A Thoughtful, Analytical Approach to NGO Security

Six scams that target aid workers and humanitarian organizations

scammed


1. Fake humanitarian conferences, events, and training opportunities


The script: You receive an e-mail announcing a conference, event or training opportunity related to some field of humanitarian endeavour in which your organization works. The email makes it clear that the sponsors will cover event cost, visa processing and handling, and travel arrangements. Your NGO only has to nominate two staff meeting certain criteria and the event organizers will arrange the rest.

Eventually your will be informed that, for example, hotel costs in Nairobi are not covered and you need to forward funds in advance before the participation of your staff can be confirmed.

This is a variation of the time tested advance fee fraud. Once you send funds the scammers disappear and you discover the event does not exist.

For example event scam emails see The Conference Con website.

Why it works: Conferences, and training opportunities, especially those that involve foreign travel are often seen by humanitarian organizations as a way to reward and develop hard working staff, especially junior or national staff who might otherwise not get such a chance. The promise that the vast majority of the event costs are going to be covered by the event organizers has great appeal to cash strapped NGOs.

How to avoid the con: Scammers have misused TakingItGlobal's name and reputation to carry out event scams so they have released this guide to spotting fake humanitarian event invitations.


text from a hitman scam email
2. The 'Taliban Hitman' scam

The script: The potential victim receives an email or series of text messages informing them of the following:

I was hired to kill you by the Taliban/AQ/a secret government organization. I have all the information on your daily activities that I need to kill you at any time. However, I recently became aware of your humanitarian activities and know that you are a good person at heart. If you send me 10,000 USD I will spare your life.

I have all the information needed to implicate my employer in the plot to assassinate you recorded on tape. If you me 1500.00 USD I will send you the tape. If you find the information on the tape useful you can send me the remaining 8,500.00. You can use the information on the tape to retaliate against my employer or you can go to the police with it.

Please be aware that my boys are watching you all the time. If you do not respond quickly I will be forced to carry out the contract despite my reservations.

Ahmad Killer


Why it works: Groups like the Taliban, Al-Shabaab, and Al-Qaeda have made it clear that they do not approve of many NGO activities. Often the victims have already received real threats warning them not to work for international NGOs. To a national staff member of an NGO in Afghanistan, Somalia, or Iraq it seems entirely plausible that one of these groups has hired someone to kill them.

How to avoid the con: Once you are aware of the existence of this scam the real nature of the messages become pretty obvious. The Taliban and their ilk don't need to hire a hitman to kill an aid worker. They have plenty of people willing and able to do the job for free and they are unlikely to have a change of heart.

Don't let fear overwhelm you. Don't respond to the threats and don't make counter threats. Keep the originals of all the threats and give them to your security officer so that the issue can be dealt with appropriately.

If you still suspect you are being targeted by a hitman take a look at the FBI’s 2007 post on the hitman scam.


3. The 'Intelligence Service' scam

The script: The victim is approached by a person or small group of people claiming to be undercover police officers or members of an intelligence service. The scammer tells the victim that he (the victim) is under suspicion but that for a small fee he is willing to look the other way.

Why it works: Fear... pure, simple, fear. Aid workers who belong to persecuted ethnic, religious or social groups are especially vulnerable.

How to avoid the con: Unfortunately this is a very difficult situation to deal with. Much depends on the local context. In some countries (*cough* Sri Lanka) where this scam is being run the perpetrators may actually be real police/inteligence agents. Is it better to throw them a few bucks and make your getaway? Or should you hold firm and refuse? I'll leave the choice to you. Hopefully, forewarned of this scam, you'll be able to make an intelligent choice.

Whatever choice you make you should report all such incidents to your security officer.


5. Emergency funds transfer scams

The script: The bank that holds an aid organization's funds receives a phone call and/or fax purporting to be from a program manager in the same aid organization. Usually this happens just before the bank closes for the weekend. The caller apologizes for not completely following the previously procedure for funds transfer but he explains that this is an emergency situation. Its seems that there are 250 families who have been stranded by the current emergency. They've been overlooked until now and they are in a desperate need . Unless the funds can somehow be transferred to a specified local NGO/CBO before the close of business the families will be forced to endure another weekend without food, water and shelter.

The local NGO is of course bogus and no one will know that anything is amiss until the following Monday at the earliest.

