ScriptNet: An integrated criminological-network analysis tool

ScriptNet is a software package that facilitates a visual analysis of the organisational aspects of criminal enterprise, together with a visual analysis of the network of people, organisations, places and resources that are in some way involved in the commissioning of these goal-oriented crimes. The software is geared towards those interested in analysing varied food crimes (e.g., food fraud, counterfeit alcohol) that are of an entrepreneurial nature, that is, criminal activities involving multiple people in order to generate financial gain. The software was developed in collaboration with the Food Safety Authority of Ireland (FSAI).

ScriptNet can be used by a variety of groups—including law enforcement authorities, non-governmental organisations, academic and social researchers, and many more—to visualize the connections between the different stages of pre-planned criminal behaviours and the people or organisations who play different roles, in different places, using different resources to accomplish specified criminal goals. ScriptNet is an amalgamation of the terms ‘script’ and ‘network’ that in turn represent two analytical approaches to understanding criminal and social behaviours.

Script derives from a criminological analysis technique termed crime script analysis (Cornish, 1994), a powerful tool to generate and organise knowledge about the procedural aspects and procedural requirements of the crime commission process. It specifically identifies the different ‘scenes’ that make up the crime commission process including the decisions, actions and resources required at each stage, as well as the cast of actors involved. Scripts therefore provide a way of understanding the steps that take place across different scenes of the criminal enterprise. ScriptNet uses crime script analysis to enable the deconstruction of (a) what has to be done, (b) by whom, and (c) under which (facilitative/conducive) conditions in order to accomplish serious and organised crimes. It facilitates a systematic approach to organising knowledge of criminal enterprise for the identification of critical points of vulnerability for enforcement and/or regulatory interventions.

Network derives from social network analysis, and specifically from the framework of multi-mode and multi-link networks (Carley, 2003; Schwartz and Rouselle, 2009; Morselli, 2010). This approach has a lot in common, and a lot to offer, to link analysis, a widespread tool in criminal investigations. Link analysis, “also known as association analysis, explores the connections between individuals involved in criminal activity through their links to each other and through their links to organizations, objects, places and events related to the crime” (Strang, 2014, p. 4). Multi-mode multi-link network analysis maps individual and collective actors, together with resources they can access and places where they are located, and the various types of relationships that may link them. In a crime investigation, individuals and organizations can constitute suspected nodes, and can be linked by telephone calls, business transactions, goods delivery and the like. Social network visualizations are useful to detect which nodes may be pivotal in connecting criminal activities, which groups of nodes may collaborate in a criminal operation, or which nodes could substitute others in specific tasks.

Script analysis and network analysis have recently been successfully used in combination to uncover the underlying structure of criminal networks and the procedural steps these networks take to commit crimes. Morselli and Roy (2008), for example, identify the actors who liaise between different scenes of the crime scripts, facilitating the collaborations between people involved, but also the feasibility of alternative criminal routes, in two stolen-vehicle exportation (or ringing) operations. Bright and Delaney (2013) adopt a similar method to analyse the growth of a drug trafficking network manufacturing and distributing methamphetamine: they observe the flexibility of the network structure in adapting around multiple facets where these facets provide alternative routes for the crime commission process. Duijn and Klerks (2014) combine social network analysis and crime script analysis in investigating a criminal group involved in organised cannabis cultivation. They observe criminal, kinship and affective relationships linking individuals involved in the crime commission process, and combine this actor-by-actor network with a two mode network of actors participating in different crime scenes.

Morselli and Roy (2008) look at a cross-sectional network, i.e., a network that collapses the dimension of time in a single observation. Bright and Delaney (2013) introduce a temporal element by observing the network at a different time point. In both studies, however, individuals are assigned by the investigators to a single crime scene they contribute the most, discounting the other aspects of the crime they may participate in. Duijn and Klerks (2014) extend these approaches allowing individuals in their case study to participate in more than one scene, and therefore to contribute to more procedural steps of the crime.

