Method and apparatus for identifying a suspect through multiple correlated device identities

A method and apparatus for identifying a suspect through location and time events is provided herein. During operation a central server continuously receives updates from multiple networks regarding device identifiers and associated access points. When an event (e.g., a crime) occurs at a certain location, an access point(s) near the event are identified and devices associated with the access point(s) at the time of the event are determined. The identified devices are then utilized to determine potential suspects.

FIELD OF THE INVENTION

The present invention generally relates to identifying a suspect at a crime scene, and more particularly to a method and apparatus for identifying a suspect through multiple correlated location and time events.

BACKGROUND OF THE INVENTION

Tools and processes to identify crime suspects have always been valuable in solving and preventing crime. Whether it's the use of finger prints, voice-recognition, or DNA analysis, any tool available for solving and preventing crime could be extremely useful to law enforcement. These tools become even more valuable when they are able to quickly identify a suspect. Therefore, a need exists for techniques for quickly identifying a suspect at a crime scene,

DETAILED DESCRIPTION

In order to address the above-mentioned need, a method and apparatus are provided for identifying a suspect through device identifications determined for various location and time events. During operation a central server continuously receives updates from multiple networks regarding device identifiers and associated access points. When an event (e.g., a crime) occurs at a certain location, an access point(s) near the event is identified and devices associated with the access point(s) at the time of the event are determined. The identified devices are then utilized to determine potential suspects.

In practice, the number of devices in a vicinity of a crime (suspect devices) may be extremely large. In order to reduce the number of devices considered as “suspect devices”, multiple occurrences of a single device at multiple crime scenes or events are utilized to identify suspect devices. In particular, the process of identifying suspect devices is repeated for multiple events (e.g., crimes). Suspect devices common to the multiple events are then identified as a subset of suspect devices common to both events.

The above technique assumes that a person's identity may be determined from a device identity. Such device identities include, but are not limited to a media access 802.11x (MAC) address, a cellular device identifier such as, but not limited to a International Mobile Subscriber Identity (IMSI) or Temporary Mobile Subscriber Identity (TMSI), International Mobile Equipment Identifier (IMEI), Radio Identifier, Group Identifier, application IDs, such as telephone number, email address, social media ID and the like. From the device identity, an appropriate service provider may be contacted to obtain owner information.

As an example, assume that a bank robbery occurred at 5thand State Streets on Jun. 25, 2012 at 10:05 AM. A central server may be accessed and provided the date, time, and location of the event. The central server will determine all access points near (e.g., within 1 mile) the crime scene. All devices associated with the identified access points during the time period of the crime will be identified through their device identity. For example, all devices associated with the access points between, for example, 10:00 and 10:10 on Jun. 25, 2012 will be identified. These devices will be categorized as “suspect devices”.

As is evident, the number of suspect devices may be extremely large. For example, if the above-described bank robbery occurred within a large city, there may be thousands of devices associated with dozens of access points near the time and location of the event. In order to reduce the number of suspect devices, the above process could be repeated for another similar crime. For example, assume that a bank robbery having a similar motif happened on May 15, 2012 at 1:15 PM. The above process could be utilized to identify all suspect devices near that crime scene at the time of the crime. A reduced number of suspects can be determined by identifying those devices that were near both crime scenes. Once a manageable number of suspect devices are identified, network operators may be contacted to determine the owners of the suspect devices.

As another example, assume a known kidnap victim had an electronic device (e.g., a cell phone) that periodically associated with an access point. For example, assume that the victim periodically turns on their cell phone to make calls for help. The associated access point could be determined and suspect devices near the access point could be identified as described above.

For example, assume that the victim turned on their device, which associated to an access point at a first location. The central server could then be used to identify all electronic devices associated to access points near the first location at the time the victim's device was powered on. If the victim again turned on their device an hour later at a second location (or the victim was transported to a new location with their smartphone powered on), the above process could be repeated and electronic devices associated to access points near the second location would be identified. Those devices that were common to an access point near the first location and an access point near the second location could then be identified as a subset of suspect devices. The above process could be repeated indefinitely.

It should be noted that the “time” surrounding an event in which device IDs are determined, may not be a short time. This time period may comprise days, weeks, months, or years. For example, assume that a bomb was planted at a national monument. A central server may be accessed to determine that an individual had visited the monument an inordinate amount of times prior to the bomb being discovered. In this situation, the “time period” may simply be a day of the week prior to, or after the crime.

Prior to describing a more-detailed description of the present invention, the following definitions are provided to aide in understanding the description provided below.

