Open Source Intelligence
Clive Best
Joint Research Centre
clive.best@jrc.it
Open Source Intelligence can be defined as the retrieval, extraction and analysis of information from publicly available sources. Each of these three processes is the subject of ongoing research resulting in specialised techniques. Today the largest source of open source information is the Internet. Most newspapers and news agencies have web sites with live updates on unfolding events, opinions and perspectives on world events. Most governments monitor news reports to feel the pulse of public opinion, and for early warning and current awareness of emerging crises. The phenomenal growth in knowledge, data and opinions published on the Internet requires advanced software tools which allow analysts to cope with the overflow of information. Malicious use of the Internet has also grown rapidly, particularly on-line fraud, illegal content, virtual stalking, and various scams. These are all creating major challenges to security and law enforcement agencies. The alarming increase in the use of the Internet by extremist and terrorist groups has also emerged. The Joint Research Centre has developed significant experience in Internet content monitoring through its work on media monitoring (EMM) for the European Commission. EMM forms the core of the Commission’s daily press monitoring service, and has also been adopted by the European Council Situation Centre for their ODIN system. This paper will review this growing area of research. A new research topic at the JRC is Web mining and open source intelligence. This applies EMM technology to the wider Internet and not just to news sites. A Google search or user selection is used to identify potential web resources and the extraction and download of all the textual content. This is then followed by automatic change detection, the recognition of places, names and relationships, and further analysis of the resultant large bodies of text. These tools help analysts to process large amounts of documents and derive structured data which is easier to analyse.
Keywords: information retrieval, media monitoring, topic tracking, web mining,
information extraction, statistical indicators, news visualization, social networks
1. Introduction
The term Open Source Intelligence originates from the security services and from law enforcement agencies. It refers to intelligence derived from publicly available sources of information, as opposed to closed or classified sources. The 9/11 Commission Report[1] exposed the weaknesses of traditional intelligence bodies as being too secretive and too complex. Although much information of the threat posed by Al Qaeda to the US homeland was publicly available, the intelligence services “failed to join the dots”. The report also recommends implicitly the formation of an Open Source Agency and bringing the intelligence services into the information age.
Traditionally there are three intelligence sources as shown in Figure 1. SIGINT is intelligence gleaned from signal intercepts, wire taps and the like and HUMINT is intelligence from usually clandestine human sources. High levels of secrecy are placed
on derived intelligence to protect the value of these sources. The last 10 years have seen enormous growth in the third OSINT area. Open sources by definition are non- classified although a report derived from pure open sources itself can be classified. One main advantage of OSINT is that information derived from it can be shared with other agencies and services of friendly countries. All this works to improve information sharing and to reduce complexity, both elements having been criticized in the 9/11 report.
Military organization, including NATO, recognizes open sources as strategic, cost-effective and rapid intelligence sources [2]. However it is not just governmental bodies who are turning to open sources for current awareness and insight. Large multinational companies, banks and various industries are increasingly relying on so-called business intelligence for decision making and for protecting assets and staff. As a result, there are a growing number of OSINT-related service providers in the commercial sector who market OSINT tools. In Europe a new initiative was started in 2006 called EUROSINT Forum [3]. This forum brings together government agencies, the private sector and service providers, where the needs and processes of OSINT can be discussed with the goal of identifying technology gaps and providing training. There is also a growing research community in this area developing tools and techniques to support the OSINT process. The IEEE Conferences on Intelligence and Security Informatics [4] were started in 2005 and address related technologies.
