Bursa, one of the most industrialised cities in Turkey, is experiencing a high level of local immigration; population increases geometrically where the number of police officers, equipments and resources increase arithmetically. The gap between the resources and the crime urged strategic investment to improve the effectiveness of policing. Bursa Police Department (BPD) decided to tackle crime not only by conventional policing methods, but also to benefit from information and communication technologies (ICT) to a higher degree.

BPD is one of the pioneers of crime mapping with geographic information systems (GIS) and crime analysis in Turkey. BPD initiated creating her own records management system (RMS) and using mobile data terminals (MDT) based on the latest technology. The need for querying records of suspects and recognition of criminals on the beat, BPD developed face/appearance recognition and classification software for profiling criminals.

In 2004, contrary to the fact that crime rate increased all over Turkey by 10%, Bursa experienced 10.7% decrease due to effective usage of crime databases and crime maps as well as deploying special units accordingly. For the first quarter of 2005, crime rate continued to fall by 9.6% in proportion to crime rate in 2004. The use of ICT at BPD is an unending process of learning and development. The presentation intends to guide similar efforts for the use of crime database and crime mapping which we believe will eventually be spread throughout other departments in Turkey.

1. INTRODUCTION
Recently, due to the result of sharp rise of population and unemployment in Turkey there has been an increase of crime within metropolitan cities like Bursa. In 2003 the number of reported street crimes in Turkey was 321805 where it increased by 10% to 353692 in 2004. Where as in Bursa there were reported 14988 crimes in 2004 compared to 16787 in 2003.

Figure 1: Street Crimes in Turkey 2003 represented in thematic mapping, per 100000 person.
(Source: http://www.egm.gov.tr/asayis/istatistik2003_2004.asp)

1 ANTALYA 1.719.751 6.503 8.164 14.667 56 853
2 İSTANBUL 10.018.735 29.147 53.382 82.529 65 824
3 GAZİANTEP 1.285.249 4.756 5.776 10.532 55 819
4 BURSA 2 .125.140 10.246 6.541 16.787 39 790
5 ANKARA 4.007.860 20.772 10.115 30.887 33 771
6 MERSİN 1.651.400 9.625 1.926 11.551 17 699
7 BURDUR 256.803 1.408 3 06 1.714 18 667
8 İZMİR 3.370.866 14.716 7.766 22.482 35 667
9 KIRIKKALE 383.508 1.650 3 69 2.019 18 526
10 KIRŞEHİR 253.239 1.159 1 48 1.307 11 516
11 ÇORUM 597.065 2.070 8 55 2.925 29 490
12 NİĞDE 348.081 1.348 3 40 1.688 20 485
13 ESKİŞEHİR 706.009 2.719 7 02 3.421 21 485
14 EDİRNE 402.606 1.733 1 94 1.927 10 479
15 KASTAMONU 375.416 1.580 1 77 1.757 10 468

Table 1: Street Crimes in Turkey 2003 in figures.

(Source: http://www.egm.gov.tr/asayis/istatistik2003_2004.asp)

As a result total decrease of street crimes was 10.7% which basically depends on effective use of policing methods and crime mapping analysis efforts. Bursa had the fourth highest crime rates all over the Turkey in 2003 where it has the tenth highest rates in 2004.

Figure 2: Street Crimes in Turkey 2004 represented in thematic mapping, per 100000 person.

(Source: http://www.egm.gov.tr/asayis/istatistik2003_2004.asp)

Department has decided to tackle crime problem by benefiting from information technologies. In this paper crime mapping analysis and its impact in Bursa Police Department who pioneers crime mapping analysis in Turkey is explained.

2. WHY MAP CRIME?
Maps are so useful tools for representing crime phenomena. In general terms, maps are ;

• pictorial information about locations and spaces,
• helpful for imagining abstract truths,
• capable of symbolising data which are worth thousands of words,
• good at giving opportunity for some information to be seen at first sight (Harries,1999).

On the eve of information age, the criteria for efficiency and the success of combating crime is measured by effective usage of information technologies. Statistics, as a quantitative method of analysing crime, is widely used for creating strategies for crime reduction and prevention (MACA, 2002a). Unfortunately it is not always possible to understand all aspects of crime data by only using statistical methods. Many crime events and other related social trends can be seen, evaluated and analysed without overloading of numbers, rates, and statistics. These results bring new strategies for possible crime events in the future (MACA, 2002b).

Crime mapping analysis effectively explains correlations between location and crime as well as relations amongst offender-victim-timeline with graphical interfaces such as maps, charts, reports. Crime mapping is one of the most effective ways of analysing and understanding crime (Markovic and Stone, 2002).

