Sharik 2.0: The Design and Development of a Web-Based Tool to Support Collaborative Sensemaking

Transcription

1 CAN UNCLASSIFIED Sharik 2.0: The Design and Development of a Web-Based Tool to Support Collaborative Sensemaking Shadi Ghajar-Khosravi Peter Kwantes DRDC Toronto Research Centre Terms of Release: This document is approved for Public release. Defence Research and Development Canada Scientific Report DRDC-RDDC-2017-R106 August 2017 CAN UNCLASSIFIED

2 CAN UNCLASSIFIED IMPORTANT INFORMATIVE STATEMENTS Disclaimer: Her Majesty the Queen in right of Canada, as represented by the Minister of National Defence ("Canada"), makes no representations or warranties, express or implied, of any kind whatsoever, and assumes no liability for the accuracy, reliability, completeness, currency or usefulness of any information, product, process or material included in this document. Nothing in this document should be interpreted as an endorsement for the specific use of any tool, technique or process examined in it. Any reliance on, or use of, any information, product, process or material included in this document is at the sole risk of the person so using it or relying on it. Canada does not assume any liability in respect of any damages or losses arising out of or in. This document was reviewed for Controlled Goods by Defence Research and Development Canada (DRDC) using the Schedule to the Defence Production Act. Her Majesty the Queen in Right of Canada (Department of National Defence), 2017 Sa Majesté la Reine en droit du Canada (Ministère de la Défence nationale), 2017 CAN UNCLASSIFIED

3 Abstract All-source analysts collaborate with each other on various information requirements. They receive different types of information from various collators, integrate and relate those information items to produce intelligence, and then share the new intelligence items with their peers. In this report, the authors describe Sharik (SHAring Resources, Information, and Knowledge), a web-based tool aimed at supporting collaborative sensemaking among all-source intelligence analysts in distributed command and control centers. The primary goal of this tool is to support analysts in producing, and more importantly sharing, new intelligence pieces with their teammates while retaining a high situational awareness of the intelligence production s status. Sharik s features support different stages of the intelligence cycle including direction, collection, processing, and dissemination. Significance to Defence and Security Analysts are continuously dealing with larger amounts of information to review, analyse, and extract intelligence from. A wide range of solutions is proposed for tackling this information overload issue, including various analytic tools supporting analysts analyses. On a different spectrum, another solution would be facilitating collaboration and sensemaking among teams of analysts working together on a common mission with the ultimate goal of improving efficiency and reducing redundancy in intelligence analysis activities. Hence, the tool described in this report was designed to support collaborative sensemaking among intelligence analysts. This work is being carried out at Defence Research and Development Canada (DRDC) under project 05da: JICAC (Joint Intelligence Collection and Analysis Capability) within the Joint Force Development (JFD) S&T portfolio. The JICAC project is being run as a collaboration between DRDC s Valcartier and Toronto Research Centres, and aims to provide the Canadian Armed Forces (CAF) with tools, techniques, and advice for procurement to reduce the amount of time all-source intelligence analysts must search for information, and maximise the amount of time they can spend doing analysis. In addition to Defence and Security, Sharik would also contribute to public safety community in potential future settings where the three communities would collaborate with one another in a same operation. DRDC-RDDC-2017-R106 i

4 Résumé Les analystes toutes sources collaborent entre eux afin de répondre à divers besoins en matière d information. Ils reçoivent et intègrent divers types d information de différents compilateurs et établissent des liens entre les éléments d information pour en obtenir du renseignement dont ils partageront ensuite les éléments avec leurs pairs. Dans ce rapport, les auteurs décrivent Sharik (SHAring Resources, Information and Knowledge, soit le partage des ressources, de l information et des connaissances), un outil Web qui favorise le raisonnement collaboratif chez les analystes du renseignement toutes sources disséminés dans les centres de commandement et contrôle. L objectif principal de cet outil est d aider les analystes à produire, certes, mais surtout à partager de nouveaux éléments d information avec leurs coéquipiers, tout en conservant une connaissance élevée de la situation quant à l état de la production de renseignement. L outil Sharik permet de répartir le cycle du renseignement en différentes étapes, dont l orientation, la collecte, le traitement et la diffusion. Importance pour la défense et la sécurité Le volume d information que les analystes doivent examiner et analyser afin d extraire du renseignement augmente sans cesse. Par conséquent, il existe un vaste éventail de moyens de s attaquer à cette surabondance d information, dont divers outils d analyse. Or, il existe également un autre moyen qui permettrait de faciliter la collaboration et le raisonnement au sein d équipes d analystes travaillant ensemble dans le cadre d'une mission commune et dont l objectif ultime est d améliorer l efficacité et de réduire la redondance des activités d analyse du renseignement. L outil décrit dans ce rapport a été conçu afin d appuyer le raisonnement collaboratif chez les analystes du renseignement. Ce travail se déroule à Recherche et développement pour la défense Canada (RDDC) dans le cadre du projet 05da:t sur la capacité interarmées de recherche et d analyse du renseignement) (JICAC) du portefeuille de science et technologie (S & T) du Développement de la force interarmées (DFI). Les centres de recherches de Valcartier et de Toronto collaborent à ce projet qui vise à fournir aux Forces armées canadiennes (FAC) des outils, des techniques et des conseils en matière d approvisionnement afin de réduire le temps que les analystes du renseignement toutes sources doivent passer à rechercher de l information et de maximiser celui qu ils peuvent consacrer à l analyse. L outil Sharik contribuerait aux efforts non seulement dans les milieux de la défense et de la sécurité, mais également dans celui de la sécurité publique dans un cadre leur permettant de collaborer entre eux au cours d une même opération. ii DRDC-RDDC-2017-R106

