!"# %&'(&!))'"*+,!))(&- !" .

%/0 12&3
!"# %&'(&!))'"*+,!))(&- !" .%/0 12&3




"#$$%&' () *+, %-. *+/ 0(12&%345 6-%5'789:










";/<
= >97(?4& ;@=;

!"#$%&$ (#)"*+%$("#,

!"# %&'(&!))'"*+,!))(&- !" .%/0 12&3
!"# %&'(&!))'"*+,!))(&- !" .%/0 12&3
4
2%?54 () 0(-74-7:

!"#$% '( )'*+%*+, ------------------------------------------------------------- .
/*+0'123+4'* ----------------------------------------------------------------- 5
/,,2%, "*1 62%,+4'*, ---------------------------------------------------------- 5
7*"$8+43, -------------------------------------------------------------------- 9
):7;<=>? ------------------------------------------------------------------- 9
@A@ )'B!0"C%$ 7*"$8+43 --------------------------------------------------------- D
E%',F"+4"$ 7*"$8,4, !0"1%30"(+ )%*+%0 GE7!)H IFF'0+2*4+8 J'$2K% 7*"$8+43 ------------- L
!M/ )'B!0"C%$%0 7*"$8+43 --------------------------------------- N
)'B!0"C%$%0 7*"$8+43, ---------------------------------------------------- Q
R7)! ?E7B?A7 E7!) 7*"$8+43 --------------------------------------------------- Q
OD AIO!/?E;P7@ )'B!0"C%$%0 7*"$8+43 ------------------------------------------- ST
O!BOE A41%U43U, ------------------------------------------------------------- S.
A3"$"#$% 7*"$8+43, !0"1%30"(+ )%*+%0 GA7!)H E%',F"+4"$ ;4(%$4*%, )'B!0"C%$ 6=@ ---------- S5
AAE )'KK'* /MA/, 7*"$8+43 --------------------------------------------------- S5
!"0V%+ 7*"$8,4, )%*+%0 G!7)HW)"(XW !0"C%$ "*1 M'#4$4+8 7*"$8,4, )%*+%0 G!M7)H @?/ )'B!0"C%$
7*"$8+43 -------------------------------------------------------------------- SY
!7)W)"(XW!M7) @?O )'B!0"C%$%0 7*"$8+43 --------------------------------------- S9
@?O )'B!0"C%$%0 M"*2"$ 7*"$8,4, ----------------------------------------------- SD
A2KK"08 ------------------------------------------------------------------- SL
73U*'Z$%1VK%*+, ----------------------------------------------------------- SN
A2KK"08 !"#$% '( )'B!0"C%$ 7*"$8+43, ------------------------------------------- SQ


1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
3
/-7&(.#978(-

(S//8LL 1C uSA, lvL?) 1hls shorL-Lerm sLudy overvlews and documenLs key elemenLs of Lhe co-Lraveler
analyLlcs boLh under developmenL and operaLlonal aL nSA. Lach secLlon lncludes a brlef descrlpLlon of
Lhe analyLlc, lLs sLaLus, source daLa, and caveaLs.
(S//8LL 1C uSA, lvL?) Whlle each analyLlc was deslgned Lo operaLe on a parLlcular Lype of daLa or a
parLlcular daLa formaL, many can llkely be scaled Lo operaLe on oLher daLa sources. lor lnsLance,
analyLlcs deslgned for un8 CClu or vL8 daLa mlghL also apply Lo unl CeolocaLlon daLa.
!"##$%& () *"+, -.%/0 (12 3456277 58 956:;2<=><? =1272 @<@AB=>67 4@>729 @ 724>27 58 >;354=@<= >77:27
=1@= <5= 5<AB 9>7=><?:>71 =12 @<@AB=>67 845; 2@61 5=124, C:= ;542 >;354=@<=AB, 71@32 =12 A@<976@32
=1@= D2 ;:7= 65<7>924 >< ;5E><? 854D@49 =5 ;22= =12 @<@AB=>6 <2297 @= F"+G Some of Lhese lssues are
dlscussed ln Lhe nexL secLlon.
/::#4: %-. A#4:78(-:

!"#$%& ( )#*+,(-.% (/(%0+1) )#/21&., 3".,. ( 4567 #, 89: 12 ;"021)(%%0 %#)(+.&<
! Many CSM analyLlcs use CClu lnformaLlon Lo ldenLlfy co-Lravelers. lf Lwo selecLors are seen
aL Lhe same CClu around Lhe same Llme, Lhey are consldered co-Lravel candldaLes. 1he
analyLlc does noL need Lo know where Lhe CClu ls physlcally locaLed. Powever, lf Lhe
lndlvlduals are uslng dlfferenL neLwork provlders (e.g., 1-Moblle and verlzon), Lhey may be
physlcally sLandlng nexL Lo each oLher as Lhelr moblles reglsLer wlLh dlfferenL cell Lowers.
Co-Lravel analyLlcs LhaL do noL conslder Lhe physlcal geo-locaLlons of Lhe Lowers wlll noL
dlscover lndlvlduals LhaL are co-Lravellng on dlfferenL neLworks.
! AnalyLlcs LhaL make use of polnL daLa (e.g., 1huraya) necessarlly need Lo conslder
geolocaLlonal daLa ln order Lo deLermlne dlsLance from one polnL Lo anoLher.
!"#$%& 1/)1&./+(% )#*+,(-.%.,2 =. )#/21&.,.&<
! 1here ls a dlfference beLween lncldenLal co-Lravel due Lo collecLlve movemenL (lndlvlduals
wlLh slmllar Lravel behavlors buL no oLher slmllarlLles) and funcLlonal group-based co-Lravel
among lndlvlduals wlLh behavlorally relevanL relaLlonshlps. C1CCÞ makes Lhls deflnlLlon
expllclL, buL warns LhaL we mlghL noL wanL Lo exclude seemlngly lncldenLal co-Lravelers
slmply because we are unaware of Lhelr relaLlonshlp.
! CLher facLors, such as conLacL chalns and LargeL CCMSLC behavlors (frequenL power-down,
handseL swapplng, SMS behavlor), mlghL asslsL ln deLermlnlng wheLher co-Lravelers are
assoclaLed Lhrough Lhelr Lravel behavlors alone or Lhrough behavlorally relevanL
relaLlonshlps.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
4
!"#$%& >.#>,(;"0 ;%(0 ( ,#%. 1/ )#*+,(-.%<
! 8ecause lL ls dlfflculL Lo know where a CSM LargeL ls locaLed wlLhln a CClu or vL8, many of
Lhe CSM co-Lravel analyLlcs use Lhe maLhemaLlcal cenLral polnL ln Lhe vL8 or CClu as a
reference polnL. We could posLulaLe LhaL Lravellng LargeLs wlll be locaLed along roads, Lraln
Lracks, or fooLpaLhs where neLwork servlce exlsLs. 1hls Lype of geographlcal lnformaLlon
could LheoreLlcally be used Lo lnform a co-Lraveler analyLlc ln ldenLlfylng candldaLes
(especlally Lhose LhaL are Lravellng vla Lhe same means of LransporLaLlon). Ceographlcal
information might also be used to “fill in the gaps” when data is missing beLween locaLlons
LhaL a LargeL vlslLed.
! AnalyLlcs ln this study that make use of such geographical information include DSD’s Co-
travel analytic and the Geospatial Analysis Tradecraft Center’s (GATC’s) CpporLunlLy volume
analyLlc.
!"#$%& &.-1). (/& )#%%.)+1#/ 2(?;%1/> ;%(0 ( ,#%. 1/ &.+.,?1/1/> )#*+,(-.%.,2<
! We may collecL hundreds of evenLs from one target’s moblle phone whlle collecLlng only a
few evenLs from hls co-traveler’s moblle phone. 1he number of evenLs collecLed may be due
Lo collecLlon blas, dlfferences ln neLwork servlce, and/or LargeL CCMSLC behavlor. AnalyLlcs
should Lake Lhese conslderaLlons lnLo accounL when aLLempLlng Lo ldenLlfy co-Lravelers.
!"#$%& )#*+,(-.%.,2 2../ 1/ &1@@.,./+ 2#$,). &(+(=(2.2 =. )#/21&.,.&<
! Depending on a target’s preferred communication behaviors, some co-Lravelers may be
seen largely ln un8 CSM daLa, and oLher co-Lravelers may be seen largely ln unl daLa. We
may be able Lo construct a more complete picture of a target’s locations over time if we
comblne un8 and unl daLa sources. lL mlghL be worLh conslderlng Lhe degree Lo whlch
conslderlng mulLlple daLa sources wlll slgnlflcanLly lncrease Lhe number of false poslLlves.
! uaLabases LhaL do noL conLaln geolocaLlon lnformaLlon mlghL also be consldered. lor
lnsLance, alr Lravelers on Lhe same reservaLlon number are probably co-Lravellng on Lhe
same fllghL. users sharlng a MAC address are probably co-locaLed uslng Lhe same devlce
even Lhough we may noL know where LhaL devlce ls locaLed. ConslsLenL observaLlons of
devlces wlLhln Lhe same LAlC may provlde evldence of co-locaLlon, even if the LAIC’s
physlcal servlce area ls unknown. llnally, slmllarlLles beLween lÞ addresses may lndlcaLe
proxlmlLy on Lhe same LAn, even lf Lhe physlcal locaLlon of Lhe LAn nodes ls unknown.
! 1he one analyLlc ln Lhls sLudy LhaL aLLempLs Lo comblne mulLlple sources of lnformaLlon Lo
build a more holistic picture of a target’s travel pattern is the 1AC/Cafe/1MAC Co-Lravel
analyLlc.
5(/ )#*+,(-.% =. )#/21&.,.& ( 2.,1.2 #@ ?..+1/>2<
! We aLLempLed Lo llmlL Lhls sLudy Lo LargeLs co-Lravellng Lhrough Lwo or more locaLlons
wlLhln an analysL-speclfled Llme and space wlndow. lf Lhose locaLlons are deflned, however,
we mlghL conslder co-travel as a series of “meetings” at known locations. AnalyLlcs LhaL
deLecL co-locaLlon may be dlfferenL ln naLure from Lhose LhaL deLecL co-Lravel. 1he speclflc
analyLlc need wlll deflne whlch of Lhese approaches ls more approprlaLe and efflclenL.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
3
! ln Lhls sLudy, examples of meeLlng analyLlcs LhaL deLecL lnsLances of co-locaLlon lnclude Lhe
CA1C CpporLunlLy volume AnalyLlc and Lhe MeeL&CreeL SpaLlal Chalnlng AnalyLlc.
6-%5'789:
0B6CDEF+