Access Point—Infrastructure communication equipment that allows wireless devices to connect to a network. Such equipment includes, but is not limited to, equipment commonly referred to as repeaters, base radios, base stations (BS), evolved Node Bs (eNB), wireless routers, base transceiver stations, WiFi access points, or any other type of infrastructure equipment interfacing with one or more wireless electronic devices.

Electronic Device—Any electronic device capable of associating with an access point in order to obtain network access. Such electronic devices include, but are not limited to laptop computers, cellular telephones, smart phones, electronic tablets, modems, MiFi, private PTT devices, and the like.

Suspect Device—An electronic device that was identified as being associated with an access point near an event within a predetermined time of the event occurring.

Subset of Suspected Devices—Those suspect devices that have been identified as being associated with an access point near a first event within a predetermined time of the event occurring, and additionally associated with at least a second event within a predetermined time of the second event occurring.

Device ID—An alpha-numeric number such as a MAC address, IMSI, TMSI, email address, telephone number, social media identifier, that is provided to a network access point in order to identify the device to the network or to identify the device to an application.

FIG. 1illustrates the identification of suspect devices as described above. Assume that data set101comprise suspect devices104near a first crime scene, and that dataset103comprises suspect devices104near a second crime scene. As discussed above, these devices were determined because they were associated with an access point near the crime scene, close to the time of the crime. (Only one device104is labeled inFIG. 1). For example, assume that set101contains devices identified near a first bank robbery and assume that set103contains devices identified near a second bank robbery. The intersection105of sets101and103contains a subset of suspect devices104that were registered to access points near both crime scenes close to the time of the crimes. As is evident, the intersection105contains many fewer devices104than each set alone.

As described above, when identities of the suspected electronic devices are determined, network operators can be contacted and provided with the identified MAC, IMSI, TMSI, . . . , etc. User identification can then be obtained from the network operators.

FIG. 2is block diagram illustrating system200for identifying suspect devices as described above. As shown inFIG. 2a plurality of networks203-207are in communication with central server201. Networks203-207may each comprise one of any number of over-the-air or wired networks, and may be distinctly different networks in terms of technology employed and network operators used. For example a first network may comprise a private 802.11 network set up by a building operator, while a second network may be a next-generation cellular communications network operated by a cellular service provider. Thus, network203may comprise a next-generation cellular communication system employing a 3GPP Long Term Evolution technology (LTE) system protocol, while network205may comprise an 802.11 communication system protocol.

Although only a single access point202is shown in system200, each network203-207comprises at least one access point202utilized to give network access to multiple electronic devices. Each network203-207is in communication with server201and continuously (or periodically) provides server201with information on times and dates that various electronic devices104have registered with various access points202within their network. This information may be provided directly to server201from access points202, or may be passed by access points202to centralized network infrastructure equipment (not shown), which may relay this information to server201.

Thus, during operation various electronic devices104are continuously associating with and un-associating with multiple access points202within networks203-205. When a particular device104associates with a particular access point202, the access-point202provides server201with the device ID, its own ID, the date and time of association. When the particular device104disassociates with the access-point202(or is no longer available for reasons of power loss, RF loss, etc.), the access point202provides server with the device ID, its own ID, and the data and time of disassociation. Optionally, a location of access point202may be provided along with the above information. Alternatively, the location may not be provided if server201has a database of access point locations. Server201then stores this information within an internal database and utilizes the information in identifying potential suspect devices.

FIG. 3illustrates data provided from a network to a server. As discussed above, the data may be provided directly from network access points202to server201, or through some intermediary (such as network controllers, mobile switching centers, . . . , etc.). As shown, server201maintains a table (database) of device IDs, access point IDs, Dates/Times of device association with the access point, and Dates/Times of device disassociation with the access point.

FIG. 4is a block diagram of a server201shown inFIG. 2. In general, as used herein, the central server201being “configured” or “adapted” means that server201is implemented using one or more components (such as memory components, network interfaces, and central processing units) that are operatively coupled, and which, when programmed, form the means for these system elements to implement their desired functionality, for example, as illustrated by reference to the methods shown inFIG. 5. Central server201comprises a processor401that is communicatively coupled with various system components, including networks203-207, a network interface406, a storage component405storing database300shown inFIG. 3, an optional storage component407storing an access-point locations407, and graphical-user interface408.

In the current implementation, central server201is configured to compute suspect devices when given a time and location of an event. Server201is also used to produce a subset of suspect devices when given multiple times and locations of multiple events.

Central server201further comprises an operating system404and a device identification program403. Only a limited number of system elements are shown for ease of illustration; but additional elements may be included in the central server201.