Why it works: Despite rumours to the contrary bankers are human. They don't relish the thought of their disaster stricken countrymen going without the essentials of life for another long miserable weekend. Usually the scammers have done enough research to help allay the bankers concerns. It is easy find basic information, such as the name and the contact details of the country director and finance officer on the internet. Account numbers can be found by going through the aid organizations garbage or conning a staff member to provide it.

How to avoid the con: Don't throw financial information in the garbage. Shred it. Even staff lists and contact information is useful to potential scammers. Make sure staff know and understand the risks of giving out information over the phone (see social engineering). Finally, make sure your bank understands exactly who can and cannot override previously agreed transfer and payment procedures.


6. The 'Build and Burn' scam

A badly damaged school in Afghanistan

The script: This scam is becoming more common in conflict plagued areas of Afghanistan and Pakistan. Essentially the scam works like this: a local contractor bids for a NGO funded contract to build a school or similar public building. Local militants allow the contractor to complete the contract but they take a cut of the contractors profits or divert building materials. Once the contract is complete the militants burn or blow up the school. Often an NGO, maybe even the same one, returns to rebuild the school and the scam starts over again.

Sometimes the contractor is an active participant in the scam at others times he is simply extorted.

Why it works: A poor security situation, remote management, and a certain amount of wilful blindness on the part of NGOs contribute to the success of this scam.

How to avoid the con: The only way I know of to avoid this scam is not to fund construction in contested areas. You'll need to balance the potential good of a new school (assuming it stays up) versus the bad of funding armed groups.

Twitter and disinformation in Iran

Over the past week there has been a lot of media coverage of the relationship between Twitter, the hybrid online/mobile communication service, and its impact on post election events in Iran. The argument that Twitter service in Iran is a critical opposition activist tool is already over-hyped so I won’t rehash them here. Rather, I think its worth shedding some light on how Twitter is being used to spread disinformation and who is doing it.

Twitspam has a continually updated list of suspected fake accounts that may have connections with Iranian security. I used some of these account names as a starting point for a quick and dirty analysis of their networks.

Suspected AlJazeera English producer impersonator “AJE_Producer” appears to be trying to lure Twitter users in Iran into communicating with him directly through email or telephone with the intent of entrapping them. The diagram below illustrates how easily the suspected impostor was able to disseminate his requests for contacts. It shows only recent ‘active’ direct connections between AJE_Producer and twenty Twitter users and the recent active connections between those twenty users and their contacts. It does not show retweets nor does it reflect how many people may have simply read a message from AJE_Producer.

AJE Producer Twitter connections
AJE_Producer network

Although some of the connections are from people trying to challenge AJE_Producer’s methods there were a surprising number of people who took AJE_Producer at face value including some who actually appeared to be residing in Iran. Given the current level of violence in Iran this is alarming to say the least.

Expanding the network of connections one iteration further gives a somewhat rosier picture. The chart below shows AJE_Producer’s (center of chart) deception being overshadowed by a number of well connected Twitter users (top of chart) who appear to be trying to out AJE_Producer and other fake Iran election Tweeters.

AJE Producer tertiary connections
AJE_Producer extended network

Analysing the Twitter networks of other disinformation purveyors from Twitspam’s list highlights some developing tactics. Iransource and iransource45 are likely the same person. The content of the tweet streams is remarkably similar and composed mostly of overt propoganda. These two entities dominate the chart below because they send tweets directly to other Twitter users and reply to queries. Their relatively innocuous names may be an attempt to reassure potential followers. It is interesting to see the cluster of five anti-spammers trying to counter them.

Centrality view of Iranian Twitter disinformation network
Iranian Twitter disinformation network overview

If we take a closer look at the network on the bottom left we can see a different tactic developing. Ebrahim Ansari (AKA Persian_Guy) uses fake retweets to spread disinformation and confusion. Essentially he is putting his words in the mouths of other users, both real and imagined. The AhmediNej accounts are primarily used to retweet Ebrahim’s content, probably in an attempt to bypass users trying to block obvious proganda. They don’t have a lot of active connections, likely because the account names themselves are so obviously inflammatory.

Twitter disinformation closeup view
Close-up view showing AhmedNej and Ebrahim Ansari networks

For the moment it appears that activists in Iran have the edge when it comes to making use of Twitter to get their message out . However the propagandists are trying to close the gap. They hope to trap gullible users, spread disinformation, and create distrust.