A()B>,#$/&
(TS//SI/REL TO USA, FVEY) Chalkfun’s Co-1ravel analyLlc compuLes Lhe daLe, Llme, and neLwork locaLlon
of a moblle phone over a glven Llme perlod, and Lhen looks for oLher moblle phones LhaL were seen ln
Lhe same neLwork locaLlons around a one hour Llme wlndow. When a selecLor was seen aL Lhe same
locaLlon (e.g., vL8) durlng Lhe Llme wlndow, Lhe algorlLhm wlll reduce processlng Llme by chooslng a few
evenLs Lo maLch over Lhe Llme perlod. Chalkfun ls SÞCMA enabled
1
.
(S//Sl/8LL 1C uSA, lvL?) noLe: As of 6 SepLember 2012, Lhe evenLs LhaL are chosen depend on Lhe
“sampling method” chosen by Lhe analysL (mosL acLlve, mosL per day, flrsL/lasL/mosL, or
first/last/spread). The “sampling rate” specifies how many events are chosen to match. As Chalkfun
moves Lo Lhe cloud, Lhls opLlon wlll be dlsconLlnued.
(1S//Sl/8LL 1C uSA, lvL?) 1he cloud-based verslon of Chalkfun (see 86 SC81lnCLLAu Co-Lraveler
AnalyLlc secLlon), whlch may be released as early as SepLember 2012, wlll have a number of addlLlonal
feaLures and opLlons:
 1he sysLem wlll run one query (raLher Lhan separaLe querles) for all of Lhe lMSls, MSlSuns, vL8s,
and CClus LhaL an analysL enLers (as lf Lhe selecLors and areas of lnLeresL were [olned wlLh an
“OR”). The system currently runs separate queries for each, returning separate sets of results for
each comblnaLlon of selecLor and areas of lnLeresL. 1he cloud-based verslon wlll also enable Lhe
user Lo seL Lhe slze of Lhe Llme wlndow LhaL Lhe analyLlc conslders, raLher Lhan defaulLlng Lo one
hour (as descrlbed above).
 1he user wlll be able Lo choose Lhe counLrles or locaLlons of lnLeresL. 8lackllsL and whlLellsL
feaLures wlll enable Lhe user Lo lnsLrucL Lhe sysLem Lo lgnore acLlvlLy wlLhln a reglon, or resLrlcL
analysls Lo speclfled reglons of lnLeresL (e.g., lgnore acLlvlLy ln or use only acLlvlLy from
)
 ln conslderlng poLenLlal co-Lravelers, Lhe analysL wlll have Lhe opLlon Lo lgnore acLlvlLy ln whlch
Lhe LargeL ls ln hls home counLry

1
(S//Sl//8LL) SÞCMA enables Lhe analyLlc Lo chaln "from," "Lhrough," or "Lo" communlcaLlons meLadaLa flelds
wlLhouL regard Lo Lhe naLlonallLy or locaLlon of Lhe communlcanLs, and users may vlew Lhose same
communlcaLlons meLadaLa flelds ln an unmasked form.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
6
 1he analysL wlll be able Lo fllLer ln or ouL poLenLlal co-Lravelers wlLh speclfled preflxes (for
lnsLance, reLurn only moblles, remove all moblles, Lhem, or lnclude only moblles
LhaL are from Lhe same counLry as Lhe LargeL).
!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
- CperaLlonal, Avallable aL
analysLs deskLops
- Cloud verslon could be
avallable as early as SepLember
2012.

- All lASClA daLa conLalnlng vL8
and CClu lnformaLlon
- CurrenL verslon ls noL cloud-
based and can have long
processlng Llmes, however
cloud-based soluLlon ls
lmmlnenL.
- AnalyLlc wlll only reLurn co-
Lravelers on Lhe same provlder
neLwork
*"* 0(12&%345 6-%5'789

A()B>,#$/&
(S//Sl/8LL 1C uSA, lvL?) 1he uSu Co-1ravel analyLlc predlcLs LargeL locaLlons and co-Lravelers by
calculaLlng Llme-based Lravel Lra[ecLorles. Þrobable Lravel rouLes are calculaLed uslng observed locaLlons
and deLermlnlng Lhe mosL llkely paLhs and Lravel Llmes slmllar Lo LhaL used ln Lurn-by-Lurn navlgaLlon
sysLems. 1hese LargeL Lravel paLhs are represenLed as a serles of LA1/LCnC waypolnLs or llne segmenLs
along Lhe probable Lravel rouLes, such as roads. 1he Lravel paLhs are dlvlded lnLo segmenLs (e.g. 20 Lo
30km along Lhe road). 1he analyLlc predlcLs Lhe approxlmaLe Llme LhaL Lhe LargeL would LheoreLlcally
arrlve aL each segmenL waypolnL based on pro[ecLed Lravel Llmes beLween known locaLlons. 1hen,
wlLhln Lhe Lravel wlndow, Lhe analyLlc dlscovers candldaLe co-Lravellers LhaL lnLersecL locaLlons along
Lhe buffered Lravel paLh. 1he nexL sLep ln Lhe analyLlc ls performed uslng lnLeracLlve 8enolr analysls of a
Lwo mode graph represenLlng Lhe rouLe segmenLs and selecLors observed on Lhese rouLe segmenLs
wlLhln Lhe Llme wlndows. Cnce Lhe daLa ls clean and candldaLe co-Lravellers are ldenLlfled deLalled
analysls can be done ln 8enolr or oLher Lools such as Ceo1lme lncorporaLlng oLher supporLlng daLa such
as communlcaLlons evenLs and conLenL.
(S//Sl/8LL 1C uSA, lvL?) 1he analyLlc currenLly runs on a neLezza-based archlLecLure, called PecLlc
Snare, LhaL rapldly execuLes MySCL-based Clus. 1hls archlLecLure enables lnLeracLlve exploraLory
analysls and rapld paLLern maLchlng. 1he analyLlc ls dlsLrlbuLable and could be lmplemenLed ln
Padoop/Map8educe or Accumulo.
(S//Sl/8LL 1C uSA, lvL?) 1hls analyLlc was LesLed uslng an LerrorlsL case sLudy. 1he case
sLudy used approxlmaLely 80,000 base sLaLlons locaLlons and 16 bllllon moblles locaLlon records for
Cu8s (Call deLall records) and lnfrasLrucLure collecL from u81 and !uggernauL sysLems. 1hls case sLudy
showed LhaL more candldaLe co-Lravellers were dlscovered by analyzlng Lhe Lravel paLhs Lhan by
conslderlng common meeLlng locaLlons alone.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
7
!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
+<@AB=>6 >;3A2;2<=29 @<9
=27=29 @= H"HG
- Moblle Cu8s and resldlng ln
neLezza-based archlLecLure.
- 8equlres neLezza (currenL
lmplemenLaLlon)
- 8equlres 8enolr

