IBM Software Group NonObvious Relationship Awareness NORA Jeff

IBM Software Group Non-Obvious Relationship Awareness (NORA) Jeff Jonas, Distinguished Engineer and Chief Scientist IBM Entity Analytic Solutions Las Vegas, Nevada jeffjonas@us. ibm. com © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Introduction q Founded Systems Research & Development in 1983 q Moved headquarters in Las Vegas in early 90’s q Worked with the gaming industry to help them better understand who they were doing business with q Funded by CIA’s In-Q-Tel q Brought in a professional management team in 2002 q 70% federal of which 70% intelligence q Acquired by IBM January 2005 q Chief Scientist of the IBM Entity Analytics 2 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Agenda q Introducing Identity Resolution q Relationship Awareness q Case Studies q Introduction to Anonymous Identity Resolution™ q Summary q Questions and Answers 3 © 2005 IBM Corporation

IBM Software Group Identity Resolution Answering “Who is Who? ” © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Identity Resolution History q 1983: Technology originally developed to identify credit fraud for the credit bureau/collection industry q 1994: Significantly enhanced for the gaming industry to protect them from unknowingly doing business with criminals and “insider threats” q 1996: Created an identity-centric customer repository based on 4, 200 disparate systems resulting in >100 million resolved identities q 2001: In-Q-Tel, a venture capital arm for CIA, funded certain technology enhancements q September 2001: Used by a handful of US companies to generate leads of immediate investigatory importance to national law enforcement q 2002: 2 nd round In-Q-Tel funding for enhanced scalability q Today: Real-time, streaming data sustaining >2, 000 Identity Resolutions/second against a 3 billion row database describing 600 million resolved identities 5 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Identity Resolution Example – 1 st Record System A #70001 Marc R Smith 123 Main St (713) 730 5769 537 -27 -6402 DL: 0001133107 1 New identity (#1) introduced to database 6 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Identity Resolution Example – 2 nd Record System A #70001 Marc R Smith 123 Main St (713) 730 5769 537 -27 -6402 DL: 0001133107 System B #009103 Randal Smith DOB: 06/17/1974 (713) 731 5577 1 2 No meaningful correlation – new identity (#2) 7 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Identity Resolution Example – 3 rd Record System A #70001 Marc R Smith 123 Main St (713) 730 5769 537 -27 -6402 DL: 0001133107 System B #009103 Randal Smith DOB: 06/17/1974 (713) 731 5577 1 System C #6251 Mark Randy Smith 456 First Street (713) 731 5577 DL: 1133107 2 Identity #1 is enhanced 8 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Identity Resolution Example – 3 rd Record System A #70001 Marc R Smith 123 Main St (713) 730 5769 537 -27 -6402 DL: 0001133107 System B #009103 Randal Smith DOB: 06/17/1974 (713) 731 5577 System C #6251 Mark Randy Smith 456 First Street (713) 731 5577 DL: 1133107 1 Identity #2 is identity #1 – Identities are conjoined 9 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Identity Resolution … Accumulates Context Names Marc R Smith A-#70001 Randal Smith B-#009102 Mark Randy Smith C-#6251 123 Main St. A-#70001 456 First Street C-#6251 (713) 730 -5769 A-#70001 (713) 731 -5577 B-#009102 (713) 731 -5577 C-#6251 SSN 537 -27 -6402 A-#70001 DL 0001133107 A-#70001 1133107 C-#6251 06/17/1974 B-#009103 1 Address Phones DOB 10 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Identity Resolution Example – 4 th Record System A #70001 System Mark Smith B #009103 M Smithe 123 Randal Main Street System C #6251 DOB: 06/17/1934 (713) 730 -5769 Marc Randy Smith (713) 731 -5577 537 -27 -6402 123 Maine Drive NV/0001133107 (713) 731 -5577 NV/1133107 System D #7700214 Randy Smith Sr. 6/17/1934 (713) 731 -5577 423 -22 -7027 1 Record resolved to identity #1 11 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Identity Resolution Example – 4 th Record System D #7700214 Randy Smith Sr. System B #009103 6/17/1934 Randal M Smithe (713) 731 -5577 DOB: 06/17/1934 (713)423 -22 -7027 731 -5577 System A #70001 Mark. System Smith C #6251 123 Marc Main Randy Street Smith (713) 730 -5769 123 Maine Drive 537 -27 -6402 (713) 731 -5577 NV/0001133107 NV/1133107 1 3 Conflicts discovered – context corrected 12 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Identity Resolution Properties q Self-Correcting Ø New data corrects previous outcomes. Ø Accuracy improves over time - more data lowers false positives and negatives q Sequence Neutral Ø Same end-state despite the arrival order of the data q Full Attribution Ø Every row retains original pedigree and temporal values Ø No merge/purge – not a lossee process q Persistent Context Ø Moment of data availability, context is constructed, persisted, published and managed Ø No operational requirement for periodic database refresh/reloads q Reconcilable Ø Tethered to the real-time add, change and delete data streams from systems of record 13 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Priority #1: Dealing with Poor Data Integrity Customers Employees Suppliers Subjects of Interest Name and Address Standardization Normalization Data Enhancement Identity Resolution Ingest Resolved Identity Database 14 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Name Standardization 15 Dick, Dickie, Ricardo, Rich, Richie, Rick, Rickey, Rickie, Ricky, Rikki, Ritchie Richard Mohamad, Mohammad Mohamed, Mohammed Mohammad © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions International Root Names African Arabic/Muslim Asian American Indian Biblical Chinese Celtic Czech & Slovak Farsi French German Greek 16 Hindi/Indian Hungarian Italian Irish Japanese Jewish/Hebrew Korean North Pacific Islander Pakistani Pashto Polish Polynesian Portuguese Romanian Russian Scandinavian Scottish Spanish Urdu Welsh © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions International Address Standardization 17 460 Oak Street Mill Valley, CA 94914 4737 Simeron Drive Easton, MA 02334 460 South Oak Ave Mill Valley, CA 94941 4737 Cimarron Drive Easton, MA 02334 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Normalization Formatting Standards Applied 7074121234 557672061 /SMITH&! (707) 412 -1234 557 -67 -2061 SMITH Value Validation (213) 543(000) 000 -0000 (800) 555 -1212 18 Rejected, incomplete Rejected, invalid Accepted, noted generic © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Data Enhancement Customers Employees Suppliers Subjects of Interest Name and Address Standardization Normalization EXTERNAL REFERENCE DATA Data Enhancement Identity Resolution Ingest Resolved Identity Database 19 Address changes Latitude/longitude Public records Financial indicators Bankruptcies © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Accumulating Historical Data to Enhance Context Identity #934256 RELATIONS Spouse: John Shaw Ref: Martin Shay NUMBERSRef: Helen Bryant Ref: Kelly Jones (702) 555 -2091 NAMES Susan Miller Sue Miller-Shaw Sue Shaw (916) 342 -6721 ADDRESSES 460 S. Oak Ave. 012 -34 -5678 4737 Cimarron Dr. 5021 1111 2391 1231 POB 17454 1101 Princeton #31 20 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Identity Resolution – Example Data Points 21 Name Location – Last name – First name – Middle name – Other name parts – Generation – Organization name – Aliases – Address 1 – Address 2 – Address 3 – City – State/province – Postal code – Country – Latitude/longitude Identifiers – Credit card – Driver’s license – Bank account – Tax ID – Passport – Loyalty club – Phone – Email address – IP address – … user defined Attributes – Date of birth – Circa date of birth – Nationality – Citizenship – Place of birth – Height – Weight – Eye color – Hair color – … user defined © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Resolved Relationships Example Database Good Guys Hotel guests Loyalty club enrollment Employees Vendors Victims Subjects of Interest Specially designated nationals Excluded persons Gaming license revocations Known cheaters Interpol FBI Most Wanted 22 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions “Degree of Separation” Discovery and Alerting A Credit card number link B C Address link D Passport link Phone number link G H K L E Name/DOB link J I Driver’s license link O N M 23 P Q R S © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Perpetual Analytics (not data mining) Customers Employees Suppliers Subjects of Interest Name and Address Standardization Normalization Data Enhancement Identity Resolution Ingest Real-time ALERTS 24 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Case Studies 25 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Case Study: Las Vegas Casino Data Sources Detected Relationships • 20, 000 plus employees • All vendors • 24 active players were known cheaters • All slot club & table games-related players • 23 players had relationships to prior arrests/incidents • In-house arrests/incidents • 12 employees were themselves the player • Known cheaters • 192 employees had possible vendor relationships • 7 employees were the vendor 26 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Case Study: Retail Data Sources Detected Relationships • 40, 000 plus employees • 2 out of every 1000 employees had been arrested for shoplifting • 10, 000 plus vendors • 26, 000 international security/arrest records (shoplifters, etc. ) • 8 out of every 1000 employees were related to known shoplifters • 9 vendors on the internal security file • 1 executive related to a vendor (a charity). Possible case of embezzlement. 27 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Case Study: Federal Agency Data Sources Detected Relationships • 20, 000 plus employees • 140 employee relationships to vendors • 75, 000 plus vendors • 200, 000 plus Type 1 security risk entities • 200, 000 plus Type 2 security risk entities • 1451 potential vendor relationships to security risks • 253 employee relationships to security risk entities • 2 vendors were the security risk • “n” employees were the security risk/vendor 28 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions A Post September 11 th Analysis (Public Information, prepared for presentation purposes only) 29 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Starting with 2 Known Terrorists in US WATCH LIST: CIA/INS/FBI POSSIBLE TERRORISTS IN THE US: Ø On or before August 23 rd, 2001, Nawaq Alhamzi and Khalid Al-Midhar added to INS watchlist MAKE PLANE RESERVATIONS USING SAME NAMES: Ø On or about August 25, 2001, Khalid Al-Midhar purchases cash ticket for American Airlines flight #77 scheduled for September 11, 2001 Ø On or about August 27, 2001, Nawaq Alhamzi books a flight on American Airlines flight #77 scheduled for September 11, 2001 30 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions American Airlines Flight 77 Target - Pentagon Nawaq Alhamzi Salem Al-Hazmi Khalid Al-Midhar Hani Hanjour Majed Moqed American Airlines Flight 11 Target - North Tower of World Trade Center Mohamed Atta Abdulaziz Alomari Wail Alshehri Waleed Alshehri Satam Al Suqami Starting with 2 Known Terrorists in US United Airlines Flight 175 Target - South Tower of World Trade Center United Airlines Flight 93 Target - Unknown Ahmed Alghamdi Marwan Al-Shehhi Fayez Ahmed Saeed Alghamdi Mohand Alshehri Ahmed Al Haznawi Ahmed Alnami Hamza Alghamdi Ziad Jarrah 31 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Address Connections RESERVATIONS MADE WITH ADDRESS #1 AND ADDRESS #2 Ø On or about August 25, 2001, Khalid Al-Midhar makes a reservation on American Airlines flight #77 scheduled for September 11, 2001 using Common Address #1 Ø