CA2500082A1

CA2500082A1 - Intelligent surveillance and profiling method and system for application in a wireless network

Info

Publication number: CA2500082A1
Application number: CA002500082A
Authority: CA
Inventors: Aaron Demello; Alexander Miller
Original assignee: Individual
Current assignee: Individual
Priority date: 2005-03-18
Filing date: 2005-03-18
Publication date: 2006-09-18

Abstract

An intelligent surveillance, tracking and profiling system utilizing a wireless network is provided to surveil in real-time a plurality of mobile or wireless communication devices each emitting a unique identifying signal. The system includes a network adapter system and a data storage and computation system including: a local sentinel system; and a history sentinel system; and a network data controller to facilitate user interfacing and data management. The continuously emitted unique identifier signals for each of the plurality of wireless devices are periodically detected. Positions of the plurality of wireless devices are periodically computed based on the unique identifier signals. Position data is monitored in real-time to track individual wireless communication devices. Patterns of behavior based on the real-time and historic position data are determined for each wireless communication device and compared with predetermined patterns of behavior of interest.
Authorities may search historical location data to identify and isolate any wireless device whose signal was detected at or near a particular location on a particular data at a particular time. The owner of the isolated wireless device can then be identified and tracked.

Description

Intelligent Surveillance and Profiling Method and System for Application in a Wireless Network Field of the Invention:
This invention relates to a method and system for locating, tracking, and creating a geo-based profile of a plurality of wireless communication devices operating in a wireless network. Specifically, the invention is directed to an intelligent surveillance and profiling method and system for remotely, anonymously, and non-intrusively gathering and monitoring position data for each of a plurality of wireless devices operating in a wireless communication network and an intelligent surveillance and profiling method and system for analyzing behavioral trends and creating a geo-profile of each of a plurality of wireless devices operating in a wireless network by determining patterns of current and historical behavior data based on the position data.
Background of the Invention:
Recent events have heightened the consciousness for personal safety and security throughout the world. This in turn has lead to an increased demand from government and law enforcement agencies for large-scale surveillance, intelligence-gathering and sharing, and decision making support and analysis solutions to aid in the protection of national security and public safety.
Terrorism is a global threat influencing the attitude and behavior of a target group by threatening or carrying out devastating actions. These actions, as have been demonstrated, may involve coordination of nationally and globally disbursed terrorist groups, involving only one or a few individuals, to carry out missions of terror targeting critical or strategic objectives and mission critical infrastructure. Likewise, drug traffickers have notoriously used gangs, or even loosely formed networks of otherwise unobtrusive individuals to traffic illicit drugs. Many of these individuals use aliases and phony identification to travel unnoticed by law enforcement. These individuals may use the darkness and obscurity of night, fake alibis, frequently move or change vehicle, or other surreptitious means to cover their tracks and prevent law enforcement from detecting their activities.
Further, criminals and terrorists often use the anonymity, mobility, concealability, and convenience of wireless communication devices to communicate secretly with one another to carry out their plans.
Without accurate details and specifics about their travels and whereabouts at a particular time (such as might be obtained from credible eyewitnesses, strategically positioned surveillance cameras, credit card receipts or even telephone records) law enforcement cannot often trace a criminals path. In the never ending pursuit of crime prevention, law enforcement officials must be able to constantly and cross-nationally track various situations and individuals and somehow gather and use historical details of prior crimes and known behaviors and activities of suspicious, potentially suspicious, or even otherwise seemingly innocent individuals in order to solve or prevent crime.
Currently, intelligence gathering by law enforcement agencies ("LEA's") requires significant legwork, cunning, skill, time and manpower to gather critical information related to a suspect's activities. It is only after LEA's have reasonable suspicion that a criminal act has or will take place by a specific targeted suspect that they are able to seek authorization to eavesdrop, bug or wiretap a targeted suspect's conversations. Unfortunately, this delay often results in the gathering of incomplete or late information related to a suspects activities or plans. While a suspect may be surveilled or followed to learn his current behaviors, gathering enough data to determine a consistent pattern of behavior would entail long term surveillance of the suspect at close range. Present surveihance and intelligence gathering techniques do not quickly, easily, or inexpensively, allow for tracking of historical or present behaviors of large numbers of possible suspects.
With the current state of public surveillance technology, law enforcement agencies ("LEA's") face a number of challenges to address their mission critical needs for tracking historical and present behavior to establish patterns of behavior. Primarily these obstacles include: the difficulty of gathering sufficient and consistent information indicative of an individual's behavior; the disparate sources of data whose data are not often easy to correlate;
insufficient, incomplete, unclear, or indefinite data or evidence regarding an individuals behavior which are available with certain current surveillance and intelligence gathering methods and which are infrequently shared among law enforcement agencies and sources; an over abundance of insignificant or extraneous information gathered from certain other current surveillance and intelligence gathering sources which hides or masks significant patterns of behavior which would be useful to law enforcement; the necessity and unaffordability of acquiring and utilizing very expensive, sophisticated intelligence tools to assist with decision making and analysis of data and trends; the lack of timely dissemination of information about the activities of suspicious groups or individuals between agencies, or department or law enforcement; and the complexity and political protectionism of interoperational and interagency exchanges of potentially useful and important information between the various LEA's, including, federal, state, and local. Importantly, current surveillance methods are unable to or notoriously poor at predicting possible criminal activity in real-time based on current and past behavior on a large scale. More importantly, because of costs and the enormity of the amount of wireless transmissions flowing through a network daily, current wireless communication surveillance methods are generally small scale efforts of a few individuals tracking a few previously identified suspected criminals or terrorists. Thus, to make wireless surveillance efficient and productive, significant legwork must be completed to identify and determine suspicious patterns of behavior to justify wireless surveillance.
Additionally, the law and the constitution themselves hampers at-will implementation of critical surveillance technology and the gathering of information by LEA's.
Wiretaps and racial profiling are both important, useful, and critically controversial identification and intelligence gathering tools which are subject to strict government scrutiny.
If improperly implemented, use of these tools to gather information or even to identify individuals of potential interest may lead to the inadmissibility of key evidence gathered using these methods during prosecution of the surveilled criminals or terrorists.
However, because of time, expense and potential privacy issues, the wireless communication network has not been fully utilized on more than a small scale for surveillance and data gathering in criminal investigations. Because of the mobility of wireless communication devices, establishing wiretaps of wireless transmissions and other means for eavesdropping, tracking, intelligence gathering, or surveillance is not always an option. Further, even when such means may be established, because of the mobility of wireless devices, such means do not always sufficiently provide the type, quality, and quantity of information that law enforcement finds useful in a timely manner.
Importantly, current surveillance methods using the wireless communication network require the prior identification of suspected criminally active individuals before surveillance begins. These identifications are generally done by a suspect being associated with targeted groups, or by racial or ethnic profiling. Because current surveillance methods to do not predict when a criminal act will be performed or plotted, surveillance must be continuously performed in order to catch the individual performing or plotting the criminal act and gather sufficient information to prosecute. Thus, current surveillance methods are not able to use the wireless communication network as a predictive tool for crime prevention.