In general terms crime mapping is spatial and temporal representation of all crime related data which are available in paper-based documents and digital Records Management Systems (RMS) by using state-of-art Geographical Information Systems (GIS) and digital map layers of selected location. As it can be deduced from its definition, in order to create crime maps crime data and digital map layers are essentially required.

Crime mapping has brought a new approach to crime prevention efforts. Crime maps provide easiness and practicality to apprehend many complex spatial crime data so easy to be seen at one sight. Numerous types of crimes and other realities represented by colours, symbols, charts to be understand easily. Streets, neighbourhoods, buildings, bus-stops on digital map layers can be accessed and queried if needed to relate crime events.

Figure 3: A query made for a homicide event where GIS opens related table by clicking on crime location. (Source: Bursa Police Department, Information Processing Unit, 2001)

Apart from representing crime and criminality crime maps also help police officers and executives to recognise their areas of responsibility. Since crime maps are produced according to crime databases, related personnel can acquire intelligence very fast and at satisfying levels. Lack of proper crime databases and maps result some failures where personnel are inexperienced and unaware of specialities of the neighbourhoods.

3. CRIME MAPPING APPLICATICATIONS IN BURSA
In 2001, the decision of using new method of policing was made by the police executives to use crime mapping, crime analysis and crime databases in the most effective ways that the gap between the resources of Bursa Police Department and growing numbers of crime can only be solved by effective use of resources. Bursa Police Department decided to fight crime also by benefiting from information and communication technologies at maximum levels. Initial maps were created for serious crimes in 2000 and 2001. One of the examples of very early crime maps are exhibited in Figure 4 which is the thematic map of vehicle burglary and burglary from vehicles in 2001.

Figure 4: Thematic map of vehicle burglary and burglary from vehicles in 2001

(Source: Bursa Police Department, Information Processing Unit 2001)

The existing crime mapping applications in Bursa Police Department can classified within six types of policing tasks; planning patrol locations and resource allocation,command and control, monitoring displacement & temporal changes, automated reporting and information sharing, crime analysis and public acknowledgement.

3.1. PLANNING PATROL LOCATIONS AND RESOURCE ALLOCATION
According to produced crime maps, resources such as patrols, vehicles and equipment are concentrated on high density crime locations. Plans are made in consideration with crime hotspots then patrol routes and timing of patrol services are arranged accordingly. Instead of random patrol services around random neighbourhoods, contemporary understanding of preventive patrols are realised in high crime rated streets within crime occurred peak times by benefiting crime maps.

Figure 5: Newly created street patrols also equipped with Mobile Data Terminals (MDTs).

They can access data on the beat when required (Source: Bursa Police Department 2004) The success achieved in 2004 mainly depended on creation of new street patrol teams in accordance with effective use of crime databases and crime maps. Responsibility areas of street patrol teams are redesigned according to crime maps. In 2005, the locations and police beats of 35 new automobile patrols are decided according to new crime hotspots occurred within the city. Regular crime maps and acknowledgement of crime hotspots to patrols resulted to a satisfying level of crime reduction.

3.2. COMMAND AND CONTROL
Police executives decide new plans and strategies on crime suffering neighbourhoods with the aid of crime maps produced. These plans are passed quickly to subordinates as memorandums and reports with crime maps attached to them.

3.3. MONITORING DISPLACEMENT & TEMPORAL CHANGES
Because of strict measures taken as a response to crime hotspots, displacement of crime is a common fact of policing. These temporal changes are monitored on crime maps very easily and new responses are made accordingly.

3.4. AUTOMATED REPORTING AND INFORMATION SHARING
In regular terms, crime maps and crime statistics are reported and evaluated within meetings where decisions and results are shared with other local authorities (Ratcliffe, 1999).

3.5. CRIME ANALYSIS
Produced crime maps and statistics are analysed by professional problem solving crime analysts. Researchers and professional crime analysts within universities show interest for academic research. Uludag University of Bursa and Istanbul University Forensic Science Institute are academic partners for our Research & Development efforts.

3.6. PUBLIC ACKNOWLEDGEMENT
Produced crime maps and analysis results are shared with public. Official crime reports acknowledged by the public have positive impact on community-based policing applications and feed-back from local neighborhoods. Figure 6 below represents homicides occurred in 2001. It is surprisingly fact that 12 homicides out of 28 has occurred in the same Police Beat (namely S.S. Yilmaz Police Station). The neighborhood is informed about the fact and highest preventive measures realized with the cooperation of neighborhood.

