Inside an Analyst’s Toolkit: From OSINT to GIS and Link Analysis

Public safety and homeland security have become data-driven fields, reliant on metrics to reveal what is happening and how law enforcement should respond. With vast quantities of data come new challenges, however. Without the right tools or statistical methods, it can be easy to get lost in records or reports and not understand how to use any of it.

Today's intelligence analyst jobs demand technical expertise, which means knowing which tools to use and when. Below, we highlight the most critical components of the analyst toolkit, along with pathways to building analytical competency.

What’s Inside an Intelligence Analyst’s Toolkit?

The analyst's toolkit describes the different technologies, platforms, techniques, or resources that intelligence analysts use to gain insights from raw data. These complementary capabilities help analysts collect and analyze information as they navigate the intelligence cycle. Through these efforts, scattered data gives way to well-informed decisions.

Why Analysts Rely on a Range of Tools

The intelligence cycle encompasses many distinct phases, and no one stage can be entirely served by a single tool or strategy. Each tool presents its own unique gaps or biases. While crime analyst software can combine functions, tool-specific weaknesses are usually best overcome with a layered approach. Ideally, this will include tools with complementary attributes. If one tool misses critical takeaways, another can shed light on details that were overlooked elsewhere.

Targeted intelligence analysis tools may be integrated into overarching analytical workflows. Under this coordinated setup, outputs from a given platform can feed into other systems to guide further processing and analysis as needed. 

How the Tools Work Together

Analyst tools are not used in isolation. Rather, analysts move data through relevant tools as that information progresses through stages in the intelligence cycle. Workflows are tailored according to specific investigative questions but also largely depend on available data.

What Is OSINT Open Source Intelligence?

Open-source intelligence involves data gathered from publicly available sources, including commercial databases, government records, and even news media. Analysts can readily access and quickly use this data to gain a better understanding of a given threat or event. 

Gathering Insight From Publicly Available Information

While analysts enjoy access to many data sources, publicly available information can provide an excellent starting point. This encompasses data that can be legally accessed by the public. As information is collected from varied sources, it can be analyzed to provide deeper insight into subjects. This information may also help analysts identify new leads. 

Examples may include court filings, business records, professional licenses, and social media content. Analysts can also use the National Incident-Based Reporting System (NIBRS) to learn about reported crimes and examine incidents across various jurisdictions. NIBRS crime data provides a glimpse into broad crime patterns, offering valuable context for analysts. 

Domain-registration lookups, once associated with WHOIS and now largely conducted through the Registration Data Access Protocol, provide registration details (although registrant identities may be redacted). Analysts use this to observe connections between domains and examine claims about the individuals behind online identities. 

Data sources vary, as do the OSINT tools that analysts use to examine that information. Search and discovery tools help map digital footprints, while domain tools examine surrounding infrastructure. Other tools emphasize human intelligence or even the dark web. 

How Analysts Use OSINT Responsibly

OSINT techniques can present considerable ethical challenges. Public accessibility does not eliminate the public's right to privacy or the potential for data misuse. 

Through ethical decision-making, it is possible to minimize physical and psychological harm to individuals and entire communities. This means striking a careful balance between investigative objectives and the rights of those involved. The information collected (and methods used to analyze it) should be proportionate to the investigation's purpose. 

Why Do Analysts Learn SQL and Python Basics?

Analysts rely on programming languages to retrieve and analyze large volumes of data. Programming languages help analysts move beyond spreadsheets, even supporting automation so that analysts can dedicate their time to interpreting results rather than performing manual tasks. 

Using SQL to Work With Data

Analysts work with high volumes of data, but this serves little purpose if it is not properly organized and stored. This is where Structured Query Language (SQL) comes into play. Across industries, SQL provides a reliable approach to storing information in (and retrieving it from) relational databases.

In crime analysis, SQL helps teams clean data and pull records as needed. These could include incidents filtered by date or location. As queries are applied to vast data sets, analysts can isolate information relevant to the situation at hand. Analysis can take place directly within databases, freeing analysts from the need to directly export data to spreadsheets.  

How Python Helps Automate and Analyze

As one of the most popular programming languages, Python is well-suited to projects involving artificial intelligence and automation. Its syntax is uniquely readable — and beginner-friendly — so analysts are unlikely to feel overwhelmed with complexities in the code.

Using Python, analysts can automate repetitive tasks (for example, using scripts to help clean incident records) or apply statistical methods to gain deeper insights from crime data. Analysts who commit to learning Python can gain a clear advantage amid the accelerating adoption of machine learning across crime analyst jobs. 

What Are GIS Crime Analysis and Geospatial Mapping?

The question "Where?" plays heavily into intelligence, but traditional tables and text only go so far in illuminating spatial patterns and relationships. This is where geographic information systems (GIS) prove useful.

By connecting data to locations, analysts can examine where key events occurred and explore factors that may explain their locations.

Turning Location Data Into Visual Insight

GIS layers information onto digital maps, with each layer representing a particular data category. Geographic data is linked to locations, and map layers can be compared or turned on and off as needed. This helps analysts visualize connections between incidents, infrastructure, or neighborhood characteristics. 

How Mapping Supports Investigations and Prevention

Geospatial analysis shows how details from sources connect to actual landscapes. At the same time, it supports hot spot policing by highlighting areas in which risk could be concentrated. 