5 Table of Contents Abstract i Significance to Defence and Security i Résumé ii Importance pour la défense et la sécurité ii Table of Contents iii List of Figures v List of Tables vii Acknowledgements viii 1 Introduction Background Intelligence Cycle Scope Definition Intended Users Development Definitions Information Pool Project Space Content Types Features Description Home Page Intelligence Collection Plan (ICP) Management Project s Space INT Notes Note Entry Approaches Entity Wikis Propositions Proposition Entry Approaches Requests For Information (RFIs) Information Requirements (IRs) Proposition Subscription Concept Maps (CMap) Concept Map (CMap) Selection and Filtering Timeline View INT Brief Preparation Commenting and Messaging Notifications DRDC-RDDC-2017-R106 iii

6 4 Conclusion and Future Work References List of Symbols/Abbreviations/Acronyms/Initialisms iv DRDC-RDDC-2017-R106

7 List of Figures Figure 1: The Intelligence Cycle Figure 2: Sharik s home page for logged-in users Figure 3: Sharik s home page (Special agents / CCIR1 are selected here) Figure 4: PIR1 Who is Jason Bourne? project s space Figure 5: A note s full page view in an overlay display Figure 6: Figure 7: Figure 8: Figure 9: Form-based data entry approach for adding new Notes to a PIR space. (a) The left panel on a PIR s space with Add New Note button. (b) The Form-based entry page Word document Macro. (a) User selects a line of text and clicks on the macro s icon. (b) The macro function highlights the selected text, copies the selected text along with the file path into clipboard, and then saves the Word file Adding a new note using Quick Access approach. (a) User pastes the text that was copied by Word macro. (b) User attaches the note to an existing proposition The new note is added to the project s space. The title of the note is created automatically using the first few words of the text snippet Figure 10: The Entity Wikis tab under project s space Figure 11: The full view of Jason Bourne s Wiki page Figure 12: Figure 13: Figure 14: Form-based entry approach for adding new propositions. (a) The left panel on a PIR s space containing Add New proposition button. (b) The form-based entry approach for adding new propositions to the system Command-based approach for adding new propositions to a project: (a) The left panel on project s space containing the command line text field, (b) The new proposition is added to the list of propositions after submitting the command Propositions table filtered by linking phrase type (only extract propositions are displayed here) Figure 15: RFIs submitted under PIR1 Who is Jason Bourne? Figure 16: (a) The user subscribes to the proposition by clicking on Subscribe link. (b) The user could unsubscribe from a proposition by clicking on Unsubscribe. 20 Figure 17: The CMap tab, consisting of three panels, is displayed Figure 18: The CMap graph visualization of all the propositions submitted under PIR1 Who is Jason Bourne? DRDC-RDDC-2017-R106 v

8 Figure 19: Figure 20: Figure 21: Figure 22: Figure 23: Figure 24: Figure 25: Figure 26: Filtering panel: (a) Filter options expanded include concept type, users, and propositions type. (b) Filter options expanded include concept type and date picker. (c) Filter options expanded include concept type and properties Associations check-box is selected in this screenshot. Orange lines represent association links and connect linking phrases and concepts that have shared properties although are not part of the same proposition User clicks on the proposition David Webb met with Maria and the details of the proposition is displayed to the right of the CMap under Info tab The Timeline panel is displayed at the bottom of the CMap panel. Dated propositions are displayed as boxes. The length of boxes represent the time duration associated to each proposition through date property PIR home page with +create Int Brief (.ppt) button highlighted at the bottom-left User selects which PIR s data should be loaded for thbe purpose of creating a PowerPoint presentation User selects PIR1 Who is Jason Bourne?, and content (notes and propositions) of the selected PIR is loaded into the content table. User will selecetd porpositions and notes from this table and add them to one of the slides shown at the bottom of this screenshot The system asks the user to enter the appropriate classification level for the presentation file to be created Figure 27: One comment submitted about a proposition Figure 28: Figure 29: This menu is shown at the top of all Sharik pages. There are two notifications in this screenshot The notifications page is displayed here. The page can be accessed through the notifications link presented on the top-right menu bar (black) in all Sharik pages vi DRDC-RDDC-2017-R106

9 List of Tables Table 1: Reliability and Credibility Ratings guideline Table 2: Shorthand notations for Proposition commands DRDC-RDDC-2017-R106 vii

10 Acknowledgements This work is being carried out at Defence Research and Development Canada (DRDC) under project 05da: JICAC (Joint Intelligence Collection and Analysis Capability) within the Joint Force Development (JFD) S&T portfolio. viii DRDC-RDDC-2017-R106