Processor401may be partially implemented in hardware and, thereby, programmed with software or firmware logic or code (e.g., the device identification program403) for performing functionality described inFIG. 5; and/or the processor401may be completely implemented in hardware, for example, as a state machine or ASIC (application specific integrated circuit). All storage and components403-405and407can include short-term and/or long-term storage of various information needed for the functioning of the respective elements.

In the illustrative embodiment, networks203-207are attached (i.e., connected) to the central server201through network interface406and communicates with the processor401. Central server201may receive, and store data from networks as shown inFIG. 3.

Where networks203-207are connected wirelessly to the network interface406, network interface406includes elements including processing, modulating, and transceiver elements that are operable in accordance with any one or more standard or proprietary wireless interfaces, wherein some of the functionality of the processing, modulating, and transceiver elements may be performed by means of the processor401. Examples of network interfaces (wired or wireless) include Ethernet, T1, USB interfaces, IEEE 802.11b, IEEE 802.11g, cellular network interfaces, etc.

As discussed networks203-207capture association data every time an electronic device associates with the network's access points202. Additionally, networks203-207capture disassociation data every time an electronic device disassociates with the network's access points202.

Device identification program403runs on top of the operating system404(e.g., Windows 7 or Linux). When the device identification program403is requested by the operating system404to be launched, it is executed therein by the processor401. The processor401uses the device identification program403to receive a date, time, and location and return suspect devices. As described above, the date, time, and location may comprise the date, time and location of an event such as a crime. Alternatively, processor401uses the device identification program to receive multiple dates, times, and locations of events and return a subset of suspect devices common to all events.

During operation of server201, the information on dates, times, and locations is input into processor401via GUI408, which may simply comprise a keyboard and monitor. In a similar manner suspect devices and/or a subset of suspected devices are provided to a user of server201via GUI408as a list of device IDs.

Thus, during operation, network interface406continuously receives access data from networks203-207. As described above, the data preferably comprises a device ID, an application point ID, a date and time of association of the device with the application point, a date and time of disassociation of the device with the application point, and an optional location of the application point. The location of the application point may comprise an address or any geographic coordinate for the application point (e.g., latitude/longitude). Additionally, to save network bandwidth, an internal database407may be maintained of access point IDs and their associated location.

Processor401receives the network data and stores the network data as table300in database405. Processor401will then receive (via GUI408) a date, time, and location. Processor401may also receive other parameters such as, but not limited to distance parameters used for including or excluding access points. For example, processor401may receive a request to determine all device IDs associated with access points within 500 feet of 5thand Mane, on Tuesday, Aug. 28, 2012.

Processor401will utilize the location of the event to determine all nearby access points within a predetermined distance (e.g., 500 feet) of the location. Once the nearby access points are determined, processor401will determine suspect devices that associated with the nearby access points within a predetermined time period surrounding the time of the event. For example, processor401will determine device IDs for all electronic devices that associated with the nearby access points ½ hour before, to ½ hour after the event. These suspect devices will be presented through GUI408as a list of IDs, and may be saved as a data file in database405.

As discussed above, the list of suspect devices may be quite large. Processor401(when executing identification program403) will be configured to narrow down the list of suspect devices by receiving a second date, time, and location of a second event. Suspect devices may be determined as described above for the second event, and those suspect devices common to the first event date/time/location and the second event date/time/location may be presented to the user of server201as a subset of suspect devices. For clarification, “devices common to an event” is envisioned to encompass those devices associated with access points near the event, at a time period close to the time of the event.

In an alternate embodiment, processor401may receive a date, time, and location, and then determine those devices that associated with access points more than a predetermined number of times over a time period. For example, processor401may receive a time (e.g., Aug. 28, 2012 at 12:00 PM) as an input time. Processor401may also receive a distance value (e.g., 1 mile) and a location (Washington Monument). In this particular embodiment, processor401may receive a time period (e.g., 1 week) and a threshold number of associations (e.g., 15). Processor401will then determine all device IDs that associated more than 15 times with access points within 1 mile of the Washington Monument for the week prior to Aug. 28, 2012 at 12:00 PM.

FIG. 5is a flow chart showing the operation of the server ofFIG. 4in accordance with a first embodiment of the present invention. The logic flow ofFIG. 5assumes that database405is being continuously populated with access data as shown inFIG. 3. The logic flow begins at step501where processor401receives a first time and first location. At step503processor401accesses database405to determine at least a first access point near the first location. A first group of fixed or mobile devices IDs are then determined that were associated with the first access point at the first time (step505). At this point the device IDs may be output to a user through a graphical user interface, however, in order to narrow the number of devices the following optional steps may take place.

