SSS Research, Inc. – DECIDE

VAST 2006 Contest Submission
July 2006

Authors and Affiliations:

Russell A. Lankenau – SSS Research, Inc.  russell.lankenau@sss-research.com

M. Andrew Eick – SSS Research, Inc. aeick@sss-research.com

Alexander Decherd – SSS Research, Inc. alex.decherd@sss-research.com

Maxim Khailo – SSS Research, Inc. maxim.khailo@sss-research.com

Phil Paris – SSS Research, Inc. phil.paris@sss-research.com

Jesse Fugitt – SSS Research, Inc. jesse.fugitt@sss-research.com

 

Tool(s):

DECIDE is a tool developed by SSS Research, designed to aid analysts in organizing intelligence data, constructing hypotheses, and performing analysis of competing hypotheses.

 

DECIDE programming team

      Andy Eick – Chief Software Architect

      Russ Lankenau – Software Engineer

      Alexander Decherd – Software Engineer

 

FreeMind is a simple mindmapping tool available without cost from http://freemind.sourceforge.net.

 

TOC:  Who – What – Where – Debriefing - Process
          VIDEO – 2 page summary

1. WHO: who are the players engaging in deceptive activities in the plot(s)?

Name	Most relevant source files (5 MAX)
Bruce Rinz	1101243338500,
Laurel Sulfate	Voter Registry, 1101243338500, 1101240332919
John Torch	picture 084, picture 085
Alejandro VonRyker	Scientific Review 3, Scientific Review 4
Delwin Sanderson	Scientific Review 3, Scientific Review 4

2. WHAT:

  What is the time frame in which the plot(s) unfolded?
  Which events occurred during this time frame that are most relevant to the plot(s)? 

 

Time Frame

August 2001-April 2004

 

 

	Event	Date Can be a range	Most relevance source files (5 Max)
1	VonRyker Institute AG closed due to bioethics violations, fraud, and misuse of government funds	August 2001	Scientific Review 3, Scientific Review 4
2	Mad Cow Disease scare in Alderwood area	December 2001	1101243512780
3	Phone calls made from City hall establishing link to Switzerland	January 2002	Conference Room Phone Log
4	Boynton Labs founded	Sept 2002	1101243338500
5	Someone (possibly Laurel Sulfate) modifies voter registry	Sept 2002?	Voter Registry
6	Second individual modifies voter registry	Unknown	Voter Registry
7	Bruce (Augustus?  Mike?) Rinz serves as Interim City Manager	Several periods: Jan 2002 – May 2003	1101243423983, 1101243183934, 1101163904092
8	John Torch and Laurel Sulfate photographed together	April 2004	Photo 084, Photo 085, Photo 083
9	Laurel Sulfate vacationing in Switzerland	April 2004	1101163356001

---

3. WHERE: What locations are relevant to the plot(s)?

	LOCATION	Most relevance source files (5 Max)
1	Switzerland	Conference Room Phone Log, Scientific Review 3, Scientific Review 4, 1101163452222
2	Alderwood	Voter Registry, Conference Room Phone Log

 

---

4. DEBRIEFING

Plots

            Hypothesis: Political corruption is present in the Alderwood government.

            Political corruption seems to be present in several forms: election tampering, unethical behavior, and deception all seem to be present in one form or another during the period of January 2002 - March 2004.

 

            Evidence of election tampering is present in the Alderwood Voter Registry.  It appears that at least two different individuals have tampered with the registry.  Both made mistakes which can be used to identify which records are fraudulent.             

 

            The first individual input dates of birth in an incorrect format; all records inserted by this individual have a date of birth of 8-Apr-34, and a registration date from one to four years after this date.  These records also reuse the same set of first names several times.  There are 73 records of this type inserted into the registry.

 

            The second set of records was properly formatted, but the registration dates did not seem to correspond to the dates of birth listed.  In the state of Washington, an individual must be 18 by the date of the next election to register to vote.  Many of the records contained registration dates which preceded the date of birth listed.  Other records contained registration dates which were well before (>10 years) the date on which the individual could conceivably register. 

 

            With the exception of the aforementioned records, the majority of the records indicate that the registered individual registered when they were between the ages of 17 and 40.  There was one exception: Laurel Sulfate was registered on 8/1/2002, at the age of 16. This should not have been possible, since mid-term elections took place on Nov 5, 2002, before Sulfate was eligible to vote.  This leads me to believe that Laurel Sulfate was somehow connected to the first instance of election tampering, since the style of her record best matched the style of that saboteur.

 

            Someone in the Alderwood government seems to be involved with an entity in Switzerland, as well. The City Hall conference room records show calls to entities in Berne and Kriens on several occasions in January of 2002.  Bruce Rinz has his own phone line as City Attorney, so it is not likely that he made these calls, and there is no indication of activity involving the Swiss development company this early in the timeline, so it is more likely that these calls were related to the founding of Boynton Labs.