1.1. The OSINT process
The intelligence cycle is a process which begins with a request for an intelligence study. This request comes from a senior manager in a commercial company, a minister of state, a military commander, or a director of an intelligence agency. Firstly the task is
planned and information sources identified. A researcher or OSINF specialist then collects relevant information using specialized tools. The data is then indexed and processed by extracting and tagging relevant metadata. The analyst should be an expert in the relevant field with deep understanding of the problem being addressed. The analyst accesses the collected OSINF in order to author the intelligence report. Intelligence is nearly always a written document including imagery, maps etc where relevant. The web mining and information extraction research discussed in this paper concentrates on
Figure 1: The three traditional intelligence sources
Billions of Internet users 0 0.5 1 1.5 2 1998 2000 2002 2004 2006 200 8 2010 Total us ers Us ers with broadband
the collection and processing of OSINF. This can be broken down into five technical processes. 1) Collection: Information retrieval 2) Process: Information extraction 3) Analyse : Trend analysis/Link analysis 4) Visualise: Data visulisation 5) Collaboration. International organizations like the UN and EU, as well as national governments, maintain so-called situation rooms for crisis management, early warning and conflict monitoring. These operations produce regular OSINT products:
1. News Flash Alerting 2. Daily news highlight reports
3. Situation updates: regular updates on an on-going crisis or conflict 4. Specific study reports: i.e. classic intelligence report
The first three products illustrate the importance of real-time news monitoring services and the systematic processing and archival of news. Such systems also form the core of media monitoring units in governments and large corporations.
1.2. Open Source Information
Open Source information (OSINF) is information trawled from the internet, periodicals, newpapers and radio/TV broadcasts. It is not necessarily free information and includes commercial subscription services like BBC Monitoring or Factiva, and commercial satellite imagery. The main source of information however is the Internet. In just 12 years the Internet has grown to become a major source of human knowledge. A study [5] by IDC in
February 2007 estimated the total on-line digital content at 1.6x1020 bytes and that by 2010 70% of content will be user generated. The so-called Web 2 phenomeon [6] is all about on-line communication and opinion and has been driven by the widespread deployment of broadband. Broadband is enabling greater user participation and interaction unavailable during the first DOTCOM bubble. The phenomenon of Blogs and social networking sites with global participation means that opinions, local news reports and eye witness accounts are available real time.
The phenomenal growth in knowledge, data and opinions published on the Internet requires advanced software tools which allow analysts to cope with the overflow of information. Malicious use of the Internet has also grown rapidly particularly on-line fraud, illegal content, virtual stalking, and various scams. These are all creating major challenges to security and law enforcement agencies. The alarming increase in the use of the Internet by extremist and terrorist groups has emerged. The number of terrorist- linked websites has grown from about 15 in 1998 to some 4500 today. These sites use slick multimedia to distil propaganda whose main purpose is to 1) enthuse and stir up rebellion in embedded communities 2) instill fear in the “enemy” and fight psychological warfare. Anonymous communication between terrorist cells via bulletin boards, chat rooms and email is also prevalent.
1.3. Commercial Satellite Imagery
High resolution satellite data is now readily available commercially. This allows governments and NGOs to have unprecedented access previously the preserve of the military in elite states. However, the possibility of terrorists using such imagery to plan attacks is a real threat as identity checks on customers is difficult. Interpretation of imagery can require sophisticated processing and correction algorithms. Humanitarian applications for disaster response can rapidly perform damage assessment. JRC have been involved in damage assessment exercises for the 2005 Tsunami, the Lebanon war and Pakistan earthquakes. IAEA use satellite imagery to control proliferation at Nuclear plants in signature states. Currently available satellite systems offer 60 cm IKONOS and 1 meter Quickbird producing images of stunning accuracy.
Figure 4: Two examples of JRC work in image analysis using very high resolution satellite Above: Esfahan Nuclear Plant, Iran showing a new Chimney and processing plant. Right: damage assessment of Beirut using before and after change detection following the Lebanon conflict 2005.
Current high resolution satellites are Ikonos
up to 60 cm pan-chromatic, Quickbird – 1m and Spot 2.5 m pan-chromatic. Pre- recorded data can be ordered on-line. However, for crises and damage assessment work it is necessary to task the satellite for a scene. Data needs ortho-correcting and scenes must be aligned at the pixel level for time ordered change detection [7].