If you want to counter them I suggest you go to Twitspam and block the those on the “
Obvious Disinfo” list. Certainly you should not retweet anything from these people.

Qwam System Charts

A while ago I was struggling to understand influence and social connections in Afghanistan. It seemed to me that more than a few Afghans in positions of authority had trusted contacts on both sides of the conflict. It was something I didn’t really understand until I came across references to the Afghan Qwam (or Qaum) system.

I can’t claim any great insight beyond the simplistic explanation that a Qwam is a shifting solidarity network that exists for the benefit of the group and its members. Qwams compete with one another for influence and resources but there is also competition within the group. It appears that Qwams, at least in Afghanistan’s current fractured society, cut across family, tribal, and even ethnic boundaries.

Afghan Qwam Clip

In an effort to better understand the Qwam concept I mapped some connections in Analyst’s Notebook. Since I never used them for anything beyond my own efforts at understanding I’m making them available here. Maybe some of you smart types out there can make better use of it.

Qwam - Analyst’s Notebook version
Qwam - .pdf version

Maps - Aid worker fatalities in 2008


View Larger Map
Map - Humanitarian Aid Worker Fatalities - 2008


Aid Worker Fatalities in 2008 - Heat Map
Heat Map - Violence Related Fatal Incidents - 2008

Somali 'Green Zone' won't improve aid worker security

AU soldiers guard port in Mogadishu
Photo by David Axe Some rights reserved.

A couple of days ago Peter at The Road to the Horizon asked me what I thought of the proposal by the UN envoy to Somalia for a Baghdad-style Green Zone in Somalia. Since I don’t know all the reasons the UN might want a green zone I’ll stick to the question of whether or not a green zone type base would enhance aid worker security in Somalia.

So do I think a Somali green zone could make humanitarian staff safer? No, at least not appreciably so and certainly not cost effectively.

Here is why:

Soldiers required: A Somali green zone would require competent armed troops to protect the perimeter and man the gates. Who would do this? The Somali army is virtually non-existent and lets face it, foreign troops aren’t exactly welcomed with open arms in Somalia. Even if a troop-contributing nation could be found there would still be the issue of feeding the perception of a link between military forces and humanitarian assistance.

Attack magnet: A green zone would become a magnet for attacks just as the original Green Zone was. Even if groups like al-Shabab decided to give up attacks on aid workers they are still going to attack the soldiers manning the facility. Every deluded suicide bomber and wannabe Jihadist would be drawn to this symbolic target.

Exclusivity: It won’t protect Somali aid workers who do most of the direct implementation. After a long day of work in the field they’ll still be returning to their family homes… outside the green zone.

It won’t protect field staff: Ibrahim Hussein Duale and Mohamud Omar Moallim were both killed while they were working in the field. A green zone wouldn’t have saved them. Nor would it protect any other staff going to do actual implementation in the local communities.

It will be a prison: While a green zone might provide some protection to international mangers and such but they will still be almost as cut off from the ground reality of Somalia as they are now in Nairobi.

Culturally inappropriate security: A green zone would not do anything to increase local acceptance of foreign aid organizations. In order for NGO security measures not to risk reducing acceptance they need to be culturally and socially appropriate for the local context. Giant HESCO Bastion barriers are just not part of Somali culture tradition.

It’s a money sink: The problem with protective security measures is that they quickly become obsolete in the presence of a determined attacker. Build thicker blast walls and they will build bigger car bombs. Each escalation requires more spending on security measures.

All in all I think a green zone would isolate and reduce the acceptance of international aid staff, blur the line between military and humanitarian response, waste money and do nothing to make aid workers safer.

Why are ambulances targeted in Gaza?

After last weeks killing or a paramedic in Gaza I found myself wondering how and why such incidents happen. Sure, being a medic in Gaza is dangerous work. They place themselves in harms way in order to save others and unfortunately crossfire doesn’t discriminate.

Could there be other reasons for attacks on ambulances and medics in Gaza? The video link below suggests there is. Watch it carefully. What do you see?



If this video is in fact what it purports to be there is cause for concern. First is that the ambulances seem to show up before the violence starts. They don’t appear to be responding to an incident. Rather, they seem to know in advance that trouble is coming. How neutral and impartial are you if you become the de facto medical support for one side?