C$+$,. D#,B
(S//Sl/8LL 1C uSA, lvL?) uSu would llke Lo lnLegraLe key meeLlng locaLlons lnLo Lhls analyLlc, such as
safehouses. Þlans are also underway Lo ldenLlfy LargeLs based on CCMSLC behavlors such as ldenLlfylng
moblles LhaL are Lurned off rlghL before convergence beLween Lwo Lravel paLhs occurs.
G4(:H%78%5 6-%5':8: 2&%.49&%)7 04-74& IG620J >HH(&7#-87' K(5#$4
6-%5'789

A()B>,#$/&
(1S//Sl/8LL 1C uSA, lvL?) 1he opporLunlLy volume analyLlc deLermlnes wheLher Lwo enLlLles (e.g.
devlces) could have been co-locaLed by conslderlng Lhe posslblllLy of Lhelr Lravel paLhs lnLersecLlng. 1he
opporLunlLy volume analyLlc requlres palrs of evenL locaLlons and Llmes for each enLlLy, and compuLes
Lhe posslble locaLlons and Llmes ln whlch Lhe Lwo enLlLles could have been co-locaLed. lL does Lhls by
compuLlng posslble Lravel rouLe surfaces for each enLlLy beLween Lhe speclfled evenLs, uslng a Lravel
cosL surface compuLed from Lerraln, land cover, and road neLwork daLa. 1hese posslble Lravel rouLe
surfaces lnclude Lhe Lemporal dlmenslon (LhaL ls, Lhe perlod of Llme ln whlch Lhe enLlLy could have been
aL Lhe glven locaLlon), Lhe lnLersecLlon beLween Lhese mulLldlmenslonal surfaces represenLs Lhe places
and Llmes durlng whlch Lhe enLlLles could have been co-locaLed. 1he analyLlc was developed uslng CÞS
polnL evenL daLa, buL Lhe analyLlc acLually uses a 1-km grld for Lhe spaLlal resoluLlon and a 13-mlnuLe
perlod for Lhe Lemporal resoluLlon, so lL can be applled Lo any daLa LhaL can be expressed ln Lhese
Lerms.
!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
I45=5=B32 724E>62 >;3A2;2<=29
5< FJ+F2=G F5= B2= 354=29 =5
F"+F2=G
- Ceohashes of CÞS polnL evenL
daLa.

- 8equlres evenL locaLlons and
Llmes for every selecLor.
- ueslgned for 1 km grld-based
locaLlons and 13 mlnuLe Llme
lnLervals.
- Co-Lravel capablllLy would
requlre analysL Lo deflne a serles
of meeLlngs aL speclfled
locaLlons.

1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
8
C$+$,. D#,B
(1S//Sl/8LL 1C uSA, lvL?) 1he purpose of Lhls servlce ls Lo deLermlne wheLher Lwo enLlLles could have
been co-locaLed glven observed evenL locaLlons for Lhose enLlLles. 1o deLecL co-Lravel, Lhe analysL would
need Lo deflne a serles of meeLlng locaLlons and Llmes. 1he opporLunlLy volume analyLlc could also
provlde a mechanlsm for veLLlng co-Lravel analyLlcs by LesLlng for posslble co-locaLlon evenLs along co-
Lravel rouLes.
2L/ 0(12&%3454& 6-%5'789

A()B>,#$/&
(1S//Sl/8LL 1C uSA, lvL?) 1he 1rack MuLual lnformaLlon (1Ml) cloud analyLlc
was developed as a sLudy under Lhelr graph analyLlcs, alerLlng, and LargeL developmenL program. 1he
analyLlc ls orlenLed Lo work on 7 Lo 30 days worLh of reglonal collecLlon. lL has been LesLed on 81-8C
daLa from Lhe reglon. lnsLead of uslng CClu lnformaLlon as co-Lravel reference polnLs, Lhe
analyLlc works cross-network by computing target “closeness” based on Lhe CClu LaL/Long CLC
lnformaLlon and Llme. 1he LaL/Long lnformaLlon ls obLalned from 81-8C.
(1S//Sl/8LL 1C uSA, lvL?) 1he analyLlc sLarLs by compuLlng evenL sequences of LA1, LCnC, and Llme for
each selecLor. These are called “tracks”. lL Lhen compuLes a value LhaL measures how far Lhe selecLor
has Lraveled ln general. lf Lhe selecLor has noL Lraveled ouLslde a 20 Lo 30 km radlus, Lhe selecLor ls noL
consldered. Each eligible selector’s Lracks are palrwlse-compared Lo Lhe oLhers and a measure of
slmllarlLy ln Llme and space ls compuLed.
!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
K<>=>@A 92E2A53;2<= 65;3A2=29G
K< =27=><? 31@72, <5= B2=
5324@=>5<@A
- SorLlnglead summarles of
lASClA daLa on CM-ÞLACL and
CM-
- 81-8C reglonal CSM collecLlon

- AnalyLlc only conslders Lasked
selecLors as seeds.
- AnalyLlc does noL conslder
LargeLs LhaL do noL Lravel ouLslde
a 20 Lo 30 km radlus.
- 1rack daLaseL musL be
repopulaLed for each daLa
updaLe


C$+$,. D#,B
(1S//Sl/8LL 1C uSA, lvL?) would llke Lo reduce processlng by creaLlng an lndex conLalnlng selecLors
whose Lracks are near each oLher ln space. 1o achleve Lhls, fuLure work may make use of a CLCAddress
hashlng algorlLhm LhaL uses LA1/LCnC lnformaLlon Lo group cell Lowers lnLo clusLers LhaL are ln Lhe
same reglon. 1hls hash conslders laLlLude and longlLude only, and ls agnosLlc Lo Lhe targets’ servlce
provlder. lL may be posslble Lo also compare LargeL Lracks qulckly by comparlng Lhese CeoAddresses.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
9
0(12&%3454& 6-%5'789:

A()B>,#$/&
(1S//Sl/8LL 1C uSA, lvL?) has developed Lwo co-Lravel analyLlcs: lasL lollower (ll) and
MeeL&CreeL SpaLlal Chalnlng (MCSC). 1he ll analyLlc was lnlLlally deslgned Lo deLecL lndlvlduals who
are followlng sLaLlon personnel. ueLalled non-SlCln1 paLh daLa ls collecLed consensually on Lhe sLaLlon
personnel, and Lhls reference paLh daLa provldes Lhe seeds for Lhls analyLlc, whlch aLLempLs Lo dlscover
moblle CLC daLa lndlcaLlng lndlvlduals LhaL may be followlng Lhe sLaLlon personnel. 1he MCSC analyLlc
ls deslgned Lo deLecL meeLlngs beLween hlgh-value lndlvlduals and oLher enLlLles.

(1S//Sl/8LL 1C uSA, lvL?) 1he ll analyLlc beglns by conslderlng non-SlCln1 reference paLhs for sLaLlon
personnel based on deLalled knowledge of Lhe entity’s location. CandldaLe followers are deLermlned by
ldenLlfylng oLher lndlvlduals LhaL have Lraversed some number of consecuLlve polnLs (deLermlned by Lhe
analysL) LhaL maLch Lhe reference paLh ln space and Llme. 1he analysL also seLs a parameLer Lo speclfy
Lhe mlnlmum dlsLance LhaL musL be covered along a candldaLe paLh.