11 1 Introduction This report describes a software tool that is being developed as part of a larger project designed to develop new tools and techniques to support all-source intelligence analysts. The project, called the Joint Intelligence Collection and Analysis Capability (JICAC), is being run as a collaboration between DRDC s Valcartier and Toronto Research Centres, and aims to provide the Canadian Armed Forces (CAF) with tools, techniques, and advice for procurement to reduce the amount of time analysts must search for information, and maximise the amount of time they can spend doing analysis. The purpose of this report is to describe the capabilities built into the Sharik system to date. The tool discussed in this report is called Sharik (SHAring Resources, Information, and Knowledge), a web-based tool aimed at supporting collaborative sensemaking among all-source intelligence analysts in either distributed or co-located intelligence analysis locales (e.g., All-Source Intelligence Centres, or ASICs). Sharik tool is at the unclassified level. The target audience of this report is considered to be Canadian Armed Forces (CAF) clients and DRDC colleagues who are interested to know more about Sharik s features and/or are already part of JICAC project team. All-source analysts produce intelligence products by integrating information from multiple sources. During the scoping exercise for JICAC, Subject-Matter Experts (SMEs) identified collaboration as an important aspect of the analysts job that could be enhanced through the use of tools to support it. All-source analysts receive different types of information from collators or collection assets, and then integrate the information items to produce intelligence products. Sharik is designed to support analysts working together on different aspects of an intelligence problem by providing them with a means by which intelligence production can happen effectively in a collaborative fashion. Specifically, the Sharik is designed to help analysts: effectively manage and integrate the information they receive from various sources; effectively manage and integrate the knowledge they share and collaboratively produce intelligence products; collaborate with their peers in an unobtrusive way; and form and maintain a high level of situational awareness (Endsley, 1988) with respect to the current status of the intelligence mission to which they are contributing. Before demonstrating the various features of Sharik, a brief overview of Intelligence Cycle (IC) along with details on Sharik`s scope, intended users, development process, and key concepts are provided in Section 2. An overview of IC is provided in order to enable readers to gain a better understanding of Sharik s features and the reasons for creating those features in a tool intending to support analysts. The detailed description of Sharik`s features that have been developed to date is provided in Section 3 which is followed by concluding remarks in Section 4. DRDC-RDDC-2017-R106 1

12

13 2.2 Scope Definition The online collaborative sensemaking tool described here is to support collaboration among all-source analysts. A number of analytic tools are likely to be integrated into this system in the future. However, the discussion of those tools is out of the scope of this document. Sharik s features support different stages of the intelligence cycle including direction, collection, processing, and dissemination. 2.3 Intended Users All-source analysts are the intended primary users of this system. However, given their relationship with collators and the CCIRM, the latter two are likely to be users as well. 2.4 Development To develop Sharik, a requirements analysis was conducted in January The results are documented in an earlier report (Ghajar-Khosravi & Kwantes, 2015). From it, 14 major use cases were identified. These use cases formed the basis of the design and development of a mock-up prototype. This prototype helped the JICAC team build a shared understanding of what such a collaborative sensemaking tool was supposed to do and how much of a good fit it was to the complementary tools being developed at DRDC under JICAC. 1 Once the mock-up prototype was presented to the project team and the requirements were further refined by the team, the next step was developing the tool in a web-based environment. The tool was created based on Drupal, 2 an open-source content management system built based on PHP 3 and MySQL. 4 Drupal can be used to make various types of websites including e-commerce and social networking sites. What makes Drupal a powerful tool is the flexibility it provides for integrating as many modules as needed into a website. The Drupal s extensive community provides a wide list of user-created modules which provide additional functionalities when integrated with Drupal s core modules. The development of the first version of Sharik was completed in April 2016 and presented to three SMEs on April 27 th, Based on the feedback received during that meeting, the list of requirements was revised and new features were added. The purpose of this report is to describe the capabilities built into the Sharik 2.0 to date. A protocol has already been approved for the usability and usefulness evaluation of Sharik. No further requirements are expected to be added to Sharik at this time except the recommendations that will be generated as a result of the usability study. Sharik 2.0, the version described in this report, is the same version being currently evaluated through a usability study. 1 Such as Wisdom software currently being designed and developed at DRDC Valcartier Research Centre PHP originally stood for Personal Home Page. But, it now also stands for PHP: Hypertext Preprocessor. 4 MySQL is named after its co-founder s daughter, My. SQL abbreviation stands for Structured Query Language. DRDC-RDDC-2017-R106 3

14 2.5 Definitions In the following sub-sections, the terms related to Sharik s key features are described to provide the reader with a better understanding of the features that are described in Section Information Pool This information pool is assumed to be the primary source for analysts to look for information and is assumed to be external to Sharik such as folders of documents, reports, pictures, movies, or simply the Internet Project Space Any intelligence analysis project has an individual space where analysts would be able to store, review, and update the content that is related to that project. Any content submitted to the system should be associated with, or belong to, a specific project. In Sharik, each PIR is given a dedicated Project Space Content Types There are three different ways that content is entered and stored in Sharik: Notes, Wikis, and Propositions. Notes: Notes are written/generated by analysts while searching the information pool or the inter/intranet. Analysts create notes to log details of people, locations, organizations, or anything considered relevant to an investigation or argument. Notes are generally expected to have supplementary files (e.g., documents, movies, pictures, etc.). In our view, notes should have evaluation ratings assigned to them to describe aspects such as the reliability and credibility of the information contained within them. Ratings could be submitted following the criteria provided in Table 1 (Department of National Defense, 2003). Entity Wikis: Entities are the named concepts of interest in a PIR or project. For example, places, people, cities, groups, organizations, movements, and events are among the types of entities that could be central to an investigation. Once data is collected about an entity, analysts may feel the need to integrate this data into an individual page or report specific to that entity. Sharik uses Wikis for this purpose. Analysts have the option to create a Wiki page for any concept/entity of the project. Whether or not the Wiki feature is used depends on whether analysts have the luxury of time to record and elaborate on entities. The Wiki feature may be most applicable to strategic analyses wherein there is not an immediate requirement. In operational contexts, analysts may not have the time to create a Wiki page for any of their entities. 4 DRDC-RDDC-2017-R106