1.4. Commercial Aggregators and Intelligence providers
Another important source of Open Source Information is the large commercial aggregation systems and Intelligence houses. Aggregators arrange contracts with newspapers and data providers to cover delivery and distribution rights to subscribers. Each provider feeds content to the aggregator who consequently allows customers to search their archives for data. The aggregator normally reformats all content to a standard form and indexes articles and reports by subject, source and time. These providers keep huge databases of information for on-line access. Such aggregators represent a one-stop shop for information, but they impose restrictions on the redistribution and storage of their content. Providers in this field include Lexis Nexis,
Factiva and Dialog. Intelligence providers, on the other hand, generate their own reports based on open sources for specialist subjects. They are based on subscription services and include Janes Defence, Oxford Analytica and BBC Monitoring Service (multilingual news reviews)
1.5. News Aggregation systems
In recent years a number of automated news aggregation services have become available on the web. These systems monitor round the clock thousands of web based news sites and filter reports according to topics. They have a partly automated algorithm for identifying the top stories of the moment, while providing links to topic specific pages. Some systems like Google News are free, while others offer a free component and a subscription based component. This market is evolving fast as add-on analytic tools on extracted information are deployed.
The Joint Research Centre has deployed a media monitoring system for the European Commission called Europe Media Monitor (EMM). EMM is a real-time system which detects news reports in 30 languages published on Internet news sites and 15 news agencies. The EU depends on EMM for breaking news alerts, daily press reviews and early warning. Research continues on analytical tools to derive insight from news reports. A detailed description of the monitoring techniques used in EMM is given here. The other systems use similar techniques.
1.6. Web Mining Tools
The major search engines like Google are the main tools for open source information retrieval. CIA agents have once been quoted as saying 80% of intelligence is from Google. Search engines suffer from a slow update time due to the sheer size of the crawling and indexing problem. Dedicated crawlers which can monitor a user-specified set of web sites, detect and perhaps download new additions, are used both by law enforcement agencies and business intelligence units.
The phenomenal growth in Blog publishing has given rise to a new research area called opinion mining. Blogs are particularly easy to monitor as most are available as RSS feeds. Blog aggregators like Technorati and Blogger allow users to search across multiple Blogs for postings. Active monitoring of Blogs applies information extraction techniques to tag postings by people mentioned, sentiment or tonality or similar [8]
2. Real Time News Monitoring
The JRC has developed the Europe Media Monitor (EMM) [9] for the European Commission. EMM scans all principal news sites in Europe and around the world up to every 10 minutes and detects new articles as they are published. The text of each article is processed and sorted into one or more of 600 topics (alerts). A breaking news algorithm detects major news stories within minutes and alerts subscribers. Inside the Commission 15 news agencies, and daily reviews of the printed press from 50 capitals, are also aggregated. The daily reviews also include reviews of newspaper clippings attached through the web authoring interface. A team of reviewers based in Brussels author a twice daily briefing newsletter and reviews of the printed press using the EMM’s Rapid News Service which is a web based editorial and alerting tool. These
reports are printed and sent to all Commission spokespersons and cabinets. EMM has become the EU’s integrated media monitoring tool. Other agencies have adopted EMM technology and variants of it are used for specialist areas including Medical Intelligence – Medisys [10]. EMM processes about 40,000 articles in 30 languages each day. News monitoring is fundamental to Open Source Intelligence, especially where fast reliable and accurate information is needed in crisis situations. The requirements and techniques used are described in the following sections.
2.1. News Monitoring Requirements
There is a characteristic distribution of news publishing during a normal weekday. Normally very few articles are published overnight, while the main flux starts begins around 5am and slows down in the evening. This is complicated in a language like English as several time zones are involved. Then there are the rare cases when a major story breaks and publication peak can occur at any time including the nightime. The 2005 tsunami was an example where all news sources were active out of hours. Another factor that needs to be considered in real-time monitoring is the different update rates of various sources. Some sites like CNN are updated very often while others - particularly weekly reviews - only once per day. An effective monitoring system needs to be able to cope with large variations in news fluxes as well as optimizing the scan rate for individual sites.
Users have specific interests, so a pre-defined topic detection system is needed to feed targeted news reports to that interest group. At the same time, a breaking news story can be about any subject and is therefore not predefined. Similarly a search engine of news should allow recall of any search terms in a time-ordered page ranking.
2.2. Web Site Scraping
EMM uses a technique known as headline scraping. The scraper system visits a single given news section page containing headline links to articles. The page itself is defined in HTML which describes layout, not content, and can be ill-formed with adverts and the like. Scraper first simplifies the layout and converts the page to XHTML, then for each site applies an XSLT transform to convert the content to RSS 2.0 (Realy Simple Syndication). By keeping a rolling cache of RSS feeds scraper detects new articles.
