Data Fusion, Link Analysis & Investigative Analytics
How agencies connect people, vehicles, phones, accounts, addresses, locations, incidents, records, transactions, cameras, and other data to identify relationships and investigative leads—and what personnel should understand about entity resolution, link charts, timelines, association versus causation, data quality, source reliability, inference, privacy, discovery, auditability, and human judgment.
What this explainer does
Investigations frequently involve information distributed across many systems. A suspect's name may appear in an RMS report. A vehicle may appear in ALPR data. A phone number may appear in another case. A business address may be associated with several people. A camera may capture the same vehicle near a crime scene.
Data-fusion and investigative-analytics systems help analysts bring those records together, normalize them, identify possible common entities, visualize relationships, create timelines, and search for patterns that may be difficult to see when each database is reviewed separately.
The technology can reveal relationships within information. It does not automatically establish what those relationships mean. A shared address may indicate relatives, roommates, former residents, a business relationship, a data error, or nothing relevant at all. Investigative interpretation and corroboration remain essential.
Modern analytical environments increasingly combine records from multiple government systems and, where lawfully available, external information sources. Their value often comes from reducing the time required to discover connections among people, places, vehicles, devices, incidents, and records.
DHS describes fusion centers as state and local information-sharing hubs that gather, analyze, and share information for terrorism, crime-prevention, and broader public-safety purposes. The same basic analytical principle— receive, analyze, connect, and disseminate information—also appears in many local investigative and RTCC systems.
1. Overview
Investigative analytics is the process of organizing and examining information so that relationships, patterns, sequences, and anomalies become easier to identify.
Link analysis itself is not new. Law-enforcement analysts have used association matrices and link diagrams for decades to visualize connections among people, organizations, events, and records. Early police-intelligence literature described a process of assembling information, identifying relevant relationships, creating an association matrix, developing a link diagram, and refining the resulting network as more information became available.
What has changed is scale. Modern systems can ingest millions of records, resolve entities across datasets, query multiple databases rapidly, map relationships geographically, and generate visual networks in seconds.
2. Potential Data Sources
Incident reports, persons, vehicles, addresses, narratives, case numbers, and investigative records.
Calls for service, locations, units, timestamps, dispositions, and incident histories.
Vehicle observations, timestamps, camera locations, plate information, and associated metadata.
Identity, aliases, booking information, associates, contact information, and custody history.
Phones, computers, messages, accounts, photographs, documents, and extracted information.
Public cameras, private cameras, BWC, RTCC video, and video-analytics results.
Lawfully obtained device, vehicle, account, commercial, or other location-related information.
Publicly available websites, business records, news reports, social media, and other OSINT.
Authorized governmental, commercial, investigative, or intelligence databases.
3. A Typical Data-Fusion Workflow
4. What Is an Entity?
An entity is a real-world person, place, object, organization, account, device, or other thing represented within one or more data sources.
Names, aliases, dates of birth, identifiers, photographs, addresses, and contact information.
License plates, VINs, make, model, color, registered owner, and observations.
Phones, identifiers, accounts, IP-related records, device IDs, and network information.
Residences, businesses, incident locations, coordinates, cameras, and geographic areas.
Businesses, groups, agencies, associations, institutions, and other entities.
Incidents, arrests, calls, transactions, meetings, communications, and observations.
5. Entity Resolution — Are These Records the Same Person or Thing?
One of the most important functions in data-fusion systems is entity resolution: determining whether records from different systems likely refer to the same underlying person, vehicle, device, address, or other entity.
A VIN, driver's-license number, unique account identifier, or other precise identifier may strongly connect records.
Names can be misspelled, abbreviated, changed, duplicated, or recorded in different orders.
The same address may appear as “Street,” “St.,” apartment variants, historical addresses, or data-entry errors.
Numbers can be shared, reassigned, spoofed, temporary, or associated with several people.
Nicknames, alternate spellings, maiden names, false names, or identifiers may connect records.
Software may use several imperfect attributes together to estimate whether records likely represent the same entity.