On or about August 27, 2001, Nawaq Alhamzi books flight on American Airlines flight #77 scheduled for September 11, 2001 using Common Address #2 ADDRESSES ARE USED BY THREE (3) ADDITIONAL PASSENGERS Ø Mohamed Atta has reservation on American Airlines flight #11 scheduled for September 11, 2001 using Common Address #1 as a contact address Ø Marwan al-Shehhi has reservation on United Airlines flight #175 scheduled for September 11, 2001 using Common Address #1 as a contact address Ø Salem Alhamzi has reservation on American Airlines flight #77 scheduled for September 11, 2001 using Common Address #2 as a contact address 32 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions American Airlines Flight 11 American Airlines Flight 77 Target - North Tower of World Trade Center Target - Pentagon Nawaq Alhamzi Salem Al-Hazmi Khalid Al-Midhar Hani Hanjour Mohamed Atta Majed Moqed Abdulaziz Alomari Wail Alshehri Waleed Alshehri Satam Al Suqami 5 are Identified United Airlines Flight 175 Target - South Tower of World Trade Center Ahmed Alghamdi Marwan Al-Shehhi Mohand Alshehri 33 Fayez Ahmed Hamza Alghamdi United Airlines Flight 93 Target - Unknown Saeed Alghamdi Ahmed Al Haznawi Ahmed Alnami Ziad Jarrah © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Phone Number Connections ONE (1) ALERTED PASSENGER MAKES RESERVATION USING COMMON TELEPHONE NUMBER Ø On or about August 28, 2001, Mohamed Atta uses Florida Telephone #1 as a contact number when making reservations on American Airlines flight #11 scheduled for September 11, 2001 NUMBER IS USED BY FIVE (5) ADDITIONAL PASSENGERS Ø On or about August 26, 2001, Waleed Alshehri and Wail Alshehri make reservations on American Airlines flight #77 scheduled for September 11, 2001 using Florida Telephone #1 as a contact number Ø On or about August 27, 2001, reservations for electronic, one-way tickets were made for Fayez Ahmed and Mohand Alshehri for United Airlines flight #175 using Florida Telephone #1 as a contact number Ø On or about August 28, 2001, Abdulaziz Alomari reserves a seat on American Airlines flight #11 using Florida Telephone #1 as a contact number 34 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions American Airlines Flight 11 American Airlines Flight 77 Target - North Tower of World Trade Center Target - Pentagon Nawaq Alhamzi Salem Al-Hazmi Khalid Al-Midhar Hani Hanjour Mohamed Atta Majed Moqed Abdulaziz Alomari Wail Alshehri Waleed Alshehri Satam Al Suqami 10 are Identified United Airlines Flight 175 Target - South Tower of World Trade Center Ahmed Alghamdi Marwan Al-Shehhi Mohand Alshehri 35 Fayez Ahmed Hamza Alghamdi United Airlines Flight 93 Target - Unknown Saeed Alghamdi Ahmed Al Haznawi Ahmed Alnami Ziad Jarrah © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Frequent Flyer Connections ONE (1) ALERTED PASSENGER MAKES RESERVATION USING A FREQUENT FLYER NUMBER Ø On or about August 25, 2001, Khalid Al-Midhar makes a reservation on American Airlines flight #77 scheduled for September 11, 2001 using Frequent Flyer #1 FREQUENT FLYER NUMBER IS USED BY ONE (1) ADDITIONAL PASSENGER Ø On or about August 25, 2001, Majed Moqed makes a reservation on American Airlines flight #77 scheduled for September 11, 2001 using Frequent Flyer #1 36 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions American Airlines Flight 11 American Airlines Flight 77 Target - North Tower of World Trade Center Target - Pentagon Nawaq Alhamzi Salem Al-Hazmi Khalid Al-Midhar Hani Hanjour Mohamed Atta Majed Moqed Abdulaziz Alomari Wail Alshehri Waleed Alshehri Satam Al Suqami 11 are Identified United Airlines Flight 175 Target - South Tower of World Trade Center Ahmed Alghamdi Marwan Al-Shehhi Mohand Alshehri 37 Fayez Ahmed Hamza Alghamdi United Airlines Flight 93 Target - Unknown Saeed Alghamdi Ahmed Al Haznawi Ahmed Alnami Ziad Jarrah © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Public Record Connections PUBLIC RECORDS