EMM uses a simple REST architecture to communicate between Web applications using a queuing system to handle bottlenecks. The Grabber subsystem accesses the URL of the new article and uses a proprietary text-extraction algorithm based on an HTML scanner/parser. In a first analysis, text nodes are extracted from the HTML data stream and tagged with a synthetic 'distance' value. Based on this distance value the normal minimum distance is calculated and text nodes clustered using this minimum distance. In a second analysis a value (a so-called magic number) is attributed to each cluster based on the total length of the article, number of cluster fragments, total length of the cluster, parse tree depth with respect to structural HTML nodes (e.g. table, div, frame etc). From these numbers a minimum value is derived and all clusters with a value greater than the minimum value are considered to be part of the text. The strength of this method is that it uses the layout and style of the page itself to determine what is likely to be the most important 'block' of text.
Figure 5: Overview of the EMM real time processing chain
2.3. Topic Detection
Topic Detection and Tracking has been a study area under the DARPA TIDES programme[11]. TDT aims to develop methods and algorithms for threading together related texts in streams of data - especially multilingual news. News monitoring requires two distinct tasks in this field. Firstly we want to detect articles which refer to a pre-defined subject eg. Finance, and secondly we want to detect breaking news on any subject. Breaking News detection is discussed in the next section. Pre-defined subject detection is needed for regular updates and alerts about an area or interest, and in the European Commission concerns policy areas of the various directorates. Each incoming article in any language needs classifying into one or more topics. The EMM categorization engine is based on a proprietary and original parallel finite state machine algorithm that allows extremely fast 'feature extraction' from article text. Normally the article content is considered the 'fixed' data, and stored in a database. Categorization is then performed by running queries on the stored data. In EMM the process is turned around and the category definitions are considered the 'fixed' data. The article text 'flows' through the categorization engine and triggers the relevant categories.
Categories are defined in two ways. Firstly through weighted lists of multilingual keywords, and secondly through Boolean combinations of keywords which can include a proximity measure. Keywords can include wildcard characters to cover language dependent endings. In the first method each matched keyword contributes a weighted score, and the total sum of scores must exceed a threshold. Weights can also be negative to avoid wrong hits. The second method is a simple Boolean combination of keyword sets. One or more words in each set triggers to apply the condition and conditions are AND/NOT as illustrated in Table 1. Each category or “Alert” is hand-tuned by an editor to cover the category area concerned. For EU applications these categories can be rather broad, requiring several hundred keywords.
Weighted Definition Boolean Definition alert=EuropeanParliament maxArticles=50 words, threshold=20 european+parliament 20 parl_ment%+euro% 20 euro%+parlament% 20 europa+parlamentet 25 europaparlamentet 25 alert=IrishReferendum maxArticles=50 Proximity=5 combination or= ireland irish iers ierland irland% or= referendum volksabstimmung not= rugby football
Table 1: Examples of the 2 methods of defining alerts. A single Alert can contain one or more combinations and/or a single weighted list.
2.4. Breaking News Detection
The objective of a breaking news detection algorithm is to detect as rapidly as possible a sudden flux of similar articles referring to a single undefined event. This is a different problem to pre-determined topic classification, since there is no a priori definition of what topic the articles refer to. Early warning systems require automatic alerting when a major story breaks. The first algorithm used by EMM is based on a statistical analysis of the usage of proper nouns (capitalized words) in news articles for each language. This is based on the assumption that a new story will refer to a person , a place or an organization and this assumption has proved to be correct. For each language, statistics are kept on all proper nouns found in texts, which fall outside a tuned list of stop words. Typical stop words are days of the week, newspaper titles and the like. These lists are tuned manually until false triggers are kept below 5%. A database tracks about half a million terms over a rolling 3 week period. Every 10 minutes an hourly expectation rate of occurrences over the last 3 weeks is calculated for each term. This is then compared to the actual occurrences over the last hour. Since there is always a risk of duplicates from a single source, a factor is applied to ensure independent reporting from typically three or more sources and a scaling factor is applied for each language. The score is calculated for each term as given in Equation 1.
where
S = score of topic
t
n
= number of occurrences of topic in last hourt
n
= rolling average number of occurrences of topic per hourβ
= multiplying coefficientF
n
= number of feeds (sources) from which the topics are derivedF
N
= feed scaling coefficientF F t t
N
n
n
n
The advantage of a rolling average is that it suppresses an old breaking news story to allow increased sensitivity to other independent emerging stories. Three levels of breaking news level have been defined. The precision for detecting the highest level which represents the top 1-2 stories per week is 100% and the recall is over 95 %.