Second and more important is the issue of the ambulance itself. The ambulance is clearly marked as such and even has UN markings. Despite this the gunmen are clearly using it as transportation. Using ambulances to transport combatants is a violation of the Geneva Convention.

It doesn’t take many incidents like this to lose the acceptance that humanitarian organizations depend upon to ensure their safety and security.

Old Choices Come Back to Haunt NGOs in Afghanistan.

The Ghosts of Alexander have a great post on the The Politicization and Militarization of Aid to Afghanistan. As the ghosts quite rightly point out the process did not begin in 2001. It began much earlier and NGOs are still feeling the impact today.

To quote the ghosts again, “All it takes is for either the US, the Taliban, the locals or the central government to see it as political and becomes so...” Unfortunately that means your organization’s carefully crafted, acceptance based, security strategy disappears along with your perceived neutrality.

Read the whole post to see how your NGO’s choice of friends in the 80’s might be affecting your security today.

Frontline - Are the Taliban Winning?

In this video from the Frontline Club reporter Hamida Ghafour and author Ahmed Rashid discuss if the Taliban are set to regain control in Afghanistan or if they are they being slowly marginalised.

Afghanistan Maps

If you need a little cartographic assistance to help you make sense of Afghanistan, Somalia, or world wide opium production, you should check out the Senlis Council’s map page. The maps also make great orientation graphics for senior level decision makers, VIP visitors, and others with short attention spans.



Human Security Brief 2007 - We Are Winning!

The Human Security Brief 2007 has been released. It challenges the conventional doom and gloom we've become so used to hearing. Maybe, just maybe, the voices of reason are winning.




Number of Reported Battle-Deaths from State-Based Armed Conflict by Type, 1946-2006

You can also listen to a webcast of Andrew Mack's press conference to discuss the report. Sorry but you'll need RealPlayer. Note to UN - why can't you use a non-proprietary format?

The Taliban and Propaganda of the Deed

The Insurgency Research Group has an excellent analysis of the significance of the Taliban attack on Sunday's Afghan National Day parade. The whole post is worth reading but don't do it yet. Read the following paragraph first and then watch the No Comment TV video.

The incident on Sunday demonstrates a classic propaganda of the deed partnership in which the insurgents with growing skill select a media-significant target and with witless incomprehension international reporters beam the most sensationally damning images of the event around the world so as to deliver the worst possible interpretation. There is no need for a Taliban subtext or even a photo caption, the images speak powerfully for themselves sending messages of a stricken regime put to flight in their gilded uniforms by the daring fighters of the Taliban.






OK. Now go ahead and read the whole post.

Darfur, Afghanistan, Beer, and Breakfast

Google Trends can be a useful tool for context analysis. If you've ever wondered why your security budget is dwindling despite the rise in security incidents or why the head office seems to have forgotten you it can be a pretty useful tool.

For those who haven't seen it before Google Trends compares the relative Google search frequency of up to five user specified terms. For example if you want to compare relative search interest in various hot beverages you might enter "coffee, tea, cocoa" and press search. Google Trends returns a nice neat chart that shows how many searches were made for each term over time. It also shows a "news reference volume" chart, or in other words the frequency with which the term has shown up in the media.


Relative frequency of search terms Darfur, Iraq, Afghanistan, Congo and Sweden

The chart above was generated when I compared relative interest in Darfur, Iraq, Afghanistan, and the Congo, with Sweden as a control.
The results were pretty interesting. Searches for Iraq seem to correspond with increases in media coverage. No surprises there. The big surprise for me was Sweden. Google user are more interested in Sweden than they are in Darfur, Afghanistan, and the Congo. Talk about forgotten conflicts!

Flag B is interesting. It marks George Bush's call for more NATO troops in Afghanistan and clearly shows an increase in media coverage of Afghanistan. It even overtook coverage of Iraq for a short while. However, the general public took no notice.

Headlines associated with country comparison

Relative search frequency by region

The regions chart is enlightening. Americans are predominantly interested in Iraq and seem to have forgotten about Afghanistan. The Canadians, who have troops in Afghanistan but not Iraq seem equally interested in both countries. And finally, the Swedes seem to be totally obsessed with Sweden.


beer_comp

Not without trepidation replaced Sweden with "beer" in my search terms. I shouldn't have. I now know that your average computer using westerner is more interested in beer than they are in Iraq and Afghanistan combined. "Darfur?... never heard of it... do they have good beer?"