Figure 6: Homicides occurred in 2001

(Source: Bursa Police Department, Information Processing Unit 2001)

4. CONCLUSION: LESSONS LEARNED AT BURSA
When almost five years of crime mapping and analysis applications considered, there many good results produced in terms of policing. But there were some further points,many of them were technical IT drawbacks, required to be handled with crime mapping applications. Lessons learned in this five-year-process are explained below.

4.1. ACTION FOR COMMUNITY POLICING

As a result of good results produced after usage of crime mapping analysis, at the beginning of 2003 initiatives launched for community-based policing, for this end a workgroup is created at the police department. Rather than trying to solve every single security and crime problem one-by-one, it has been aimed to inform community members about high risk problems within their neighborhoods. According to the records of 2002, maps for every neighborhood and every single street for selected four types of crime are produced and published in media to be delivered to local crime units to be shared by local people. These crime types were burglary from dwellings and houses, burglary from vehicles, vehicle burglary and burglary from non-residential premises. Apart from these meetings all patrols and other police staff are submitted to regular crime analysis meetings where the message was passed to all members of police department: It is not possible to fight crime by only policing, contributions from locals, non-governmental organizations and the citizens on the streets are essential. The support of local people against crime is a must.

4.2. SOLVING DATA ENTRY AND GEOCODING PROBLEMS

Although it is possible to represent crime locations by plotting (as pins) by manual geocoding, contemporary GISs automatically geocode locations in relation with digital map layers, such as street map layers and parcel layers. In automated geocoding locations are interrelated to existing street names, door numbers or latitudes-longitudes and recorded in specific fields within tables of databases.

It has been observed that data entry errors prevented 100% accurate crime maps which can misguide users. One possible reason for this is lack of standards for naming locations, but even street names are subject to change within time. Local governments should never change street names without the acknowledgement of police departments. Update of digital map layers should be done at least three or four times within a year, otherwise technical issues on base maps can result confusion among police officers. One of the main inaccuracy problems was due to unpopular forms of crime reports, department decided to add latitude and longitude fields for every crime incident to make sure that data entry error is minimized. Even if data entry error is not made by the officer on the beat while filling in the form manually, during the phase of data entry to digital database at the computers produced similar errors. To overcome this problem totally, interfaces which are shown below were added to records management system (RMS) and automatically related to GIS.

Figure 7: Interface for Crime Locations at RMS.

Figure 8: Data Entry Form for Crime Incident at RMS.

Figure 9: Data Entry Form for Persons at RMS.

4.3. ENCOUREGEMENT OF LOCAL CRIME DATABASE USAGE

In 2004, more than 1000 convicted criminals or suspects who were subject to search warrants are coughed by the street patrols because of using crime databases on the field. From mobile data terminals it takes only a couple of second to check a person’s ID information. But databases used at local levels must be at satisfying size. The much it grows, the more criminals can be found with hit score. That is why local crime databases on all levels must be supported financially. All paper-based records should be transferred to databases in digital formats. The table below represents the number of records at Bursa Police Department’s local database.

RECORDS ENTERED BETWEEN 01.01.1994 - 09.05.2005
TOTAL CRIME RECORDS 138.935
TOTAL NUMBER OF OFFENDERS 96.759
TOTAL NUMBER OF PERSONS (EXCLUDING OFFENDERS)111.910
GROSS TOTAL 347.604
Table 3: (Source: Bursa Police Department, 2005)

When other cities in Turkey considered, the only dating back to 1994 crime records local database is belong to Bursa Police Department. This disadvantage for other police departments in Turkey can be exampled as a person who is so powerful but who can’t remember his enemies in his past. All police departments in Turkey urgently need to create their own crime databases by themselves. Old crime records and ex-criminal intelligence can be used for pre-emptive policing even before crime has occurred.

4.4. MORE SOFTWARE FOR SOPHISTICATED CRIME ANALYSIS

When good results are produced Bursa Police Department sought for more satisfaction from IT technologies. In 2001, as the first time in Turkish Policing History crime database integrated crime maps were produced. These crime maps contributed to developing problem solving policing in Bursa. After initialising Geographic Information Systems (GIS) there had been a demand for Mobile Data Terminals (MDTs) which are used on the beat.

Apart from text-based queries there were demands from the staff about creating a
software module which integrates existing crime databases as well as including
photographs of suspects and offenders. This was simply because some calls for services and applications to police were about some people whose ID information are not known. The only evidence was about their appearances which can only be identified by comparison. In 2004 a new module for existing crime database was launched in order to address this issue. By 09th of May 2005, “Appearance Module for Crime Database” includes 8272 male and 768 female 9040 in total subjects to be used for querying by appearance.