(S//Sl/8LL 1C uSA, lvL?) 1he MCSC analyLlc ls deslgned for LLkÞ8ln1S daLa from smarLphones. 1hls
analyLlc ldenLlfles sequences of consecuLlve locaLlon polnLs close ln Llme and comblnes Lhem lnLo a
slngle daLa polnL. A maxlmum veloclLy movemenL parameLer ls applled Lo creaLe a Llme wlndow around
each polnL represenLlng Lhe approxlmaLe Llme aL whlch Lhe lndlvldual was locaLed Lhere (as opposed Lo
Lravellng Lo or from LhaL locaLlon). llnally, co-Lravelers are ldenLlfled by dlscoverlng palrs of selecLors
LhaL meeL Lhe duraLlon and dlsLance Lhresholds seL by Lhe analysL as lnpuL parameLers. SpaLlal chalnlng
sofLware aggregaLes and presenLs Lhe meeLlng daLa, lncludlng Lhe locaLlons, Llmes, and scorlng meLrlcs
Lo Lhe analysL.
!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
1he MGSC ana|yt|cs has been
tested on rea| LLkÞkIN1S data,
but resu|ts have not been
va||dated by operat|ona|
ana|ysts.
1he II ana|yt|c has been tested
on made-up data.
- SmarLphone daLa from
LLkÞ8ln1S
- 8eference-paLh daLa (ll)
- LlsL of selecLors (MCSC)

- AnalyLlc deslgned for preclse
geolocaLlon daLa (e.g., from
smarLphones)
- MCSC analyLlc would requlre
Lhe analysL Lo deflne a serles of
meeLlngs

N602 +G61+"6 G620 6-%5'789


A()B>,#$/&
(1S//Sl/8LL 1C uSA, lvL?) 1he ÞAC1 analyLlc ls a [olnL nSA-nCA efforL Lo ldenLlfy co-Lravellng 1huraya
handseLs. 1he efforL was moLlvaLed by an lncrease ln 1huraya phone usage by
. SlCln1 CeospaLlal AnalysLs were able Lo characLerlze Lhe Lravel
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
10
behavlors of Lhe LargeLed 1huraya handseLs and ldenLlfylng oLher handseLs wlLh slmllar paLLerns. 1he
LargeLed handseLs were observed Lravellng beLween known governmenL and mlllLary
lnsLallaLlons, Lherefore, handseLs wlLh slmllar Lravel behavlors were lnferred Lo be governmenL
forces.
(1S//Sl/8LL 1C uSA, lvL?) 1he flrsL sLep of ÞAC1 ls Lo ldenLlfy a seL of waypolnLs for each LargeL handseL.
WaypolnLs are generaLed from sequences of evenLs LhaL clusLer LogeLher ln space and Llme. 1he second
sLep ls Lo ldenLlfy whlch palrs of handseLs conLaln slmllar waypolnL clusLers. Þalrs are scored based on
Lhe number of waypolnL clusLers LhaL maLch. 1hls analyLlc also conslders Lhe LoLal posslble number of
waypolnL clusLers for each selecLor, so LhaL Lhe LoLal number of communlcaLlon evenLs per selecLor ls
Laken lnLo conslderaLlon. 1hls process ls lnLended Lo reduce Lhe posslblllLy of produclng resulLs LhaL
lnclude lncldenLal co-Lravel. 1he Lhlrd sLep ln Lhls analyLlc ldenLlfles perslsLenL paLLerns by examlnlng Lhe
Llme perlods over whlch co-locaLlon occurs for each co-Lravel candldaLe palr.
!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
(27=29 5< .)KM%"+K& 9@=@ 845;
M*&(P%+.%G I@==24<7 7=5429 ><
Q-HG
K< 3456277 58 =4@<7>=>5<><? I+M(
=5 F"+#"RG
- 1huraya daLa from CuL1WLAvL
(~300 M waypolnLs ln
CuL1WLAvL)
- AnalyLlc deslgned for 1huraya
or oLher polnL daLa

C$+$,. D#,B
luLure work could lnvolve applylng Lhls analyLlc Lo oLher Lypes of Clu daLaseLs such as lnmarsaL and
CSM daLa. 1he Leam ls also lnLeresLed ln bulldlng on Lhls analyLlc Lo enable dlscovery of asynchronous
co-Lravellng relaLlonshlps.
,O ">,2/+GCM6* 0(12&%3454& 6-%5'789

A()B>,#$/&
(S//8LL 1C uSA, lvL?) 86 has been parLnerlng wlLh Chalkfun Lo upgrade Lhe Chalkfun co-Lraveler
analyLlc Lo a cloud-based analyLlc LhaL wlll run on Cloud 14 (Lo evenLually be mlgraLed Lo Mu8-2).

(1S//Sl/8LL 1C uSA, lvL?) 1he 86 co-Lraveler analyLlc accepLs a selecLor and Llmeframe as lnpuL, and
Lhen derlves an lLlnerary for Lhe selecLor LhaL lncludes Lhe CLLL lus and/or vL8s (dependlng on whaL ls
avallable). 1he lLlnerary ls based on a serles of waypolnLs generaLed from Lhe locaLlon lnformaLlon LhaL
ls avallable ln lASClA-PCS. Then, the analytic searches for other selectors that were “near” these
waypolnLs ln space and Llme. 1lme wlndows are conflgurable and can be ad[usLed by Lhe user. Lach
candldaLe ls scored and Lhen prlorlLlzed based on Lhe scores.

(1S//Sl/8LL 1C uSA, lvL?) 1he 86 co-Lraveler analyLlc operaLes on SorLlnglead LvenL Summarles and a
CLC lndex. 1he SorLlnglead LvenL Summarles provlde rapld access Lo lASClA ÞCS evenLs by summarlzlng
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
11
and enrlchlng key elemenLs of selecLor behavlor. 1he SorLlnglead LvenL Summarles beneflL Lhls analyLlc
because Lhey can provlde enrlched locaLlon lnformaLlon abouL selecLors LhaL ls noL presenL ln Lhe raw
meLadaLa. 1he CLC lndex conLalns a mapplng beLween Lhe locaLlons (CClus or vL8s) vlslLed by a
selecLor and Lhe Llme (day/mlnuLe) LhaL Lhe vlslL(s) occurred. lnformaLlon from command and conLrol
neLworks LhaL Lrack lLu aLLacks ls also used Lo enrlch Lhe CLC lndex.

(1S//Sl/8LL 1C uSA, lvL?) 1he resulLs LhaL can be reLurned from Lhls Lype of analyLlc can poLenLlally be
enormous. Lach candldaLe wlll have some level of Llme and space overlap wlLh Lhe seed. ÞrlorlLlzaLlon
occurs by assesslng Lhe quallLy of Lhe overlap ln Lerms of Llme and space closeness. 1he analysL may
choose Lo Lrlage any number of poLenLlal candldaLes (e.g. Lop 10 or Lop 100 candldaLes, or candldaLes
LhaL surpass a glven Lhreshold).

!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
O K< =27=><? 31@72 =5 C2
423A@62;2<= C@6SO2<9 854 =12
6:442<= 3459:6=>5< MT+&N-*F
65O=4@E2A24 =55A
O MA5:9OC@729 !L@3$29:620
>;3A2;2<=@=>5< :<924
92E2A53;2<= =5 1@<9A2 A@4?24
<:;C247 58 U:24>27
7>;:A=@<25:7AB
- lASClA ÞCS SorLlnglead
Summarles
- CPALklun enrlchmenL (vL8
counLry mapplng)
- AnalyLlc cannoL recover cross-
neLwork co-Lravelers
- AnalyLlc wlll noL be effecLlve
agalnsL sLaLlonary (non-Lravellng)
LargeLs
- Þrocesslng ls memory lnLenslve
- AnalyLlc ls senslLlve Lo large
cells, vL8s, and dense areas
- noL dlrecLly appllcable Lo saL
phones wlLh LA1/LCnC
lnformaLlon
- 8esulLs can be very senslLlve Lo
Llmeframe chosen as lnpuL. lor
lnsLance, analyLlc wlll noL be
effecLlve for large querles across
mulLlple counLrles and large Llme
frames (e.g., anywhere ln
over Lhe pasL year and Lhen
anywhere ln ).

