FOG DATA SCIENCE

REVEAL PORTAL

USER MANUAL

1
TABLE OF CONTENTS

Topic Page
I. Foreword………………………………………………………………………………………………………………………4
II. Accessing the Fog Reveal Portal……………………………………………………………………………………5
A. Password and Sign in……………………………………………………………………………………………….5
B. Overview Screen…………..…………………………………………………………………………………………..5
C. Downloads/Recent Updates..…………………………………………………………………………………....5
D. Queries/Query Limits……………………………………………………………………………………………….5
E. The My cases Box……………………………………………………………………………………………………..6
F. A New Case………………………………………………………………………………………………………………..6
G. Opening the REVEAL Portal……………………………………………………………………………………….6
III. Portal Orientation, Nomenclature and Symbols………………………………………………………….6
A. Mapping Tools…………………………………………………………………………………………………………..7
B. Finding a Location/Search…….……………………………………………………………………………….....7
C. The Portal’s Analytic and Diagnostic Tools………………………………………………………………..7
1. Need Help........……………………………………………………………………………………………………….8
a. My Account……………………………………………………………………………………………………….8
b. Running Queries……………………………………………………………………………………………….8
c. Technical Support……………………………………………………………………………………………..8
d. Work Space……………………………………………………………………………………………………….8
e. Query Results……………………………………………………………………………………………………8
f. Documents………………………………………………………………………………………………………..8
2. The Users Name……………………………………………………………………………………………………...8
a. My Info………………………………………………………………………………………………………………..8
b. My Cases’…………………………………………………………………………………………………………….8
c. New Cases……………………………………………………………………………………………………………8
d. User Group………………………………………………………………………………………………………….8
(1) Edit User Group……………………………………………………………………………………………..9
(2) Supervisor’s Actions………………………………………………………………………………………9
(3) Supervisor’s Edit……………………………………………………………………………………………9
(4) Add New User…………………………………………………………………………………………………9
(5) View Cases (Read Only)…………………………………………………………………………….....10
e. Change Password/Log Out……………………………………………………………………………….10
f. Hide or Show Flagged Signals
3. Cases…………………………………………………………………………………………………………………… 11
a. Editing User Names, Access……………………………………………………………………………… 11
b. Switching/Editing Cases…………………………………………………………………………………...11
4. Query Results……………………………………………………………………………………………………….12
a. Edit Folders……………………………………………………………………………………………………….12
b. New Folder Editing……………………………………………………………………………………………12
c. Switch/Edit Folders…………………………………………………………………………………………..13
d. Query List………………………………………………………………………………………………………….14
e. Selecting a Query………………………………………………………………………………………………14
(1) Create a Common Device Query……………………………………………………………………15
(2) A Fenced Query…………………………………………………………………………………………….16
(3) A Device Query……………………………………………………………………………………………..16
(4) Selecting A Query………………………………………………………………………………………….16
5. Query Settings……………………………………………………………………………………………………….17
a. Changing a Query or Running a New Query………………………………………………………..17
b. New Query Choices…………………………………………………………………………………………….18
(1) Draw New Geofences……………………………………………………………………………………..18
(2) Keep Geofences……………………………………………………………………………………………..18
(3) Query By Device ID (s)…………………………………………………………………………………..18