6. Link Analysis
Link analysis represents relationships among entities visually or mathematically. A person may connect to another person through an address, phone call, vehicle, business, incident, financial transaction, communication, jail visit, social-media connection, or many other forms of association.
Two entities are connected by a documented event, communication, record, transaction, or observation.
Two entities connect through one or more intermediate people, locations, devices, organizations, or events.
Records may share an address, phone number, vehicle, account, workplace, or other characteristic.
Not All Links Mean the Same Thing
A phone call can establish that a communication occurred but not necessarily what was discussed. Two people at the same address may be relatives, roommates, customers, employees, former residents, or strangers separated in time.
7. Timeline Analysis
Data fusion can place information from several sources onto a single chronology. That can be especially useful where no one system captures the entire event.
Dispatch events can establish call, assignment, arrival, and communication times.
Cameras may document movement, vehicles, people, and physical events.
Plate observations may place a vehicle at particular locations and times.
Messages, calls, application data, or lawful location information may contribute timestamps.
Locks, badges, cameras, accounts, or IoT systems may record events.
Transactions, logins, bookings, reports, and other records may contribute temporal anchors.
8. Network Analysis
Network analysis examines the structure of relationships among many entities. It can help identify central actors, clusters, bridges among groups, highly connected entities, or unusual relationships requiring additional review.
How many direct relationships an entity has within the selected network.
Mathematical measures may attempt to identify entities occupying influential or structurally important positions.
Groups of entities may appear more densely connected to one another than to the wider network.
An entity may connect otherwise separate portions of a network.
Relationships may be examined over defined periods rather than treated as static.
Systems may assign different significance or frequency to different types of association.
9. Geospatial Analysis
Investigative analytics can add geography to entity and timeline information, helping personnel visualize where events occurred and how locations relate.
Plot offenses, calls, encounters, or events to identify geographic relationships.
Lawfully obtained ALPR or other records may help reconstruct vehicle movement.
Analysts can identify public or private cameras potentially covering a route or incident area.
Systems may identify entities or events occurring within a defined distance or geographic zone.
Investigators can compare sequences of known locations against roads, travel paths, or relevant facilities.
Time and location can be examined together to reconstruct movement and event sequence.
10. Investigative Uses
Connect cases, vehicles, locations, communications, suspects, associates, weapons, and digital evidence.
Identify relationships among people, organizations, transactions, addresses, and events.
Compare incidents for common people, vehicles, locations, methods, devices, or other features.
Connect firearm evidence, shootings, people, vehicles, locations, and related cases.
Connect accounts, addresses, devices, transactions, businesses, identities, and communications.
Combine records, vehicles, devices, video, locations, contacts, and timeline information.
RTCC analysts may connect incoming events with historical records or existing investigative information.
Analyze authorized information to identify threats, networks, patterns, or information gaps.
Identify when investigators in different units may be examining related entities or events.
11. Association Is Not Causation—and Proximity Is Not Participation
The greatest analytical risk is turning a machine-discovered relationship into a factual conclusion the underlying data does not support.
May reflect family, roommates, former occupancy, mailing records, or stale data.
May reflect family use, reassignment, business use, spoofing, or account errors.
Registration does not establish who was driving during a particular observation.
Being near an incident does not establish knowledge, intent, participation, or even precise presence.
A communication record may establish contact but not necessarily its content or significance.
Two people connected to the same third person may never have met one another.
12. Data Quality Controls the Analysis
Analytical systems can process data very quickly, but they cannot automatically repair every defect in the information they receive.
Addresses, phone numbers, ownership, employment, and other attributes change.
The same person or event may appear multiple times under slightly different identifiers.
Data-entry mistakes, misidentification, outdated information, or source errors can propagate.
A field extracted from a record may lose explanatory narrative or limitations present in the source.
Imported information may lack clear source, date, collection method, or reliability indicators.
Multiple systems may contain inconsistent names, dates, addresses, or identifiers.
13. Source Reliability and Provenance
A strong analytical platform should preserve the connection between a displayed fact and the source record supporting it.
Identify which database, report, provider, agency, or evidence source supplied the information.