C$+$,. D#,B
(1S//Sl/8LL 1C uSA, lvL?) 8ecause Lhe 86 co-Lraveler analyLlc depends on CClu and vL8 locaLlons as
meeLlng polnLs or waypolnLs, lL wlll noL reLurn selecLors LhaL co-Lravel on dlfferenL provlder neLworks.
(lor lnsLance, lL could noL reLurn a verlzon selecLor co-Lravellng wlLh a 1-Moblle selecLor.) 1he 86 Leam
ls worklng on experlmenLs LhaL mlghL "allas" seed selecLors Lo nearby selecLors on oLher neLworks Lo geL
around Lhls problem, buL Lhls poses challenges. 1he 81-8C analyLlc (dlscussed laLer ln Lhls paper) uses
relaLlve veloclLles Lo deal wlLh Lhe cross-neLwork challenge, buL Lhls approach requlres pre-compuLlng
Lravel behavlor for all palrs of selecLors, whlch can be compuLaLlonally expenslve.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
12
,21,G "8.4P89P:

A()B>,#$/&
(1S//Sl/8LL 1C uSA, lvL?) 1he 81-8C Sldeklck Cloud-8ased Co-Lraveler analyLlc compares average Lravel
veloclLy beLween palrs of selecLors Lo lnfer wheLher or noL could co-Lravel would pracLlcally be posslble.
1he veloclLy facLor ls lnLended Lo reduce Lhe number of false poslLlves when conslderlng Lravel among
urban areas by fllLerlng ouL palrs of selecLors LhaL were seen aL Lhe same serles of CLLL lus or vL8s over
Llme, buL could noL have been Lravellng LogeLher because Lhe locaLlon daLa LlmesLamps presuppose an
unreasonable veloclLy. 1hls may happen because one or boLh of Lhe selecLors ln Lhe palr may have been
locaLed aL Lhe edges of Lhe neLwork coverage durlng one or more of Lhelr Lravel mldpolnLs.
(TS//SI/REL TO USA, FVEY) The analytic first computes “movement summaries” of all available tasked
selecLors. 1he movemenL summarles conLaln a llsL of locaLlons LhaL a LargeL vlslLed durlng Lhe Llmeframe
of lnLeresL, glven by Lhe analysL. LocaLlons are deflned by CLLL lus (for CSM) or CLC-Pashes (for
any oLher selecLors wlLh LaL/Long). 1hen, Lhe sysLem dlscovers palrs of LargeLs LhaL could be Lravellng
LogeLher by comparlng Lhelr sequences of physlcal locaLlons and facLorlng ouL palrs LhaL could noL have
reasonably arrlved aL Lhe meeLlng waypolnLs wlLhln 10 mlnuLes of each oLher.
(1S//Sl/8LL 1C uSA, lvL?) Cne of Lhe maln beneflLs of Lhe 81-8C Sldeklcks analyLlc ls LhaL lL ls noL
consLralned by provlder neLwork. 8ecause lL conslders physlcal (LA1/LCnC) locaLlons and Lravel
veloclLles, lL can provlde co-Lraveler resulLs LhaL lnclude selecLors on dlfferenL provlder neLworks.

!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
- ÇID ava||ab|e at k1-kG ana|yst
desktop.
k1-kG 1oo|s: Go|dm|ner, CnL1,
GLC1

- SorLlnglead LvenL Summarles
(Lhe subseL
of lascla ÞCS)
- CurrenLly runnlng on 81-8C

- Could posslbly scale Lo lASClA
evenL summarles
- 8equlres accuraLe Lower geo
daLa (locaLlon and daLe)
- 8equlres pre-compuLlng all
selecLors agalnsL all selecLors,
whlch can be expenslve
- CurrenL ouLpuL lncludes only
Lasked selecLors
- AnalyLlc ls noL deslgned for
sLaLlonary LargeLs.


C$+$,. D#,B
(1S//Sl/8LL 1C uSA, lvL?) CurrenLly, Lhe sysLem ls lnLegraLed wlLh 81-8C, operaLlng on
CSM daLa. lL may scale Lo a larger daLa source, however, lL ls deslgned Lo precompuLe sldeklcks for each
posslble palr or Lasked selecLors.
(1S//Sl/8LL 1C uSA, lvL?) 1hls analyLlc could also be applled Lo unl locaLlon daLa.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
13
"9%5%?54 6-%5'789: 2&%.49&%)7 04-74& I"620J G4(:H%78%5 C8)458-4: 0(1
2&%345 AE*

A()B>,#$/&
(1S//Sl/8LL 1C uSA, lvL?) 1he geospaLlal llfellnes Clu applies the concept of “dwell times” to identify
un8 co-Lravelers. uwell Llmes descrlbe Lhe Llme perlod spenL aL Lhe beglnnlng or endlng desLlnaLlon. A
locaLlon ls consldered a beglnnlng or endlng locaLlon lf Lhe dwell Llme aL LhaL locaLlon ls greaLer Lhan 2
hours.
(1S//Sl/8LL 1C uSA, lvL?) 1hls Clu flrsL generaLes geohashes uslng CSM evenL daLa, and Lhen
calculaLes LranslLlon llnes lndlcaLlng LhaL a devlce Lraveled from one geohash Lo anoLher. 1he resulL ls a
graph ln whlch Lhe geohashes represenL nodes and Lhe LranslLlons represenL llnks or edges. ClusLerlng
algorlLhms are applled Lo Lhe graphs Lo deLermlne locaLlons and selecLors of lnLeresL.
(1S//Sl/8LL 1C uSA, lvL?) 1he geospaLlal llfellnes represenL Lhe beglnnlng and endlng locaLlons, as
deflned by Lhelr dwell Llmes, and all oLher lnLermedlaLe observaLlons. 1he llkellness of co-Lravel along
paLhs beLween sLarLlng and desLlnaLlon polnLs ls based on Lhe followlng measuremenLs: neL dlsLance,
Llme of LranslLlon (mlns), speed (kph), AzlmuLh, and number of Lravel segmenLs.
!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
+<@AB=>6 =27=29 5< WX 9@B7 58
J"L 2E2<= 9@=@ 845;

M592 >7 @E@>A@CA2 =145:?1 "+(M,
C:= @<@AB=>6 >7 <5 A5<?24 :<924
92E2A53;2<=G
- Ceohashes of CSM evenL daLa
reLrleved from lASClA.

- AnalyLlc deslgned for CSM
daLa, buL could be applled Lo
oLher Lypes of daLa
- CrlenLed Lo LargeLs LhaL remaln
ln one locaLlon for aL leasL 2
hours
- 8equlres Ceocoded source daLa
for generaLlng Ceohashes

C$+$,. D#,B
(S//8LL 1C uSA, lvL?) 1he code for Lhls Clu ls avallable Lhrough SA1C, buL Lhe analyLlc ls no longer
under developmenL. ldeas for fuLure work before Lhe pro[ecL ended lncluded addlng acceleraLlon and
slnuoslLy Lo Lhe compuLaLlon.
""G 0($$(- /L"/: 6-%5'789

A()B>,#$/&
(S//Sl//8LL) 1he Common lMSls AnalyLlc ls a model ln SLu8 !LMA flnds SlM card acLlvlLy seen on cell
Lower panels ln mulLlple areas (e.g.- border crosslngs commonly used by Lrafflckers). lL makes use of Lhe
1ower Clu.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
14
(S//Sl//8LL) AnalysL lnpuLs areas of lnLeresL and Llme range. 1he analyLlc reLurns an excel flle wlLh a llsL
of lMSls seen ln Lhose areas aL LhaL Llme. lL ls enrlched wlLh CC1AvL Lasklng lnformaLlon. LlmlLaLlons are
LhaL Lower locaLlons ln CC1Sk?WA8u can be lmpreclse. Also, Lhe SLu8 1ower Clu summarlzes lMSls by
LAlC by day. Summarles by MSlSun or lMLl are noL avallable.
!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
+E@>A@CA2 >< Y%L+G -CC1AvL and lASClA

