Stanley Cup Riot Investigation June 15 th, 2011

Transcription

1 Stanley Cup Riot Investigation June 15 th, 2011 Operational Track 1

2 1. Riot Review for context (video) 2. Social Media collecting evidence from the web 3. Processing evidence - Facial Recognition vs AVID Media Composer 4. Social Media using the web to generate tips 5. Social Media digging to find evidence 6. Electronic Disclosure 7. What we would do differently? June 15, 2011 Game 7 Stanley Cup Final Canucks vs Bruins 150,000 people in downtown core Young, male population High levels of alcohol consumption Operational Track 2

3 Damages 112 Businesses damaged or destroyed 122 Vehicles were damaged or destroyed 93 Civilian vehicles; 5 Business vehicles; and 24 Emergency vehicles (Police, Fire, and Ambulance) Damages Businesses: $2,715, (does not include lost time, wages, counseling) Civilians: $537, Police and Fire Department vehicles $136, Operational Track 3

4 Video.. This video contains evidence from an ongoing criminal investigation. Reproduction, redistribution or rebroadcast is strictly prohibited. Caution: Some may find these images disturbing. Integrated Riot Investigation Team Lower Mainland = 16 Municipalities, Population 2.6 Million Operational Track 4

5 Integrated Riot Investigation Team Major Case Management Approach 8 Police Agencies Vancouver Police Department Delta Police Department New Westminster Police Department Port Moody Police Department South Coast British Columbia Transportation Authority Police Service (aka Transit Police) West Vancouver Police Department Abbotsford Police Department Royal Canadian Mounted Police (10 Municipalities) Integrated Riot Investigation Team Operational Track 5

6 Charge Approval in BC British Columbia is the only Canadian Province in which Police do not lay charges.. Police Recommend Charges >> Crown Prosecutors Approve Charges There is a higher standard for charge approval than elsewhere. We work with a team of dedicated Crown Prosecutors. Social Media Let someone else do the work for you.. Operational Track 6

7 The Way It Was in 94 Before common internet, video cameras, etc Suspect photos available six months after riot and for only limited amount of time All media photos/videos were seized with warrants No public submissions Access through video terminals in stores/malls only No one turned themselves in The Way It Is in 2011 Operational Track 7

8 Social Media Justice Started occurring within hours people outed as riot participants named on social media sites Photos and videos of perpetrators appeared in real-time on Tumblr, Flickr and other photo blogging sites VPD had to discourage vigilantism against outed rioters ID The Rioter Sites Pop Up Facebook Vancouver Riot Pics: Post your photos 101,614 likes Facebook Canucks fans against the 2011 riots - 73,367 likes Operational Track 8

9 Overnight Many people submitting photos and links via Twitter and Tweeted we d have more info for submitting photos in the morning I.T. Section scrambled to set up a process and address Following days saw almost 5,000+ s sent with photos, links, naming suspects and thank-you s Stats - 1 Week Post-Riot 53 with videos attached 676 with links to YouTube 708 with images attached 1,011 with hyperlinks to other social media sites other than YouTube (mostly Facebook) 344 s contain only text 280 Crime Stoppers tips recei ed 280 Crime Stoppers tips received 900 additional s received by the VPD Public Affairs Operational Track 9

10 Video Evidence Open-Source Video and photographs from open-source are not always accepted in court as evidence. Problem = photographer is unknown, cannot verify authenticity of evidence YouTube, Facebook, recorded TV broadcasts, Flickr, images copied from news sites, etc. Video Evidence Open-Source Videos Posted on YouTube, Facebook, Vimeo, etc Captured daily (non-stop) Comments reviewed for potential suspects Categorized by posting user, riot events, named suspect Named Suspects - may be difficult to contact or identify the tipster, so no court-admissible statement Operational Track 10

11 Facebook and Photo websites Captured and reviewed daily (non-stop) Comments reviewed for potential suspects Photos and screen captures categorized by posting user, riot event, named suspect Named Suspects - may be difficult to contact or identify the tipster, so no court-admissible statement Capture Strategy We captured all open-source (Facebook, Twitter, etc) manually as screen captures In hindsight: consider open-source data mining applications such as TwInbox (simplistic) or Bright Planet ( Operational Track 11