If you are feeling particularly masochistic try breakfast or worse boobs. For a brief while in 2004 your average Google user was more interested in what was happening in Iraq than what they were going to have for breakfast. That aberration hasn't repeated itself since. Its also interesting to note that while American's seem equally fascinated by Iraq and breasts, Canadians have a distinct preference for the later.

FORA.tv: Mohammed Hafez on Suicide Bombings in Iraq

I don't normally cover Iraq. There are more than enough pundits doing so. However, in this case I am going to make an exception for one simple reason: Iraq is a testing ground for a new model of war. The lessons learned in Iraq, by both sides, will be used elsewhere in the world. By the very nature of where NGOs tend to work they will be directly and indirectly impacted by this new, rapidly evolving, mode of conflict.

Suicide attacks seem to be a keystone tactic in this new conflict. Suicide attacks have a disproportionate effect on world political developments because of their targets, their apparent unpredictability and inevitability, and most of all the incredible psychological impact. NGOs can no longer be confident that they will not be the target of such attacks. Even when humanitarian workers are not directly targeted the places they frequent inevitably will be. Restaurants, hotels, night clubs, public gatherings, government buildings, and UN complexes have all been attacked by suicide bombers in recent years. To make matters worse suicide bombings are no longer rare events outside Iraq. They have increased in frequency in Pakistan, Afghanistan, and other countries around the world.

In the two video clips below author Mohammed Hafez discusses the strategy and ideology of suicide bombing. They are well worth watching.






Question: How do INGOs, often viewed as proxies of western governments, protect themselves from suicide bombers?

Has the World Become a More Dangerous Place?

Is the world a more dangerous place to live now than it was ten years ago? How about a hundred years?

According to this first video the answer is yes. In it the University of Hawaii examines the complex issues of armed conflicts, peace-keeping operations and humanitarian relief with the input of former UN and government officials, humanitarian aid workers and PKO experts.



In "A Brief History of Violence" Steven Pinker argues the opposite. His data suggests that we are living in what might very well be the most peaceful time in human history.



So who is right here? Is the world safer? How do our cognitive biases shape our perceptions of the risks we face now versus those faced by our ancestors?

Terrorism, Economic, and Privacy Risk Maps

I love maps. Good maps can be a security analyst's best friend. A good map can summarize an entire analytical report.

A recent post on sources and methods led me to Aon Corporation's Terrorism Threat Map. Risk levels, regions of special risk, religious extremist groups, political extremism, separatist movements, and kidnap risk are all covered in a simple and easy to grasp format. The legends are chock full of information as well. One even contains a concise explanation of the terrorism risk assessment process.

Terrorism Threat Map


Aon's 2008 Political and Economic Risk Map is another that deserves a place on your office wall. Not only does it illustrate the usual war, terrorism, and civil disturbance risks but it also highlights exposure to the current global credit crisis. You can get a copy here but unfortunately you'll have to fill in one of those annoying online forms.

Political & Economic Risk Map 2008


Privacy International's map of Surveillance Societies Around the World isn't nearly as professional as the ones above but it is still effective at pointing out that the world's nosiest governments aren't necessarily where you might think. Although I think Privacy International tends to be somewhat alarmist my biggest problem with their latest report is that they still leave large portions of the world uncovered. Surely Africa, the Middle east, and South Asia deserve greater attention?

Map of Surveillance Societies arounf the World

For extra analytical fun try overlaying the maps. How does surveillance intensity compare to terrorism risk? Kidnap risk?

The Global Risk Report Rank Ordered

"Sources and Methods" has a great post on rank ordering the risks from the 2008 Global Risk Report. I'm not really conversant with all the math but his rank ordered list is pretty interesting. Where do you suppose international terrorism ranks compared to a pandemic? Or how about "failed and failing states" compared to "natural catastrophe: earthquake?"

Suicide Attacks in Pakistan 2007

The Pak Institute for Peace Studies' Security Report has some interesting data on suicide attacks in Pakistan in 2007. Actually there is all manner of data covering many aspects of the violence plaguing Pakistan but I've only had time to play with the suicide bombing data. Digging deeper into the numbers reveals some interesting facts.