2
 6. Date/Time…………………………………………………………………………………………………………….19
a. The Date and Time Calendar………………………………………………………………………………19
(1) Date Selections………………………………………………………………………………………………19
(2) Hours and Minutes………………………………………………………………………………………...19
(3) Bundled Day Options……………………………………………………………………………………..19
(4) The Apply Box………………………………………………………………………………………………..19
b. Time Zones………………………………………………………………………………………………………..19
7. Geofences………………………………………………………………………………………………………….......19
a. Fence Numbers………………………………………………………………………………………………….20
b. Sizing a Geofence……………………………………………………………………………………………….20
c. Multiple Fences, One Location……………………………………………………………………..........20
d. Additional Selections…………………………………………………………………………………………21
(1) Hide Shapes…………………………………………………………………………………………………..21
(2) Clear Shapes………………………………………………………………………………………………….21
8. Devices/Signals……………………………………………………………………………………………………..21
a. Devices/Signals Choices……………………………………………………………………………………..21
(1) Fit All……………………………………………………………………………………………………………..21
(2) Uncluster……………………………………………………………………………………………………….21
b. Displaying all the Devices …….……………………………………………………………………………22
c. Clustered Signals……………………………………………………………………………………………….22
d. Pattern of Activity……………………………………………………………………………………………...22
e. All Devices………………………………………………………………………………………………………….22
(1) Signal Lists…………………………………………………………………………………………………….23
(2) Tag This Device……………………………………………………………………………………………..24
(3) Query This Device (90 Days)………………………………………………………………………….24
(4) Add to Device ID Query………………………………………………………………………………….25
IV. Timelines…………………………………………………………………………………………………………………..25
A. The First Step…………………………………………………………………………………………………………..26
B. Device and Query Timelines……………………………………………………………………………………26
C. Movement by Seconds Interval………………………………………………………………………………..26
D. Exiting the Timeline………………………………………………………………………………………………..26
V. Steps for Conducting a Single Site Query……………………………………………………………………….26
A. Find a Location Box…………………………………………………………………………………………………..26
B. Date/Time………………………………………………………………………………………………………………..27
C. Geofences………………………………………………………………………………………………………………....27
D. Run Query………………………………………………………………………………………………………………..27
E. Query Results……………………………………………………………………………………………………………28
F. Opening a Device ……………………………………………………………………………………………………..28
VI. CSV Files………………………………………………………………………………………………………………………29
A. Devices/Signals………………………………………………………………………………………………………..30
B. Download A CSV File………………………………………………………………………………………………..30
C. Download Complete………………………………………………………………………………………………….30
VII. Questions……………………………………………………………………………………………………………………30

3
 FOG’s REVEAL Portal Users’ Manual
I. Foreword. The FOG Data Science Portal, FOG REVEAL, uses (opt-in) unstructured geo-
spatial data to correlate devices to dates, times and locations. FOG REVEAL is a highly effective
forensics tool that assists Law Enforcement and Security Agencies in their efforts to develop leads
that can result in the identification of known and unknown suspects, persons of interest,
associates, witnesses and locations. Information that was previously “unknown” or knowable
only through the investment of significant time in efforts such as witness interviews, reviewing
surveillance video and travel records can now be revealed in minutes via a desktop or laptop
computer. The base line for this capability is the passive collection of (opt-in) signals emitting
from personal electronic devices such as smart phones, tablets and laptops that result in the daily
collection of more than 15 billion signals globally.

This system is very efficient in identifying and displaying devices and signals. However, caution
must be given that, when applying this analysis, users remain cognizant of the fact that even with
known dates, times, places and device ID numbers there is no guarantee that every query will
result in all the devices and/or signals germane to that geographical location or range of time
being identified. While our signals’ processing efforts will cleanse and normalize the data to
provide the best possible results, there are several reasons why all signals are not captured and
understanding why will help in investigatory efforts.

A. In some cases, the magnitude of the daily and global collection and storage of these billions of
signals can lead to computer processing limitations. One example might be a single query that
asks for identification of signals and devices from a large number of geographical locations
stretched over a considerable range of time. In this case, the system’s data retrieval and
processing capabilities juxtaposed to the rapid response times (seconds) required to reply to the
analyst’s request may result in some devices and signals not being processed and displayed.
These drops are decisions made by the computer to complete its response timeline.

B. Another case may be an analyst initiating a query too soon after an occurrence. It takes
approximately 24 hours to process and store a daily collection of signals. With that in mind, users
must be cognizant of the fact that queries made within that processing period can result in
searches reduced in terms of the numbers of devices and signals identified. However, the daily
updating and refresh of signals data will allow a user to continuously update queries to obtain
new results. Better results occur after 48 hours, best results after 72 hours. The emphasis is this
is not capable of analyzing real time crimes (Crimes occurring that day or the day after).

C. Unrelated to the processing capability, other reasons for a lack of identification of devices that
might have been present but not displayed can be explained as simply as devices being present
but the open apps on their devices not reaching out to other apps and transmitting at that
particular time and location.

D. Other variables, such as the analyst’s selection of the physical dimensions of an electronic
fence resulting in signals being offset and displayed outside of the geo fence may also have an
impact on not being able to identify each and every signal and/or device.

Many of these later cases can be mitigated and lead to previously unidentified devices and signals
by simply re-running the query again several days later if an initial query was close to the
processing wait out time; by extending or reducing the size of a geo fence; or by making even
minimal changes to the dates and/or times. When compared to current investigatory procedures,
the benefits of this analytical tool far outweigh any of the aforementioned shortcomings,
particularly in terms of savings in money and in work hours. Analysts and investigators are now
empowered with the capability to sit at a desk and, in a relatively short period of time, identify
potential suspects, witnesses, associates, locations and routes previously unknown.