12 s and Crimestopper Tips Links to online videos / photos were captured s categorized by named suspect, events, sender Suspects turning themselves in Starting the day after the riot (June 16, 2011) Suspect is confessing, but we do not yet have any idea who they are or what they have done Reverse interview Some would minimize their involvement and confess only to the offenses seen on TV, YouTube, etc Operational Track 12

13 Video Evidence Sourced Video and photographs from photographer / videographer, with a written statement verifying the authenticity of evidence. Many open-source videos on YouTube were subsequently sourced as the videographer was identified. s responded to obtain original evidence. Video Evidence Sourced Hours of video = or raw, unedited video (includes CCTV) Total number of movie clips provided = 5,619 Total number of images = 28, video formats, many proprietary formats 30 TB of data (equivalent to 7,500 DVD s or 45,000 CD s) Sourced video can authenticate open-source video if it depicts the same incident. Operational Track 13

14 With this volume of evidence, how do you identify and track suspects? Facial Recognition? AVID Media Composer? Facial Recognition Operational Track 14

15 Facial Recognition Biometric Data - analyzing fixed facial characteristics such as the size/location of cheekbones and the distance between eyes, facial-recognition technology is able to extract the finite details of a person's face. Cross-reference the results with a database of photos, which can include drivers licences, health cards, passports, etc. Facial Recognition Automated requires consistency in lighting, image backgrounds, camera angles. Manual extremely time-consuming to mark fixed points on images; requires high level of training and high quality images Operational Track 15

16 Facial Recognition Riot investigation - Do not have consistency in lighting, photo background, camera angles, etc; - Image / video of varying quality - Many suspects are masked or disguised Would any other investigation be any different? Operational Track 16

17 Facial Recognition June 17, Announced by the Premier s Office that ICBC will offer facial-recognition technology to Vancouver police s riot investigation If there is a match in our system then we can advise that we ve found a match and then the next process is the court order before we can go into more detail. - ICBC Facial Recognition June 20 BC Civil Liberties Association raises objection That database was brought in under the justification of ID theft and fraud and to use it to simply assist in identifying people in public spaces adds a whole new level of pervasive surveillance to our culture and our society. Michael VONN, BC Civil Liberties Association Operational Track 17

18 Facial Recognition July 22, 2011 BC Privacy Commissioner Elizabeth Denham confirmed Friday she has launched an investigation into whether provincial privacy law is being followed as the Insurance Corp. of British Columbia works with authorities in the massive task of pinpointing those criminally responsible. But. VPD never accepted the ICBC offer to use their facial recognition technology. February 17, 2012 Facial Recognition The use of technology outside of ICBC violates provincial privacy laws and raises important questions about the use of sensitive biometric data. - Elizabeth Denham Operational Track 18

19 Facial Recognition In 2006 Google acquired Neven Vision, who had developed technology to search for features within photos such as people or buildings. In 2008 this technology was included d with a new launch of Picasa. Operational Track 19

20 Facial Recognition Picasa continually scans your directories for images and attempts to match faces to those you have already identified. Facial Recognition Our face-matching technology works best when a person is looking at the camera. There are a variety of factors that may limit our success in matching faces, including profile views and challenging lighting conditions like shadows. - Mike Horowitz, Google s Picasa Product Manager Is this going to stand up in court? Operational Track 20

21 Facial Recognition Technology is not the appropriate tool, and the corresponding database of confirmed ID photos is not available for police use. So what do we use instead. AVID Media Composer ( The AVID ) Operational Track 21

22 AVID Media Composer Non-linear (digital) editing tool. AVID will ingest multiple video formats and allow conversion / export to a commonly viewable format. The Avid Media Composer Bin environment provides for a dynamic and custom configurable visual evidence management and search engine = metadata. AVID Media Composer IRIT partnered with the Law Enforcement and Emergency Services Video Association (LEVA) to analyze and process this data LEVA Lab in Indianapolis operated almost 24 hrs/day for 2 weeks, with close to 60 analysts and investigators Operational Track 22