15 Table 1: Reliability and Credibility Ratings guideline. Reliability of the Source Credibility of the Information A Completely reliable 1 Confirmed by other sources B Usually reliable 2 Probably true C Fairly reliable 3 Possibly true D Not usually reliable 4 Doubtful E Unreliable 5 Improbable F Reliability cannot be judged 6 Not Credible Propositions (intelligence): While investigating entities and concepts of interest, a key task for analysts includes finding and describing the relationships between entities. These relationships could be inferential and/or uncovered from information contained in notes, Entity Wikis, or new files received from collators. In Sharik, the analyst expresses and stores facts or hypotheses pertaining to an investigation in the form of a proposition. A proposition is a statement linking two concepts or entities and is expressed as a judgment that is either true or false (Kwantes, Derbentseva, & Ghajar-Khosravi, 2015). For example, the statement Jason Bourne met David Webb is a proposition because it is either true or false. In our scheme, a proposition is expressed as a triple containing two concepts connected by a linking phrase. Concepts are the key entities of interest in a PIR or investigation and mostly expressed as nouns or noun phrases. There are three types of propositions: facts, extracts, and conjectures (or hypotheses). Extracts represent factual statements that are supported by supplementary files or notes. Facts are statements that are considered to be true without supporting documentation. Finally, Conjectures are propositions that could be true or false but are as yet, unknown. Once the requisite evidence supporting a conjecture is found, they may be able to change a Conjecture to an Extract. Properties: Analysts may need to input additional details about a proposition such as the time or place associated with an event (e.g., Jason Bourne met David Webb in Toronto in fall 2012). Once a proposition is created, Sharik allows the user to add any number of arbitrarily created properties. Conclusion: Conclusion is a special property associated with propositions. Conclusion propositions could be facts, extracts, or conjectures that represent the final findings of an investigation, or the conjectures that precipitated the investigation. For example, validating the proposition Jason Bourne works for David Webb might be the purpose for conducting an investigation. Certain propositions are defined as conclusions because, when they are rendered in visualization, it is important that the user s attention be easily directed to them (i.e., facts or conjectures) since they are central to the goals of the investigation. Bidirectional: Direction is another special property associated with propositions. Propositions could be bi-directional or uni-directional. For example, the proposition John is married to Mary is bidirectional but John loves Mary is unidirectional. Externalizing Propositions as Concept Maps: Propositions are the intelligence pieces that are put together to form a story. A concept map (CMap, Novak, 1998) is a visual technique for laying DRDC-RDDC-2017-R106 5

16 out all the relationships among entities as a graph visualization of interconnected nodes (representing concepts or entities) linked by linking phrases. Sharik uses a CMap visualization technique to provide analysts with an overview of a project s knowns and unknowns. Spatial and Temporal maps: In addition to the graph-representation of propositions, where each proposition is represented as connected nodes, analysts may also choose to view propositions on geospatial or temporal displays. Once fully implemented, this feature will be applied to those propositions containing location and date/time details. A timeline display (see Section ) for those propositions that have time details has been implemented in the Sharik 2.0 version described in this report. 6 DRDC-RDDC-2017-R106

17 3 Features Description In the following sub-section, Sharik s key features and capabilities are described. 3.1 Home Page The first step in using Sharik is logging in to the system with a username and password. The Admin is the user responsible for creating accounts for new users. Once the user logs into the system, tile views of all the PIRs which the logged-in user is working on are displayed under the corresponding Missions and CCIRs. Within each PIR the recent notes and propositions submitted under that PIR are displayed. As well, new notifications or messages are brought to user s attention on the top right-hand side of the top menu bar (See Figure 2). Notifications will be explained in a later section. For recent notifications a red menu badge is shown containing the total number of new notification items. Figure 2: Sharik s home page for logged-in users. 3.2 Intelligence Collection Plan (ICP) Management Through the two buttons provided on top-left side of the homepage (Figure 2), users could simply upload a completed Intelligence Collection Plan (ICP) in a Standard Excel Sheet format or create a new ICP from scratch by starting to add new missions, CCIRs, and PIRs. Also, users are able to add new CCIRs or PIRs to existing missions or CCIRs respectively. Including ICP components into Sharik could improve situational awareness of analysts with respect to the status of other PIRs or CCIRs. DRDC-RDDC-2017-R106 7

18 Figure 3: Sharik s home page (Special agents / CCIR1 are selected here). 3.3 Project s Space Suppose a user wanted to visit the page for the PIR1 Who is Jason Bourne? which is part of CCIR1 under Special Agents mission. She or he would click on PIR1 Who is Jason Bourne? link on Figure 3 and the system directs her to the PIR s dedicated page or project s space (Figure 4). Each PIR space consists of two main panels: Left Panel (data entry and team): The panel on the left-hand side of the project s window is dedicated to data entry and team management activities. Add Content: This tab is specified to data entry activities for Notes, Propositions, and Entities. In addition to the basic form-based data entry, users are also provided with alternative Quick Access ways of entering propositions (through command line) and notes (through snippet text-area box). Besides, the last button under this tab provides the user with the option of creating a briefing presentation (see Section 3.11) in a semi-automated approach using the content submitted under each PIR. Team: this tab lists all the members of a project (a.k.a. PIR) along with their details and a link for sending messages to them. Also, for authorized users, the Add New Member button is available enabling them to add new team members to a PIR space. Center Panel (content display): The center panel, consisting of multiple tabs, displays the project s content. Specifically, it shows the user propositions, notes, and Entity Wikis submitted by different team member along with the CMap, and the list of IRs and RFIs submitted under each PIR. 8 DRDC-RDDC-2017-R106