What is needed is a geo-specific tracking and profiling based intelligent surveillance method and system which effectively utilizes existing wireless communication network infrastructure and allows LEA's to locate, track, and profile groups or individuals remotely, anonymously, passively and non-intrusively. What is needed is an intelligent surveillance and profiling method and system which utilizes the existing wireless communication network and the existing wireless network infrastructure and which does not overburden existing systems or require costly modifications to existing infrastructure. What is needed is an intelligent surveillance and profiling method and system which covertly tracks the location of every wireless communication device (and thereby the user) in real-time, while storing historic location data for each wireless communication device for future reference and analysis. What is also needed is an intelligent surveillance and profiling method and system which aides LEA's in identifying suspicious behavior patterns and profile trends on a historical and real time basis for each wireless device, drawing inferences, and producing actionable intelligence data for those identified wireless devices. What is also needed is an intelligent surveillance and profiling method and system which initially protects user privacy by not intercepting voice transmissions or identifying other personal identification information when gathering, analyzing, profiling and storing location data.
What is needed is an intelligent surveillance and profiling tool and method which aids LEA's to identify, track, and profile individuals or groups of potential interest to law enforcement based on their patterns of activities or movements within the wireless network, and not based on racial, gender, or economic profiling. What is needed is an intelligence gathering and surveillance system for gathering and sharing data internationally and across jurisdictional lines in order to better identify, track, and apprehend criminals or those potentially involved in suspected criminal activity based on their tracked movements and patterns of behavioral characteristics.
Summary of the Invention:
An object of the present invention is to provide an intelligent surveillance and profiling method which uses a wireless communication network to remotely, anonymously, non-intrusively, passively and covertly locate, track, surveil, and geo-profile in real-time and historically, a large number of individuals operating in a wireless network.

An object of the present invention is to provide an intelligent surveillance method and system which utilizes a wireless communication network to identify suspects based on their geo-profiles and not based on either who called whom or on racial or ethnic profiling.
An object of the present invention is to provide an intelligent surveillance and profiling method for locating, tracking, and determining behavior profiles by recognizing patterns of behavior from location data gathered for a plurality of wireless communication devices operating in a wireless communication network.
Another object of the present invention is to provide an intelligent surveillance and profiling system utilizing the disclosed method which allows remote, anonymous, and non-intrusive geo-based monitoring and tracking of individual wireless signals to or from pre-identified wireless communication devices.
Another object of the present invention is to provide an intelligent surveillance and profiling system utilizing the disclosed method which allows for remote, anonymous, and non-intrusive geo-based monitoring and tracking of individual wireless signals originating in or occurring in a vicinity of a location of interest either in real-time or in the past.
Another object of the present invention is to provide a intelligent geo-based profiling surveillance and tracking system utilizing the disclosed method for determining behavior profiles based on patterns of current and historical position data of a plurality of wireless communication devices operating in a wireless communication network.
Another object of the present invention is to provide an intelligent surveillance and profiling system utilizing a computer readable code implementing the disclosed method which may be easily programmed to recognize trends which correspond to preprogrammed data patterns of interest and to alert authorities of such recognized trends.
Yet another object of the present invention is to provide an intelligent surveillance system utilizing a computer readable code implementing the disclosed method which may be easily programmed to cull extraneous data and identify data trends, other than the preprogrammed data patterns, which otherwise might be lost in an overload of data influx.

Still another object of the present invention is to provide a cost effective and efficient geo-based tracking and profiling intelligent surveillance method and system for locating, tracking, and profiling movements and patterns of behavior of wireless devices in a wireless network which does not require a significant and potentially costly change in current technological devices or in established infrastructure in order to implement.
One skilled in the art would recognize and appreciate that objects other than those discussed above may also be realized by the intelligent surveillance and profiling system and method disclosed herein. Thus, the intelligent surveillance and profiling method and system described herein should not be limited thereto.
In order to meet each of the above defined objects, an intelligent surveillance system of the present application has been developed which utilizes the existing wireless communication network system and its related infrastructure to enable the deployment of large-scale intelligent surveillance and behavioral profiling by LEA's. The system uses mobile telephones and other wireless communication devices operating in the cellular network as unique tracking devices. The system stores tracked data for historical reference and future analysis. Thus, the intelligent surveillance and profiling system enables the entire mobile population to be monitored for potentially suspicious activities, historically and/or in real time.
A wireless device operating in a wireless communication network transmits a unique identifier signal which is used to track a location of the wireless device (i.e., geo-tracking).
The intelligent surveillance and profiling method and system designed according to the present invention determines geo-profiles of all wireless devices operating in a wireless network by detecting patterns of activity based on reception and tracking of these signals.
The system generally comprises: a network adapter; a data collection and computational system including a local sentinel system and a history sentinel system; and preferably a network data controller. This type of surveillance is best described as real-time and historic geo-profiling. That is, the surveillance and profiling methods described herein identify suspects based on suspicious patterns of behavior or movement within the wireless network and not by racial, ethnic, or other personal identification parameters.