4
II. Accessing the FOG REVEAL Portal. The opening page of the REVEAL Portal
has a warning sentence. The warning is to remind users that, although they are not dealing with
“classified” data, they are dealing with data that is, in many cases, sensitive and should be handled
and safeguarded accordingly

Screen Shot 1 Screen Shot 2

A. Sign In. Once the user is reminded of the sensitive material within and checks the “OK” shown
on Screen Shot 1, above, a second screen will appear (Screen Shot 2, above) requesting the user
“Sign In” enter their email address and password.

B. Overview Screen. After the user’s address and password have been completed, checking the
“Sign In” box will bring up a third screen. This screen will display FOG Data Science in the top box,
followed by the user’s name. Below the user’s name are 3 separate boxes titled Queries, Query
Limit and Cases (Screen Shot 3, below).

Screen Shot 3

C. Downloads/Recent Updates. The upper right corner of Screen Shot 3, above, contains the
Portal’s user manual which is available for immediate download.

D. Queries and Query Limit. Queries contains the cumulative total of all queries that have been
used in the current month. It allows a user to keep track of how many queries have been used
that day, past week or current month for better insight on allocating queries to caseloads. Query
Limit provides the status of the total number of free and prepaid queries allowed each month and
the number of unused ones remaining. Exceeding the per-month allocation can lead to additional
charges for each query conducted over the allotted amount. The remaining line resets to the full

5
monthly allocation at the beginning of each calendar month. Any recent updates that did not
require a formal change to this manual will be posted here.

Screen Shot 4 Screen Shot 5

E. The “My Cases Box” located on the lower right of screen, Screen Shot 4, above, allows the user
to immediately select a previous case (Only the previous 5 cases will initially be shown on the
screen). Previous Cases not shown will appear through “All Cases”. The number of query results
that were run for each case appears to the right.

F. A New Case can be entered by typing in the case’s name in the box that appears when “New
Case” shown in Screen Shot 5, above, is opened. After entering the name of the new case,
additional personnel can be provided access to either view or to contribute to the case by
selecting the “+Add Additional User” title.

G. Opening the REVEAL Portal occurs once a previously named case is selected, or a new one
entered. The REVEAL portal will then open to the main screen shown in Screen Shot 6, below.
The following paragraphs describe the tools resident within the portal overall and how to use and
maximize their capabilities

III. Screen and Portal Orientation, Nomenclature and Symbols

Screen Shot 6

The FOG REVEAL Portal was designed with symbols and wording that are easy to understand and
user intuitive. Once a case selection has been entered, a main screen will appear, Screen Shot 6,

6
above, with “Mapping Capabilities” on the upper left, a Search box in the upper middle and the
“Portal Dashboard” on the right side of the screen.

A. Mapping Tools. The choices satellite or map located on the left-hand side of the screen, as
depicted in Screen Shot 7, below, allows the users to select how the query locations and searches will
appear. The default view is the Satellite map with labels (states, cities, etc.). Clicking on the box
labeled Map will not only change the appearance to a flat Satellite map view but will also bring up a
drop box that asks if the user would like to change to a terrain view. Mapping symbols on the lower
right side of the screen, Screen Shot 8, below, provides the user with common Google mapping tools
such as the standard zooming in (+) and out (-) symbols and the yellow figure street level view,
picture rotation and viewing angle are also resident.

Screen Shot 7 Screen Shot 8 Screen Shot 9

B. Finding a Location/Search. Screen Shot 9, above, is located in the upper center of the screen
and is one of the key discriminators in query searches. Locations, whether general, address
specific or lat/longs are central to locating devices and signals. In the “Search box”, type in the
name of the lat/long or the location/address you want to query. Once a location is entered, a GPS
marker representing the exact location displayed in the search box will appear as a geospacial
overview on the main screen.

C. Analytic and Diagnostic Tools. Screen Shot 10, below, is located in the dashboard displayed
on the right hand side of the map. Shown are the major functions of the dashboard: Need Help
and User’s Name with embedded features, Named Cases, Query Results, Case Folder,
Date/Time/Zones, Geofences, Devices/Signals and Query by Device ID. Embedded in these
settings are capabilities for running, naming and filing queries; common device searches; sharing
and supervisor intereactions; assigning cases to users; and adding/deleting or changing names of
cases, queries and folders.