4.5. NEXT GENERATION POLICING: GEOGRAPHIC PROFILING

Geographic profiling was pioneered by Detective Inspector Kim Rossmo, the first police officer in Canada with a PhD in Criminology. Dr. Rossmo’s research was on a sophisticated software system called Rigel that uses the technology in crime analysis, digital mapping, database integration, and visual presentation tools. In the 1980s, researchers at Simon Fraser University in British Columbia, Canada, began to focus upon the geography of the criminal act rather than just the motivation of the criminal(the question of where, versus the why). The research found that humans tend to follow predictable patterns of movements (Rossmo, 2000).

Although famous geographic profiling software Rigel is not available at Bursa geographic profiling has been tried on some examples of crime series in Bursa and results are promising. These crime types are homicides, sexual rapes, arsons, vandalism and serial burglaries. Figure 13 represents a serial burglary offender C.A. `s relation between crime scene and his residence. As it can be seen offender basically operated in his neighbourhood as well as neighbourhoods which he knows best.

Figure 13: The yellow symbol of anchor point is C.A. ` s home.

We have found some profiling patterns for homicides, burglaries, street snatching, auto thefts, drug delivery areas, and crimes train/metro/bus stops.

Figure 14: Street snatching is an increasing crime which can be profiled to main streets within the town centre

Each of geographic profiles has typical patterns which can be applied to other cities in Turkey, but cultural and location differences vary for geographic profiling (Brantingham and Brantingham, 1984). These changes must be taken into consideration. Bursa Police Department encourages existing cooperating crime analysts to conduct research for geographical profiling.

REFERENCES

Brantingham, Paul J. and Brantingham, Patricia L. (1984). Patterns in Crime. New York, NY; Macmillan.

Harries, K. (1999). Mapping Crime: Principle and Practice. National Institute of Justice Crime Mapping Research Centre (CMRC) (Online) [http://www.ncjrs.org/html/nij/mapping/pdf.html]

MACA (Massachusetts Association of Crime Analysts) (2002a). A History of Crime Analysis (Online)[http://www.macrimeanalysts.com/articles/historyofcrimeanalysis.pdf]

MACA (Massachusetts Association of Crime Analysts) (2002b). What is crime analysis? (Online) [http://www.macrimeanalysts.com/aboutca.html]

Markovic, J.Stone, C. (2002). Crime Mapping And Policing Of Democratic Societies. Vera Institute of Justice; New York

Ratcliffe, J. (1999). Implementing and Integrating Crime Mapping into a Police Intelligence Environment. International Journal of Police Science & Management Vol:2 Num:4 pp.313-323

Rossmo, D. K. (2000). Geographic profiling. Boca Raton, FL: CRC Press.

1 Introduction
Link analysis and group detection is a newly emerging
research area which is at the intersection of link analysis,
hypertext and web mining, graph mining (Cook and
Holder, 2000) and social network analysis (Scott, 2004).
Graph mining and social network analysis in particular
attracted attention from a wide audience in police
investigation and intelligence (Getoor et al., 2004). As a
result of this attention, the police and intelligence
agencies realized the knowledge about offender networks
and detecting covert networks are important to crime
investigation (Senator, 2005). Group detection refers to
the discovery of underlying organisational structure that
relates selected individuals with each other, in broader
context; it refers to the discovery of underlying structure
relating instances of any type of entity among themselves
(Marcus et al., 2007). Since discovery of an underlying
organisational structure from crime data leads the
investigation to terrorist cells or organised crime groups,
detecting covert networks are important to crime
investigation. Detecting an offender group or even a part
of group (subgroup) is also important and valuable. A
subgroup can be extended with other members with the
help of domain experts. An experienced police officer
usually knows the friends of well-known offenders, so he
can decide which subgroups should be united to
constitute the whole group. Another outcome of offender
group detection is considered to be pre-emptive strike or
crime prevention. For example a drug dealing network
prepares all required vehicles and people for transaction
where all members are in the process of getting prepared.
Such cases can be prevented with offender group
detection before it happens. A further advantage of group
detection is acting in a group of offenders to commit a
crime is regarded as an aggravating factor for a heavier
punishment in many country’s laws. For instance,
Turkish Crime Code extends six years imprisonment for
group leader and one year imprisonment for group
members plus the punishment.
Specific software like Analyst Notebook (2007), and
Sentient (2007) provide some visual spatio-temporal
representations of offender groups in graphs, but they
lack automated group detection functionality.
In this paper, we make the following contributions for
offender group detection (OGD);
· We identify and discuss converting arrest data to
graph format where there is no standardised way
of doing this. We suggest the choice of
representation for edges and nodes should follow
the rules in SNA where mostly one-mode social
network representation which is now standard
(section 4).