19 3.4 INT Notes Figure 4: PIR1 Who is Jason Bourne? project s space. INT Notes are the most basic form of information that could be entered into the system as free-form text. There is no particular structure that analysts need to follow when entering notes into the system. Notes are basically paragraphs or text snippets. Each note has the following fields: Title: The note title is a link pointing to the note s full page (Figure 5). Body: The content of the note or the text excerpt that the analysts would like to record into the project will be entered into the Note s body filed. This content could be directly extracted from a file or could be anything in analysts minds that they think would be useful and beneficial to be recorded and shared with the team. File: In cases where the note is content extracted from a file, the user has the option to attach the file to the note s content. Credibility/reliability rating: Analysts have the option to rate the reliability/credibility of the note s primary source. Tags: users have the option to assign tags, or keywords, to notes. Although it is optional, it is highly recommended that users enter at least one or two tags for their notes. Tags can improve the search functionality of the system. DRDC-RDDC-2017-R106 9

20 Figure 5: A note s full page view in an overlay display. There are two ways of entering notes into the system: 1) Form-Based, 2) Quick-Access Note Entry Approaches Form-based: The user clicks on the Add New Note button located on the left panel (see Figure 6). The system displays a form with note fields where the user fills in the fields as required. This approach can be time consuming but it gives users the opportunity to enter details such as supplementary files, credibility ratings, and tags for each note. Quick-Access: The second approach is handled by the multi-row text field on the left panel of Figure 6 and is facilitated by customized macros that are built into Microsoft Office. This approach would be useful when users find some parts/lines of a document crucial to be recorded and shared in a project s space while they are reading a document. All they need to do is to select the lines in an MS Office document, click on the macro icon on top of the document (Figure 7.a), paste it on Sharik s text field located on the left panel, and click on Add Snippet as a Note (Figure 8.a). By doing so, the macro function highlights the selected lines in the document and copies the text along with the file s path onto a clip board, and saves the changes in the document (Figure 7.b). When users paste into the text field and click on Add Snippet as a Note, Sharik attaches a copy of the document file (with selected lines highlighted) to the newly created note. This approach involves few clicks without the need to attach the source file to the note manually. Moreover, if the user believes that the new note is relevant to, or supports, an existing proposition, she has the option to attach the note to the proposition from the drop-down menu located underneath the text field (See Figure 8.b). Users have the option to edit notes they create such that they are able to add further details to the note (e.g., tags or ratings) by editing the note at a later time. 10 DRDC-RDDC-2017-R106

21 (a) Figure 6: Form-based data entry approach for adding new Notes to a PIR space. (a) The left panel on a PIR s space with Add New Note button. (b) The Form-based entry page. Macro Icon (b) (a) Figure 7: Word document Macro. (a) User selects a line of text and clicks on the macro s icon. (b) The macro function highlights the selected text, copies the selected text along with the file path into clipboard, and then saves the Word file. (b) DRDC-RDDC-2017-R106 11

22 The text snippet copied from Word document is entered to the text field with the paste command. The pasted text also contains the path to the file from which the text has been extracted. Maria Bourne was raised in Paris and born in Rome. Her brother was a journalist and got killed in a Threadstone mission. SharikTextSnippetExtracted From- C:\\Users\\SCS\\Desktop Maria Bourne was raised in Paris and born in Rome. Her brother was a journalist and got killed in a Threadstone mission. SharikTextSnippetExtracted From- C:\\Users\\SCS\\Desktop Jason Bourne Lived in London David Webb met Jason Bourne Jason Bourne works for CIA David Webb lives in Toronto Carlos studied biology Jason Bourne studied physics Maria studied math Jason Bourne takes order from David Webb Carlos is a brutal Assassin Carlos works at Threadstone Carlos is seen in Toronto Carlos is friends with John M li d i R i The user is also able to link an existing proposition to the newly extracted text snippet which is to be added to the system as a new Note. (a) Figure 8: Adding a new note using Quick Access approach. (a) User pastes the text that was copied by Word macro. (b) User attaches the note to an existing proposition. (b) Figure 9: The new note is added to the project s space. The title of the note is created automatically using the first few words of the text snippet. 12 DRDC-RDDC-2017-R106

23 Display format: As soon as a new note is entered into the system, it will be displayed as a new tile under the Notes tab in the center of the project s space (Figure 9). The first few lines of the note along with its author, rating, and source file are displayed on its tile. Users could view the note s full page by clicking on Read more or by just clicking on the note s title. 3.5 Entity Wikis Rather than just entering individual stand-alone notes, later during an investigation, analysts may feel the need to integrate multiple notes that are related to the same entity (e.g., people, places, groups) into a single page containing all the details related to that entity. Entity Wiki pages are designed to support this requirement. An Entity Wiki page has the following fields: Title: The entity title is a link pointing to the entity s individual page (Figure 10). Summary: Each entity page could start with a summary or abstract. However, the summary section could also contain a picture file. Wiki sections: Users can create an unlimited number of sections under each Entity Wiki page. Tags: Similar to notes, users have the option to assign tags to notes. Tags will improve the search functionality of the system. Sources: Any relevant notes or files could be linked to an Entity Wiki page under the sources field. This feature is likely to be most applicable to projects with a longer life-span. The benefit of this feature is that it provides users with the capability to aggregate different pieces of information with each other and group them under an entity/concept of interest. DRDC-RDDC-2017-R106 13

