies and tools to detect and dismantle organized crime on Thursday, July 25, 2024, at 16:00 CET.Register now! close
17 Jun 2024

How Law Enforcement Can Leverage Internal Data and OSINT to Gain Insights

Sergio Leal Rodriguez

Law enforcement agencies (LEAs) have a wealth of data at their disposal, but often struggle to use it effectively. This data, if properly accessed and analyzed, can help LEAs to make better investigative decisions, solve cases faster, and improve overall operations. Unfortunately, data is usually scattered across different sources and lacks a unified structure, making it difficult to piece together the full picture.

For instance, a police department might maintain separate databases for passwords, hashes, profiles, or seized databases coming from different operations. The absence of integration among these sources and the different technologies used to store them makes investigations challenging.

This whitepaper explores how law enforcement can overcome these challenges to support their criminal investigations. We’ll discuss the role of competency questions, explain how defining an ontology can make operations more effective and data-driven, discuss two approaches to storing and accessing internal data, and show how this can be done using Maltego.

By following our guidelines, cyber investigation teams will be able to not only enhance data quality and accessibility but also support comprehensive and accurate business intelligence and analytics, driving better decision-making and strategic planning.

Identify Data Sources Used in Criminal Investigations πŸ”—︎

What data does your team use and need for criminal investigations? What technology was used to build the databases? Where are they stored, and in what format? How can they be queried effectively? Finding answers to these questions and understanding what information your data can offer (or lacks) is fundamental for making better-informed decisions in real time.

These data sources can be anything that includes pieces of information that may help identify a person, establish a timeline, or uncover connections. They can range from logs coming from incident reports and communication records when available. Depending on the focus of a given team, the specific data needs will differ.


Imagine the work of a cybercrime unit tracking an online fraud scheme. They would need to analyze data from financial transaction records, emails, IP addresses, and social media interactions.

By having a clear understanding of where this data is stored and how to retrieve it swiftly, the unit can trace the digital footprints of the perpetrators, connect the dots between different data points, and uncover the network behind the fraud.

Understand Questions Your Data Should Answer πŸ”—︎

Knowing your data sources and their contents is one thing, but figuring out how to leverage them for a specific project or investigation is the next challenge.

Let’s imagine the following scenario:

Case Study πŸ”—︎

Your team works under an international law enforcement body. It is tasked with investigating a series of financial frauds linked to a major crime syndicate.

The investigation team will need to use several different datasets from different financial institutions, internet service providers (ISPs), and social media platforms.

The data includes transaction records, account details, and communication logs, originating from various sources built using diverse technologies, where each dataset follows its own format.

Your Goal: Analyze and model the data to identify patterns and connections that can lead to the crime syndicate’s key operatives.

Role of Competency Questions πŸ”—︎

Before jumping straight into querying the different datasets, the first step is to ask and answer a set of competency questions. These questions help LEAs define what they want to learn from the data and what kind of information they need to find. For example:

  • What specific fraudulent activities are you looking to identify?
  • Are there particular transaction patterns indicating suspicious behavior?
  • What connections between accounts and individuals are you trying to uncover?

Setting these questions upfront brings better focus to your data analysis, making your insights directly applicable to the investigation. This approach helps avoid aimless data sifting and ensures your efforts align with the investigation’s goals.

Finally, by understanding the needs, investigative teams can avoid focusing on unnecessary or irrelevant data points and stay on the right track instead of going down the rabbit hole without a clear strategic goal.

Download This Whitepaper πŸ”—︎

The insights shared in this article are just the beginning steps to help your team understand the potential questions your data can answer. However, the challenge of using that data effectively and at scale, without missing any vital information, still remains.

This whitepaper aims to guide you through this process by defining common ontologies to ensure consistent terminology, introducing two effective data analysis strategies, and explaining how to standardize and centralize your data warehouse. Finally, it provides a comprehensive guide on leveraging Maltego to gain insights from both internal and OSINT data sources.

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

We hope this whitepaper will help you make better decisions about the use of internal data and OSINT within your unit or team of investigators.

Your Next Steps πŸ”—︎

For more insights like this, you can check out our other resources:

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author πŸ”—︎

Sergio Leal Rodriguez

Sergio Leal Rodriguez πŸ”—︎

Sergio is an experienced and dedicated professional with more than 20 years of invaluable experience in coordinating, investigating, modeling data, and researching cybercrimes with a focus on the critical field of Child Sexual Abuse at Europol’s AP TWINS. His expertise lies in coordinating multi-agency efforts as well as conducting thorough investigations, and he has actively contributed to the development of innovative methodologies for data analysis and modeling in the context of child sexual abuse.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.