Ø Alerted subjects Nawaq Alhamzi and Khalid Al-Midhar lived with Hani Hanjour Ø Alerted subject Wail Ashehri was roommates and shares PO Box with Satan Al Suqami 38 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions American Airlines Flight 11 American Airlines Flight 77 Target - North Tower of World Trade Center Target - Pentagon Nawaq Alhamzi Salem Al-Hazmi Khalid Al-Midhar Hani Hanjour Mohamed Atta Majed Moqed Abdulaziz Alomari Wail Alshehri Waleed Alshehri Satam Al Suqami 13 are Identified United Airlines Flight 175 Target - South Tower of World Trade Center Ahmed Alghamdi Marwan Al-Shehhi Mohand Alshehri 39 Fayez Ahmed Hamza Alghamdi United Airlines Flight 93 Target - Unknown Saeed Alghamdi Ahmed Al Haznawi Ahmed Alnami Ziad Jarrah © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Remaining Connections WATCH LIST: INS ILLEGAL/EXPIRED VISAS Ø On or about August 29, 2001, Ahmed Alghamdi reserves an electronic one-way ticket on United Airlines flight #175 scheduled for September 11, 2001 FIVE (5) ADDITIONAL PASSENGERS: Ø Alerted subject Ahmed Alghamdi and Hamza Alghamdi both use same address on their airline reservations Ø Alerted subject Hamza Alghamdi has/does live with Saeed Alghamdi, Ahmed Alhaznawi, Ahmed Alnami Ø Alerted subject Ahmed Alhaznawi lives/lived with Ziad Jarrah 40 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions American Airlines Flight 11 American Airlines Flight 77 Target - North Tower of World Trade Center Target - Pentagon Nawaq Alhamzi Salem Al-Hazmi Khalid Al-Midhar Hani Hanjour Majed Moqed Mohamed Atta Abdulaziz Alomari Wail Alshehri Waleed Alshehri Satam Al Suqami All 19 are Identified! United Airlines Flight 175 Target - South Tower of World Trade Center Ahmed Alghamdi Marwan Al-Shehhi Mohand Alshehri 41 Fayez Ahmed Hamza Alghamdi United Airlines Flight 93 Target - Unknown Saeed Alghamdi Ahmed Al Haznawi Ahmed Alnami Ziad Jarrah © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions All 19 via 3 Degrees of Separation Khalid Al-Midhar Majed Moqed Mohamed Atta Marwan Al-Shehhi Waleed Alshehri Wail Alshehri Satam Al Suqami 42 Nawaq Alhamzi Salem Al-Hazmi Ahmed Alghamdi Hanjour Fayez Ahmed Mohand Alshehri Abdulaziz Alomari Hamza Alghamdi Saeed Alghamdi Ahmed Alhaznawi Ahmed Alnami Ziad Jarrah © 2005 IBM Corporation

IBM Software Group Enabling Enterprise Awareness and Insight “Just-in-Time” Context Versus On Demand Context © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions “Just-in-Time” Context versus On Demand Context q “Just-in-Time” Context Ø Data is assembled only when requested Ø Recursive processing is use to handle false positives and false negatives Ø Enterprise discovery requires that a user or system asks a question Ø Very limited scalability q On Demand Context Ø Context is accumulated, managed and persisted based on real-time streams Ø Contains the most accurate, up-to-the-minute view of an identity based on the sum of the enterprise’s knowledge Ø At the moment of ingestion a prime opportunity exists to discover and publish insight Ø Massively scalable Ø When a user or system makes a request, real enterprise discovery is possible 44 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Transaction Processing and User Queries – Same Process Query Customers Employees Subjects of Interest Name and Address Standardization Normalization Data Enhancement Identity Resolution Ingest Results 45 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions On Demand Context Enables Enterprise Discovery Search Enterprise Discovery Subject Robert I. Ashley Jr. Aka Bob Ashley 1024 Mescal Way Las Vegas, Nv. 89110 132 -42 -1776, 133 -42 -1776 (702) 555 -0008, (707) 555 -5678 Bobby Ashley 1024 Messcal Las Vegas, Nv. 89110 On Demand Context 46 Index Pointers HR Applicant System (ref: 0098712) Credit System (ref: 180 -13455) Fraud Database (ref: 05 -201 -0311) © 2005 IBM Corporation