A first embodiment of the intelligent surveillance and profiling method and system performs real-time, non-intrusive tracking of unique identifier signals transmitted from each of a plurality of wireless communication devices, which may be used to identify a position of each of the wireless communication device. The method generally comprises the steps of at periodic intervals of time, detecting a unique identifier signal transmitted in a wireless network from each of a plurality of wireless devices; determining a position of each of the plurality of wireless devices based on the respective transmitted unique identifier signals at each of the periodic intervals of time; tracking over a period of time the positions of each of the plurality of wireless devices; formulating a position history for each of the plurality of wireless devices based at least in part on the respective tracked positions over time; and performing at least one of the following steps: a) determining whether any of the position histories for any of the wireless devices corresponds to any of a plurality of predetermined patterns of interest; and b) determining which, if any, of the plurality of wireless devices has had a position at or near any of a plurality of predetermined points of interest. Additionally, the first embodiment includes the step of isolating the position history of any of the plurality of wireless devices which either corresponds to any of the plurality of predetermined patterns of interest or has had a position at or near any of the plurality of predetermined points of interest. Still further, according to the first embodiment, when a particular signal of interest is isolated, tracking may continue at periodic intervals of time more frequent than the periodic intervals of time above for the isolating step. The intelligent surveillance method of the present invention is also well suited for being embodied in a computer code utilizing the method.
According to a second embodiment, historical position data is used to identify suspicious individuals operating in a wireless communication network based on their past behavior and movements. The method comprises the steps of: searching the historical data base to identify patterns of behavior from the historical position data for all or any predetermined portion of a plurality of wireless communication devices operating in a wireless communication network; and at least one of: isolating and identifying any wireless device which was operating at any time around or near a critical structure;
isolating and identifying any wireless device which was operating at a particular location on a particular day at or around a particular time; and isolating and identifying any wireless communication device whose identified pattern of behavior corresponds to a predetermined pattern of behavior.

The intelligent surveillance method and system of the present invention allows LEA's to take and analyze real-time behavioral data of a large number of wireless users in order to determine behavioral patterns of interest. Further, the intelligent surveillance method and system of the present invention allows LEA's to search historical data for:
patterns of behavior of known suspects; patterns of behavior of any wireless user which matching a predetermined pattern of interest; a wireless user who may be or who may have been at or near a location of interest (e.g., scene of a crime) at or around a particular time and therefore be a potential witness; and to identify patterns in a controlled parameter search by inputting any combination of defined search criteria for possible matches.
Uses and benefits of using an intelligent surveillance method and system designed according to the present invention include but are not limited to: the quick, easy, efficient, accurate and affordable establishment of geo-profiles or historical location patterns of mobile users in a cellular network; the ability to monitor known targets of interest;
the establishment of real-time alert triggers using geo-profiles to alert law enforcement of detected suspicious activity; the ability to send location information based alerts, which allows law enforcement agents to provide a more immediate and directed response to criminal activity;
and a means for law enforcement commanders to track the location of and better direct available law enforcement personnel and resources within the network during times of critical need.
Further, because the unique identifier signals are openly transmitted and do not themselves divulge any personal information, law enforcement is able to freely track patterns of behaviors for a large population over time, and from that, identify suspects without relying on racial, ethnic, or other controversial techniques for criminal profiling. The identity including other personal information about an individual who owns a particular wireless communication device whose pattern of behavior has been determined to be suspicious, may then be determined.
Brief Description of the Figures:
Figure 1 is an overview illustrating a wireless communication network operating to transmit emitted unique identifier signals from a plurality of wireless devices;
Figure 2 is an overview of a component architecture of an embodiment of a geo-profiling platform according to the present application;