As the interest in combining social network analysis and script analysis is growing, we see an initial emergence of tools that aim at operationalising the procedural aspects of mixing these two theoretical and methodological frameworks (Brants, 2019). ScriptNet contributes to these attempts by proposing a simple tool to visualize suspected criminal networks. In ScriptNet, the investigators can create a node for each entity involved in the crime (person, location, resource and organisation) and add a series of nodes’ attributes that are visualised automatically with nodes’ shapes and colours. The investigators can then link these nodes with edges representing different types of relationships (personal, communication, financial, business, ownership, working or geographical relationships) which again are visualised with different colours. ScriptNet incorporates four predefined ‘scenes’, or stages, of the criminal activities under investigation: preparation, pre-activity, activity, post-activity (Tompson and Chainey, 2011, pp. 188–189). The investigators can assign each node (actor, organization, resource, and location) to any scene of the ‘crime script’, to visualize the connective points and bridges across the procedural steps of the crime commission process.

Below we illustrate the functions and features of ScriptNet using data provided by the FSAI. The regulator was investigating a number of related cross-border cases involving the distribution of counterfeit vodkas and wines and provided us with access to extensive and detailed case files. Specifically, the investigation focused on subsequent seizures of counterfeit alcohol delivered from Jurisdiction A to the same Jurisdiction B destination via similar transport strategies. The North Case (September 2013) seized counterfeit Vodka (Vodka 1) that was sent to a food wholesale company in Jurisdiction B via legitimate international transport networks, while the Delivery Ltd case seized the same type of Vodka from the same wholesale company (April 2014) using an alternative international transport network. Other seizures of Vodka bottles, with the same identification numbers embossed in the base and the same counterfeit caps but different labels (Vodka 1 and Vodka 2), were also seized subsequently across Jurisdiction B, while in July 2014 a batch counterfeit wine was seized that was sent to a private customer by people involved in previous consignments using the same transport method.

The full case descriptions and the script analysis are published in Lord et al. (2017), while in Bellotti et al. (2020) the same data are analysed mixing script analysis with multi-node multi-link social network analysis. We refer the readers to those publications for a detailed account of the results. One of the outcomes of our analysis was the development of ScriptNet, which we use here to reproduce the data to highlight the features, advantages and limits of the tool. All names of jurisdictions, people, organizations and counterfeit goods have been anonymised.

On opening, ScriptNet looks like a Window interface, with menus at the top left; button for quick links to the top left and top right; a node and edge legend on the right of the visualization screen; and four main functions to generate networks and assign scenes at the bottom (Fig. 1).

Figure 1:

Step 1: visualize the network

In the case of counterfeit alcohol distribution that we use to illustrate ScriptNet features, we had six different type of nodes, representing persons, logistic and transport businesses, storage and selling businesses, locations, websites, and the counterfeit goods (Vodka 1, Vodka 2 and Wine). We start by adding the people with suspected involvement in the crime, and the relationships that link them. We first click on “Add node” where we can choose what type of node to add (person, location, resource, organization). We select “Add a Person” and a separate window opens (Fig. 2). This window allows us to specify the characteristics of the person we want to add, like their role in the crime commission process (suspected primary offender, suspected co-offender, suspected facilitator, suspected victim, regulator, other, or unknown role), where they are geographically located, their gender, and the jurisdiction in which they operate compared to the one where the primary criminal activity is committed (local, national, transnational). Note that once added, node labels can be switched on and off using the “show label” button on the top right, to guarantee anonymity in the visualization, if needed.

Figure 2:

In our case, there were 18 people suspected to be involved in the distribution of counterfeit alcohol, either as primary offenders, co-offenders, facilitators or potential victims (Fig. 3). This information may change during the investigation: pub landlords could initially be assumed to be victims of counterfeit alcohol distribution, but subsequent evidence may indicate their collusion with the criminals as facilitators in selling counterfeit alcohol. By clicking on each individual node information can be modified, or nodes can be deleted.