· We explain precisely how to use police arrest
data to look for possible offender groups
(section 5). Surprisingly this has not been
explained precisely before.
· We show how we can apply filters to graph data
in order to adhere to countries’ criminal law
requirements (section 7).
· We show that ruling members, not new recruits,
are likely to be detected, but “big brother” of
network is unlikely to be detected (section 8).

2 Group Detection
Group detection task is defined and different methods
applied in data mining, in social network analysis, and in
graph theory. For example, Getoor and Diehl (2005)
state group detection aims clustering of object nodes in a
graph into groups that share common characteristics. But
to some extent, subgraph discovery does the same job for
finding interesting or common patterns in a graph. On the
other hand social network analysis tries to detect cohesive
subgroups among which there are relatively strong,
direct, intense, frequent, or positive ties (Wasserman and
Faust, 1994). Graph matching (Cook and Holder, 2007)
methods are also recommended for group detection tasks.
There are also many specific group detection models.
Adibi et al. (2004, 2005) propose KOJAK group finder
which firstly positioning possible groups, expanding
these groups using knowledge-based reasoning
techniques and then adding more candidates relying on
observed interactions that shows possible associations.
Kubica et al. (2002, 2003) first proposes a generative
model for multi-type link generation, called collaborative
graph model (cGraph) and introduce a scalable group
discovery algorithm called k-groups, which is similar to
k-means algorithm.

3 OGD
When we focus on offender group detection, the most
remarkable works are CrimeNet Explorer, which is
developed by Xu et al. (2005), and Terrorist Modus
Operandi Detection System (TMODS), which is
developed by 21st Century Technologies (Moy, 2005).

3.1 CrimeNet Explorer
Xu et al. (2005) defined a framework for automated
network analysis and visualization. Using COPLINK
connect and COPLINK detect (Chen et al., 2002)
structure to obtain link data from text, CrimeNet Explorer
used an Reciprocal Nearest Neighbour (RNN) based
clustering algorithm to find out links between offenders,
as well as discovery of previously unknown groups.
CrimeNet Explorer framework includes four stages:
network creation, network partition, structural analysis,
and network visualization. CrimeNet Explorer uses
concept space approach for network creation, RNN-based
hierarchical clustering algorithm for group detection;
social network analysis based structural analysis, and
multi dimensional scaling for network visualisation.
CrimeNet Explorer is the first model to solve offender
group discovery problem and its success comes from the
powerful functionality of overall COPLINK structure. On
the other hand, since CrimeNet Explorer was evaluated
by university students for its visualization, structural
analysis capabilities, and its group detection functionality,
the operationally actionable outputs of CrimeNet
Explorer has not been proved on real-time police
investigations.

3.2 Terrorist Modus Operandi Detection
System (TMODS)TMODS, which is developed by 21st Century
Technologies (Marcus et al., 2007), automates the tasks
of searching for and analysing instances of particular
threatening activity patterns. With TMODS, the analyst
can define an attributed relational graph to represent the
pattern of threatening activity he or she is looking for.
TMODS then automates the search for that threat pattern
through an input graph representing the large volume of
observed data. TMODS pinpoints the subset of data that
match the threat pattern defined by the analyst thereby
transforming a manual search into an efficient automated
graph matching tool. User defined threatening activity or
pattern graph can be produced with possible terrorist
network ontology and this can be matched against
observed activity graph. At the end, human analyst views
matches that are highlighted against the input graph.
TMODS is mature and powerful distributed java software
that has been under development since October 2001
(Marcus et al., 2007). But it needs a pattern graph and an
analyst to run the system. Like a supervised learning
algorithm, TMODS tries to tailor the results according to
pre-defined threatening activity. Another possible
drawback is graphs used in TMODS are multi-mode and
can be disadvantageous for further analysis. Multi-mode
graph means that nodes in multi-mode graphs are more
than two types of entities. A person, a building, an event,
a vehicle are all represented as nodes; when for instance
we want to detect key players in multi-mode graph, a
building can be detected as key player, not a person. This
can be a cause of confusion. To overcome this confusion
the definition of a one-mode (friendship) social network
should be used rather than representing all entities as
nodes.