Screen Shot 10 Screen Shot 11

7
1. Need Help? is located in the top right corner of the portal as shown in Screen Shot 10, above.
Clicking on it will open up Screen Shot 11, above, with 7 sites to help users answer many of the
more common questions concerning how to access user information. Questions such as how to
maneuver through the portal and understand how it operates, as well as how to get help if
functionality still isn’t clear, is within this window.
a. My Account provides users with information concerning how to find out the status of their
queries, the cases they are listed under and ways to make changes to passwords or to label new
cases.
b. Running Queries provides new users with how to get started running a new query.
c. Technical Support tells users where to send questions if they need assistance.
d. Workspace helps new users orientate themselves to key functions on the dashboard such as
the map layout and where to find Cases and Queries.
e. Query Results describes how signals and devices are acquired, or not acquired, what an
analyst should be cognizant of when devices and signals are displayed, what types of information
are being given, how to run a simple query and the definitions of many of the items within a
query. This includes a list of Signal explanations that help users understand what the symbols
mean that may appear next to signals and to help better understand what type of signal it is or
how it was acquired.
f. Documents is a way of downloading and accessing the SOP.

2. User’s Name is located at the very top right of the screen as shown in screen shot 10, above.
Clicking on the user’s name or the icon will create a drop down menu with 7 topics and 4 major
categories, as shown in Screen Shot 12, below.

Screen Shot 12 Screen Shot 13 Screen Shot 14

a. My Info. Clicking on this box will send the user back to the beginning screen that appeared
after first logging in Screen Shot 3 that showed numbers of queries allotted, used and remaining
and cases worked and on file.
b. My Cases. As depicted in Screen 13, above, the listing allows the user to quickly view and
access a listing of all previous cases and the query usage associated with those cases. Screen Shot
14, above, shows that if the user wants to open or recycle bin the case all they have to do is click
on that section. Screen Shot 15, below, also shows that they can “Edit” a case to either change or
modify the case’s name or open it to an additional co-worker. Any person within that department
already authorized by FOG Data to use the portal will appear on a dropdown screen and can be
added to that case.
c. New Cases. This tool, as depicted in Screen Shot 15, below, allows for the addition of a new
case and, by clicking on “+ Add Additional User” can select, from a drop down list the name(s),
additional people who will also be working on the case.
d. User Groups. As shown in Screen Shot 16, below, are used at the Supervisor level. Groups can
be case officers working on similar crimes such as a Gang Task Force, CID, Drugs, CI, etc., or entire
Departments. This tool not only allows Supervisors to see what cases are being worked, it also
allows them to see how many users are working on a particular project, edit a case
officer/analyst, add a new user, change the name of a case or view queries associated with
particular cases.

8
(1) Tapping on the blue “Edit” to the far right of the name, Screen Shot 17, below, allows adding
or editing of the Group’s name, the user(s) name(s) and supervisor’s name or, by clicking on the
active box on the lower left, uncheck and deactivate the Group.
(2) Tapping on the “New Group” box in the bottom left of the screen allows for the addition of a
new Group, named users and supervisor, Screen Shot 18, below.
(3) Tapping on a Group’s Name allows a supervisor to see who is assigned to this Grouping, add
the details required when adding a new user and see the Group’s monthly query status. (Screen
Shot 19).
(4) Tapping on a blue highlighted group name will bring up a screen showing the users within
that group, the status of their queries and a box in the lower left of the screen saying New User,
Screen Shot 19, below. Opening up the new user box will allow new users to be added to that file
as well as the user’s email address, the number of queries allocated and the position or billet of
the user, Screen Shot 20, below.
(5) Tapping on a user name will bring up a box with 2 choices, Screen Shot 21, below. The first
one is “Edit”, which allows editing of the user’s name, billet, email address and how many queries
a month they are allotted, Screen Shot 22, below. The second choice is “View Cases (Read
Only)”. This allows supervisors (or other authorized persons) to review the cases a person in a
group is working on but not add or alter the material within, Screen Shot 23, below.

Screen Shot 15 Screen Shot 16

Screen Shot 17 Screen Shot 18

9
 Screen Shot 19 Screen Shot 20

Screen Shot 21 Screen Shot 22

Screen Shot 23

e. Change Password and Log Out directions and function are shown in Screen Shots 24 and 25,
below. Once Log Out is selected, log out is instantaneous but automatically brings the user back to
the “Log In” screen.

f. Hide or Show Flagged Signals, Shown in Screen Shot 12, above, allows the user to either
disregard or display the different explanations for signal strength, origin and reliability within
individual queries.

