IPPC Technologies 

Focus on Spotlight

by Brian J. Kelly - Supervisory Cyber Analyst

Spotlight is a data analysis service provided by IPPC Technologies that uses a combination of artificial intelligence (AI) technologies and human verification to validate content captured and flagged by IPPC’s monitoring solutions. Spotlight’s mission is to provide agencies and officers with streamlined and verified leads, for possible intervention opportunities related to concerning behaviors. Spotlight does not provide a “deep dive” review, nor does it remove the need for officers to review data, but rather gives them a respite from the volume that can exhaust even the most seasoned and focused officer. Spotlight is being overseen by Brian J. Kelly, Supervisory Cyber Analyst, a retired Senior US Probation Officer - Cyber Crime Specialist (New York-Eastern), Certified Cyber Crime Investigator (NW3C), and Certified Cyber Crime Intelligence Analyst (NW3C). His full background and experience as well as his recent articles for IPPC can be found at www.uspokelly.com. Spotlight Analysts possess education, training and law enforcement/industry-recognized certification(s) showing proficiency in how computers and the Internet work, computer & Internet management/monitoring in a community corrections setting, cybercrime investigations, digital forensics, mental health/sex offender treatment, etc. Several of the current Spotlight Analysts have earned the Certified Cyber Crime Investigator (3CI) certification from NW3C. The Spotlight team also provides internal feedback to IPPC technical staff to improve the overall functionality of IPPC's monitoring solutions. IPPC believes Spotlight can assists agencies and officers with risk control, investigations, and also strengthens the ability for officers to use computer & Internet monitoring data as an early intervention/treatment tool. 

A recent analysis of the Spotlight service metrics showed that over a 30 day period, Spotlight Analysts reviewed a total amount of over 909,000 events. Of those 909,000+ events, Spotlight Analysts validated an average of 1.45% of events as concerning/relevant. 

Agencies enrolled in the Spotlight program will receive two reports per case from Spotlight:

Spotlight Daily Summary: End of day report generated automatically and emailed to case officer containing all events validated for each affiliated case.

Spotlight Alert (see Alert Criteria): When a Spotlight Analyst validates an event AND determines the agency/officer requires immediate notification. A Spotlight Alert report is emailed to the case officer within one hour of validation.

*Spotlight reports are not designed and not recommended for use in court proceedings.*

When a Spotlight Analyst assesses and validates an event that the agency will be notified of, the analyst will select one or more checkboxes of descriptors that will accompany the notification. Below are the current Spotlight checkbox descriptors and definitions for guidance:

NUDITY: Content contains partial and/or fully nude individual(s). May or may not be sexually explicit or intended to be arousing.
EXPLICIT LANGUAGE/THREATS: Content contains language, composed by the person under supervision or other individual he/she is interacting with, that indicates sexually explicit or threatening terms and context.
WEAPONS: Content displays or discusses weapons (firearms, bladed weapons, explosives, etc.).
EROTIC: Content intended to be or can be viewed as sexually arousing.
CHILD PRESENT: Content contains individual(s) which appear to be under the age of 18. If the event is not concerning (e.g. is not/does not contain erotic, nudity, CSAM), limit to user-created content (e.g. photo taken with device camera).
IMAGE CONTAINS CSAM: Content is considered child sexual abuse material (minor engaging in sexually explicit conduct as per definitions contained in 18 USC 2256). 
TREATMENT-RELATED: Content contains information that suggests possible mental  health/drug treatment concern (i.e. drug use; attraction to minors; suicidal ideations, etc.).
POLITICAL EXTREMISM: Political content outside mainstream societal values and on the fringes of the ideological spectrum; extreme conspiracy theories.
CHILD EROTICA: Content that is sexually arousing to persons having a sexual interest in minors but that is not, in and of themselves, obscene or that do not necessarily depict minors in sexually explicit poses or positions. Includes but not limited to fantasy writings, letters, diaries, books, sexual aids, souvenirs, toys, costumes, drawings, cartoons and non-sexually explicit visual images.
SEE SIMILAR EVENTS: Content is identical/similar to other events occurring the same timeframe/date which may not be validated by Spotlight due to volume and redundancy.
SEE SAVED EVENTS IN NEXT GEN: Relevant events that the Spotlight Analyst has saved in the Next Gen interface, but were not flagged as High or Medium.
OTHER (see notes): Please see text box for information from the Spotlight Analyst. 
*PENDING* SUSPICIOUS FINANCIAL ACTIVITY: Financial statement and/or activity that is considered concerning/suspicious due to offense conduct, existing financial  conditions/restrictions, etc. 

As indicated above, if a Spotlight Analyst determines the agency/officer requires immediate notification regarding a specific event(s), the analyst can generate a Spotlight Alert. A Spotlight Alert report is emailed to the case officer within one hour of validation. Alerts are based on specific internal criteria and subject to change. Spotlight Analysts must properly assess any event and have preponderance of evidence that the person under supervision purposefully accessed/created the content configured for alert. The current criteria for alert is as follows:

1. Child sexual abuse material (CSAM) as defined in 18 USC 2256.
2. Localized risk of child abuse/exploitation.
3. Child erotica when other factors present (e.g. multiple images; intermingled with pornography; off-hours activity) indicating content is being used for sexual gratification.
4. Risk/threats of violence towards case officer, other law enforcement or government entity.
5. Risk/threats of violence towards another individual or self.
6. Risk of suicidal intentions (considering timeliness of risk) or other severe mental health crisis. 
7. Possession of firearms, ammunition, destructive device, or other dangerous weapon, as defined in 18 USC 921.
8. Evidence of new law violation.
9. Evidence of high risk computer/Internet monitoring program violation (e.g.: possession/use of unauthorized device; blatant tampering/circumventing monitoring software or restrictions).
10. Direct evidence of a violation of a special condition. (Spotlight Analyst must have copy of pretrial release conditions/sentencing order/judgment).

IPPC has received positive feedback from officers who have used Spotlight’s output to address non-compliance and other behavioral issues with individuals under supervision. Officers have confirmed positive changes in the behavior of individuals under their supervision following discussions about the content validated by Spotlight, confirming the service is functioning as a successful proactive solution.

Existing clients using Spotlight can give feedback on the service by taking the Spotlight Performance Survey by clicking https://forms.office.com/r/K9JpsNjKHE

New and existing clients using Spotlight can participate in a monthly (typically first Tuesday of each month) Spotlight Feedback Group virtual meeting to obtain a brief overview of the service, current updates and trends, and have the opportunity to pose any questions or comments to the Spotlight team. If you are interested in participating, please email Brian Kelly for more information.

IPPC Technologies continues to strive towards predictive and proactive solutions so officers can intervene early, address areas of concern and change behavior. For more information on Spotlight, please call IPPC at (888)-WEB-IPPC or contact me directly at bkelly@ippctech.net or by calling (516)341-4201.