Suicide Attacks by MonthCasualties Due to Suicide Attack by Month

If we examine the number of suicide bomb attacks per month we see a peak in July 2007. This coincides with an active suicide bombing campaign against predominantly military and police targets. However if we compare it to the adjacent chart showing casualties due to suicide bomb attacks we can see another peak in November and the start of one in December. The July, November and December peaks coincide with attacks on Pakistan Peoples Party rallies and/or attacks on the party chair, Benazir Bhutto.

Incidents of suicide bomb attacks and casualties by region of Pakistan
This chart reveals that most of 2007's suicide attacks occurred in the NWFP. The single but very lethal attack in Karachi also stands out.

Assessed Intended Target of Suicide Bomber

Attacks probably intended to target the military accounted for 47% of suicide attacks with attacks against the police accounting for another 20%. Assessing the actual target of suicide attacks is difficult since the perpetrators are no longer around to explain their intent so these numbers are approximate. The 'mixed' category in particular may be the result of bombers attempting to attack police or military targets without regard for nearby civilians.

Nine percent of the attacks were assessed to be primarily intended to target civilians while 13% where assessed as being intended to attack government personnel and/or political entities, including VIPs.

A comparison of BBIED vs VBIED as method of attack

In 2007 suicide bombings in Pakistan were almost evenly split between Vehicle Borne Improvised Explosive Devices (VBIEDs) and Body Borne Improvised Explosive Devices. There were a small number of 'complex attacks' involving either multiple bombers or combinations of suicide bombers and conventional attacks.

Relative lethality of VBIEDs and BBIEDs

It was a comparison of the relative lethality of the variants of suicide attacks that surprised me somewhat. I had expected complex VBIED attacks to produce the highest number of casualties per incident yet we can see that complex BBIED attacks on average produced two and a half times as many casualties. However, on second examination it becomes apparent that suicide bomber on foot are able to get much closer to their targets and are able to merge easily with large crowds. Even a relatively small quantity of explosives will cause many casualties when employed indiscriminately at political rallies and religious festivals. In addition it appears that VBIEDs were employed primarily against harder military and police targets.

I would have liked to compare civilian victims of suicide bombers against total casualties but unfortunately the data fidelity is just not there. However PIPS did have a table showing total civilian casualties as a result of 2007's cumulative attacks and clashes. Once again civilians seem to bear the brunt of the violence as the chart below shows.

Casualties of Clashes in Pakistan 2007

So what does all this mean for NGO's and others wanting to increase their personal security? Well there shouldn't be any surprises here. The data supports the tried and true advice:

* Avoid potential targets including military and police personnel and facilities as best you can.
* Don't wear clothing that might be mistaken for a uniform.
* Don't mingle with military or VIP convoys while driving.
* Avoid travelling on routes and at times used by military convoys and/or VIPs.
* Avoid political rallies especially when VIPs are present.
* Avoid large crowds including during religious festivals.

Sri Lanka 2008

2008 is going to be a very difficult year for humanitarian organizations working in Sri Lanka according to this post in groundviews. I wish I could disagree with the author as the predictions are grim indeed.

"Senior leadership of pro-democracy NGOs will face ever increasing hate speech by those in power and their local and international apparatchiks. Field workers of local and international human rights and humanitarian organizations in particular will suffer the brunt of physical attacks, including outright murder and torture with total impunity. Further, organizations working on media freedom and the freedom of expression will find themselves painted as agents of foreign government’s with no real legitimacy in Sri Lanka. The Administration will become more rabid and parochial in its definition of what is local, authentic, Sinhala and Sri Lankan and essentially kosher in civil society initiatives. Anything and anyone that falls outside these self-styled definitions will be dealt with extreme prejudice."


Unfortunately I think that Sanjana has it right. You might want to make sure your contingency plans are in place and up to date.

A Periodic Table of of Visualization Methods

Visual-literacy.org has a great periodic table of visualization methods. You can find something here to help tackle the most complex of analytical problems.

table of visualization methods
Periodic Table of Visualization Methods

Thanks Rick!

Twitter Tracking for Security and an Answer

Twitter has added the ability to track keywords. Now whenever someone sends a public update containing your word or phrase of interest you’ll receive a copy of the update. How is this useful for NGO security officers? I’m currently tracking several towns in trouble areas, Tsunami, and a variety of other keywords. You’re only limited by your creativity. One word or warning though: you’ll get ALL public updates with the search term, even ones in languages you don’t speak.