24 Figure 10: The Entity Wikis tab under project s space. Display format: Figure 10 shows the tiles view of the two Wiki pages that have been created under the Jason Bourne project so far. Entity Wikis are intended to be edited by all the group members. So, as soon as any of the project members finds information related to Jason Bourne, they will be able to include it under Jason Bourn s Wiki page. To see the full view of Jason Bourne Wiki page (Figure 11), users could click on Read more or just the title of the Wiki page (i.e., Jason Bourn ) and the page will be overlaid on the project s page. To create a new entity, the user needs to click on Add New Entity button located at the bottom of the left panel. 3.6 Propositions The other content type that Sharik supports is called Proposition. Although propositions are also entered into the system in the form of text, unlike notes or Entity Wikis, they should be entered following a specific structure. The pre-defined structure of propositions encourages consistency among different analysts and makes the text more readable by the machine. As mentioned earlier, a proposition is a statement linking two concepts. In other words, a proposition is a triple consisting of two concepts connected by a linking phrase. Concepts are the key entities of interest in a PIR or investigation and mostly expressed as nouns or noun phrases (e.g., Jason Bourne, World Health Organization, teacher, Toronto, etc.). Propositions are used to express the relationships between concepts or entities (Derbentseva & Kwantes, 2014). Each proposition submitted to Sharik consists of the following fields: 14 DRDC-RDDC-2017-R106

25 Concepts: In Sharik, each proposition includes two concepts. These make the primary components of a proposition and normally represent some entities of interest in a project. Concept types: The two concepts or entities of a proposition could be of different types such as person, place, group, etc. This field enables users to specify the type of the first and second concepts. Link: This field contains the linking phrase that links the concepts. In other words, it describes the relationship between the concepts. Link type: This field specifies whether the relationship described in the proposition is a fact or a conjecture and, if it is a fact, whether or not it is backed up by any sources (i.e., extract ). Properties: Users are able to add more details about a proposition through properties. For example, if the proposition says Jason Bourne Met David Webb, the time and location of the meeting could be recorded through the properties of this proposition. Related Notes and Entities: if there are entities or notes that are relevant to or support a proposition, they could be linked to the proposition through this field sources field. A link to those notes and entities will be provided under this field. Supplementary Files: If there are any new files relevant to or supporting a proposition, they can be attached to the proposition through this field. There are two ways of entering propositions into the system: 1) Form-based, 2) Quick-Access (Shorthand/Command-based) Proposition Entry Approaches Form-based: The user clicks on Add New Proposition button (located at the bottom of the left panel). The system displays a form with all the proposition fields and the user fills in the fields as needed (Figure 12). This approach can be time consuming but it gives users the opportunity to enter details like supplementary file, first and second concept types, linking types, and properties. DRDC-RDDC-2017-R106 15

26 Figure 11: The full view of Jason Bourne s Wiki page. a) Figure 12: Form-based entry approach for adding new propositions. (a) The left panel on a PIR s space containing Add New proposition button. (b) The form-based entry approach for adding new propositions to the system. (b) 16 DRDC-RDDC-2017-R106

27 Quick Access (Shorthand/Command-based): In addition to the fairly labour-intensive option of form-based data entry, users also have the option to enter shorthand format commands in the command field located at the top of the left panel (Figure 13.a). The simplest proposition command is as follows: starts with the type (optional) and name of the first concept separated by :, followed by the linking phrase enclosed by: - and > for one way propositions, or - and - for bi-directional propositions, ends with the type (optional) and name of the second concept separated by :. For example the command below enters a bi-directional proposition linking the two persons (designated with i ) Jason Bourne and David Webb with the linking phrase Met with. Jason Bourne and David Webb are the concepts. i:jason Bourne - met with - i:david Webb For propositions representing a one-way relationship, the linking phrase is enclosed by - and >. i:jason Bourne - takes order from > i: David Webb i:jason Bourne -met with- i:david Webb i:jason Bourne - was seen in - p:syria (a) (b) Figure 13: Command-based approach for adding new propositions to a project: (a) The left panel on project s space containing the command line text field, (b) The new proposition is added to the list of propositions after submitting the command. DRDC-RDDC-2017-R106 17

28 Entering the concepts type is optional. So, the command below, without the i flag, is also admissible. Jason Bourne - takes order from > David Webb If a proposition is a conjecture i.e., it is not known yet whether the proposition is true or false the command starts with a? as in the command below.? Jason Bourne - met with- David Webb The relationships between concepts (i.e., the link) could have associations or properties. Example properties include date, time, location, weather, etc. Each property consists of a label and an associated value separated by a colon. For example, to enter the location where Jason Bourne and David Webb met in the form of a property, the property s label would be in and the value would be Toronto. i:jason Bourne - met with - i: David Webb, in:toronto Property label: in Property value: Toronto The properties of relationships are entered at the end after the second concept, separated by,. Date and Time are reserved property labels and are admissible only if used in the standard pre-defined format of yyyyddmm for date and hhmmss for time. i:jason Bourne - met with - i: David Webb, in: Toronto, date: , time:1030 In some cases, the same property might be repeated for a relationship. For example, if Jason Bourne has lived in Paris in two different years. To avoid multiple properties with the same label, the repeated labels will be numbered. Jason Bourne - lived in> Paris, (date:2011, date2:2013, time:1030) Table 2: Shorthand notations for Proposition commands. Notation First/Second concept type Notation Relationship/ proposition type Notation Separator i: Individual(person) - link phrase> One-way link : If Properties -> label:value p: Place <link phrase> Bi-directional link : If Concepts -> type:name g: Group(organization)? conjecture r: Role t: Thing/object e: Event Users are not able to add all possible details (e.g., files, sources, etc.) to a proposition through the command format. However, they always have the option to edit a proposition after entering it into the system and add or edit further details to them at a later time. Display format: As soon as a new proposition is entered into the system (using either of the two approaches above), it will be added to the propositions table displayed under the Propositions tab (Figure 13.b). Each row of the table specifies one proposition. The first column of the table contains the propositions string which is linked to the propositions full 18 DRDC-RDDC-2017-R106