IBM Software Group Privacy and Civil Liberties Protections Introducing Anonymous Identity Resolution © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Example of A Sharing Nightmare Cruise Line Reservations Hazardous Materials Handlers Nuclear Facility Employees Federal Watch List Name and Address Standardization Normalization Data Enhancement Identity Resolution Ingest Real-time ALERTS 48 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Current Data Sharing Challenges q Few data owners really want to share their data q Private sector resists shipping all their data to the government q The government doesn’t want to expose their “subjects of interest” to the private sector q Data sharing must meet appropriate legal standards and our personal privacy/civil liberties expectations q If one legally must share data, there is a higher risk of unintended disclosure or misuse 50 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Introducing Anonymous Resolution A technique that allows n data holders to share anonymized identity-based data … whereby all identities are managed and correlated while in their cryptographic form … resulting in a more secure and privacy-enhancing way to resolve identities and discover relationships of particular interest 51 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions The One-Way Hash INPUT VALUE Khalid Al-Midhar One-Way Hash Function (e. g. , MD-5 or SHA-1, SHA 256) OUTPUT VALUE One-Way Hash Value (MD-5) cbd 034409 c 22929518 fa 494 f 99 dc 9964 Result: An irreversible signature Use: Fundamental building block used in modern cryptography 52 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions The One-Way Hash – Infinitely Sensitive INPUT VALUE OUTPUT VALUE One-Way Hash Function One-Way Hash Value (MD-5) cbd 034409 c 22929518 fa 494 f 99 dc 9964 Khalid Al-Midhar 56429 da 8 c 660 e 5 b 1 f 35 e 2 b 2 f 8 ad 27 c 91 Khalid Almidhar 53 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions The Anonymizer Name: Rob Smith DOB: 6/7/1972 cd 5 dced 41028 cb 7 ea 51 d 52 a 888089 d 73 00 c 9782 a 552 a 2 d 09 b 1 b 85 e 0 d 0 db 52 ef 3 7 f 2 b 6 e 48 ea 7 d 042 bbe 85 e 46 ef 2107 da 4 0 d 06 b 31 faa 7 c 44682 d 770706640465 d 2 B 5 e 341 a 4 b 0 cdf 0 e 8 de 7 b 6 f 957818 d 746 bd 0 ec 72 f 2424729 efa 7 baac 9 a 636970 a 54 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions The Anonymizer Name: Rob Smith DOB: 6/7/1972 Anonymization Preprocessing (Secret Sauce) Standardization ROBERT SMITH 06/07/1972 55 ROBERT SMITH 06/07/1972 07/06/1972 Variants “SALT” ROB+”x 2 Mn 21” ROBERT+”x 2 Mn 21” SMITH+”x 2 Mn 21” 06/07/1972+”x 2 Mn 21” 07/06/1972+”x 2 Mn 21” One-Way Hash cd 5 dced 41028 cb 7 ea 51 d 52 a 888089 d 73 00 c 9782 a 552 a 2 d 09 b 1 b 85 e 0 d 0 db 52 ef 3 7 f 2 b 6 e 48 ea 7 d 042 bbe 85 e 46 ef 2107 da 4 0 d 06 b 31 faa 7 c 44682 d 770706640465 d 2 B 5 e 341 a 4 b 0 cdf 0 e 8 de 7 b 6 f 957818 d 746 bd 0 ec 72 f 2424729 efa 7 baac 9 a 636970 a © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Anonymized Data Correlation Organization A Bad Guy #100031 Khalid Al-Midhar Saudi Arabia DOB: 07/12/76 ALERT! VX 1 RU 9 is #100031 Organization B Good Guy #VX 1 RU 9 Khaleed Al-midhar San Francisco (415) 555 -0900 ID: 33000102334 Anonymous Identity Resolution Anonymizer 56 Anonymizer © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Stored & Compared While in Anonymized Form What’s in this Database? A-100031 57 Name Normalized cbd 034409 c 22929518 fa 494 f 99 dc 9964 Variation 1 9269 bb 3 bc 60366245144 cbd 5 e 960 cfd 8 Citizenship Normalized b 835 b 521 c 29 f 399 c 78124 c 4 b 59341691 Date of Birth Normalized 799709 b 2 e 5 f 26 f 796078 fd 815 bebf 724 Variation 1 40 ddba 83 c 22 acc 2 acaddff 12 c 66 d 7 adf Variation 2 e 4310 b 75 f 2 fa 9595 f 8154411924 b 19 b 1 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Basic Concept of Operations Organization A Organization B Anonymous Identity Resolution Organization C ALERT! VX 1 RU 9 is #100031 