10
 Screen Shot 24 Screen Shot 25

3. Cases. The next main section of the dashboard, located directly below the user’s name, begins
with the blue highlighted box and name of the case selected when the user opened the portal,
Screen Shot 26, below. This part of the Portal has a lot of redundancy (i.e., adding a new case,
changing a name, adding people, etc.,) all of which were to save time going back into another part
of the portal to find these features. The “3 white dots” to the right of the case’s name opens a box
that allows the user to Edit a case, Switch Folders/Edit a Case or Add a New Case (Screen Shot
27, below).

a. Editing, Screen Shot 28, below, allows the user to change the name of the case as well as add
authorized co-workers access to the case.

b. Switching/Editing Cases, Screen Shot 29, below, opens the screen to a list of all user cases,
allowing the user to quickly switch from their present case to another case without having to go
back to the beginning opening screen in the portal. As soon as the user selects the case they want
a drop down menu, Screen Shot 30, below, will appear. Selecting “Open” will engage the portal to
immediately load and open up the selected case. The drop down also allows the user to edit the
case, similar to Screen Shot 28, or delete the case and send it to the Recycling bin.

Screen Shot 26 Screen Shot 27 Screen Shot 28

Screen Shot 29 Screen Shot 30

11
 4. Query Results, Screen Shot 31, below, is the heading directly beneath the project’s name. The
numbered “Query Results” box will open up, Screen Shot 32, below, with a menu on the left side
of the screen. Unnamed, the folders and subfolders will appear as in the Screen Shot. If named,
the name will replace the word Primary Folder. In both cases, the number of queries within each
folder will be displayed.

Screen Shot 31 Screen Shot 32

Clicking on a folder will bring up a named listing of all the queries, by type, in that folder, as well
as the number of signals within each listed query, Screen Shot 33, below.

Screen Shot 33

a. Edit Folders, shown in the bottom left of Screen Shot 33, above, brings up a New Folder,
Screen Shot 34, below. The user has three choices. One is to add a new folder by tapping on the
New Folder icon and a New Folder Template, Screen Shot 35, below, will appear. Screen Shot 36,
below, is a continuation of making the New Folder showing the dropdown menu choices under
Parent Folder. The second choice is to edit the existing folders shown above “Edit Folders” in
Screen Shot 33, above. The template for making those changes appears when the user taps on the
word “Main” as shown in Screen Shot 37, below. The third choice is to delete a folder by using the
“Recycling Bin” in Screen shot 37, below.

b. New Folder Editing, continued. Screen Shot 35, below, allows the user to type in the name of a
New Folder and decide whether it will be a stand-alone folder or be a sub-folder under and
existing Parent folder. “No Parent Folder” means it will be a stand along folder. If the desire is
to add it as a sub-folder under and existing parent folder, all that is required is to select the parent
folder from the dropdown menu and then type in the name of the new folder. If the user wants to
move a subfolder to become a main folder or vice versa, clicking on the selected Main Folder in
the upper left of Screen Shots 33 and 34 and it will bring down a menu with 3 choices, Screen Shot
37, below. If the user desires the next query to be run to go into a specific, listed folder then
selecting “Set Folder for New Query” will set that action up and that folder’s name will be
displayed on the menu in the blue box underneath Query Results. The same editing tasks listed in
the beginning of this paragraph, Editing a Folder by making it a Parent or a Sub, as shown in
Screen Shots 35, 36, below, can also be done here in Screen 37. The user can also Recycle or
delete the file using this box.

12
 Screen Shot 34 Screen Shot 35

Screen Shot 36 Screen Shot 37

c. Switch/Edit Folders. The blue box under Query Results is the folder that is currently being
used to store new queries, Screen Shot 38, below. Tapping on the 3 white dots to the right of the
name will bring up Switch/Edit Folders, Screen Shot 39, below. Clicking on that box will bring
up Screen Shot 40, below, which has already been described in paragraph b. above.

Screen Shot 38 Screen Shot 39

Screen Shot 40

13
 Screen Shot 41 Screen Shot 42

d. Query List. Queries are labeled and will be listed as either Fence Queries, Device Queries or
Common Queries, Screen Shots 41 & 42, above. A Fence Query is one that is restricted to an
area defined by an electronic fence around a specific location or address and will be named by
that geo location or, in some cases, with a sequential number if the same geo area was previously
run. A Device Query is a pattern of activity within a specified date/time ranging from a single
day up to 90 days and can be searched back to Jun of 2017. Its locations may include local,
regional or global travel and it will be shown as a numbered device until the user changes its
name. A Common Query is one that looks for devices that are common to 2 or more geo-
locations. All 3 will have the start and ending dates/times the query was run in parenthesis to the
left of their name. All 3 will be explained in more detail later in this manual.