Show when the information was created, observed, reported, or last updated.
Allow analysts to return to the source rather than relying only on an extracted field or link-chart label.
Distinguish verified facts from uncertain, inferred, or probabilistic information where appropriate.
Maintain awareness of restrictions attached to information obtained through particular sources or processes.
Understand whether a displayed relationship changes when source records are corrected or updated.
14. AI Is Expanding Investigative Analytics
Artificial intelligence can make large, heterogeneous datasets easier to search and analyze, but it also introduces new forms of inference and error.
Investigators may ask questions conversationally rather than construct complex database queries.
AI can identify names, places, vehicles, dates, accounts, and other entities from narratives or documents.
Systems may infer possible relationships described within reports, communications, or records.
AI may assemble events from multiple records into a proposed chronology.
Large analytical collections may be summarized for investigators or command personnel.
Systems may identify relationships or patterns the investigator did not specifically request.
15. Privacy, Civil Rights, and Civil Liberties
The privacy significance of data fusion comes from aggregation. Information that appears relatively limited when viewed in isolation can become much more revealing when combined with other records.
DHS foundational guidance for fusion centers expressly treats privacy, civil rights, and civil liberties protections as integral to information-sharing and analytical operations. Federal guidance has also emphasized written privacy policies, training, accountability, auditing, and controls over information use.
Define why each dataset is being collected, searched, combined, and retained.
Restrict sensitive analytical systems to personnel with a legitimate operational need.
Establish appropriate rules for searching persons, groups, locations, and other sensitive information.
Consider whether derived relationships and analytical records should persist indefinitely.
Determine how incorrect source information and erroneous entity merges are corrected.
Preserve sufficient records to identify inappropriate, unauthorized, or unusual searches.
16. Investigative Analytics, Evidence, and Discovery
An analytical chart is not the source evidence.
Link diagrams, dashboards, maps, timelines, and AI-generated summaries are derivative analytical products. Their reliability depends on the records from which they were created and the assumptions used to connect those records.
| Item | Why It May Matter |
|---|---|
| Source records | Provide the underlying factual basis for the analysis. |
| Queries | May show how investigators searched or filtered large datasets. |
| Entity merges | Can be important if several records were treated as one person or object. |
| Link charts | Show relationships relied upon during investigative analysis. |
| Timelines | May reflect investigator or software decisions about sequencing events. |
| Maps | May contain selected data, assumptions, geographic filters, or calculated relationships. |
| Analytical notes | Can distinguish facts from analyst interpretation and hypotheses. |
| AI outputs | May require preservation where generated summaries or suggested links materially influenced the investigation. |
| Audit records | Can document user activity, searches, exports, and system access. |
| Corrections | May show that a relationship or source record was later determined to be inaccurate. |
17. Auditability and Accountability
Investigative-analytics systems can provide access to unusually broad collections of information. Auditability is therefore an important governance control.
Record which authorized user conducted a search or accessed a record.
Preserve searches sufficiently to investigate misuse or reconstruct consequential analytical work.
Record bulk downloads, reports, link charts, and data exports.
Log changes to permissions, datasets, integrations, or system rules.
Preserve information concerning system-generated alerts, entity merges, or other consequential automated operations.
Use periodic or risk-based audits to identify inappropriate access or unusual query patterns.
18. Governance Framework
Identify every dataset available through the analytical platform.
Document the authority, purpose, and restrictions associated with each data source.
Define how records are merged and how incorrect merges are corrected.
Preserve the connection between analytical results and source records.
Apply role-based access appropriate to dataset sensitivity and mission.
Establish appropriate restrictions or documentation for sensitive searches.
Require source review and corroboration before consequential action based on an analytical result.
Distinguish machine-generated suggestions from verified relationships.
Record user access, searches, exports, and significant administrative activity.
Establish retention rules for queries, charts, derived relationships, and other analytical products.
Create procedures for correcting inaccurate source data or derivative analytical records.
Reassess datasets, algorithms, AI functions, privacy risks, and operational use as the system expands.