 

            Bruce Rinz also seems to be involved in something not entirely aboveboard.  There is no listing in the voter registry for a Bruce Rinz, which seems strange for a public official.  There is, however, a listing for Augustus Rinz.  The individual serving as Interim City Manager is referred to in several articles as Bruce Rinz, and later as Mike Rinz.  It seems plausible that Augustus Rinz is using an alias for some reason. If the date of birth reported in the voter registry is correct, Rinz would be 49 years old, which is probably in the correct age range for someone who is a lawyer and active in city government.

 

            The voter registry indicates that Augustus Rinz was born in Switzerland.  This may support a connection between Rinz and an entity in Switzerland.  There are several entities in Switzerland which show up in the data set: a Swiss developer which may be interested in developing the land purchased from the Monson family, the entities contacted from the City Hall conference room in January of 2002, and the VonRyker Institute AG.

 

            However, Rinz registered to vote at the age of 20, which indicates that he was a US citizen at this time.  In order to become a naturalized citizen, Rinz would have had to reside in the US for at least 5 years prior to his application for naturalization. To establish the required residency period, Rinz would have needed to leave Switzerland on or before 1/7/72, which seems to reduce the probability of his connection to entities in Switzerland.  This does, however, depend on the accuracy of the voter registry, which has already been called into question.

 

            Rinz also seems to be financially connected to the Washen Foundation, an organization which provided a great deal of the funding for Boynton Labs.  There seems to be enough evidence that Rinz is involved in something to warrant further investigation.

            Hypothesis: Boynton Labs is engaged in unethical conduct.

            Both Dr. Alejandro VonRyker and Dr. Delwin Sanderson, chief scientists at Boynton Labs, were involved in the VonRyker Institute AG, which was closed due to violations of bioethics, fraud, and misuse of research funds.  The work done at the VonRyker Institute was very similar to that done at Boynton Labs.  It may be that the same kind of unethical behavior that went on at the VonRyker Institute continues at Boynton Labs.

 

            VonRyker faked two papers on synthetic transmissible prion diseases while director of the VonRyker Institute, and a news story from the Alderwood Daily News reports that Boynton Labs is continuing research in this area. It is possible that VonRyker and Sanderson are simply using Dr. Boynton, who is a reputable scientist, as a front for continuing unethical activities.  The phone calls made from the City Hall conference room occurred immediately before the opening of Boynton Labs was announced and shortly after the VonRyker Institute was closed.  If further research into these phone calls indicates that they support a link between Alderwood and the VonRyker Insitute, this may indicate that it was VonRyker who is truly in control of Boyton Labs.

 

            The highly publicized bovine spongiform encephalitis cases found in the Alderwood area may have provided VonRyker and Sanderson an opportunity to open a lab where they could continue their research without arousing suspicion.

 

            Laurel Sulfate’s vacation to Switzerland also seems too convenient to be coincidence.  It definitely appears that there is a continuing connection between Boynton Labs and some entity in Switzerland.

            Hypothesis: Boynton Labs is connected to the Alderwood city government.

            There are clearly several personal connections between individuals in the Alderwood government and individuals employed by Boynton Labs, but the Alderwood city government may also be granting Boynton Labs political favors in an attempt to jump-start the local economy.  Several people may also have personal reasons for wanting Boynton Labs to be successful.

           

            There are rumors that Bruce Rinz is heavily invested in the Washen Foundation, which is a major stockholder in Boynton Labs.  He may be using his positions as City Attorney and City Manager to influence city politics to support Boynton Labs. 

 

            Laurel Sulfate appears to be linked to election tampering, as well as being romantically linked to John Torch and being connected to both the Alderwood city government and Boynton Labs.

 

            Laurel Sulfate is listed in the voter registry with a registration date of 8/1/2002, a full year before she would be eligible to register.  There are over 150 other entries in the voter registry which give registration dates before the registered individual would be eligible.  Sulfate worked as the Mayor Rex Luthor’s aide in 2002, so she may have had an opportunity to tamper with the voter registry at this time.

 

            Photos from April 2004 show Sulfate with John Torch.  These photos seem to indicate that some relationship exists between Torch and Sulfate. Since Torch was active as a councilman at this time, their relationship seems to indicate that Sulfate might be able to influence city politics.  Since Torch and Sulfate worked together when Sulfate was the Mayor’s aide in 2002, their relationship may go back as far as 2002.

 

            Beginning in September 2002, Sulfate is linked with Boynton Labs.  On September 15^th, 2002, she is listed as executive assistant to Dr. Philip, and by September of the next year, she is listed as spokesperson for Boyton Labs.  Her rapid advancement, combined with her connections in the Alderwood city government, may indicate that she is influencing the political situation in Alderwood to benefit Boynton Labs.  Further investigation of Sulfate is probably wise.

 

           

5. VISUALS and Description of ANALYTIC PROCESS

            The overarching strategy I applied to the Alderwood data set was to identify key players, pick out the events each of these key players was involved in, and discover the relationships between each of the players based upon their interaction.

 

            My initial strategy in analyzing the data set was to perform broad searches to identify key players.  DECIDE provides local search capabilities through integration with Windows Desktop Search, so I began by searching the provided news articles for general terms provided in the “Analysts background” document.  Initial searches for “Alderwood Scientist” and “Boynton” returned a fairly long list of documents, which I examined using DECIDE’s Document Preview function.