Screen Shot 43 Screen Shot 44 Screen Shot 45

Screen Shot 46 Screen Shot 47

e. Selecting a Query by tapping on any individual query will result in a box appearing with 5
options, Screen Shot 43, above. Selecting “Open” will result in a pictorially displayed mapping of
the devices and their signals, Screen Shot 44, above. The second option allows a user to store a
particular in a tab by selecting Open in a New Tab. A tab will appear in the upper portion of the
screen and queries and information relating to that particular query will be stored in the tab for
quick reference. The third option allows the user to Edit the Query, Screen Shot 45 above, by
either re-naming it or moving it to another folder as previously explained in paragraphs 4. a. and
b. above. The fourth option, Create a Common Query, is described in detail in paragraph (1)
below. The fifth option, Share with Another Case, allows queries from one case to be shared
with another case. When this choice is selected, Screen Shot 46, above, will appear. Tapping the
Select Case will provide a list of all the users cases in the portal, Screen Shot 47, above. After a
case is selected, hitting the save button will bring up Screen Shot 48 below, that shows the query
was exported to the case selected. The query also remains and is not deleted from the original
case. The query that is being shared will be displayed in the sharing case as shown in Screen Shot
49, below. The final option is the ability to Send to Recycling Bin where the data will be saved
for other future uses.

14
 Screen Shot 48 Screen Shot 49

(1) Create a Common Device Query is used to determine if any devices are common to multiple
locations. There is no limit to the number of queries that can be selected for a common query but,
the more added, the longer the process may take. To initiate the Common Devices process,
merely touch a query from the query list and a check mark will appear to its left, Screen Shot 50,
below. You can check, or uncheck, if running a second query or you decided not to include one,
and as you select the number chosen will appear on a new screen to the right and parallel your
original screen as shown in Screen Shot 51, below. Once you are thorough selecting which
queries you want to search for common devices, hit the green “Search for Common Devices”
button on the right-hand screen. The results will be listed on the right screen with the all the
common device combinations found and the ones with the most common queries listed first, at
the top, and the least number towards the bottom, Screen Shot 52, below. The top of the screen
shows the number of common queries run and tells the user to click on a combination below to
preview. The user can then review and decide which ones they want to retain them by first
selecting one, clicking and have it open up on the dashboard screen under primary folder,
depicted in Screen Shot 53, below. If the user decides to save the Common Query, selecting the
Orange “Save Common Device Query” button at the bottom of the page, as shown in Screen Shot
54, below, will save it to the common query list. Whether you chose to add the query or reject it,
you can return to the remainder of the list by selecting the white button, Back to Query
Combinations below the Save Common Device Query button, Screen Shot 54, below, and repeat
the process. When you select a Common Query, it is added to the list of Common Queries and
displayed in two places. One is by a small white link symbol to its left and also placed in a list
above your regular query listing, Screen Shot 55, below. The other place it is displayed is on the
Dashboard, as shown is Screen Shot 53, below. When a query is selected and the no common
devices are found, a “No Devices Found” display will appear, as show in Screen Shot 56, below.

Screen Shot 50 Screen Shot 51

Screen Shot 52

15
 Screen Shot 53 Screen Shot 54

Screen Shot 55 Screen Shot 56

(2) A Fenced Query, as depicted in screen shot 57, below, will result in a display of single red
dots representing individual devices and their associated signals. A single device may represent
multiple signals; therefore, the number of devices does not always equal the number of signals.
Multiple signals from a single device occurs when a device remains in one position while
simultaneously continuing to broadcast signals over an extended period of time.

(3) A Device Query, as shown in Screen Shot 58, below, depicts device(s) and associated signal
locations over an unconstrained or non-fenced geographical area. Red Numbered Circles or
Clusters may appear when an area is inundated with a large number of devices and signals and
viewing them is easier when they are rolled up or consolidated. This also happens when a map is
zoomed out, allowing devices and signals within a general vicinity of each other to roll up. In
these cases, the Numbers within the Red Clusters represent the number of signals in that geo-
location, not the number of devices. Clicking on the circles, or zooming in on the map, will allow
the user to drill down and to individual devices and their associated signals. An improved way to
query clusters has been added and is discussed in detail in paragraph V., F. at the end of the SOP.