I've also finally added the solution to our geographic distribution analysis problem.

Analysis 101: Geographic Distribution Analysis 2

As Paul pointed out it would be beneficial to compare our office location (the blue square) with the IED incidents. We’ve also added military installations (the green squares) and the primary military convoy routes (marked in orange dashes) as these are likely targets.

Geographic Distribution Example Map 2

A search for more information reveals the following:

You have two small low-key programs operating in town.
The bulk of programming takes place in other areas of the country but staff travelling to the field offices are forced to take one of the major roads.
The main road to the east is the only viable route to access offices in the east.
Local staff travel back and forth to work by public transport or personal vehicles using all the main roads.
International staff travel to and from work in agency vehicles.
The first military convoys of the day are usually between 0600 and 0900.

Analysis 101: Geographic Distribution Analysis

Geographic distribution analysis is a method of examining the occurrence of security incidents or the distribution of entities over a particular geographic area to determine what can be concluded about the incidents or entities. The analysis is usually performed on a map but the final results can also be expressed in a descriptive manner, as in a written report.

To complete a distribution analysis, data on the locations of violent incidents, entities of interest, etc. should be collected and plotted on a map that covers the area in question. Next the map is reviewed to produce a summary and to draw conclusions about what it might mean.

At its simplest geographic distribution analysis might only represent one dataset e.g. a plot of violent incidents on a city map. While this can be useful in itself, as a weekly briefing update perhaps, we can delve much deeper by synthesizing two or more datasets on the same map. We could compare a plot of violent incidents and criminal activities against a plot of proposed office and residence locations. As another example we could compare the locations of narcotic growing areas and smuggling routes with an overlay of violent incidents targeting NGOs.

To illustrate lets look back at our previous problem. As you’ll recall we did a time series analysis of a series of IED attacks. Although we were able to make some basic and tentative conclusions we knew we needed to do further analysis and geographic distribution is a good next step.

After plotting the IED incidents you come up with a map that looks like this.

Geographic Distribution Example Map

What are your conclusions now? Would you change or amplify your advice?

Analysis 101: Time Series Analysis Answers

Earlier in Analysis 101: Time Series Analysis I introduced an analytical problem and asked a few questions. You can find some possible answers here. CtJ also has some hypotheses that might serve as a good starting point for further analysis.

Analysis 101: Times Series Tools

Old School

To do basic time series analysis all you really need is graph paper and a pen or pencil. The down side is that this method is very labour intensive and as the dataset becomes larger most of us can’t cope.

Middle of the Road

The next step up is to use something like Excel. There are some useful free or low cost tools that can simplify time series analysis. In a previous post we saw how to use Excel to do some simple analysis. The sample templates we used are located here.

I’ve developed a Cumulative Security Incident workbook that I use to track longer-term trends. It is available on the downloads page. It’ll produce charts like this one.

casualties by month

Vertex 42 has a free Excel template that can help you create simple timelines. While it might seem to be better suited to presenting a final analytical product it can also be used in the analytical process. Back in the days of the First Gulf War I used a timeline similar to this in an effort to gain a better understanding of Saddam Hussain.. Above the line I plotted significant events in Saddam Hussain’s personal life. Below the line I plotted significant historical impacting Iraq. The exercise proved very revealing and shed light on the man behind the myth.

timeline

Some people use Gantt Chart software to do time series analysis but I find it awkward and time consuming.

Bleeding edge

If you are going to do a lot of time series analysis or if you need to analyse large quantities of data you should probably consider a product like Analyst’s Notebook by i2. It can handle a time series of several thousand incidents with relative ease. It is also beneficial in many other types of analysis so you’ll probably here me refer to it again. Be warned though, it is expensive.

Analyst's Notebook

Analysis 101: Time Series Analysis

A time series analysis is a security analysis technique that is used to examine the occurrence of similar security incidents over time. In this case time refers not only to time of day but also day of the week and the day of the month. Longer-term analysis can also include month and season.

By way of example let us imagine that during the past month there have been twelve Improvised Explosive Device attacks in the district where your organization is working. The attacks have occurred at ten separate locations. Victims have included soldiers, police officers, and civilians alike. The only apparent pattern seems to be that the attacks have all taken place on or near main roads. To make matters worse your country director wants to be briefed in four hours.

