An Overview of Tripwires in SAS Law Enforcement Intelligence

[#1]

Everyone knows that in today’s world, we can use technology to our advantage in our everyday lives. Let’s say you need a last-minute birthday gift for your spouse. You go online, order, click and pay. Then you anxiously keep your phone next to you waiting for that ‘ding’ sound that you have a notification. DING! You can see the order has been processed. DING! The order has been packed. DING! A shipment label has been created. DING! Your package has been received by the shipping service. DING! The shipment is on its way. DING! The shipment is out for delivery. Technology is helping you keep a close eye on that package. You might even frantically check your location app and home cameras to see where your spouse is. You get the point. Since you are having it delivered to the house you want to get to the gift before your spouse does. DING! A cat walked into the view of your doorbell camera. UGH. It’s not what you need so you ignore it. DING! It finally happens. The package has been delivered to your doorstep. You run to the porch, grab the gift, and hide it.

Select any image to see a larger version.
Mobile users: To view the images, select the "Full" version at the bottom of the page.

The packed, shipped, and delivered notifications have become a welcoming action in our quest of instant bursts of knowledge in our daily routine. It’s so convenient! And like the convenience of shipment notifications, SAS can make a difference in law enforcement using real time notifications. The SAS Law Enforcement Intelligence solution allows you to set up notifications called Tripwires on objects in your system, that you are interested in following. This is not only convenient information for officers, but at times could even be critical for timing and resources in carrying out a plan of action.

Let’s discuss Tripwires. Tripwires notify the tripwire owner that another user is accessing a specific object. There are two main types of tripwires: tripwire and covert tripwire.

When a tripwire is added to an object both the owner and the user making the access are notified that the access took place. For example, as a narcotics officer you’ve come to a dead end on your investigation into Travis Smith, a known drug trafficker. There is enough information that you don’t want to close your investigation, but not enough information to move forward. So, you apply a tripwire to the Travis Smith object in the system by chance that eventually someone else might have information you need. The tripwire allows you to focus on other cases until that day hopefully arrives.

Later, an investigations officer accesses the Travis Smith person object. The investigations officer is notified of the tripwire though the banner on the object, and if configured, also by a pop-up message when they first open the object.

And DING! You as the tripwire owner are notified of the officer’s access, by email. Wonderful! The case has been out of sight, and slightly out of mind, but this notification lets you know to check back in. You can also see what actions the officer performed against the object such as, viewed, edited, or deleted information within the object. This allows you to gather information, and if warranted, contact the investigations officer about their access and collaborate with that officer to gain information on your pending case.

When a covert tripwire is added to an object only the covert tripwire owner is notified of the access. For example, when the investigations officer accesses the Travis Smith object, they are not notified of the tripwire though a banner on the object, or by a pop-up message. But, DING!, you as the tripwire owner are still notified of the officer’s access, through email. A covert tripwire could be used in an instance of monitoring the system to see if any officers are trying to access an object in the system that they shouldn’t be trying to access.

A third type of tripwire is a tripwire exclusion. When a tripwire exclusion is applied to an object, new and existing tripwires no longer create notifications when a user accesses the object. A tripwire exclusion could be used for instances when an auditor accesses the object. They are not making changes or adding value, so you don’t need to know when they access the object.

Let’s review some basic rules of the tripwire. A Tripwire object has its own workflow. New tripwires must be activated. You can activate your own tripwires, but covert tripwires and tripwire exclusions must be approved by a supervisor before they can be activated. Your organization’s solution administrator configures which entities can have tripwires added to them. Once installed, and then configured as a toolbar item, you still must have ‘Create’ permissions to create a Tripwire entity. Now we have access and a need for a tripwire, here is an example of a Tripwire that has been added to an Information Report. Notice the default message appears on the dialog pop-up box. And the banner message appears within a blue banner at the top of the page on the information report.

As you can see, SAS Law Enforcement Intelligence’s tripwires provide a practical advantage to law enforcement by helping officers keep notified (DING!) in real time, about important information.

Learn more:  SAS Law Enforcement Intelligence