29 page. The second, third, and fourth columns contain the types of the proposition components. The fifth column displays whether or not the proposition is a conclusion and/or bi-directional and the following columns display the proposition s author, date created, and the Subscribe/Unsubscribe (See next section), edit, and delete links. Propositions table can be filtered based on the types of concepts and linking phrases. For example, users are able to choose to view only the extract propositions (Figure 14). Figure 14: Propositions table filtered by linking phrase type (only extract propositions are displayed here). 3.7 Requests For Information (RFIs) The RFIs tab provides a list of RFIs (Request for Information) that have been submitted under each project or PIR (Figure 15). The Add New RFI link, on top of the list, enables analysts to submit new RFIs. It is assumed that any new RFI that gets submitted to Sharik will eventually be automatically sent to the Collection Coordination and Intelligence Requirements Management (CCIRM) center which is responsible for managing RFIs submitted from different unit. Users are able to track RFIs and check their statuses through the last column of the table shown in Figure 15. Analysts may submit new RFIs to resolve the uncertainty around some of their propositions. Hence, the system enables users to link their hypotheses (i.e., conjecture propositions) to the RFIs they submit by adding a new field to the fields of a standard RFI form. DRDC-RDDC-2017-R106 19

30 Figure 15: RFIs submitted under PIR1 Who is Jason Bourne?. 3.8 Information Requirements (IRs) The IRs tab provides a list of IRs (Information Requirements) related to each PIR. The IRs list is created when a new ICP is uploaded. However, if an ICP does not contain the list of IRs in it, analysts could add them later via the link provided on top of IRs table. 3.9 Proposition Subscription By default, Sharik gives notifications to users on any proposition they have interacted with; i.e., by creating, commenting, or editing them. In some cases, however, a user might be interested in receiving update notifications on propositions he/she has not created, commented, or edited. A proposition subscription feature is included in Sharik to support this need and the feature could be extended to other content types as well. (a) (b) Figure 16: (a) The user subscribes to the proposition by clicking on Subscribe link. (b) The user could unsubscribe from a proposition by clicking on Unsubscribe. 20 DRDC-RDDC-2017-R106

31 For each proposition there is a Subscribe link. When the user clicks on this link, the user will get subscribed to that proposition, and from then on will receive notifications if anyone comments on or make changes to that proposition. Clicking on the Subscribe link will change the label from Subscribe to Unsubscribe. Once the user loses interest in her marked propositions, she can unsubscribe from them by clicking on the Unsubscribe link and from then on the user will no longer receive notifications regarding that proposition (Figure 16) Concept Maps (CMap) Propositions make the core of the analyses in the Sharik environment in the sense that they are the units of analysis, and the means by which analysts record, relate, and share key intelligence pieces. Clearly however, reading a long list of propositions may not be the most convenient way to communicate the situation to the users, Sharik thus uses concept mapping as a visualization technique to provide analysts with an overview of all the propositions submitted to a project. As mentioned earlier, a CMap (Novak, 1998) is a visual technique for laying out relationships among concepts. Because of having a triple structure, it is possible to easily visualize propositions in the form of graphs with concepts making the nodes and linking phrases making the nodes connections, i.e., edges. Figure 17: The CMap tab, consisting of three panels, is displayed. DRDC-RDDC-2017-R106 21

32 As can be seen in Figure 17, the CMap visualization of propositions is provided in the second tab of the center panel of each PIR space. There is one CMap per each PIR or project. The CMap tab consists of three panels: 1. CMap graph (top-left) 2. Selection and Filtering (top-right) 3. Timeline (bottom) Concept Map (CMap) As can be seen in Figure 18, the CMap uses some basic visual cues to differentiate the various concept types and proposition types. Concepts are represented as rectangles, except for people concepts which are presented with a person icon. The colours of the rectangles correspond to the type of the concept. Figure 18: The CMap graph visualization of all the propositions submitted under PIR1 Who is Jason Bourne?. The links/relationships between concepts are represented as lines (i.e., graph edges) connecting the concepts. The connecting lines are labelled with the linking phrases and their arrowheads represent the direction of the relationship between the two concepts. 22 DRDC-RDDC-2017-R106