Figure 3:

Next, we add the relationships that link suspected people with each other (Fig. 4). In ScriptNet we have the option to distinguish between personal, communication, financial, business, ownership, working and geographical relationships. For example, Alan is Paul’s father, John is Andrew’s brother, and Sean is Stephen’s brother. Stephen is linked via social network sites to David, John and Andrew, and Tom to John, so we consider all these as personal relationships. David is the owner of a courier firm, with Michael and Graham working for him as drivers (working relationship), while Tom works for Philip. Sean sold counterfeit wine to Richard, who paid cash (financial relationship). Note that some people are not directly linked by any type of relationship to any other individual (Helen, Mark, Sarah, Peter).

Figure 4:

Next, we add logistic/transport businesses and storage/selling businesses as “organizations” via the “Add Node” function (Fig. 5). Organizations can be characterised according to their function (production, distribution, trading/wholesale, transportation, retail, disposal), to their role (suspected primary offender, suspected co-offender, suspected facilitator, suspected victim, regulator, other, or unknown role) and to their sector (construction, real estate, banking, etc.). Investigators can also indicate if organizations are private or public, their geographical location and their jurisdiction.

Figure 5:

We then link organizations to individuals and to other organizations again using the “Add Relationship” function (Fig. 6). For example, Patrick, Paul and Alan own storage spaces and food and groceries wholesale companies (ownership relationship), David owns a courier firm, while logistic networks that transport counterfeit alcohol are linked by business relationships.

Figure 6:

Counterfeit alcohol distribution was organised along two routes. The North Case was organised by James, who contracted ABC Logistics to collect consignments from a storage facility in Jurisdiction A and deliver them to Food Wholesales and NE Grocery in Jurisdiction B. The Delivery Ltd case was organised by David, owner of a local courier firm, who delivered several consignments to an international logistic company, Parcel network. Consignments were subsequently subcontracted by Parcel network to a series of transport companies that shipped them from Jurisdiction A to Jurisdiction B. As Food Wholesale was already known by the regulator as a possible co-offender, the suspicion is that David diverted the consignment to a nearby MOT garage (MB Testing) on purpose. Upon delivery, MB testing asked Bard, the transport company in charge of the final leg, to drop off the parcel to Food Wholesale. The two alternative routes of distributions (September/ April) are considered as two facets of the same scene, and are clearly visualised in ScriptNet as the two long green paths between red nodes and connected in the middle by Food Wholesale (Fig. 6).

There were several locations where counterfeit alcohol was subsequently seized: of some we had details of the type of organization (bars, shops, websites, etc.) while for others, for example seizures conducted by other regulators, we only know the geographical location. Some of these seizures were connected to the distribution case under investigation because the bottles’ identification numbers were the same of the two main seizures described above. We use the “Add Node” function to add locations, for which we can specify the geographical location, the jurisdiction and the function (offending location, meeting, storage, hideaway, unknown). Using the same function, we add the type of alcohol seized to our network as a resource, for which we can specify again the geographical location, the jurisdiction and the function (production, distribution, acquisition, exchange, facilitation, finances). We then add edges connecting in various ways locations and resources with other nodes (Fig. 7).

Figure 7:

ScriptNet visualises by default the whole network as we input it in (Fig. 7), but the function “Apply Visualization” allows us to focus the attention on single nodes—with all types of relationships linked to it—or single types of relationships—with all nodes linked by these. Figure 8, for example, visualizes only the relationships directly linked to an individual actor (David), while Figure 9 visualizes only business relationships.

Figure 8:

Figure 9:

Step 2: Visualize the Scenes and other visualizations

We can now assign the network’s nodes to the four scenes predefined in ScriptNet. These are preparation, pre-activity, activity, post-activity. We consider the main criminal activity that of distributing counterfeit alcohol; preparation includes identification of storage facilities and logistic couriers; pre-activity involves making arrangements for the transport—i.e., contracting delivery companies—while selling activities and seizure locations (as in selling points) are included in the post-distributing activity. To assign scenes, we simply select the type of scene from the left window that opens up with the function “Assign scenes” and click on every node we want to include in that scene (Fig. 10). Nodes can be assigned to multiple scenes.