4 Offender Group Representation
Wasserman and Faust (1994) pp.35 states that the modes
of a network as the number of sets of entities on which
structural variables are measured. One-mode (friendship)
networks, the predominate type of network, study just a
single set of actors while two-mode (affiliation) networks
focus on two sets of actors, or one set of actors and one
set of events. One could ever consider (three and higher)
mode networks but rarely have social network methods
has been designed for such complicated data structures.
According to these definitions it is better to represent
actors (offenders) as nodes and rest of the relations as
edges in one-mode (friendship) social networks. This can
produce many link types such as “co-defendant link”,
“spatial link”, “same weapon link”, and “same modus
operandi link”. Thereby many graph theoretical and SNA
solutions can be used on one-mode (friendship) networks
effectively such as friendship identification, finding key
actors.

5 Police Arrest Data
We recommend looking for common characteristics of
offenders in police arrest data. Do they commit the same
crime somewhere sometime together, and then any of
these offenders has also committed another crime with
another offender? This information can be obtained from
a relational database table, text-based arrest report, or
CCTV footage.

In Operation Cash we obtained this information from
Bursa Police Arrest Data where the table included the
fields for: P_ID (person id), C_ID (crime reference
number), BRANCH (police branch that deals with),
CRT_ID (Crime type it belongs to), CR (Name of the
offence), MOT_ID (Modus Operandi it belongs to), MO
(name of the modus operandi), D (date stamp), DIS
(district), NG (neighbourhood), and NG_ID
(neighbourhood number).

6 Offender Group Detection Model (OGDM)
OGDM is mainly developed for detecting gangs and theft
networks.

As exhibited in Figure 1. the source of link
information is gathered from police arrest records where a
link table; consisting of From (From Offender), To (To
offender), and W (how many times this offender pair
caught together by the police) is produced with an inner
join SQL query.

Inner join query result, which we call co-defendant link
table, then converted to graph where nodes represent
offenders, edges represent crimes committed together
using offender group representation exhibited in section
4. Number of times caught together is counted to be used
for edge weight (W). At this point a subgraph detection
operation is needed; various social network analysis
algorithms such as k-clique, k-core (Wasserman et al.,
1994) can be used for this purpose. We used strongly
connected components (SCC) algorithm in Operation
Cash because it is scalable and gives concrete results.
SCC algorithm is defined as (Cormen et al., 2001);

a directed graph is called strongly connected if for every
pair of vertices U and V in a graph there is a path from U
to V and a path from V to U. The strongly connected
components of a directed graph are its maximal strongly
connected subgraphs.

In a graph generated from an arrest table where there are
at least couple of hundred thousand of crimes (edges) and
thousands of offender (nodes) makes scalability and
performance issue very important. At last, every
component represents a unique offender group because
one offender can only belong to one group thereby
concrete a result of group membership is obtained.

7 Filtering for Legal Requirements
Turkish Crime Code requires that an criminal
organisation (offender group) must consist at least of
three members, and two members in an offender group
must have been convicted together for committing the
same crime at least two times (Turkish Crime Code,
Article Number:261). According to this definition, where
edge weight is W and number of members is N;
Wgroup >= 2, Ngroup >= 3
is the threshold to constitute a criminal organisation. This
requirement can be different in different countries but it is
essential to create a filter for a legally accepted criminal
organisation.

8 Operation Cash
Offender group detection action is started with
preparation of Bursa Police arrest data. Initial data preprocessing
and data cleaning are done in cooperation with
Bursa Police Department on more than 300000 crimes
and 6000 offenders. Starting from 1994 to 2007, arrest
data included all offenders with a unique person-id
number. This uniqueness allowed us to track all
offenders’ activities. We had opportunity to find out an
offender’s history over time with all his/her crimes had
committed. We produced first the link table, and then
converted it to a massive graph; at the end all components
in the graph are obtained with SCC. Accepting that even
two offenders caught by the police is enough to be a
component, total number of components were 33004
(199728 crimes; with an average of 6.05 crimes per
component). When Wgroup threshold is put to 2, number of
components is dropped to 4488 (15482 crimes; with an
average of 3.45 crimes per group). When Ngroup threshold
is put to 3, number of offender groups, which is adherent
to Turkish Criminal Law definition, is dropped to 1416.
Reminding the fact that these groups included many
offenders committed various types of crimes from theft to
violence, from gangs to terrorists; we only focused on
active theft groups who committed crimes in the last five
years. As a result, 63 theft groups are detected and these
findings were introduced to the police experts for further
examination. According to police experts, our findings
were very valuable but not enough. There was a
consensus to search group members, gather enough
evidence for arrest and prepare the case for a sentence.
Besides, in parallel, the effectiveness of our method was
also a question for the police so just one random theft
group out of 63 is focused, a judge verdict is obtained for
electronic surveillance and telephone conversations of all
members of selected group are eavesdropped for ten
weeks. Our findings for this theft group are exhibited in
figure 4 as offenders by person-id numbers, and with
degrees of members in brackets.