A related statistical breaking news detection concerns a sudden increase in flux of articles within one of EMM’s predefined alerts. For example, a sudden rise in articles about an infectious disease may not trigger the overall breaking news system but is still of interest to epidemiologists, who may need alerting. To address this problem statistics are kept on the correlation of articles triggering a theme (topic) and a country alert (EMM has one alert defined for each world country). The alert system logs hourly counts for all theme/country correlations per hour.
i i i
T
C
A
=
is the normalized count of articles for country/theme last hour.1
2 0−
=
∑
− =N
A
A
N j jis the averaged normalised count for the last N-1 days
We assume that A has a normal distribution and then define levels of breaking news for a given theme and country according to their probability. The highest level corresponds to a random probability < 0.01.
This automated monitoring of alert levels across many topics provides a convenient way to visualize the top topics reported at the current time. The alert levels can be used to send automatic emails to specialists.
2.5. Real Time Clustering
The objective of real time clustering is to identify the current top stories and to track their evolution on a minute to minute basis. Clustering of texts is a well developed technique for topic detection and tracking [12]. Such a clustering technique has previously been applied on EMM data for the News Explorer application [13] which extracts a daily analysis of news in 18 languages. This clustering technique uses an agglomerative algorithm [8] based on hierarchical clustering. This algorithm is rather accurate, however it is still not fast enough to apply directly in real-time. Therefore a new approach was developed as described below.
The articles for each language for the last n-hours are processed. At least 200 articles are required in each language, so for major languages n=4(en, fr etc.) and minor
languages n=6(ar, tk etc.). Stop words are removed from the texts automatically, based on the top 100 most frequently used words. A further reduction removes high entropy words across documents and words which appear only once. Typically this leaves 6000 unique words across 400 documents, resulting in 400 vectors in the word space. A simple hierarchical clustering algorithm is applied merging the 2 nearest vectors at each stage using a cosine distance function. Tests have shown that optimum results are when only the first 200 words in the article are used, since this avoids secondary information outside the main story, and when a cosine cutoff of 0.6 is used to distinguish stories. The full algorithm is illustrated in Figure 7. 18 languages are clustered every 10 minutes using a rolling time window of 4(6) hours. Each clustering is done independently and the central article is selected as being that closest to the centroid vector. Stories can easily be tracked across time simply through the overlapping articles with a cluster 10 minutes earlier. Stories can grow very fast within several 10 minute intervals and this is then used to trigger breaking news alerts and news update alerts. News updates are triggered when an old story suddenly receives more articles within a 10 minute period than expected. Figure 8 shows the evolution of 24 hours of news recorded automatically using this technique.
Figure 8: Real Time Clustering over a 24 hour period
3. News Visualisation
Information overload is a growing problem for OSINT analysts. Consequently, research focuses on techniques to visualize a summary of textual information. Information extraction techniques, entity tracking and event extraction are described in
other papers in this book. Here we concentrate on techniques for visualizing news overviews and social networks based on relation extraction.
News Maps [14] are intended to show country hot spots for thematic news in analogy to weather maps. They display the relative media reporting for a given time period for all countries of the world In the case of EMM they are driven by statistical correlation data recorded by the EMM alert system. Such statistical data can be used to derive normalised indicators which “measure” the relative media coverage for a given topic and a given country. This technique has been applied to detect so-called “forgotten crises” [15] which are countries with humanitarian needs arising from famine or conflict, but under-reported in the world’s media. An analysis of such forgotten crises forms one of the bases for planning the yearly aid budget of the EU office for humanitarian aid.
Entity extraction is a well developed technique and has been applied to EMM [16]. The statistical co-occurrence of entities in texts can then be used to derive social networks. Relation extraction goes further and identifies phrase patterns linking two entities in a sentence[17]. EMM has studied three relations so far: contact (met, phoned, etc), support, criticize and family. Figure 8 shows such a derived social network.