Figure 3 is an overview of a flow of cell-based location tracking of an embodiment of a geo-profiling platform according to the present application;
Figure 4 is an overview illustrating an intelligent surveillance system of the present invention;
Figure 5 is a flow diagram of one embodiment of a real-time surveillance utilizing the intelligent surveillance system of the present invention; and Figure 6 is a flow diagram of one embodiment of a historical data surveillance operation utilizing the intelligent surveillance system of the present invention;
Figure 7 is a data flow overview of the message broadcast and profiling system; and Figure 8 is an overview of a flow of geo-tracking using the message broadcast and profiling platform of Fig. 7.
Detailed Description of the Invention:
The present invention relates to an intelligent surveillance and profiling method and system for surveilling, detecting, gathering, tracking, and archiving location data computed based on a location of a unique tracking and identification signal periodically emitted for each of a plurality of wireless communication devices operating in a wireless communication network. Further the intelligent surveillance and profiling method and system and method of the present invention relates to a method and system for determining a geo-profile for each of the plurality of wireless devices based on a pattern of activity for each of the plurality of wireless communication devices. According to the invention, a geo-profile is based at least in part on the detected and gathered location data. The intelligent surveillance and profiling method and system may be used to surveil and profile whether the user of a wireless device is engaged in calling activity. As discussed herein, it leverages passive location tracking technology used to track the entire wireless subscriber base to enable a wide range of predictive applications. Additionally, it provides the potential for geo-based triggers for wide-scale but directed message broadcast. For clarity and brevity, the intelligent surveillance and profiling system and method of the present application will hereinafter be referred to as the system and method of the present application.
By way of background, a wireless communication network comprises a plurality of interconnected cells each containing a transmission tower for transmitting and receiving signals from wireless communication devices. Existing infrastructure of wireless communication network 10 is illustrated in Fig. 1. Transmission towers 12 dot the map and criss-cross the country and the world effectively forming a network of interconnected cellular grids or transmission cells 14. Each of the transmission cells contains at least one transmission tower 12 for transmission of wireless communications. Wireless communications (e.g., telephone calls, data transmission, or text messaging) are transmitted across the interconnected wireless communication network to or from a plurality of wireless communication devices 20 operating within the wireless communication network.
Currently, wireless communication coverage is not uniformly available in all areas of the United States, and only sporadically if at all in many other less populated or less affluent countries around the world. Thus, no transmission of wireless communication may take place in areas without transmission towers or wireless network service. However, as the proliferation of wireless communication devices expands world wide, so too grows the infrastructure of the wireless communication network.
The wireless communication network identifies a wireless communication device operating therein by recognizing a unique identification signal transmitted by the wireless communication device to the network. Wireless communication devices 20 (e.g., 20a and 20b) each continually emit unique identifier signals 22 (e.g., 22a and 22b) even when not otherwise transmitting or receiving. Unique identifier signal 22 is different for each wireless communication device 20 and enables the wireless communication network 10 to accurately identify the particular wireless communication device operating. Unique identifier signal 22 also enables wireless communication network 10 to determine a location or position of each of the plurality of wireless devices operating within the network to properly direct transmissions thereto or therefrom through transmission cells I4 and transmission towers 12.
For the purpose of this application, a wireless communication device is operating and thus continually emitting its unique identifier signal the entire time the wireless communication device is turned on, whether or not transmission or reception of other types of communications are taking place. That is, position data for each operating wireless device may be determined from continually emitted unique identifier signals 22 so long as wireless communication device 20 is turned on.
As discussed above, when operating, a wireless communication device 20 continually emits or transmits unique identifier signal 22 which is unique to wireless communication device 20. That is, each wireless communication device is equipped with a unique data chip which emits an identifier signal which is different from the identifier signal emitted from any other wireless device. Within wireless communication network 10, the position of the origination of unique identifier signal 22, and therefore the position of wireless communication device 20 (i.e., and thereby the location of the person operating the wireless device), may be determined. Determining a position of unique identification signal 22 emitted from wireless communication device 20 may be done by any means now known or later developed including but not limited to: CGI, triangulation, or GPS
monitoring.
Conventionally, this signal and determined position data are used only to locate a particular device at a current time in order for network 10 to transmit a call or to receive a call communication device 20. In the system and method of the present application position information for communication devices 20 is transmitted in real-time through wireless communication network 10 to local sentinel system 32 of data storage and computational system 24. The position information is gathered, stored, and analyzed to track an individual's movements and to determine a geo-profile or pattern of behavior over time for the wireless communication device (and thereby of the individual who operates the device).
The determined pattern of behavior may be compared with known (i.e., red flag) patterns of behavior of interest to law enforcement. If red flag behavior is recognized, the system is adapted to isolate the data for a particular device and notify authorities, who may use this information to identify the actual user of the particular wireless device.
Also, any recognized pattern of behavior is compared with historic patterns of behavior for the same wireless communication device to spot trends of behavior for a particular wireless communication device user which might aid law enforcement in predicting future patterns of behavior for that particular user, and possibly prevent crimes or solve past crimes.
The ubiquity of wireless communications creates an opportunity for law enforcement agencies to use the existing infrastructure of cellular networks for nation-wide surveillance with the express purpose of detecting individuals or groups that exhibit suspicious activities.
The intelligent surveillance system of the present invention leverages the intrinsic capabilities of wireless networks to persistently track in real-time the location of each and every wireless communication network user and provides surveillance officials with the capability to profile and automatically detect suspicious groups of people based almost entirely on the wireless communication device user's own patterns of movement (i.e., patterns of behavior).