(4) Selecting a Query from the list of previous run queries will place the address searched, or the
edited name of the query, into the first box on the dashboard. The number of devices and signals
associated with that query will appear on the map and replace the label “Query by Device ID”
with “New Query” in the last box on the dashboard, Screen Shot 59, below. The Show Timeline
feature will be discussed in greater detail later in paragraph IV.

n
Screen Shot 57 Screen Shot 58 Screen Shot 59

16
 5. Query Settings box will appear as shown in Screen Shot 60, below, with the Case name at the
top in the blue box, the number of Queries in the box and the name of the Folder the last query
was placed in the blue box at the bottom. As a previously run query is selected, or a new one
added, the name of that query will appear in a blue box below the folder name, Screen Shot 61,
below. Should the user choose to re-name the query or change the folder, clicking on the 3 dots to
the right of the name will bring up “Edit” as shown in Screen Shot 62, below.

Screen Shot 60 Screen Shot 61

Screen Shot 62

a. Changing a Query or Running a New Query. Once a Query is selected, it appears in the blue
box below the case’s name (previously shown in Screen Shot 60, above). This indicates that the
query has been opened on the map and the devices and signals associated with that query are
displayed at the bottom of the dashboard under “Devices and Signals”, Screen Shot 63, below.
Trying to run an entirely new and unrelated query, or to change the parameters of the Query that
is open (same location and fence but different dates or times), requires the user to first open the
“New Query” box at the bottom of the dashboard. Trying to run another Query or a change prior
to that will result in the message shown in Screen Shot 64, below. The user will not be able to
proceed until the New Query box, Screen Shot 65, below, is clicked.

Screen Shot 63 Screen Shot 64

Screen Shot 65

17
b. New Query Choices appear when the New Query box is clicked, Screen Shot 65, above.

(1) Draw New Geofences is selected when the user wants to run an entirely new and unrelated
query. A new geolocation is typed into the Search Box at the mid-top of the screen and the
normal procedures for date/time, drawing a geofence and Run Query is applied. The result will
be an entirely new named query that will be added to the project query list.
(2) Keep Geofences is selected when the user would like to only change dates and or times to the
current query. Changes to dates and/or times are made and Run Query is selected. A newly
numbered query will be added to the project query list. It is recommended that numbered
queries be given names to help facilitate keeping track of the new data as the search gets bigger.
(3) Query by Device ID(s) is selected when the user would like to do a current history search of
1 or more devices within that query. Selected Device ID numbers are pasted into the Device
Box that will appear at the mid-top of the screen (Screen Shots 66 & 67, below). Up to 10 devices
may be selected at one time. The next step is to select a particular date range for the search or the
use limit 90 days box. The final step is to select Run Query. This action will also initiate a new
query and query count to the project query list.

Screen Shot 66 Screen Shot 67

6. Date and Time entries are required for all query selections whether the exact date or time is
known or not and can be entered either as estimates or as accurate as down to the specific month,
day, hour and minute. The initial Date and Time block is shown in Screen Shot 68, below.

Screen Shot 68

Screen Shot 69

18
a. The Date and Time Calendar is displayed when the small white calendar to the right of the
Date/Time box in Screen Shot 68 is tapped. The interactive calendar, Screen Shot 69, above,
allows manipulation of dates and times and will open to the previous and the current month with
a one week date range default. Once the calendar is opened, the user is provided with the
following selections:

(1) Date Selections can currently only go back to Jun of 2017 (this is as of Jan 2019). That reach
back will increase in coming months, years. The reason for this constraint is the systems
collection and storage capability. The system collects over 16 billion signals a day, worldwide,
and has to cleanse these signals down to an average of 5 billion before they are stored on the
server. This process takes a minimum of 24 hours to complete, but reasonable results aren’t
available until 48 hours and greatly improved if the user waits 72 hours. This needs to be
understood so that expectations are not lost because users or supervisors thought the system
could be used on incidents occurring in the last 48 hours. The 48 hour minimum results in a line
through the current day and previous day on the calendar. A line will also appear on the furthest
day back from the current day, thereby fencing in any possible start or ending dates. When days
are selected, they will become highlighted in blue on the calendar and will also be displayed
numerically in the upper left boxes of the calendars. Two calendars will always appear, even
when only one day is selected. The maximum period that can be searched at any one time is 90
days.