Figure 10:

We can now visualize the scenes with the function “Apply Visualizations”. Figures 11 to 14 show individual scenes, while Figure 15 visualizes the four scenes together.

Figure 11:

Figure 12:

Figure 13:

Figure 14:

Figure 15:

Finally, we can apply the visualization of jurisdictions (Fig. 16). In our case, the investigation revealed transport of counterfeit alcohol across Jurisdiction A and Jurisdiction B. As the primary criminal activity was conducted in Jurisdiction A, we consider people, organizations and locations in Jurisdiction A as national, while the ones in Jurisdiction B as transnational. The function also allows us to visualize the geographical location of the nodes, as in the national countries where they are located: in our case we only have nodes in Jurisdiction A and Jurisdiction B, so the geographical visualization corresponds to the jurisdictional one.

Figure 16:

Once created, ScriptNet cases can be saved and opened up again using the quick link button “Cases”, so visualizations can be quickly retrieved and modified. Likewise, individual visualizations can be exported as screenshots using the quick link button “Export”.

Figure 15 visualizes the whole networks with assigned scenes. The visualization allows us to draw some information about the crime commission process. For example, we notice that the network is fully connected. We might not see all the people involved in the crime commission process because investigators have not detected them, and some of the relationships may have gone undetected too, but the connectedness clearly suggests that the various seizures are related to one single criminal case, and allegedly to one criminal group. Investigators knew seizures were connected by bottles’ identification numbers, points of delivery and personal relationships, but ScriptNet immediately reveals this information in one single picture of the crime commission process.

Such picture clearly identifies not only if people are connected either directly or via shared resources, locations, and organizations, but also which nodes may be pivotal in connecting criminal activities via different scenes and which nodes could substitute others in specific tasks. The network visualizations, and the superimposed script analysis, facilitate the process of organising information in complex investigations and exploring potential paths that link several enquires and seizures. For example, the visualization suggests that Philip may have an important role in liaising across different crime scenes: during the investigation, this information was passed onto the regulator who increased surveillance and found further important elements indicating the central role of Philip in the crime commission process. As the regulator does not directly press charges but work as background intelligence, we do not know if the information retrieved by combining network with script analysis could be potentially used as evidence in court, but it surely helped advancing and focusing the investigation.

We also notice that there are only few nodes identified as part of preparation and pre-activities. This may be due to lack of information collected during the investigation, or to a hierarchical organization of the criminal group where the planning and preliminary steps of the crime are in the hands of few individuals. Moreover, nodes and edges assigned to the activity phase are only partially overlapping with preparation and pre-activity, but not with post-activity. This suggests specific strategies of the criminals:

They seem to use long chains of legitimate logistic networks where alcohol can be easily concealed as a legitimate product and therefore can travel unobserved. Because the logistic companies they use are not required to check the content of parcels, once the illegal consignments are embedded in the licit chain of local and transnational transport, they become highly invisible to authorities. However, if discovered, it is easy for authorities to track the reverse process of collection and delivery, and initiate investigations that involve the licit business in charge of storing the alcohol at beginning and ending point of delivery.

There is another software available on the market that partially cover some of ScriptNet functions. IBM distributes the Security i2 Analyst’s Notebook

IBM Security i2 Analyst’s Notebook—Resources—United Kingdom|IBM.

There are also many visualization tools for social network analysis, some of which freely available on the web, but again they do not combine it with script analysis. To our knowledge, the only other attempt to mix script analysis and network analysis in an analytical and visualization tool has been proposed by Brants (2019), who used a graph database model to represent data, and a graph query language to identify criminal networks via script analysis. Brants’ proposal is more advanced and refined than ScriptNet, but less user friendly and therefore more difficult to be adopted by a wider audience that includes, for example, law enforcement authorities, non-governmental organisations, academic and social researchers.