- Cell Lower locaLlons ln
CC1Sk?WA8u can be lmpreclse.
- 1he SLu8 1ower Clu
summarlzes lMSls by LAlC by
day.
- Summarles by MSlSun or lMLl
are noL avallable.
E&&1+1#/(% 6/@#,?(+1#/
hLLps://wlkl.nsa.lc.gov/wlkl/AnalyLlcs 1axonomy
hLLps://wlkl.nsa.lc.gov/wlkl/un8 1ravel ÞaLLern
2%&Q47 6-%5':8: 04-74& I260JR0%)SR 2&%345 %-. L(?8587' 6-%5':8: 04-74&
I2L60J *+/ 0(12&%345 6-%5'789
)"(X AF4* S GI3+'#%0 .TSS – ["*2"08 .TS.H


A()B>,#$/&
(1S//Sl/8LL 1C uSA, lvL?) 1he Cafe pro[ecL lnvolved 1MAC, SSC, 11212, and S2l3 worklng ln concerL Lo
develop boLh unl and un8 cloud-based Lravel analyLlcs. 1he absence of a cloud-based soluLlon LhaL
could run over bulk daLa moLlvaLed Lhls lnlLlaLlve. 1he Cafe ob[ecLlve was Lo sLeer cloud Lravel analyLlcs
Loward operaLlonal use and ulLlmaLely merge Lhe unl and un8 analyLlcs ln a unlfled co-Lravel analyLlc.
1hese analyLlcs are currenLly sLlll under developmenL, however, Lhey are avallable Lo Lhe developmenL
communlLy on CM-ÞLACL.
(1S//Sl/8LL 1C uSA, lvL?) 1hls analyLlc uses lÞ geolocaLlon of acLlve user/presence evenLs as Lravel
lndlcaLlon.
(1S//Sl/8LL 1C uSA, lvL?) 1he unl analyLlc operaLes ln one of Lwo modes. 1he flrsL mode accepLs a llsL
of Lasked LargeLs vla u11, and aLLempLs Lo ldenLlfy co-Lravelers for Lhose LargeLs LhaL have been deemed
Lo have Lravelled durlng a speclfled Llme wlndow (Lyplcally 30 days). 1he analyLlc only conslders LargeLs
LhaL Lraveled beLween aL leasL 2 counLrles ln a glven monLh. lor Lhese Lravellng LargeLs, candldaLe co-
Lravelers are scored based on how many Llmes Lhey were seen ln Lhe same locaLlons durlng Lhe same
Llmes as Lhe LargeL. 1argeL locaLlons are glven by unl selecLor lÞ geolocaLlon, provlded by ASul enrlched
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
13
wlLh CLC reference daLa (or geo-Lagglng where avallable). 8ecause Lhls daLa provldes clLy-level locaLlon
resoluLlon, co-Lraveler candldaLes are asslgned scores based on Lhe exLenL Lo whlch Lhey were seen ln
Lhe same clLles and on Lhe same days as LargeLs.
(1S//Sl/8LL 1C uSA, lvL?) 1he second mode accepLs a paLLern represenLlng LargeL Lravel across
spannlng counLrles of lnLeresL (e.g., ), and opLlonally, Lhe days on whlch Lhe counLrles
were vlslLed. ln Lhls mode, Lhe 1AC/Cafe/1MAC unl Co-Lravel analyLlc ln Lhls mode ldenLlfles Lravelers
LhaL (aL mlnlmum) maLch Lhe paLLern. All candldaLes LhaL maLch Lhe paLLern are regarded as posslble
co-Lravelers.
(S//8LL 1C uSA, lvL?) 1he resulL of Lhese analyLlcs ls a Clu monLhly roll-up LhaL can be querled.
!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
+E@>A@CA2 =5 92E2A53247 D>=1
@66277 =5 J157=;@61><2 !JLO
I&+M%0
- 1asked unl selecLors (u11)
- CeoLagged ASul daLa
- user-provlded Lravel paLLerns
- 1asked LargeLs or Lravel
paLLerns provlded as lnpuL,
resulLs lnclude Lasked and
unLasked LargeLs

- AnalyLlc operaLes aL Lhe
counLry level Lo deLermlne
Lravel/clLy level for co-Lraveler
deLermlnaLlon, and deslgned Lo
provlde monLhly Clu roll-up

- Þroxles and oLher shared lÞ
seLLlngs can render lÞ
geolocaLlon suscepLlble

C$+$,. D#,B
(S//Sl/8LL 1C uSA, lvL?) 1he 1AC/Cafe/1MAC unl Co-Lraveler Leam also consldered capablllLles Lo
enable follow-on querles uLlllzlng CPALklun for convergence efforLs Lo ldenLlfy roamlng handseLs as
posslble unl LargeL co-Lravelers.
F+"., ,.2#$,).2
hLLps://ncmd-saLc01.ncmd.nsa.lc.gov/gamblL/publlc/q/dnl Lravel analyLlc cloud verslon
hLLps://wlkl.nsa.lc.gov/wlkl/CafeLravel dnl co-Lravelers
260R0%)SR2L60 *+, 0(12&%3454& 6-%5'789
)"(X AF4* . G["*2"08 – [2$8 .TS.H


1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
16
A()B>,#$/&
(1S//Sl/8LL 1C uSA, lvL?) 1he Cafe pro[ecL lnvolved 1MAC, SSC, 11212, and S2l3 worklng ln concerL Lo
develop boLh unl and un8 cloud-based Lravel analyLlcs. 1he absence of a cloud-based soluLlon LhaL
could run over bulk daLa moLlvaLed Lhls lnlLlaLlve. 1he Cafe ob[ecLlve was Lo merge Lhe unl and un8
analyLlcs Lo creaLe one compleLe co-Lravel analyLlc, however Lhe un8 co-Lraveler analyLlc, descrlbed
below, ls currenLly sLlll under developmenL.
(1S//Sl/8LL 1C uSA, lvL?) 1he un8 cloud-based analyLlc conslders all known LargeLs (Lasked ln CC1AvL)
LhaL have Lraveled wlLhln a glven daLe range (e.g., monLhly roll-up Lo flve monLh range), and aLLempLs Lo
flnd Lhelr co-Lravelers. Co-Lravelers are deflned as lndlvlduals LhaL were seen ln Lhe same area (currenLly
deflned by vL8s) around Lhe same Llme as Lhe LargeLs. 1he ouLpuL lncludes boLh Lasked and unLasked
selecLors as posslble co-Lravelers wlLh Lhe Lasked seeds. Lach posslble co-Lraveler ls asslgned a score
LhaL lndlcaLes Lhe probablllLy of co-Lravel wlLh Lhe seed. Plgher scores are asslgned Lo co-Lravelers LhaL
are seen aL more of Lhe same locaLlons and closer ln Llme (palrs are glven one polnL lf seen wlLhln one
hour, and a half polnL lf seen wlLhln Lwo hours of each oLher).
!+(+$2 (/& !$??(,0
SLaLus Source uaLa CaveaLs
+<@AB=>6 1@7 C22< =27=29 5<
-+"MK+ 9@=@ 5< JLOI&+M%

M5;;@<9 A><2 ><=248@62
@E@>A@CA2 =5 92E2A53247
- lASClA daLa on CM-ÞLACL
- ~408 rows ln Lhe CM ÞLACL
CLCuu8ASL Lable
- CPALklun LnrlchmenL (vL8
CounLry mapplng)
- CLCuu8ASL LvenLs (lMSl,lMLl)
rounded Lo nearesL hour

- AnalyLlc only conslders Lasked
selecLors as seeds
- Source daLa provlded by vL8s
- Co-Lravel evenLs are rolled-up
by Lhe hour