At step507processor401receives a second time and second location. At step509processor401accesses database405to determine at least a second access point near the second location. A second group of fixed or mobile devices IDs are then determined that were associated with the second access point at the second time (step511). At step513those suspect devices that are common to the first group of devices and the second group of devices are determined and presented to a user through GUI408as a subset of suspect devices (step515). Thus, at step515potential suspect(s) are determined by determining a subset of devices common to the first group of devices and the second group of devices This process can be repeated with the user inputting additional times and locations. At this point the device IDs may be output to a user through a graphical user interface.

As discussed above, although not necessary for practicing the invention, the first time and the first location may comprise a time and location of a first crime and the second time and the second location may comprise a time and location of a second crime

During operation, processor401can “rank order” devices that represent the best correlation of devices with access points at the given time. For example, those devices that were located at (associated with) an access point at the exact given time may receive a higher rank than those devices that were associated with an access point, for example, 15 minutes prior to the given time.

Although not discussed in detail, it is assumed that the network operator of the access point may be contacted to obtain the owners/users associated with suspect devices. In addition to contacting the network operator, an internal database may be kept and accessed for this mapping. Additional information may also be obtained. This information includes, but is not limited (1) name, (2) address, (3) physical description, (4) vehicles registered to suspect, (5) description of vehicles registered to suspect, (6) suspect picture, (7) suspect vehicle picture, (8) known accomplices to suspect, (9) suspect mobile devices, (10) suspect social media identifiers (email, twitter ID, etc.), (11) suspect criminal record, (12) suspect voice sample.

The above information may be utilized in several ways that may help law enforcement. For example, once the suspect device(s) has been determined, database405may be accessed to determine other access points that the suspect device associated with over time. From this information a route may be derived. If this can be done quickly enough after an event, the route can be used to activate cameras searching for vehicles related to owner of device along predicted path.

FIG. 6is a flow chart showing operation of the server ofFIG. 4in more detail. It should be noted that any step inFIG. 6is optional. For example, althoughFIG. 6will be shown having the steps of, performing route determination, or obtaining owner information for the suspect devices, these steps may be omitted without varying from the scope of the present invention.

The logic flow begins at step601where processor401receives a location, date and time. At step603processor401receives a time period. At step605processor401receives a distance. It should be noted that in this particular embodiment the location, date, time, time period, and distance may all be input by a user via GUI408.

At step607processor401then accesses database407to determine access points within the distance of the location. At step609database405is accessed and processor401determines a first group of device IDs associated with the determined access points over the time period surrounding the time. This information may be output at step611.

Processor401then receives a second location, second date, and second time (step613), second time period (step615), and a second distance (step617). At step619processor401then accesses database407to determine second access points within the second distance of the second location. At step621database405is accessed and processor401determines a second group of device IDs associated with the determined second access points over the second time period surrounding the second time. The logic flow continues to step623where device IDs common to the first group of device IDs and the second group of device IDs are determined and presented to the user (step625) as a list of suspect devices.

As discussed above, network operators may be contacted to determine owners/users of devices associated with the common device IDs (step627). Additionally, database405may be accessed and searched for a suspect device ID to determine those access points the suspect device associated with in order to determine route information (step629). In other words, route information for devices associated with the common device IDs may be determined.

In the foregoing specification, specific embodiments have been described. However, one of ordinary skill in the art appreciates that various modifications and changes can be made without departing from the scope of the invention as set forth in the claims below. For example, the above description was provided to enable the determination of individuals through the detection of their device IDs. The device IDs were provided by network infrastructure. However, in alternate embodiments of the present invention these device IDs may be provided to a central server via any method. For example, a child registration database may associate a particular device with a child. These devices may communicate directly with a central server. Alternatively, in an LTE system using “ProSe”. one wireless device can discover other wireless devices in range. Wireless nodes capturing IDs in range can then relay this information to a server. Accordingly, the specification and figures are to be regarded in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of present teachings.

Those skilled in the art will further recognize that references to specific implementation embodiments such as “circuitry” may equally be accomplished via either on general purpose computing apparatus (e.g., CPU) or specialized processing apparatus (e.g., DSP) executing software instructions stored in non-transitory computer-readable memory. It will also be understood that the terms and expressions used herein have the ordinary technical meaning as is accorded to such terms and expressions by persons skilled in the technical field as set forth above except where different specific meanings have otherwise been set forth herein.