Mapping enables informed decision-making, allowing teams to anticipate threats and plan strategies with greater precision by showcasing how threats relate to local geography. This approach can support problem-oriented policing by addressing the root causes that contribute to recurring incidents. 

Although often framed as a tool for background analysis, GIS crime mapping can also provide rapid support in times of crisis. GIS can bring time-sensitive threat information and relevant locations to shared maps to support emergency management teams, with this technology even leading to location-based alerts.

What Are Link Analysis and Social Network Analysis?

Link analysis brings an investigative approach to examining or mapping a variety of relationships. These could show connections among people and organizations, as well as their ties to specific locations or events.

Social network analysis (SNA) is similar but emphasizes social structures, detailing how people relate to one another. Together, these techniques allow intelligence analysts to evaluate who, exactly, is connected, while also examining the strength of those connections. 

Mapping Connections Between People and Events

Now used heavily across many law enforcement jobs, link analysis represents entities (such as people or events) as nodes or vertices. The links (or edges) visually demonstrate how various nodes are connected. Visual systems of entities and edges appear as network graphs, in which clusters are easy to spot. 

How Link Analysis Reveals Hidden Patterns

Link analysis sheds light on connections that would otherwise be lost in a whirlwind of information. Analysts choose link analysis tools and techniques based on which questions need to be answered and which inputs are already available. 

• Focused on the 'who' or 'whom' of the investigation, association analysis examines relationships, such as shared contacts or participation in groups. These details join forces to eventually showcase the human structure of a network and to reveal who, exactly, sits at the center of it. 
• Financial flows. Detailing transfers and transactions, financial flows demonstrate how funds move throughout networks or organizations. This approach is sometimes described as "follow the money” and can help analysts investigate crimes involving financial gain or funding.

In general, link analysis begins with a central question: How, exactly, does person (or event) A connect to person (or event) B? This gives way to entity extraction, or identifying all people, organizations, events, or locations referenced in supporting materials. Then, relationships between these many entities are identified and examined, forming edges between the nodes.

Link sources must also be clarified and documented. This is what lends link analysis conclusions credibility. Relationships should be listed as confirmed or suspected, with unverified claims identified accordingly.  

How Do Analysts Use Dashboard Reporting?

The very range of systems and techniques that allow intelligence analysts to do their work effectively also presents challenges, because all those resources can be difficult to coordinate. Analysts may find themselves wasting valuable time switching between databases, logs, or platforms, with key details potentially lost along the way. 

Dashboards address this problem by providing a centralized space in which analysts can easily view all relevant information and spot previously hidden connections. Consolidating various alerts, threat feeds, metrics, or geospatial data into a visual interface, these dashboards help analysts work efficiently and limit the potential for data fragmentation. 

Making Data Clear, Visual, and Actionable

While many of the tools and methods highlighted above contain a visual element, dashboards offer a more comprehensive take on data visualization, integrating diverse information to provide a quick but meaningful overview at a glance.

Featuring visual summaries and interactive filters, dashboards are designed to demonstrate patterns quickly and connect those patterns to viable strategies. This is where analysis gives way to action. 

Why Are Briefings a Key Part of the Toolkit?

Intelligence analysts must ultimately convey their findings to key decision-makers, but leaders may lack the technical knowledge needed to fully understand complex relationships within intelligence data. Through briefings, analysts distill the essentials, presenting key evidence without sacrificing context. 

Communicating Findings to Decision-Makers

Leaders rely on briefings to fully understand the issue at hand and to separate fact from speculation. Briefings cut through the noise to demonstrate what has happened, where threats still exist, and which actions are recommended based on the available evidence. 

Communication strategies determine whether key takeaways resonate with decision-makers. Through the bottom line up front (BLUF) method, analysts clearly state central conclusions at the outset, rather than leading in with extended chronologies or methodology descriptions. 

How Do You Build These Analyst Skills?

With so many tools to explore and technical skills to develop, it can be difficult to know where to start with crime analyst training. In general, analyst skills are best built progressively, within a structured program that introduces you to relevant programming languages and allows you to work directly with the actual programs or platforms that you will eventually use in the field. 

Education and Practice That Prepare You for the Field

Choosing the right criminal justice or homeland security degree begins with determining how you want to make a difference and which skills will empower you to do so in various criminal justice jobs. 

Look for a well-rounded criminology or public safety degree that examines fundamentals (such as statistical concepts or visualization methods) and shows how critical concepts apply in practice. These concepts even complement police officer training, helping tomorrow's law enforcement officials accurately interpret crime data. 

Ideally, a criminology degree or criminal justice degree will provide scenario-based training, including hands-on opportunities to work directly with the data analytics tools and techniques that actual analysts use on the job. 

Expand Your Analyst Toolkit With IWU

Build confidence in navigating (and leveraging) the tools and competencies that will allow you to collect and evaluate information in your work as an analyst.

Whether you envision working in forensic science — or as a crime scene investigator or cybersecurity analyst — you can benefit from intentionally developing widely relevant intelligence analyst skills and applying those abilities in realistic scenarios. 

Indiana Wesleyan University provides a pathway to analytical skill development with the online Bachelor’s in Intelligence and Criminal Analysis. Spanning 90 credits, this program empowers tomorrow's analysts to uncover patterns and interpret evidence.