[DES THIS PARAGRAPH BELONG HERE ON WTTH THE TRIGGER
BROADCAST SECTION BELOW?] Refernng to Figure 2, a platform asynchronously collects network events in real-time using signaling probes. Such events include but are not limited to: periodic registration, forced registration, power-up registration;
power-down registration; location area registration; call events (e.g., set up, termination, hand-off, etc.);
Short Message Service (SMS) location events including SMS submit (mobile originating/terminating) on Digital Control Channel/Digital Traffic Channel (DCCH/DTC);
mobile originating SMS manual/delivery acknowledgement on DCCH/DTC; and message center SMS manual/delivery acknowledgement (mobile terminating) on DCCH/DTC.
Network events are collected through a physical connection with SS7 signaling interfaces using network cross-connectors as illustrated in Fig. 2. The signaling probe technology is designed to monitor network signaling activity rather than the activity of individual subscribers. Therefore, network probes need to be placed on selected signaling links to enable location and network activity monitoring for all subscribers in the identified geographical area of the network. As illustrated in Figs. 2 and 3, to enable the location tracking capabilities of the system and method of the present application, the platform system must interoperate with the wireless network via dedicated interfaces to select wireless nodes (i.e., MSC, VLR, OSS, etc.) [PLEASE INDICATE WHEREON FIGS. 2 OR 3 OR ANY
OTHER FIGURE THIS IS LOCATED?, location determination platforms [PLEASE
INDICATE WHERE ON FIGS. 2 OR 3 OR ANY OTHER FIGURE THIS IS LOCATED?' 72] and network adapters (non-intrusive probes) [PLEASE IlsIDICATE WHERE ON
FIGS. 2 OR 3 OR ANY OTHER FIGURE THIS IS LOCATEF)? 74]. The network integration requirements vary depending upon the required accuracy of user positioning detection, characteristics of the wireless network (i.e., standards, vendors, etc.), and frequency of sampling (sampling rate). Preferably, the system offers an integrated location services platform and network probes. The system is adapted to integrate with location determination equipment 76 to receive the location of wireless subscribers through specific data interfaces and transmit information to any of a plurality of clients at remote terminals 78. While the system will successfully operate utilizing a lesser standard of capability, because the system relies on accurate and frequently updated subscriber location data, the system has basic system requirements on subscriber technology which are preferably met for optimal operation. These requirements may include but are not limited to: requirements for location accuracy; requirements for location updates; requirements for location data access;
requirements for temporal delay of data transmission and collection;
requirements for location data interfaces; requirements for location data format; and requirements for location record content.
The preferable requirement for location accuracy is a system having a cell ID
or better (e.g., cell sector ID, latitude/longitude coordinates, etc.). Preferable requirements for location updates including regular or periodic location updates including mobile terminal activities which includes information related to: subscriber movements across cell area boundaries, periodically scheduled subscriber location updates; and terminal engagement activities which update location information when voice or data calling is initiated/received or when the wireless device is powered on or off. Location data access preferably allows for retrieval of subscriber location information by accessing real-time databases of the equipment monitoring network signaling links via network probes. Preferably, the location data should be transmitted with a minimal of delay. Preferably, the system is adapted for interfacing with location access points using any TCP/IP-based protocol (e.g. FTP push, FTP
pull, Remote Procedure Call (RPC), proprietary, etc.). Preferably the location data format is ASN.I or any other binary or ASCII data format. However, the system is adapted to operate with other formats now known or later developed. Preferably, location record content received from the network monitoring equipment includes data fields such as: Mobile Identification Number/
Mobile Station ISDN/International Mobile Station Identity (MIN/MSISDN/IMSI);
cell ID;
timestamp; and network event ID.
Referring now to Fig. 4, a first embodiment of an intelligent surveillance system according the present invention utilizes wireless communication network 10 and comprises:
network adapter system 30, and data storage and computation system 24 which includes local sentinel system 32, and history sentinel system 34. The network adapter system is a collection and aggregation of data feeds from the wireless network to track location presence of wireless users in real-time. The collection function uses non-intrusive network data extraction methods to enable simultaneous tracking of all users in the network. Local sentinel system 32 of data storage and computational system 24 is adapted to compute and collect position data (i.e., location data) for each of a plurality of wireless communication devices 20 operating within wireless communication network 10 based on unique identifier signal 22 periodically emitted from each operating wireless communication device 20. The local sentinel system matches and triggers operation of surveillance campaigns (i.e., searches). A matching operation performs comparison of matching condition, established for a surveillance campaign, against real-time user status measurements. A
triggering operation provides for an event-based or anticipated dispatch of alerts based on the result of the matching operations. Local sentinel system 32 is preferably configured to serve a pre-set number of campaigns, moving terminals and geographical areas. Local sentinel system 32 may comprise one or multiple local sentinels deployed either centrally or at a plurality of collection sites, depending upon capacity and performance needs and objectives. History sentinel system 34 of data storage and computational system 24 is adapted to compute and store location data and position histories for historical reference and subsequent analysis.
That is, history sentinel 34 is for the logging of historical movements of mobile terminal for subsequent analysis of trends and patterns of behavior. History sentinel system 34 is preferably integrated with local sentinel system 32 to use identified suspicious groups and individuals as targets for persistent real-time surveillance. As with local sentinel system 32, the history sentinel system 34 may be centrally located or at various sites across network 10.
Network data controller 26 integrates the potentially widespread data storage and computational components of system 24 and facilitates communication with outside interfaces. Law enforcement agencies and or authorized users may be granted access to the intelligent surveillance system through work station 28 coupled to network data controller 26.
Network data controller 26 prevents unauthorized access to or downloading of the data and monitors use of the system. Network data controller 26 also enables LEA's or other authorized users anywhere in the world to access, manipulate, and cull data stored in data storage and computational system 24 to better focus a search and identify potential suspects.
Intelligent surveillance system 10 of the present invention may be deployed in a rack-mounted configuration configured to serve a pre-set number of campaigns, monitored terminals and geographic areas. Alternately, the system may be deployed in a network configuration with individual instances of the system serving a designated segment of the wireless network or/and territorial/administrative districts. The above described system is adapted to perform multiple real-time and historical data searches and analysis simultaneously and independently at the initiation of a plurality of LEA's.
LEA's may operate independently and anonymously or jointly and interactively sharing data. The system is also adapted to operate continually and independently of an LEA and perform data searches and analysis based on preprogrammed criteria.
As mentioned above, the intelligent surveillance system of the present invention allows LEA's to track (i.e., surveil) and analyze behavioral data in real-time, and allows LEA's to search historical behavioral data for trends or patterns, while simultaneously monitoring current behavioral activity for a plurality of operating wireless devices.
Referring now to Fig. 5, the real-time intelligent surveillance method will now be explained. For brevity and clarity, operation of the invention described herein is initially discussed based on only one wireless communication device operating in real-time in a wireless communication network. However, the discussion is equally applicable to a plurality of operating wireless communication devices. In particular, one embodiment of the intelligent surveillance method for real-time surveillance comprises: tracking over a period of time a location of a wireless device by detecting a unique identifier signal transmitted from the wireless device intermittently throughout the period of time; determining a location of the wireless device whenever the unique identifier signal is transmitted during the period of time;
formulating a positioning history of the wireless device over time based on the determined locations; and identifying a pattern of activity of the wireless device based at least in part on the formulated positioning history.