Degree is a metric in social network analysis which is count of incoming and
outgoing links for an actor (Wasserman et al., 1994).
High degree value for an actor suggests that actor is likely
to be a key player in the network. After this electronic surveillance, verification of who is
who in the network and gathering enough convincing
evidence, Operation Cash is launched. The police
arrested 17 people, recovered worth US $ 200000 stolen
jewelleries, PCs, laptops, mobile phones, and some cash
worth US $ 180000.

Obtained evidences and interrogations showed that ruling
members were detected using OGDM. It has been proved
that the real network was consisting of 21 members and 3
of them (AB, MRK, and SE) have never been arrested by
the police so their names were not available in the
database. We managed to get only 4 ruling members
(12113, 38594, 41211, and 277801). Four leaders were
basically the chief of gun-jewellers thieves (12113), the
skilled expert thief specialized in electronic goods
(277801), chief of electronic goods thieves (38594), chief
of car and gadget supplier for the network (41211).
Interestingly, “big brother” of the network (220868) has
only two records in police database. His leader position is
identified after interrogations and cross examination of
members’ statements.

Operation Cash has attracted wide attention and positive
feedback in local and national newspapers (Zaman, Olay,
PolisHaber, 2006). The police commissioner of Bursa
city stated that Operation Cash was the most successful
operation among all operations by Bursa Police in 2006.

9 Conclusion
It has been shown that co-defendant information in police
arrest data is beneficial for the police to detect ruling
members of offender groups. It has been also shown that
detecting an underlying criminal network is possible with
link mining and group detection techniques.
OGDM has been successful for partly detection of
offender groups. But it is clear that domain expertise is
still needed for complete detection of groups. This shows
the necessity of semi-supervised models for OGD.
The result achieved depends on the details of the OGDM
come from offender group representation success (see
section 5). By representing actors as nodes and rest of the
relations as edges in one-mode (friendship) social
networks can produce many link types such as “codefendant
link”, “spatial link”, “same weapon link”,
“same modus operandi link”. This helped many graph
theoretical and SNA solutions can be used in Operation
Cash.

Additional criminological conclusions reached after
discussions with domain experts are;
· Group members likely to come from the same
family (e.g. small-aged pickpocketing group).
· Group members likely to cooperate and come
together for required skills to commit
crimes.(e.g. theft from offices group, theft from
residences group, fraud group, violence group).
· Group members are high likely coming from the
same age group and peer group.
· Group members’ origins are high likely coming
from the same home cities and towns.
· Group members are likely to live in the same
areas.
· Group members are likely to operate in the same
areas.
· Group members are likely to work in the same
industries(e.g. Scrap Dealer Auto theft Group).

Copyright © 2007, Australian Computer Society, Inc. This
paper appeared at the Sixth Australasian Data Mining
Conference (AusDM 2007), Gold Coast, Australia.
Conferences in Research and Practice in Information
Technology (CRPIT), Vol. 70. Peter Christen, Paul Kennedy,
Jiuyong Li, Inna Kolyshkina and Graham Williams, Ed.
Reproduction for academic, not-for profit purposes permitted
provided this text is included.