However, ScriptNet is not intended to substitute other tools, but to complement them by offering a freely available, easy to use and open-source application that can facilitate the discussion and reasoning around crime commission processes.

It is innovative because it allows us to:

Visualise crime scripts together with social networks.

As the aim of this article is to present ScriptNet tools and features, we discuss only the limits of the software, without addressing the limits of script analysis and network analysis applied to criminal investigations.

In its current release ScriptNet does not implement an import function, which means that networks and scenes need to be manually inputted by users. The goal of the software is to guide investigators to identify entities involved in the crime commission process, their connections and their role in the criminal activity. Importing data from other sources was not a priority in the development of this proof of concept. Once the network has been inputted, however, it can be not only saved and retrieved, but also exported in two csv files, one with the node list and nodes’ characteristics, and one with edge list and edges’ characteristics. These files can be easily imported in most of mainstream statistical and social network software, like RStudio, Ucinet, Pajek, Stata, SPSS, etc.

As data are imputed manually by users, they can be affected by instrument biases, by which the nature of the data collection task can suggest or nudge individuals into withholding important data or including unnecessarily or extraneous details (Hogan et al., 2020). As nodes and edges that are added in ScriptNet are not being drawn from memory but are suggested by evidence from the case, such instrument biases should be reduced, but further work is needed to test the validity and reliability of ScriptNet data input.

ScriptNet can also currently only visualise cross-sectional data. We do know from the literature that the temporal aspect is key when investigating crime commission processes (Bright and Delaney, 2013), so adding time stamp to the data would be ideal to identify alternative and subsequent facets.

Likewise, more flexibility could be added in classifying geographical locations, which in the current release are only identifiable at the national level. Investigations instead usually require much more fine grain details about where criminal activities happen, and extending the geographical visualization where nodes could be pinned to a geographical map would be extremely useful to enhance precision and granularity of the spatial extension of the crime commission process.

Nodes and relationships features, as well as scenes, are predetermined in ScriptNet, which means that users cannot modify the categories used to describe aspects of the crime. This is partially due to the fact that the current version of ScriptNet was developed to suit the specific needs of the FSAI. Future releases could be modified according to other needs, for example by extending the type of scenes, or by adding different types of nodes and links.

There is however a more substantive reason for the inflexibility in categorizations. When conducting the analysis of networks and scripts nodes and relationships need to be assigned to a predefined set of categories to facilitate the visualizations, as well as they need to be assigned to predefined scenes to observe alternative facets. If categories were not pre-defined, for example if organizational nodes could be described with a variety of terms like “firms”, “institutions”, and the like, it would be difficult for investigators to be consistent in the classifications, and the shape and colour visualization would be too diverse to be meaningful. Likewise, the flexibility of assigning scenes would make impossible to compare crime scripts across different cases, which ultimately is one of the goals of ScriptNet.

A free-text note function would be useful, allowing additional free text information to be inserted for nodes, ties and scenes. This would alleviate the limitations stemming from fixed categories discussed above, where investigators could label nodes and ties according to the relevant categories, but add a note detailing, for example, what type of “personal” relationship links two individuals, or any other information the investigators believe to be relevant for the case.

When designing ScriptNet we needed to reach a compromise between crime specificity and generalization. By forcing pre-defined categories, we ask users to abstract from the contextual details of criminal activities and represent crime commission processes with categories that are comparable across cases. In doing so we hope to provide a tool that is unique in its capability of representing criminal activities with enough details to facilitate investigations, for example by offering the possibility of visualising the points of intersection and vulnerable spots where guardianship may intervene. We also want to provide a tool that offers enough generalizability to produce insights on commonalities and differences between various crime commission processes. This should help academics and social researches to advance the study of crime scripts and criminal networks, where network structures and scripts could be generalizable to a whole class of transit crimes, or portable to other type of illicit activities that are of an entrepreneurial nature.