To aid your analysis we will make a quick Excel chart with the time of day on one axis and the incidents on the other. For each incident we put an X the the row that represents the time of day that the IED attack occurred. The chart should look something like this one.

time series TOD

Examining the chart we see that most of the incidents have occurred between 0600 and 0900. Of these half occurred between 0800 and 0900. We'll highlight these incidents in blue to remind us that they seem to be part of a grouping. There are also four incidents that don't fit the general pattern. We've marked these in red.

With the information you have now what assessment can be made? What would you advise the country director?

Lets take it one step further and make a new chart that plots the incidents against the day of the week.

time series DOW

At first glance there doesn’t seem to be much of a pattern here but on closer examination you'll notice that all of the ‘red’ events that were highlighted earlier fall on a Friday except for one that occurred early on Saturday morning. The remaining events all occurred on weekdays (Friday and Saturday are considered the weekend where you are working).

What does this new information suggest to you? What can you tell the country director? What recommendations can you make? What additional information do you need to seek out? What additional analysis can you do?

The Analysis Gap

There is a real gap in the availability of good analytical training and resources for NGO security officers. Most NGO security manuals introduce the topic by stressing the importance of good analysis and an understanding of the local context. They might then go on to briefly cover actor mapping, and if we are lucky incident plotting. Beyond that the reader is left to his or her own devices.

Admittedly there have been a number of recent analytical studies that examine the patterns of violence against NGOs. These studies come replete with multiple regression analysis and complex equations like this one; "Sec100k = -1.384 + 1.691*BorderPak + -0.00011*Poppy + 0.036*Homeradio". I’m sure these studies are useful for developing policy and keeping underemployed academics out of the soup lines. However, they are unlikely to provide much solace when the country director wants to know how he can safely keep program running despite the recent spate of IED attacks.

In order to try and address these shortcomings I am opening the conversation on security analysis for NGOs. We’ll start with simple, robust, and inexpensive tools and techniques that can be used anywhere under any conditions. We’ll also examine more advanced tools that take advantage of the latest in ICT.

Anyone who wants to share tips and techniques should feel free to do so. It doesn’t matter to me whether you do your analysis on the back of an empty cigarette package under a sputtering lantern or on the latest networked GIS platform in a brightly light office. The goal is to identify and share best practices and to encourage the development of new tools and techniques.

I'll post the first technique shortly.

Silobreaker - Online Analyical Tool

Online research can be a great tool but as anyone who has used Google can attest there is a lot of information out there and most search tools just dump out an endless list of links. Sorting through it, discarding the irrelevant, and putting the remainder into some usable form is a task left to the user. Any tool that allows the already busy Security Officer to spend less time searching for information and more time assessing and analysing it is of value. Silobreaker is one of these tools. In the words of Silobreaker, "Silobreaker looks at the data it finds like a person does. It recognises things - companies, people, topics, places - and puts them in context".

While I was testing the public Beta I quickly discovered its utility. A basic search for the term 'suicide bomber' brought up the type of content you might expect but with some preliminary organization. There was a top stories pane, a search result timeline frame, an entity list, a "Quotes" pane, a more traditional search results list and a network visualization diagram. The sidebar also has a list of entities related to your search; cities, people, companies etc.

Since I'm currently in Sri Lanka I "drilled down", as Silobreaker calls it, to Sri Lanka. The result were now much more relevant and lo and behold there were items of interest and relationship that hadn't captured my attention before.

As one would expect with a Beta there is still some work to be done. Even on my relatively fast connection the site seemed slow at times. One very useful feature that counters the sluggishness is the liberal use of hover overs allowing a quick preview of content before you commit to clicking on a link or entity.

Silobreaker is currently allowing free public access to its online Beta. I recommend you give it a try and see if it meets your needs.

Other Stuff

Subscribe to Patronus in a feedreader
Subscribe to Patronus Analytical RSS Feed by Email

Low on bandwidth? Try this low graphics version


Lijit Search

Bloggers' Rights at EFF Global Voices: The World is Talking, Are You Listening?



Support CC - 2007

Creative Commons License
This work by Kevin Toomer is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 2.5 Canada License.
Jun 2008
May 2008
Apr 2008
Mar 2008
Feb 2008
Jan 2008
Dec 2007
Nov 2007
Oct 2007
Sep 2007
Aug 2007
Jul 2007