References
Adderley, R. (2004), The use of data mining techniques
in operational crime fighting in 2nd Symposium on
Intelligence and Security Informatics, ISI‑ 2004.
Tucson, AZ, USA. 3073, pp. 418–425.
Adibi, J., P. Pantel, et al. (2005), ‘Report Link Discovery:
Issues, Approaches and Applications’, (KDD-2005
Workshop - LinkKDD-2005), SIGKDD Explorations
7(2), pp. 123-125.
Adibi, J. & Chalupsky, H. (2004), The KOJAK Group
Finder: Connecting the dots via integrated knowledge
based and statistical reasoning, in IAAI.
Analyst Notebook (2007), ‘i2 Analyst Notebook’, i2 Ltd,
http://www.i2.co.uk/ Viewed at 31 July 2007.
Chen, H., Chung, W., et al. (2004), Crime data mining: a
general framework and some examples, in Computer 37(4), pp. 50-56.
Chen, H., J. Schroeder, et al. (2002), ‘COPLINK
Connect: information and knowledge management for
law Enforcement’, Decision Support Systems 34, pp.
271-285.
Cook, D.J. & Holder, L.B. (2000), ‘Graph-Based data
mining’, IEEE Intelligent Systems 15(2), pp. 32-41
Cook, D.J. & Holder, L.B. (2007), Graph Mining, Wiley-
Interscience, John Wiley Sons, Hoboken, New Jersey.
Cormen, T. H., Leiserson, C. E., Rivest, R. L. & Stein, C.
(2001), Introduction to Algorithms. Second Edition.
MIT Press and McGraw-Hill
Getoor, L. & Diehl, C.P. (2005), ‘Link Mining: A
Survey’, SIGKDD Explorations 7(2), pp. 3–12
Getoor, L. et al. (2004), ‘Link Mining: a new data mining
challenge’, SIGKDD Explorations 5(1), pp. 84-89.
Guest, S. D., Moody, J., Kelly, L., Rulison, K.L., (2007),
‘Density or Distinction? The Roles of Data Structure
and Group Detection Methods in Describing
Adolescent Peer Groups’, Journal of Social Structure,
8(1), Viewed at 28 July 2007,http://
www.cmu.edu/joss/content/articles/volindex.html
Kubica, J., Moore, A., et al. (2003), cGraph: A fast graphbased
method for link analysis and queries, in IJCAI
2003 Text Mining and Link Analysis Workshop.
Kubica, J., Moore, A., et al. (2002), Stochastic Link and
Group Detection, in 18th National Conference on
Artificial Intelligence, AAAI Press/ MIT Press
Marcus, S.M., Moy, M. & Coffman, T. (2007), Social
Network Analysis, in Diane J.Cook and Lawrence B.
Holder, ‘Mining Graph Data’, John Wiley & Sons.
Moy, M. (2005), ‘Using TMODS to run the best friends
group detection algorithm’, 21st Century Technologies
Internal Publication.
Olay (2006), ‘Technological tracking to criminal groups’,
Bursa Olay Local Newspaper, 19th of December 2006 ,
Viewed at 31 July 2007, http://www2.olay.com.tr/blocks/haberoku.php?
id=5990&cins=Spot%20Bursa
PolisHaber (2006), ‘Operation ‘Cash’ By Police’, Turkish
Police News Portal, Viewed at 31 July 2007,
http://www.polis.web.tr/article_view.php?aid=3666
Scott, J. (2004), Social Network Analysis: A Handbook,
SAGE Publications, London, UK.
Senator, T.E. (2005), ‘Link Mining Applications:
Progress and Challenges’, SIGKDD Explorations, 7(2),
pp. 76–83.
Sentient (2007), ‘Sentient Data Detective’, Sentient
Information Systems, Viewed at 31 July 2007,
http://www.www.sentient.nl/
Taipale, K. A. (2003), ‘Data Mining and Domestic
Security: Connecting the Dots to Make Sense of Data’,
Columbia Science and Technology Law Review 5.
Wasserman, S. & Faust, K. (1994), Social Network
Analysis Methods and Applications. Structural Analysis
in the Social Sciences, Cambridge University Press.
Xu, J. J. & Chen, H. (2005), ‘CrimeNet Explorer: A
Framework for Criminal Network Knowledge
Discovery’, ACM Transactions on Information Systems
23(2), pp. 201-226.
Zaman (2006), ‘Police tracked down 63 crime groups
with new technology help’, Zaman National Newspaper,
9th of January 2007, Viewed at 31 July 2007,
http://www.zaman.com.tr/webapptr/
haber.do?haberno=437444

I have some ideas about how to use computers for crime. Well not committing crime, but solving or preventing crime.. I have some intentions about presenting my research on how to use

* crime mapping,
* geographic information systems(GIS)
* link analysis
* graph mining
* text matching
* group detection
* artificial intelligence techniques for crime data
* crime data mining.

I have worked as a police chief for ten years, got the formal police training for eight years, so I have a great dedication to fighting crime.

If you are interested in sharing your knowledge and experience, and discuss issues on

* understanding terrorist networks and their social network structure,
* organized crime groups (i.e. drug, kidnapping, smuggling networks), prostitution rings, theft, and violence networks.
* Factors effecting offenders to meet each other for committing crime.
* Criminologists’ approach for criminality, offender networks and profiling them.
* Geographical point of view to criminality and offender groups.
* Bayesian networks approach for causes of crime and reasons for criminals decisions to work together in groups.
* Statistical and forecasting models for criminality.

I have a great desire to discuss on these issues. My shelves are full of knowledge , experience, experiments on real offender networks. Feel free to contact me.

See you again,

Fatih