4. OSINT Suite
JRC has developed a web mining and information extraction tool, which is now in trial usage at several national law enforcement agencies. Its purpose is to aid the identification and monitoring of relevant web sites, to retrieve the textual content of those sites and to apply information extraction techniques for link analysis. Key elements of EMM have been combined into a standalone Java application for web mining. Case Management, Site monitoring, text extraction and entity extraction tools are packaged in a visual interface. A case consists of documents retrieved through Google searches, or from crawling specific sites and a database of extracted linked entities. The information retrieval components are an adaptation of the scraper/grabber from EMM and the information extraction component uses the named entity recognition tools from News Explorer. Finally an interactive link analysis tool visualizes identified relationships and aids the removal of non relevant information.
Figure 9: Social network based on relation extraction
5. Conclusions
Open Source Intelligence is a growing field with important applications in the security domain. Security services, law enforcement and military intelligence rely on open sources in addition to traditional classified sources. The internet now dominates information sources and the spread of global news, rumour and propaganda requires sophisticated monitoring techniques. This paper has focused mainly on the current awareness tools for on-line media monitoring as implemented by the Europe Media Monitor. The author would like to acknowledge the EMM development team and in particular the contributions of Erik van der Goot, Flavio Fuart, Ralf Steinberger, Teofilo Garcia, David Horby, Bruno Pouliquen, Hristo Tanev and Jakub Piskorsky. The satellite image analysis results are from Martino Pasereri and his group at JRC.
6. References
[1] 9/11 Commission Report, http://www.gpoaccess.gov/911/pdf/fullreport.pdf
[2] NATO Open Source Handbook, Intelligence Reader, and Intelligence Exploitation of the Internet, 2002,
http://www.oss.net
[3] EUROSINT Forum, http://www.eurosint.eu
[4] IEEE International Conference on Intelligence and Security Informatics, ISI 2004,2005,2006,2007 [5] IDC study on Internet Broadband usage
[6] C. Pascu, D. Osimo, M. Ulbrich, G. Turlea, JC Burgelman, “The potential disruptive impact of Internet 2 based technologies", First Monday, March 2007 http://www.firstmonday.org/issues/issue12_3/pascu/
[7] M. Pesaresi and E. Pagot, “Post-conflict reconstruction assessment using image morphology profile and fuzzy multicriteria approach on 1-m resolution satellite data, IEEE GRSS/ISPRS Joint workshop on Remote Sensing and Data Fusion over Urban Areas – URBAN/URS, Apr 2007 Paris-France [8] Bing Liu, Web Data Mining, Chapter 11, Springer ISBN-10: 3-540-37881-2
[9] Best Clive, Erik van-der Goot, Ken Blackler, Teofilo Garcia, David Horby, 2005. Europe Media Monitor - System Description. EUR Report 22173 EN.
[10] R. Steinberger & R. Yangarber Medisys
[11] Wayne, C., Multilingual Topic Detection and Tracking: Successful Research Enabled by Corpora and Evaluation, Language Resources and Evaluation Conference (LREC) 2000, pages 1487-1494. [12] A. Jain, M. Murty, P. Flyn, Data clustering: a review, ACM Computing Surveys, Vol. 32(3), pp.
264-323, 1999
[13] Steinberger Ralf, Bruno Pouliquen, Camelia Ignat (2005). Navigating multilingual news collections
using automatically extracted information, Journal of Computing and Information Technology - CIT 13, 2005, 4, 257-264. Available online at: http://cit.zesoi.fer.hr/downloadPaper.php?paper=767. ISSN: 1330-1136.
[14] Clive Best, Erik van der Goot, Ken Blackler, Teofilo Garcia, David Horby(2005) Mapping World Events, GeoiInformation for Disaster Management, ISBN 3-540-24988-5, Springer p 683. [15] Clive Best, Erik Van der Goot, Monica de Paola, Thematic Indicators Derived from World News
Reports, IEEE Conference on Intelligence and Security Informatics, ISI2005, Springer Lecture Notes in Computer Science 3495, P436-447.