C$+$,. D#,B
(S//Sl/8LL 1C uSA, lvL?) lollow-on analysls could Lake advanLage of lAS1SCCÞL reservaLlon number
feaLure whlch wlll reLurn all co-Lravelers LhaL Lravel on Lhe same reservaLlon number wlLhln a glven Llme
perlod (because reservaLlon numbers are reused, a speclflc Llmeframe musL be provlded).
F+"., :.2#$,).2
hLLps://wlkl.nsa.lc.gov/wlkl/un8 1raveler
hLLps://wlkl.nsa.lc.gov/wlkl/un8 Co-1raveler
hLLps://wlkl.nsa.lc.gov/wlkl/un8 1ravel ÞaLLern
*+, 0(12&%3454& L%-#%5 6-%5':8:
1aken from: hLLps://ncmd-
saLc01.ncmd.nsa.lc.gov/gamblL/publlc/q/dnr co Lravel based on slmlllar cell lds over a Llme frame
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
17

1. SLarL wlLh a LargeL selecLor (e.g. lMSl)
2. Cuery Lhe LargeL selecLor for ÞCS evenLs Lo ldenLlfy cell Lowers Lhls LargeL hls hlLLlng off of and
aL whaL daLe/Llme.
3. noLe Lhe cell Lowers, locaLlon of Lhe cell Lowers, and Lhe daLe/Llmes
4. Cuery Lhose cell Lowers (and oLher cell Lowers ln Lhe area) for Lhose daLes and Llmes Lo
ldenLlfy oLher users who are hlLLlng off of Lhose Lowers
3. Compare Lhe resulLs of Lhe users hlLLlng off of Lhe cell Lowers.
6. 8ank Lhe selecLors as belng posslble candldaLes for co-Lravelers based on whaL cell Lowers
Lhey hlL on aL Lhe rlghL Llmes.
7. SelecLors LhaL are rellably seen Lo be hlLLlng off of Lhe same Lowers aL Lhe same Llmes more
Lhan oLhers should geL a hlgher rank.

"#$$%&'
(S//Sl/8LL 1C uSA, lvL?) AL Lhe beglnnlng of Lhls paper, we presenLed a number of key lssues and
quesLlons. Many of Lhe analyLlcs deflne Lhemselves by (1) Lhe key lssues Lhey address ln novel ways and
(2) Lhe Lypes of source daLa on whlch Lhey operaLe.
(S//Sl/8LL 1C uSA, lvL?) 1he key lssues secLlon hlghllghLs capablllLles LhaL mlghL lmprove Lhe accuracy
of Lhe analyLlc resulLs. lor example, analyLlcs LhaL have knowledge abouL Lhe locaLlons of CClus and
vL8s and can augmenL Lhelr procedures wlLh non-SlCln1 daLa such as geographlc and LerresLrlal daLa.
1hls lnformaLlon conLalns knowledge abouL Lhe locaLlons of hlghways and roads. AnalyLlcs LhaL can
geographlcally valldaLe rouLes beLween meeLlng polnLs can Lhen use Lhls lnformaLlon Lo consLraln Lhe
posslble co-Lravel rouLes and candldaLe co-Lravel selecLors along Lhose rouLes.
(S//Sl/8LL 1C uSA, lvL?) AnalyLlcs LhaL can operaLe on a varleLy of dlfferenL source daLa formaLs,
lncludlng boLh unl and un8, beneflL from Lhe ablllLy Lo explolL dlvergenL daLa sources Lo develop more
compleLe plcLures of LargeL Lravel behavlor.
(S//Sl/8LL 1C uSA, lvL?) 1he co-Lravel analyLlcs ln Lhls sLudy are aL varlous sLages of developmenL,
LesLlng, and deploymenL. Cne posslble way forward could be Lo have an lndependenL organlzaLlon
2

perform a formal evaluaLlon of Lhese analyLlcs uslng a common LesL daLaseL. 1hls would enable a falr
comparison and assessment of the analytics’ processlng Llme, efflclency, and accuracy. undersLandlng
Lhe advanLages and challenges of each analyLlc agalnsL a common LesL daLaseL wlLh ground LruLh may
faclllLaLe plannlng for fuLure work.


2
An lndependenL organlzaLlon ls one LhaL ls noL lnvolved ln Lhe developmenL of any of Lhese analyLlcs and LhaL
does noL have a sLake ln Lhe ouLcome.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
18
69P-(T54.Q$4-7:
(u//lCuC) 1hanks Lo all of Lhe parLlclpanLs ln Lhls sLudy, llsLed as ÞCCs under Lhe lndlvldual analyLlcs.
1hese lndlvlduals parLlclpaLed ln face-Lo-face meeLlngs and phone lnLervlews, and provlded Lhe deLalls
of Lhelr analyLlcs Lo Lhls sLudy Lhrough brleflngs and wrlLe-ups. 1hls compllaLlon would noL have been
posslble wlLhouL Lhe cooperaLlon of Lhese conLrlbuLors. Speclal Lhanks also Lo Lhe CeospaLlal Analysls
SupporL CenLer for Lhelr conLrlbuLlons Lo Lhe secLlon on lssues and CuesLlons.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
"#$$%&' 2%?54 () 0(12&%345 6-%5'789:
F@;2 58 +<@AB=>6 ":;;@4B "5:462 H@=@ +461>=26=:42 "=@=:7 M@E2@=7
0B6CDEF+

AnalyLlc compuLes Lhe daLe,
Llme, and neLwork locaLlon of
any (=@7S29 54 :<=@7S29)
moblle phone over some Llme
perlod, and Lhen looks for
oLher moblle phones LhaL
were seen ln Lhe same
neLwork locaLlons around a
one hour Llme wlndow. When
a selecLor was seen aL Lhe
same locaLlon (e.g., vL8)
durlng Lhe Llme wlndow, Lhe
algorlLhm wlll reduce
processlng Llme by chooslng a
few evenLs Lo maLch over Lhe
Llme perlod. Chalkfun ls
SÞCMA enabled.
- All lASClA daLa
conLalnlng vL8
and CClu
lnformaLlon
- Cloud-
based
verslon could
be avallable
as early as
SepLember
2012.
- CperaLlonal,
Avallable aL
analysLs deskLops


- CurrenL verslon ls noL cloud-
based and can have long
processlng Llmes, however
cloud-based soluLlon ls
lmmlnenL.
- AnalyLlc wlll only reLurn co-
Lravelers on Lhe same provlder
neLwork
*"* 0(12&%345
6-%5'789
ÞredlcLs LargeL locaLlons and
co-Lravelers by calculaLlng
Llme-based Lravel Lra[ecLorles
and ldenLlfylng llkely paLh
lnLersecLlons beLween
observed locaLlons. 1he
analyLlc calculaLes Lravel Llmes
aL waypolnLs slmllar Lo LhaL
used ln Lurn-by-Lurn
navlgaLlon sysLems.
-Moblle Cu8s - neLezza
- Could be
lmplemenLed
ln Cloud-
based
archlLecLure
(Padoop/
Map8educe
or Accumulo)
- lmplemenLed and
LesLed aL uSu
- 8equlres neLezza (currenL
lmplemenLaLlon)
- 8equlres 8enolr
G4(:H%78%5
6-%5':8:
2&%.49&%)7 04-74&
ueLermlnes wheLher Lwo
enLlLles (e.g. devlces) could
have been 65OA56@=29 by
- Ceohashes of
CÞS polnL evenL
daLa.
Cloud-based ÞroLoLype servlce
lmplemenLed on
nCAneL. noL yeL
- 8equlres evenL locaLlons and
Llmes for every selecLor.
- ueslgned for 1 km grld-based
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
21
F@;2 58 +<@AB=>6 ":;;@4B "5:462 H@=@ +461>=26=:42 "=@=:7 M@E2@=7
applles a maxlmum veloclLy
movemenL parameLer Lo
approxlmaLe Lhe Llme LhaL an
lndlvldual was aL each
locaLlon. Co-Lravelers are
ldenLlfled by dlscoverlng palrs
of selecLors LhaL meeL
duraLlon and dlsLance
Lhresholds seL by Lhe analysL.