33 Facts and extracts are represented as solid lines. If a proposition is an extract (i.e., it contains a back-up file), its linking phrase is enclosed by brackets. Conjectures, on the other hand, are represented as dashed lines. Lastly, propositions that represent conclusions are presented using red lines while all other types of propositions are presented using black lines Selection and Filtering Under CMap tab, the top-right panel enables analysts to filter propositions (first sub-tab) based on various criteria and also get further details (second sub-tab) on any single proposition they select by clicking on its linking phrase. Filtering ( Search tab): There are four categories of criteria based on which analysts could filter propositions shown on the CMap: Concept type: The first filtering criterion is concept type. Analysts are able to filter propositions shown in a CMap based on the type of concepts involved in the propositions. Multiple selections are also allowed. The numbers in brackets (following each concept type label) indicate the total number of concepts with that type (Figure 19.a). Proposition type: Similar to concept type, analysts are also able to filter propositions based on the link type. For example, by clicking on facts, only fact propositions will be shown. Multiple selections are also allowed. So, if the analyst is interested in seeing both facts and extracts, then both facts and extracts should be clicked on. The numbers in brackets (following each proposition type) indicate the total number of CMap propositions with that type (Figure 19.a). Users (Authors): If an analyst is only interested in viewing propositions submitted by a particular team member(s) or her/himself, he or she could then click on those usernames. Multiple selections are also allowed (Figure 19.a). Date: Analysts could also filter propositions by choosing a specific date range. The CMap will then only display those propositions with a date property that falls within the selected date range (Figure 19.b). Properties: The last section of Search tab is specified to propositions properties which are not shown in the CMap graphs. This section provides an overview of all the properties added to any of the propositions shown on the CMap, by listing all the properties with the number of occurrences for each property shown in a bracket in front of each property label (Figure 19.c). Associations: If the user clicks on the check-box labelled as Association, additional lines will be added to the CMap graph. These new orange lines will link those concepts and/or linking phrases (representing propositions) that have shared properties. In the original CMap graphs, only those concepts and linking phrases that are part of the same proposition are linked together. However, associations enables analysts to view these hidden connections by linking those linking phrases (representing propositions) and concepts that have shared properties but are not part of the same proposition. For example, in Figure 20 the proposition David Webb DRDC-RDDC-2017-R106 23

34 met with Maria has the property Toronto and hence is linked to the concept Toronto through an association link although the Toronto concept is not a concept in the proposition David Webb met with Maria as a concept. Figure 19: Filtering panel: (a) Filter options expanded include concept type, users, and propositions type. (b) Filter options expanded include concept type and date picker. (c) Filter options expanded include concept type and properties. 24 DRDC-RDDC-2017-R106

35 Figure 20: Associations check-box is selected in this screenshot. Orange lines represent association links and connect linking phrases and concepts that have shared properties although are not part of the same proposition. Figure 21: User clicks on the proposition David Webb met with Maria and the details of the proposition is displayed to the right of the CMap under Info tab. DRDC-RDDC-2017-R106 25

36 Selection ( Info tab): The CMap graph visualization of propositions does not include the propositions properties, author, or sources because the graph would quickly become too busy and difficult to read. To provide the information however, Sharik supplements the CMap by displaying details of any selected proposition in the Info tab to the right of CMap panel. To view the details of a proposition, users could select the proposition by clicking on its linking phrase. The system will then display its properties, sources, and author under the Info tab (Figure 21) Timeline View At the bottom of the CMap, right below the CMap panel, propositions containing date properties, are displayed on a timeline panel. Through this visualization, analysts will quickly be able to detect propositions occurring at the same time or propositions occurring in a sequence. Again, this display is only useful for those propositions that have a date property assigned to them. Figure 22: The Timeline panel is displayed at the bottom of the CMap panel. Dated propositions are displayed as boxes. The length of boxes represent the time duration associated to each proposition through date property. 26 DRDC-RDDC-2017-R106

37 Figure 23: PIR home page with +create Int Brief (.ppt) button highlighted at the bottom-left INT Brief Preparation During or at the end of an analysis task, analysts may need to present their interim or final findings through an INT brief presentation. Sharik helps analysts create PowerPoint presentations in a semi-automated way and based on the propositions and notes submitted under each PIR. At the bottom of the left-most panel in each PIR s main page, there is a +Create New Int Brief button (Figure 23). Once user clicks on this button, they will be asked to select the PIR(s) for which they want to create a presentation (Figure 24). Once the content (i.e., Propositions and Notes) of selected PIRs are loaded, they will be shown in a table though which users will select propositions (along with their related notes) or standalone notes of interest (Figure 25) to be include in the presentation file. DRDC-RDDC-2017-R106 27

38 Figure 24: User selects which PIR s data should be loaded for thbe purpose of creating a PowerPoint presentation. After selecting some propositions and/or notes, users would then have to assign their selections to one of the presentation slides. A default set of slides with default titles are provided ta the bottom of the content table (Figure 25). However, users could change the default titles by clicking on them. Also, users have the option to delete or add new slides. Once analysts are happy with the selection and arrangement of propositions across the slides, they would then click on Microsoft Power Point icon (to the left of the slides panel) and then choose the appropriate classification level for the presentation file (Figure 26). The system will automatically create a Power Point presentation and asks the user for a folder path to store the.ppt file. 28 DRDC-RDDC-2017-R106

39 Figure 25: User selects PIR1 Who is Jason Bourne?, and content (notes and propositions) of the selected PIR is loaded into the content table. User will selecetd porpositions and notes from this table and add them to one of the slides shown at the bottom of this screenshot. DRDC-RDDC-2017-R106 29

40 Figure 26: The system asks the user to enter the appropriate classification level for the presentation file to be created Commenting and Messaging To facilitate communication among collaborating analysts, three key features are provided in Sharik: commenting, messaging, and Live Chat. Messaging: Users could look up each other and send messages to one another. Messages are private and can only be read by the two sides of the conversation. The system will notify users of new messages through the top menu bar (Figure 28). Live Chat: When two analysts are logged-in at the same time, in addition to sending messages to one another, they are also able to communicate with each other in a live chat room. This feature has been implemented in Sharik 2.0 but not available yet at this time. Commenting: Analysts can add comments to any note, proposition, or Entity Wiki page. A threading feature is also available for replying to an existing comment. Comments are published publicly and all the project members are able to review and/or comment on them. Whenever a comment is submitted to a content, the user who has created the content, along with all the users who have commented or subscribed to the content, will be notified of the new comment through the top menu bar (Figure 29). 30 DRDC-RDDC-2017-R106