19. Procurement and Vendor Questions
| Area | What the Agency Should Understand |
|---|---|
| Data Sources | What government, commercial, open-source, and proprietary datasets can the platform access? |
| Entity Resolution | How does the system decide that two records refer to the same person, vehicle, device, or organization? |
| Confidence | Does the system expose uncertainty, matching scores, or alternative candidates? |
| Source Traceability | Can every displayed fact or link be traced directly to supporting source records? |
| AI | Does the platform generate inferred relationships, summaries, timelines, hypotheses, or suggested connections? |
| Training Data | Are agency records used to train or improve vendor models? |
| Search Logs | Does the platform retain who searched for what and when? |
| Bulk Export | Can users download large datasets, and are those exports logged or restricted? |
| Permissions | Can access be limited by user role, dataset, case, jurisdiction, or purpose? |
| Corrections | How do changes to a source record propagate through linked entities and analytical products? |
| Retention | How long are searches, relationships, analytical products, and cached source data retained? |
| Commercial Data | What third-party datasets are included, what are their sources, and what contractual restrictions apply? |
| Security | How are sensitive cross-system credentials, APIs, datasets, and user accounts protected? |
| Vendor Changes | Can new datasets, algorithms, or AI capabilities be activated without separate agency review? |
20. Questions Every Agency Should Answer
21. Where Investigative Analytics Is Going
Investigators may increasingly ask complex questions across many databases without constructing specialized queries.
AI may connect incomplete or inconsistent identities across increasingly large information environments.
Text, images, video, audio, location, biometrics, and structured records may be analyzed together.
New events may automatically connect to historical people, vehicles, addresses, or investigations as they occur.
Systems may suggest relationships, timelines, investigative gaps, or possible explanations.
Future systems may conduct multiple searches, compare records, generate charts, and propose next investigative steps.
22. Key Terms
23. Related ShieldPST.ai Resources
Understand how agencies combine cameras, CAD, ALPR, mapping, records, and other information during active operations.
Open explainer →Examine the distinction between investigative analysis and systems that predict crime risk or future events.
Open explainer →Explore vehicle-location data, network sharing, retention, analytics, and investigative use.
Open resource →Review publicly available digital information, online research, preservation, authentication, and investigative use.
Open explainer →Examine how private video can become part of larger investigative and RTCC information environments.
Open explainer →Understand AI-generated analysis, verification, hallucinations, source attribution, and governance.
Open explainer →Review commercial information sources, location data, government access, and governance.
Open explainer →Research privacy, data, surveillance, digital evidence, and investigative-technology decisions.
Browse case library →Return to the Shield Technology Reference Library.
Browse explainers →25. Key Takeaways
- Data-fusion systems combine information from multiple sources so investigators can identify relationships, timelines, patterns, locations, and investigative leads more efficiently.
- Link analysis is not new; law-enforcement analysts have used association matrices and link diagrams for decades.
- Modern systems dramatically increase scale by allowing millions of records and multiple data sources to be analyzed together.
- Entity resolution is a critical step because records from different systems may refer to the same person, vehicle, address, device, or organization—or may only appear to do so.
- An incorrect entity merge can propagate errors throughout link charts, timelines, reports, alerts, and investigative decisions.
- A link establishes an association represented in the data. It does not automatically establish the nature or significance of the relationship.
- Shared addresses, phone numbers, vehicles, locations, or associates can have innocent, historical, inaccurate, or irrelevant explanations.
- Timeline analysis is powerful but requires attention to clock accuracy, time zones, synchronization, event definitions, and reporting delay.
- Network-centrality or clustering measures describe structure inside a dataset; they do not automatically identify criminal importance.
- Data quality, provenance, currency, and source reliability place an upper limit on the reliability of analytical conclusions.
- AI can make investigative analytics much more powerful by extracting entities, generating timelines, suggesting relationships, and allowing natural-language search—but those capabilities also increase the risk of unsupported inference.
- Significant analytical findings should remain traceable to supporting source records and independently corroborated before consequential enforcement action.
- The governing principle is: use analytics to discover relationships worth investigating— not to replace the investigation required to determine what those relationships actually mean.