N602 +G61+"6
G620 6-%5'789
ldenLlfles clusLers of
waypolnLs for each LargeL
handseL. ldenLlfles whlch palrs
of handseLs conLaln slmllar
waypolnL clusLers. Þalrs are
scored based on Lhe number
of waypolnL clusLers LhaL
maLch.
- daLa
from
CuL1WLAvL vla
lC8each (e.g.
~3M locaLlons
over 6 years for
200k
locaLlons per
day)
Cloud-based
Padoop
Map8educe
framework
1esLed on
daLa from
CuL1WLAvL.
ÞaLLerns sLored ln
Clu.
ln process of
LranslLlonlng ÞAC1
Lo nSA/S2.
- AnalyLlc deslgned for
polnL daLa
,O ">,2/+GCM6*
0(12&%3454&
6-%5'789

AnalyLlc accepLs a =@7S29 54
:<=@7S29 selecLor and
Llmeframe as lnpuL, and Lhen
derlves an lLlnerary for Lhe
selecLor LhaL lncludes Lhe CLLL
lus and/or vL8s. 1he lLlnerary
ls based on a serles of
waypolnLs. 1he analyLlc
searches for oLher selecLors
that were “near” these
waypolnLs ln space and Llme.
CandldaLes are scored and
prlorlLlzed.

- ln LesLlng
phase Lo be
replacemenL
back-end for Lhe
currenL
producLlon
CPALklun co-
Lraveler Lool
Cloud-based
Map8educe
- lASClA ÞCS
SorLlnglead
Summarles
- AnalyLlc cannoL recover
cross-neLwork co-Lravelers
- AnalyLlc wlll noL be effecLlve
agalnsL sLaLlonary (non-
Lravellng) LargeLs
- Þrocesslng ls memory
lnLenslve
- AnalyLlc ls senslLlve Lo large
cells, vL8s, and dense areas
- noL dlrecLly appllcable Lo saL
phones wlLh LA1/LCnC
lnformaLlon
- 8esulLs can be senslLlve Lo
Llmeframe chosen as lnpuL
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
22
F@;2 58 +<@AB=>6 ":;;@4B "5:462 H@=@ +461>=26=:42 "=@=:7 M@E2@=7
(noL effecLlve for large querles
across mulLlple counLrles and
large Llme frames)
,21,G "8.4P89P:

(1S//Sl/8LL 1C uSA, lvL?).
1hls analyLlc compuLes
“movement summaries” of
=@7S29 selecLors. 1hese are
llsLs of locaLlons LhaL a LargeL
vlslLed durlng Lhe Llmeframe
of lnLeresL. 1hen, Lhe sysLem
dlscovers palrs of LargeLs LhaL
could be Lravellng LogeLher by
comparlng Lhelr movemenL
summarles, facLorlng ouL palrs
LhaL could noL have
reasonably arrlved aL Lhe
meeLlng waypolnLs wlLhln 10
mlnuLes of each oLher.
8ecause Lhls analyLlc
conslders physlcal (LA1/LCnC)
locaLlons and Lravel veloclLles,
lL can provlde co-Lraveler
resulLs LhaL lnclude selecLors
on dlfferenL provlder
neLworks.
- CurrenLly
runnlng on 81-
8C
- Could posslbly
scale Lo lASClA
evenL
summarles
Cloud-based - Clu avallable aL
81-8C analysL
deskLop.
- 81-8C 1ools:
Coldmlner, CPL1,
CLC1
- 8equlres pre-compuLlng all
selecLors agalnsL all selecLors,
whlch can be expenslve
- CurrenL ouLpuL lncludes only
Lasked selecLors
- AnalyLlc ls noL deslgned for
sLaLlonary LargeLs
"9%5%?54 6-%5'789:
2&%.49&%)7 04-74&
I"620J G4(:H%78%5
C8)458-4: 0(1
2&%345 AE*
1hls Clu flrsL generaLes
geohashes uslng CSM evenL
daLa, and Lhen calculaLes
LranslLlon llnes lndlcaLlng LhaL
a devlce Lraveled from one
geohash Lo anoLher.
1he llkellness of co-Lravel ls
based on dwell Llmes aL Lravel
- Ceohashes of
CSM evenL daLa
reLrleved from
lASClA.
AnalyLlc LesLed on
90 days of CSM
evenL daLa from


Code ls avallable
Lhrough SA1C, buL
analyLlc ls no
- AnalyLlc deslgned for CSM
daLa, buL could be applled Lo
oLher Lypes of daLa
- CrlenLed Lo LargeLs LhaL
remaln ln one locaLlon for aL
leasL 2 hours
- 8equlres Ceocoded source
daLa for generaLlng
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
23
F@;2 58 +<@AB=>6 ":;;@4B "5:462 H@=@ +461>=26=:42 "=@=:7 M@E2@=7
endpolnLs, and Lhe followlng
measuremenLs: neL dlsLance,
Llme of LranslLlon (mlns),
speed (kph), AzlmuLh, and
number of Lravel segmenLs.
longer under
developmenL.
Ceohashes
""G 0($$(-
/L"/: 6-%5'789
1hls SLu8 !LMA model flnds
SlM card acLlvlLy seen on cell
Lower panels ln mulLlple
areas.
1he analysL lnpuLs areas of
lnLeresL and Llme range. 1he
analyLlc reLurns an excel flle
wlLh a llsL of lMSls seen ln
Lhose areas aL LhaL Llme,
enrlched wlLh CC1AvL Lasklng
lnformaLlon.
CC1AvL and
lASClA daLa
1ower Clu CperaLlonal,
avallable ln !LMA.
- Cell Lower locaLlons ln
CC1Sk?WA8u can be
lmpreclse.
- 1he SLu8 1ower Clu
summarlzes lMSls by LAlC by
day.
- Summarles by MSlSun or
lMLl are noL avallable.
2%&Q47 6-%5':8:
04-74&
I260JR0%)SR
2&%345 %-.
L(?8587' 6-%5':8:
04-74& I2L60J
*+/ 0(12&%345
6-%5'789
ulscovers candldaLe co-
Lravelers based on how many
Llmes selecLors were seen ln
Lhe same counLrles and clLles
durlng Lhe same monLhs as
Lasked LargeLs. LocaLlons are
glven by unl selecLor lÞ
geolocaLlon, provlded by ASul
enrlched wlLh CLC reference
daLa.
- 1asked unl
selecLors (u11)
- CeoLagged
ASul daLa
- user-provlded
Lravel paLLerns
Cloud-based
CM-ÞLACL
Avallable Lo
developers wlLh
access Lo
ChosLmachlne
(CM-ÞLACL)
- 1asked LargeLs provlded as
lnpuL, resulLs lnclude Lasked
and unLasked LargeLs
- AnalyLlc operaLes aL Lhe
counLry level, and deslgned Lo
provlde monLhly Clu roll-up
- Þroxles can make lÞ
resoluLlon challenglng
260R0%)SR 2L60
*+, 0(12&%3454&
6-%5'789
(1S//Sl/8LL 1C uSA, lvL?) 1he
un8 cloud-based analyLlc
conslders all known LargeLs
(=@7S29 ln CC1AvL) LhaL have
Lraveled wlLhln a glven monLh,
and aLLempLs Lo flnd Lhelr co-
Lravelers. Co-Lravelers are
- lASClA daLa on
ChosLmachlne
- 40.78 rows ln
Lhe CLCuu8ASL
Lable
- CPALklun
LnrlchmenL (vL8
Cloud-based
CM-ÞLACL
under
developmenL
- AnalyLlc only conslders
Lasked selecLors as seeds.
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
1CÞ SLC8L1//CCMln1//8LL 1C uSA, lvL?
24
F@;2 58 +<@AB=>6 ":;;@4B "5:462 H@=@ +461>=26=:42 "=@=:7 M@E2@=7
deflned as lndlvlduals LhaL
were seen ln Lhe same area
(deflned by CounLry, vL8, or
Cell lu) around Lhe same Llme
as Lhe LargeLs. 1he ouLpuL
lncludes boLh =@7S29 @<9
:<=@7S29 selecLors as posslble
co-Lravelers wlLh Lhe Lasked
seeds.
CounLry
mapplng)
- CLCuu8ASL
LvenLs
(lMSl,lMLl)
rounded Lo
nearesL hour


CO-TRAVELER: Inside the NSA's cellphone-tracking program
24 Pages - Contributed by Matt DeLong, Washington Post - Dec 06, 2013
This is a National Security Agency white paper that evaluates the various location-based target development techniques employed
by the NSA and its partners.
Print Notes http://www.documentcloud.org/notes/print?docs[]=888734
1 of 1 12/11/2013 10:18 AM

Sign up to vote on this title
UsefulNot useful