Anonymized Content Database 58 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Some Implementation Considerations q Preventing dictionary attacks against the Anonymous Content Database Ø Using active-tamper crypto cards (e. g. , IBM 4758) to protect the SALT value Ø Using multi-party re-anonymizers to apply additional layers of SALT q Preventing users with Anonymizers from attacking the system Ø Separating the Anonymous Content Database from users – by using third party agents to perform the processing (e. g. , university, Switzerland) Ø Control anonymizer throughput volumes Ø Not sending alerts to input users, but rather to another party Ø Immutable audit trails 59 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Some Implementation Considerations q Preventing statistical or traffic analysis attacks Ø Obscuring data source and data types to prevent certain re-identification attacks (encrypting reference data or holding reference data at third party) Ø Hiding alerts from Anonymous Identity Resolution users – by employing encrypted burst traffic of fixed size; hiding occurrences of alert 60 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Media Attention Forbes Eight Masters of Information http: //www. forbes. com/2005/08/17/data-internet-masters-information_cz_05 egang_land. html Newsweek Enterprise Edition Geek War on Terror http: //www. msnbc. msn. com/id/4486823/ Wall Street Journal Entrepreneur Offers Solution for Security-Privacy Clash http: //webreprints. djreprints. com/946631285938. html Digital ID World Finding Identity in the Noise http: //magazine. digitalidworld. com/Mar 04/Page 20. pdf 61 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Policy Papers and Reports Heritage Foundation and Center for Democracy and Technology Technologies That Can Protect Privacy as Information Is Shared to Combat Terrorism http: //www. heritage. org/RESEARCH/homelanddefense/lm 11. cfm http: //www. cdt. org/security/usapatriot/20040526 technologies. pdf Steptoe & Johnson Anonymization, Data-Matching and Privacy: A Case Study http: //www. steptoe. com/publications/279 d. pdf Markle Foundation – National Security in the Information Age Task Force Second Report: Creating a Trusted Network for Homeland Security http: //www. markletaskforce. org/Report 2_Full_Report. pdf 62 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Benefits of Anonymous Resolution q Enhanced protections against unintended information disclosure (as consequences of unintended disclosure are ominous) q Unlike other anonymization techniques, identities can be disambiguated after anonymization (versus k-anonymity techniques) q In law enforcement settings it helps enforce applicable legal standards (e. g. , “reasonable and particular” search) q Insider threat-resistant q Domain-specific databases virtually eliminates the opportunities for re -purposing the anonymized database q Where there is sharing or there are pressures to share sensitive identity data, presents an important alternative to “wide open” sharing 63 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Coming Industry Shift “Information sharing” is of a growing interest to every major organization If information can be shared in an anonymized form when a materially similar result can be achieved … why would an organization share information any other way? 64 © 2005 IBM Corporation