The above embodiment may be expanded to operate for a plurality of wireless devices, to track a location of each of a plurality of wireless devices by:
gathering over a period of time unique identifier signals intermittently emitted from each of a plurality of wireless devices over the period of time; computing location data for each of the plurality of wireless devices based on the tracismitted unique identifier signals;
collecting the computed location data for each of the plurality of wireless devices to establish a real-time pattern of behavior for each of the plurality of wireless devices; and analyzing the data to determine a current pattern of behavior for each operating wireless communication device.
As an example of the versatility of the present invention, as the real-time data is collected, it may also be compared with known patterns of behavior to isolate any wireless devices whose real-time pattern of behavior corresponds to any of a plurality of predetermined patterns of behavior of interest. Still further, as an example, the real-time location data may be used to track movements of known or pre-identified suspects or to alert LEA's of any user who may currently be at or in a vicinity of a sensitive or critical structures or infrastructure, (e.g., nuclear power plants, bridges, water supplies, airports, the white house, etc.). With this information, LEA's may quickly review past behavior histories and compare these past histories with current behavior patterns for any wireless communication device matching these criteria. LEA's will then be able to quickly determine if these patterns warrant further investigation. If these patterns are found to warrant further investigation, the LEA's are able to ascertain the identity of the owner of the particular wireless device and use the past and current behavior data to locate the owner.
The operation of the historical data analysis intelligent surveillance method will now be explained. Referring now to Figure 6, another embodiment of the intelligent surveillance system of the present invention for historical data analysis is illustrated.
This embodiment enables LEA's to track and analyze historical or archived location data and patterns of behavioral data and comprises the steps of: comparing historical position histories for a plurality of wireless devices with at least one predetermined pattern of behavior; and if any of the historical position histories match the predetermined pattern of behavior, isolating the particular wireless device whose historical position history matches the predetermined pattern of behavior and notify authorities. The embodiment may further comprise the step of:
predicting a future pattern of activity of the isolated wireless device based at least in part on one of the formulated position history, the prior formulated positioning histories, and the identified pattern of activity. Still fiu~ther, as an example of the versatility of the herein described invention, historical or archived location data and behavioral patterns may be used to track historic or past movements of known suspects thereby confirming the whereabouts of an individual at a particular date and time, and to alert LEA's that a suspicious wireless communication device user has been lurking or staking out a sensitive or critical structures or infrastructure, (e.g., nuclear power plants, bridges, water supplies, airports, the white house, etc.) which may have not previously been considered to be a target.
Another example of the versatility of performing historical data searches utilizing the system of the present application is the rapid interactive capability for incorporating and utilizing LEA defined search criteria. LEA's may input various pieces of important data (e.g., a date, time, and location of a crime, or a particular location of newly identified critical infrastructure) and instantly direct or redirect a search to identify wireless devices (and thereby, the users of the wireless devices) who match these criteria with either of the real-time location data or the historical behavioral data. Alternately, LEA's operating for example at an airport or guarding the Whitehouse, may rapidly input data regarding any suspicious persons and analyze location and past behavioral trends for these persons. Yet another versatile feature of the present invention is that LEA's may program the system to notify them if a "what if' scenario is recognized. Typical "what if ' scenarios could be programmed to recognize if a signal from a wireless device owned by a particular suspect is or has been identified at or near a particular location (e.g., a critical location) at any time.
Alternately, a "what if ' scenario could be wherein every wireless device whose unique identifier signal was determined to have a position at or near a location of interest at a particular time, (e.g., such as that which substantially coincides with a relative time and location of a past criminal act) is identified and provided to authorities.
The above intelligent surveillance method and system provides the tools for real-time surveillance and geo-profiling of wireless communication device users operating in a wireless communication network. Using the method and system of the present application, LEA's may locate, track, and monitor over time large numbers of individuals by relying upon non-intrusive methods of data extraction from the wireless communication network.
Because the intelligent surveillance methods and systems presented herein keep track of a location of every user registered in the wireless network, and because the intelligent surveillance method and system track user locations whether users are making a call or are merely idle, the intelligent surveillance systems and methods of the present invention allow LEA's to establish continuous surveillance and tracking of the movements and whereabouts of one or more individuals with common characteristics or suspicious patterns of behavior while these individuals are operating in a wireless network. The system may be set up to provide warning alerts to notify LEA's if a unique identifier signal from a wireless communication device owned or know to be operated by one or more of these individuals or groups under investigation is ever identified within a certain areas or upon the satisfaction of certain critical behavioral conditions programmed to be watched for. LEA's may use this system to surveil and protect critical infrastructure (e.g., bridges, government buildings, or nuclear power plants) and monitor areas for persons moving in and out thereof where it is known that criminal activity is prevalent. The police could more quickly be dispatched and the public could be notified more timely of dangers or emergency situations which are detected.
The above discussion illustrates several embodiments of methods of real-time surveillance and geo-prnfiling. Real-time surveillance and geo-profiling give LEA's the tools to identify patterns and categorize individuals by drawing inferences from their past and present activities (time, location, frequency) without resorting to racial or ethnic profiling.
These real-time surveillance services enable LEA's to create qualitatively new factual information based on real-time data, dramatically reduce data analysis time, and reduce the decision-making time to act in response to threats occurring in real time. The geo-profiling capability is enabled through the use of movement history recorded over long periods of time.
Real-time surveillance and geo-profiling in accordance with the principal of the present invention protect the privacy of the individuals operating in the wireless network. With real-time surveillance and geo-profiling, no personal information or conversation transmission information is transmitted along with the unique identifier signal. The privacy preserved using these systems and methods is designed to prevent legal conflict between personally identifiable information and behavioral profiles inferred from the mobility data. Once a behavior trend or pattern of behavior of interest is recognized, the individual wireless communication device which transmits that particular unique identifier signal may be identified by determining the telephone number associated with the wireless communication device and thereby the owner of that number, while the movements of the wireless communication device (and thereby too the movements of its possessor) may be isolated and continue to be tracked by law enforcement in real-time.
Geo-profiling also provides the tools that make it possible for LEA's to infer potential patterns of behavior based on archived historic patterns of behavior (i.e., movements) for known or unknown suspects. Iterative analysis correlating users, locations, timeframes, events and knowledge of demographics may also help establish possible future patterns of behavior for those particular individuals possessing the wireless communication device.
Additionally, geo-profiling provides LEA's with the tools to perform analysis of different scenarios involving historical mobility information and test scenarios against pre-set real world conditions. Results of the real world response may be fed back into the process of further refinement of conditions for the test scenarios.
Additionally, because historical records of the position data are kept, law enforcement may utilize the historic position data stored in the data storage and computational system to possibly determine who, if anyone, was at or near a scene of a crime at or around a particular time. Utilizing this historic behavior data will help law enforcement to more efficiently track down possible Ieads, potential witness, eliminate possible suspects, and to identify suspects or possibly even identify the perpetrator of the crime.