23 Meta-Data = Tags - All video / photos are tagged, similar to tagging a photo in Facebook - Tags are added when crimes are observed, or when a suspect known to commit crimes in other video / photo sources - Currently have close to 88,000 tags in riot evidence What information is included in Tags? - Exhibit details are included for evidence purposes - Successful searches are dependent on the input values - The Integrated Riot Investigation Team and LEVA have designed a broadly based description protocol to assist in the tagging of suspects based on physical description, clothing and weapons. - In order to keep this process simple and effective, color coding and non-specific descriptions will be used. Operational Track 23

24 Tags = Meta-Data Colour: 01 = Light or White 02 = Dark or Black 03 = Blue 04 = Red/Orange 05 = Green 06 = Yellow/Gold 07 = Purple 08 = Multi-coloured 09 = Grey Lower Garments XX denotes the colour (see above for codes) XXSHORT = (colour) shorts of any kind XXLONG = (colour) long pants of any kind XXSKIRT = (colour) skirt Hair color/style XX denotes the colour (see above for codes) XXLONG XXSHORT 00BALD (also to be used for shaved or balding) Tags = Meta-Data UPPER GARMENT XX denotes the colour XX?HOCK** = Hockey Shirt? denotes the logo ** denotes the number XXSS = (color) and Short Sleeve upper garment XXLS = (color) and Long Sleeve upper garment XXNS = (colour) and no sleeves XXDRESS = (colour) wearing dress XXHOOD = (colour) Hoodie XXZIPP = (colour) Zipper top 00NONE = no shirt Example 01RHOCK01 = White Luongo Jersey with the Rink logo S Skate R Rink O Orca V Old 70 s V shirts J Johnny Canuck X Any other jersey 01 Luongo 03 Bieksa 06 Salo 10 Bure 14 Burrows 17 Kesler 19 Naslund 21 Raymond 22 D Sedin 33 H Sedin 55 Jovanoski Operational Track 24

25 Tags Upper Garment Recording Device (cell phone, camera, etc) Lower Garment Body Marks Gender Weapon/ Tool Hair Facial Hair Events Head Gear Suspect Name Foot Wear Suspect Number Bag Comments (anything else useful) UPPER GARMENT = 03OHOCK14 LOWER GARMENT = 03LONG HEAD GEAR = HAT or 01HAT or 03HAT GENDER = M FOOT WARE = 01SHOES Comments = Seattle, mask, S hat HAIR = FACIAL HAIR = BAG = WEAPON/TOOL = RECORDING DEVICE = BODY MARKS = Operational Track 25

26 Operational Track 26

27 Operational Track 27

28 Tagging Video for Other Investigations Clothing descriptions Accessories (man-purse?) Names? Associates? Vehicles? Social Media Using Social Media to generate investigative tips.. Operational Track 28

29 VPD Riot Website August 30, Launch of riot2011.vpd.ca website interactive website to identify riot suspects 40 photos at a time to manage information flow and tips coming in Received 2,200 hits/hour and 50 new tips within first hours of operation Tipster has option of providing name and contact t details for follow-up statement Operational Track 29

30 Operational Track 30

31 VPD Riot Website Sept visits to riot2011 vpd ca 100,000+ visits to riot2011.vpd.ca Investigators are confirming names for nine of the 40 suspects featured on the website Six people have turned themselves in Over 225 tips have been received Operational Track 31

32 VPD Riot Website V2.0 Launched in January 2012 Video capability Hundreds of new photos VPD Riot Website V million total visits 2.3 million total visits 14 million images viewed 134,600+ unique visitors 2,313 tips received (as of May 19, 2013) Operational Track 32

33 Social Media Using Social Media to identify suspects and witnesses.. Social Media Investigations Needs Identify and locate videographers / photographers Confirm suspect identification Develop background on suspects Operational Track 33

34 Strategies People are creatures of habit Names used online are consistent across multiple sites. YouTube, Facebook, Google, Craigslist, Kijiji Seach for names, phone numbers, etc Find this person. Operational Track 34

35 YouTube user The Djegovsky (not their real name) No Driver s License No police records How we did it Extensive Google searches found a blog under the name Djegovsky Blog referenced a Facebook Group (20-30 members) One member of Facebook Group had riot photos in profile Operational Track 35

36 Possibly their real name? No Driver s License No police records Other pictures showed their apartment, and the view from their window. Find this person. Operational Track 36