IBM Software Group Architecture Preview © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Designed for Streaming Context at Ingestion “n” Data Sources Pipeline Processing Name and Address Standardization Acquisition Node IN Normalization Universal Message Format (UMF) Data Enhancement Identity Resolution Acquisition Node Resolved Identities 66 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Subscription-based Publishing Pipeline Processing Name and Address Standardization IN Normalization Universal Message Format (UMF) Data Enhancement Analytic Mart Identity Resolution Resolved Identities 67 “n” Party Subscriptions Operational Systems Publishing Other 3 rd Parties © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Support for Parallelism – Run ‘n’ Pipelines 68 Data Source Name and Address Standardization Normalization Data Enhancement Identity Resolution © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Horizontally Scalable – Run “n” Pipelines on “n” Boxes Data Source 69 Data Source Data Source © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Cascading Systems – Example Asia Europe Middle East Central 70 © 2005 IBM Corporation

IBM Software Group Summary © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions What Identity Analytics “Is Not” q Not a data quality tool Ø Data quality is a transaction level activity Ø EAS builds context based on conjoined sets transactions q Not an Extract-Transform-Load (ETL) tool Ø EAS is engineered for real-time environments Ø No periodic reloads required q Not match/merge tool Ø EAS delivers full attribution, lossless processing Ø Does not rely on binary, pair-wise, compares; rather self-correcting assembly via set processing q Not “Identity Management” Ø Not used to validate user logons, grant permissions 72 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Summary q Real-time situational awareness of identity q Achieve high accuracy, real-time discovery against key targets q Precise detection and preemption of bad guys (asymmetric and insider threats) q Massively scalable to address your largest information challenges q Paradigm shifting technology whereby the more data you have the more significant the findings q Discover zero degree to “n” degree relations of investigatory importance q Proven COTS technology 73 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Related Observations from Scale q Every smart question cannot be asked every day, of every system q If one cannot assemble context at ingestion, you will never keep up q Knowledge discovery on streaming data is more productive than batch processing (i. e. , incremental learning) q At the collapsing phase-transition opportunities exist for enhanced performance q On Demand Context is essential to real-time knowledge discovery and insight q There are too many maybes to be addressed by manual human review q More data, when contextualizable, disambiguates the maybes thus lowering both false positives and false negatives – i. e. , “more hay = more needles” q Neutral data, typically pre-filtered out, as it turns out is the important glue that helps construct critical context q Information previously not viewed as a requirement … in fact is a critical requirement q On Demand Context also delivers unprecedented accuracy in information discovery 74 © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions Example Applications 75 q Perpetual employee vetting q Insider threat detection q Watch listing programs q Boarder protection systems q Identity fraud solutions q Counter terrorism q Counter intelligence q Investigations q Critical infrastructure protection q Multi-agency collaboration q Visa programs q Trusted traveler programs q Transportation safety q Licensing q Persistent surveillance © 2005 IBM Corporation

IBM Software Group | Entity Analytic Solutions … Today and Tomorrow q Today Ø Identities (people, organizations) Ø Privacy-enhanced discovery without disclosure (anonymization technologies) q Tomorrow Ø “Entity” resolution (other objects e. g. , parts, assets, proteins) Ø Biometric-enhanced disambiguation Ø Geospatial event correlation Ø Data reduction strategies, streaming net change engines 76 © 2005 IBM Corporation

IBM Software Group Questions and Answers © 2005 IBM Corporation

IBM Software Group Non-Obvious Relationship Awareness (NORA) Jeff Jonas, Distinguished Engineer and Chief Scientist IBM Entity Analytic Solutions Las Vegas, Nevada jeffjonas@us. ibm. com © 2005 IBM Corporation