Potential applications for such systems and methods include but are not limited to: use for critical intelligence and warning missions to detect and track movements by gang members and global terrorist group members; use by border patrol and airport security; use for surveillance and protection of critical infrastructure; use for preservation of public safety;
use in the pursuit of national security and counter-terrorism; use by authorities to locate or track the last known locations of missing persons who are known to carry a wireless communication device; and use by federal, state, and local law enforcement for solving and preventing crime.
As illustrated in Figure 7, the system and method of the present application may also be adapted to trigger message broadcasts to specific mobile units. Such interactions are preferably push-based or trigger based message applications. The basic components of the message broadcast application are set up as a platform. The platform interconnects with the wireless network via the location determination equipment (LDE) to receive the subscriber location data. In general, the platform passively receives location updates for all subscribers monitored by the LDE. Figure 7 illustrates the flow as a stream of passive location data and location identified network registration events. Initially, a campaign object is activated by setting up campaign triggers: user profile, time schedule, geo locations combined with a content message. The platform is preferably adapted to perform continuous matching of campaign object triggers against real-time subscriber conditions such as time of presence, current location and user geo-profiles. For subscribers whose conditions match those of the campaign object, the platform triggers the sending of the content message via the SMSC
[WHAT DOES THIS ACRONYM STAND FOR?].
According to a preferred embodiment, the network preferably extracts at least the following event information and stores it in the appropriate data field. For example, start time stamp; sequence number field; event field; MSISDN field; Subscriber Serial Number (ESN) field; Key field; and cell field are just some of the event information of importance.
The start time field is, for example, field number 2 of the ASCII list. This field should correspond to the timestamp of when the event occurred. The sequence number field is, for example, field number 4 of the ASCII list and would only be needed for sequencing the data integrity. The Event field is, for example, field number 6 of the ASCII list.
The event field is required for future use, but may not be needed. MSISDN is for example, field number 12 of the ASCII list. Assuming the mobile phone number to be unique to the handset, this field is used to uniquely identify each record to a subscriber. The ESN is, for example, field number 13 of the ASCII list. This field is used to uniquely identify the subscriber's handset. The Key is, for example, field number 14 of the ASCII list. Assuming the key to be unique to every record, this field may be used as a unique identifier for monitoring purposes. The cell is, for example, field number 17 of the ASCII list. Assuming this field represents the cellular id for a given cell, this value is used as the location identifier. This location identifier will be matched to a cellular map to extract the Cartesian coordinates, X and Y. All of the above information is preferably packaged into a binary format (ASN.1/BER) for further processing in the location platform.
As discussed previously, trigger based message broadcast and profiling may be triggered by a movement of the wireless mobile unit into or out of a particular cell or by a power-on or power-off operation. As illustrated in Fig. 8, the architecture of a trigger based profiling platform S 1 preferably comprises: a plurality of network probes 52;
a data collection and privacy server 53; a location center 54; a delivery server 56; a GIS
server [WHERE IS IT
IN FIGURE 8 AND WHAT DOES IT STAND FOR? 60]; an application server [WHERE IS
IT IN FIGURE 8? 62]; and a web server [WHERE IS THE WEB SERVER IN FIG. 8? 63].
The probes track activity of mobile units 200 operating across the network according to the flow overview illustrated in Figure 8. The accuracy of location tracking depends at least in part on the characteristics of the integrated probes. Ranges of operation may be between less than 15 m and greater than several hundreds of meters in radius therebetween.
Thus, activity can be tracked in areas of dense cellular transmitter tower positioning as well as in areas of sparse cellular transmitter tower positioning.
The data collector and privacy server 53 collects mobility events transforming cell information 59 into geographic coordinates and providing mobile subscriber information encryption, if required. The location center 54 is a network node that acts as a geographical tracking device and supports trigger-based notification as well as historical location-based data mining. The delivery server 56 delivers the proper response to a targeted mobile station once a trigger has been activated. The server [WHERE IS THE SERVER IN FIG. 8?
64]
then proceeds to decode the MS information and then is adapted to deliver a response through an appropriate medium (via SMS, WAP, voice, video, etc.) [WHERE IS THE
APPROPRIATE MEDIUM IN FIG. 8? 66]. The O&M server 58 (e.g., a carrier administration tool) provides the cellular operator with the capability to configure the platform. The GIS server 60 provides the application user with a graphical interface which can be used to select areas for which location triggers can be defined. The application server 62 (e.g., emergency alerts) API S/W is also located in this node. The web server 63 provides a web-based interface to allow cellular subscribers to register or deregister from ad campaigns.
According to the platform architecture illustrated in Fig. 8, an MS event (e.g. periodic registration, power-on registration, etc.) is detected in MSC 58 at step 101.
MS location information (Cell ID) is pushed from MSC 58 to probe 52 at step 102. MS
location information is pushed from probe 52 to collector server 53 at step 103, wherein cell location information is convened into a geographical representation. In step 104, MS
identification information (MIN or IMSI) is encrypted to protect subscriber privacy (privacy shield). Then in step 105, the location information is pushed and stored in mobile location center 54.
Because a location-based application may set a number of triggers 55 that are released when the trigger conditions are met, the occurrence of an MS event may activate a specific trigger or set of conditions that were previously input by location-based applications, step 106. If the trigger conditions are met, then the appropriate response (depending on the application) is generated and sent to delivery server 56 at step 107. Delivery server 56 converts the encrypted information of the cellular subscriber into the real subscriber MIN/IMSI at step 108. Then a proper response provided by the location-based application (text message, video, animation, etc.) may be sent to the cellular subscriber via message center 57 at step 109. In this node model, delivery server 56 is sending a text message to message center 57. The message center 57 receives the SMS request and forwards it to MSC 58 at step 110. MSC 58 forwards the SMS mobile unit 200 that has triggered this response by moving to a certain location.
Additional applications of the message based broadcast and profiling system may include collection of the subscriber network and location data for off line profiling, triggering third party content and applications using real-life application triggers (e.g., traffic, inventory conditions, surveillance databases, etc.); and interaction with presence applications and others.
There have been described and illustrated herein several embodiments of intelligent surveillance methods and systems for remotely, anonymously, and non-intrusively gathering and monitoring position data for each of a plurality of wireless devices operating in a wireless communication network and an intelligent surveillance method and system for determining patterns of current and historical behavior data based on the position data in order to establish trends and profiles and aid law enforcement in solving or preventing crimes.
While particular embodiments of the invention have been described, it is not intended that the invention be limited thereto, as it is intended that the invention be as broad in scope as the art will allow and that the specification be read likewise. It will therefore be appreciated by those skilled in the art that other modifications could be made to the provided invention without deviating from its spirit and scope as so claimed.