37 YouTube user mz0 (not their real name) How we did it mz0 is also used as a twitter name, for a user currently in Vancouver Operational Track 37

38 Regularly check the Twitter account and one night this picture was posted.. Name appears on movie ticket. Google search finds he is in Vancouver but originally from Winnipeg Winnipeg police assist investigators in contacting him. Find this person. This person went into The Bay, Chapters, and Sears Filmed his exploits and posted on YouTube Did not cause damage or take property, but other followed after he went inside. Operational Track 38

39 YouTube user antonehmac (not their real name) No Driver s License No police records How we did it YouTube also references a video for his DJ name DJ XRoot DJ XRoot is referenced on a Facebook page for Antony Root (still not his real name) Does give us more background info Operational Track 39

40 How we did it Further digging for Antoneh and DJ XRoot finds another webpage Now we have real name! How we did it Information in resume matches that on Facebook profile, and gave us an This name does exist in VPD records Operational Track 40

41 Find this person. Witness Website has contact form but no actual contact information Web page code has no information either Operational Track 41

42 Every registered web domain must have contact information provided. Who Is lookup Web registration included name, home address, home phone, . She has now changed the contact information. Operational Track 42

43 Confirm Suspect Name Anonymous webtips received provided a name for riot suspect spect IRIT Note tattoos on arm Suspect name does exist in police records as owning a white Ford Mustang No criminal record, no documented tattoos Confirm Suspect Name Found online gallery under same suspect name photos show same tattoos and white Ford Mustang License Plate is shown in some photos and matches Operational Track 43

44 Riot Suspect #1 This person started the assault on Good Samaritan protecting The Bay 14 others joined in and victim was eventually sprayed with bear spray Tips led us to Winnipeg (Manitoba) Only one witness with recent dealings, who met him once and exchanged text messages Riot Suspect #1 Search of phone number on Kijiji jj finds ad For Rent by Owner Neighbors provide statements Charges were Charges were approved, has now pled guilty Operational Track 44

45 Electronic Disclosure Electronic Disclosure Video evidence is digital... Disclosure must also be digital Operational Track 45

46 Electronic Disclosure Full Electronic Disclosure - RTCC delivered on DVD - Adobe pdf with hyperlinked attachments, video etc Electronic Disclosure Operational Track 46

47 Video: Electronic Disclosure - Subclips (target specific) - Master Clips (correspond to above subclips) - Full Videographer packages The concept of full disclosure is evolving. What would we do differently? Operational Track 47

48 - Tag locations More tags Requests for contextual video for 600 Block of Granville Street to prove the occurrence of a riot. Suspects Charged Charges Recommended against 325 rioters Charges Approved against 221 rioters Approximately 160 guilty pleas so far 1086 Charges Recommended 678 Charges Approved *as of May 16, 2013 Operational Track 48

49 Profile men / 38 women - average age is 21 years - Youngest male is 15, youngest female is 14 - Oldest male is 52, oldest female is 30 - Most charges against one person is adults, 76 youth *as of May 16, 2013 City of Residence 61 Vancouver 11 Delta 2 Port Moody 59 Surrey 38 Burnaby 22 Richmond 22 North Vancouver 15 Vancouver Island 14 Langley 13 Coquitlam 12 Maple Ridge 9 BC Interior 8 Abbotsford 7 New Westminster 6 Alberta 4 Port Coquitlam 4 Mission 2 Chilliwack 2 Pitt Meadows y 2 Washington State 81% are from outside Vancouver * As of April 22, 2013 Operational Track 49

50 Extreme cases - 45 year old male at time of riot - 17 year old female - 64 previous criminal convictions, - No previous police background including manslaughter in good grades in secondary - At riot he smashed windows at BMO, Suzette s café, and flipped school and attending university on a soccer scholarship a Smart Car as well as assaulted - At riot kicked a marked police several people car that was later set on fire - Sentenced to 20 months - Charges submitted to crown but not approved QUESTIONS COMMENTS A/SGT Caedmon Nash (caedmon.nash@vpd.ca) Grant Fredericks (grant@forensicvideoexpert.com) Integrated Riot Investigation Team or riot@vpd.ca Operational Track 50