 

 

            From the documents returned in my initial searches, I created a list of keywords and names for further search.  I maintained a mindmap in FreeMind to visually keep track of connections as I discovered them.  My initial goal was to determine key players, key events, and important locations contained within the data set, to facilitate deep searches later in my analysis.

 

            My initial searches revealed that some of the key individuals in the Alderwood city government were Rex Luthor, John Torch, Bruce Rinz, George Greenway, and Robert Rockford.  There were a few names which were often seen in connection with Boynton Labs: Dr. Philip Boynton, Laurel Sulfate, Dr. Delwin Sanderson, and Dr. Alejandro VonRyker. 

 

 

            Based on deep searches beginning with the names listed above, I began to create evidence items in DECIDE to capture information about each individual.  An evidence item in DECIDE represents a distinct datum which is evaluated for credibility based on a set of attributes describing the reliability of the source, the plausibility of the information represented in the item, and the quality of the information.

 

            Initially, I created evidence items detailing the connection between Laurel Sulfate and John Torch; the connection between Bruce Rinz, the Washen Foundation, and Boynton Labs; the phone calls made during January of 2002; and the issues of fraud and ethical misconduct associated with the VonRyker Institute AG.

 

            I attempted to investigate links between individuals by searching names in combination with each other, but this turned out to be less helpful than I expected.  The set of individuals I was interested in tended to show up in most of the same documents, so searching for “Boynton AND Sulfate” returned almost as many documents as searching for “Sulfate” alone.

 

 

            After creating my initial collection of evidence, I went back to the original background document and reviewed the information which prompted the investigation of Alderwood.  The initial background information mentioned that the influx of high-tech talent into Alderwood was supported by the “high-rolling bigboys at City Hall,” so based on this premise, I created three hypotheses: political corruption is present in the Alderwood city government, Boynton Labs is involved in unethical conduct, and that there exists some degree of connection between the Alderwood city government and Boynton Labs.

 

            The conference room phone log and voter registry came up repeatedly in my initial searches, but I hadn’t explored them very thoroughly at this point in my analysis, so I decided to investigate them further.  Several of the news stories in the data set had mentioned absentee ballots, and I reasoned that if I were attempting to tamper with an election, the safest way to do it would be to insert false records into the voter registry and then vote via absentee ballot.

 

            Assuming that tampering of this kind was going on, I examined the records in the voter registry in Microsoft Excel.  I sorted each column individually and examined the high and low values.  This revealed that the registry contained improperly formatted dates in the DOB column.  I examined those records and noticed that the registration dates listed did not match either.  In order to more easily examine the difference between date of birth and registration date, I wrote a function in a spare column to calculate the difference in years.  Sorting on this column revealed that there were other records which were invalid.  It also revealed that Laurel Sulfate registered to vote a full year before she was eligible.  I created several evidence items to capture the information I had discovered in the voter registry.

 

            Glancing over the conference room phone log, several calls jumped out immediately.  The majority of the calls were made within the 509 area code, but five calls were made that required a different country code, and five calls were made to different area codes.  Some quick internet research revealed that the international calls were to Berne and Kriens, Switzerland.  The long-distance calls were to law firms in Seattle, and to a number in Toronto.

           

            DECIDE’s overview screen provides several ways of examining arguments based on statistics, structure, and evidential content.  I used the comparison view to examine the evidence in my collection, and noticed a spike of activity in early 2002 (the highlighted section of the image below).

 

 

            Further examination of the evidence from that period revealed that most of the activity was due to the phone calls recorded in the conference room phone log, but there were also several events related to bovine spongiform encephalitis, which suggested that there might be a connection.  The closing of the VonRyker Institute and the founding of Boynton Labs occurred immediately before and after this spike of activity.  This information, as well as the fact that the VonRyker Institute was located in Switzerland and the connection between Dr. VonRyker and Boynton Labs, suggested a connection between the VonRyker Institute, Boynton Labs, and the Alderwood city government.

 

 

            After reviewing my hypotheses, I revised them to include possible alternate hypotheses.  These alternate hypotheses provide an explicit definition of possible alternate explanations which would not support the root hypothesis, and provide structure for intelligence collection tasking.         The data set provided little support for the alternate hypotheses I devised, but by enumerating alternate possibilities, I aimed to eliminate getting locked into one view of the data that looked promising.

 

            I examined my final hypotheses using DECIDE’s Analyzer screen, which uses Heuer’s method of Analysis of Competing Hypotheses to evaluate the plausibility of a given hypothesis based on evidence.  The image below shows that each hypothesis has a high probability of being valid, given the current set of evidence. 

           

           

            The final step in this analysis would be additional evidence collection to establish the plausibility of alternate hypotheses.  At this point, the hypotheses listed above seem plausible, but additional investigation is required to either confirm the primary hypotheses or provide support for alternate hypotheses.

           

TOC:  Who – What – Where – Debriefing - Process