Claims

1. A method of detecting a pattern of activity of a user of a wireless device, the method comprising:
detecting a unique identifier signal transmitted from the wireless device at intervals throughout the period of time;
determining a location of the wireless device when the unique identifier signal is detected;
formulating a position history of the wireless device based on the determined locations;
identifying the pattern of activity based on the formulated positioning history.

2. A method according to claim 1, further comprising:
determining whether the identified pattern of activity corresponds to any of a plurality of predetermined patterns of interest.

3. A method according to claim 1, further comprising:
determining whether a location of the wireless device was in a specified area of interest during a specified time period of interest.

4. A method according to claim 1, further comprising:
determining a likely location of the wireless device at a time between detections of the unique identifier signal by interpolation.

5. A method according to claim 1, further comprising the step of:
searching the position history of the wireless device to find a pre-determined pattern of interest.

6. A method according to claim 1, further comprising:
predicting a future pattern of activity of the wireless device based at least in part on one of the formulated position history, determined location, and the identified pattern of activity.

7. A method of performing real-time, non-intrusive tracking of signals from a plurality of wireless devices, which when operating, each transmit a unique identifier signal which may be used to identify a position of the wireless device, the method comprising the steps of:
intermittently detecting in a wireless network a unique identifier signal transmitted from each of a plurality of wireless devices;
determining a position of each of the plurality of wireless devices when the identifier signals are detected;
storing the determined positions of each of the plurality of wireless devices over a period of time; and formulating a position history for each of the plurality of wireless devices based on their respective stored positions over the period of time.

8. A method according to claim 7, further comprising:
identifying a pattern of activity of each of the plurality of wireless devices based at least in part on their respective formulated position history.

9. A method according to claim 8, further comprising:
performing at least one of the following steps:
a) determining whether any of the formulated position histories for any of the plurality of wireless devices corresponds to any of a plurality of predetermined patterns of interest; and b) determining which, if any, of the plurality of wireless devices has had a position at or near any of a plurality of predetermined points of interest at or about a particular time of interest.

10. A method according to claim 9, further comprising the step of:
isolating the positioning history of any of the plurality of wireless devices which either corresponds to any of the plurality of predetermined patterns of interest or has had a position at or near any of the plurality of predetermined points of interest at or about the particular time of interest.

11. A method according to claim 10, further comprising the step of:
at periodic intervals of time more frequent than the periodic intervals of time, continuing the steps of detecting the unique identifier signals, tracking the positions of, and formulating position histories for any of the plurality of wireless devices whose position histories were isolated in the isolating step.

12. A computer readable medium encoded with instructions embodying a method of performing tracking and pattern analysis of historically archived signal data periodically transmitted from each of a plurality of wireless devices in a wireless communication network, said method comprising the steps of:
interfacing with a wireless communication network controller to access critical data related to the signal data periodically transmitted from a plurality of wireless devices;
interrogating the critical data for at least one of the plurality of wireless device to determine trends in the critical data for the at least one wireless device;
recognizing a pattern from the determined trends in the critical data;
determining if the pattern recognized corresponds to a predetermined pattern.

13. A computer readable medium encoded with instructions embodying a method according to claim 12, and further comprising the steps of using an interpolation method to determine fill-in data between time periods.

14. A computer readable medium encoded with instructions embodying a method according to claim 12, and further comprising the step of:
if the recognized pattern is determined to correspond to the predetermined pattern, determining if any of the critical data forming the recognized pattern was detected in or around a particular location of interest at or about a particular time

15. A computer readable medium encoded with instructions embodying a method according to claim 142, and further comprising the step of:
if the recognized pattern is determined to correspond to the predetermined pattern, isolating the corresponding historically archived signal data; and identifying the owner of the wireless device having the recognized pattern based on the signal data.

16. A method of performing tracking of signals emitted from a plurality of wireless devices, which when operating, each transmit a unique identifier signal which may be used to identify a position of the wireless device, the method comprising the steps of:
at periodic intervals of time, detecting in a wireless network a unique identifier signal transmitted from each of a plurality of wireless devices;
determining a position of each of the plurality of wireless devices at each of the periodic intervals of time based on the respective transmitted unique identifier signals detected at each of the periodic intervals of time;
tracking over a period of time the positions of each of the plurality of wireless devices;
formulating a position history for each of the plurality of wireless devices based at least in part on the respective tracked positions over the period of time;
identifying a pattern of activity of each of the plurality of wireless devices based at least in part on the respective formulated position histories;
determining if any of the identified patterns of activity for any of the plurality of wireless devices corresponds to a predetermined pattern of activity;
if any of the identified patterns of activity for any of the plurality of wireless devices corresponds to the predetermined pattern of activity, isolating the unique identifier signal transmitted from the wireless device corresponding to the wireless device whose pattern of activity corresponded to the predetermined pattern of activity.

17. A method for a user to identify any of a plurality of operating wireless devices which were operating at or near a particular location, on a particular date, at or around a particular time of interest from historical position data representing locations of each of the plurality of wireless devices computed from periodically emitted identification signals from each of the respective plurality of wireless devices, the historical position data stored in a historical database; the method comprising the steps of:
accessing the historical position data stored in the historical database;
searching the historical position data to determine any of the plurality of wireless devices whose historical position data indicates a position substantially matching the particular location, the particular date, and the particular time of interest;
isolating the historical position data and the identification signal for the any of the determined plurality of wireless devices; and notifying the user of the identification signal for any of the determined plurality of wireless devices; and determining the identity of the wireless device and thereby the owner of the wireless device from the notified identification signals for each of the determined plurality of wireless device.

18. An intelligent surveillance and tracking system utilizing a wireless network to remotely, anonymously and surreptitiously surveil in real-time and historically a plurality of wireless communication devices each emitting a unique identifier signal, said system comprising:
a network adapter system for receiving transmissions from the wireless network to track location presence of wireless users in real-time;
a data storage and computation system including: a local sentinel system and a historic sentinel system integrated with the local sentinel system, wherein said local sentinel system is adapted to compute and collect position data for each of the plurality of wireless devices operating within the wireless network based on the unique identifier signal periodically emitted from each operating wireless devices;
wherein the history sentinel system is adapted to compute and store location data and position histories for historical reference and subsequent analysis;
and a network data controller to monitor system use, facilitate user interfacing, and perform data transfer management between users and the system.