(2) Hours and Minutes are the second step in the date/time selection process and are located
directly above the months for both the start and finish day. Both a start time and an end time
must always be entered. Even if only one day is represented or both start days and end days
occur in the same calendar month. The start time still has to be entered on the left calendar and
an end time has to be entered on the right calendar. The default times will always start with
00:00 and end with 23:59. Times are entered in local times. The date has to be tapped each time
before entering a starting time and before entering an ending time.

(3) Bundled Day Options are offered on the far right of the screen. All are specific periods of
time from 7 days to 90 days and current week to current month that are short cuts to having to
select individual days on the calendars. A search of a device’s recent history and activity can be
completed as far back as Jun of 2017; however, no individual search can exceed 90 days.
Individual 90 day searches can be conducted in any combination of consecutive days as long as
they are within the furthest day back to furthest day forward boundary.

(4) The Apply Box must be checked once all the dates and times are selected.

b. Time Zones. Time zones are automatically calculated according to the geographical location
provided and the signals. Signals opened on the map or in the signals list will show both local and
UTC times.

7. Geofences are located near the bottom of the dashboard. There are 3 geometric symbols
below the title, Screen Shot 68, below. The first is a circle, the second can be used as either a
square or a rectangle and the third is a polygon that allows the user to customize the shape of the
fence to the user’s choosing. The electronic fences limit and define what parts of the geographic
location the query will search. It’s suggest the user first use the plus sign on the far left of the map
to enlarge the geo-area that has been identified. Next, select one of the three geometric fence
options and, with the curser, drag the figure over to the site and click. This allows the selected
fence to be established at the targeted area and automatically inserts the correct time zone. Once
they are initially place on the targeted area, the fences can be adjusted to match the specific
dimensions desired. It is recommended that users start big when applying a fence and work their
way down on successive queries. This is especially true when doing comparative analysis
searching for a device located within several fenced locations (searching for a similar device that
appears in multiple locations). Signals, particularly those acquired from cell towers, vary in
accuracy and can result in offsets to their exact locations. This may cause a user to miss an

19
important signal that was lying just outside a smaller fence. Conversely, some caution needs to
be applied when using large fences in urban areas. A user would probably not want to fence a
large area of a major city at noon because the returning search will probably result in an
overwhelming number of devices and signals. Queries that exceed 100,000 signals will result in
the overage signals being dropped.

Screen Shot 70 Screen Shot 71

Screen Shot 72

a. Fence Numbers are shown once a fence is selected and applied. The system will assign it a
number as shown in Geofence Screen Shots 70, above.

b. Sizing a Geofence to fit a particular are can be accomplished by clicking on the fence on the
map to expand or contract its size. In this sample case, Screen Shots 71 & 72 above, as the
geofence is drawn it brings up a Radius and Area calculator that changes as you expand or
contract the fence.

c. Multiple Fences in One Location can be applied to a single query. As an example, Screen Shot
73, below, might be to simultaneously check a parking lot and a building that are not adjacent to
each other but within the same geolocation being searched, allowing the user to apply two or
more fences to that one query. In these instances, the Geofences Block will show the number of
fences used and what shape was used for each fence, Screen Shot 74, below. When using multiple
fences, a diagram, as shown in Screen Shot 75, below will ask if you want return signals only for
devices common to all fences or any devices within any fences, regardless of commonality

Screen Shot 73 Screen Shot 74

20
 Screen Shot 75 Screen Shot 76
d. Additional Selections. As shown in screen shot 76, above, the 3 White Dots to the right of
“Geofences” allows 2 additional selections.

(1) Hide Shapes allows a user to view the signals and devices on the screen without interference
from the fence.

(2) Clear Shapes allows the user to erase a fence either to select a different one or to run a search
that goes beyond the boundaries of the current fenced location, such as in a pattern of life.

8. Devices/Signals. As depicted in Screen Shot 77 below, Devices/Signals is the next major

heading following Geofences. Once a Query has been opened, the box below will list the total
number of devices and signals in that Query and will also display it on the map. As a reminder, the
user is cautioned to remember that a single device can represent any number of signals.

Screen Shot 77 Screen Shot 78

a. Device/Signals choices appear once a Query has been opened. Three white dots will appear to
the right of Devices/Signals, Screen Shot 77, above. Clicking on the 3 white dots will open a box
with two selections, “Fit All” and “Uncluster”, Screen Shot 78, above.

(1). Fit All can be used when the user zooms out on a map and wants the signals to cluster until
they all reside in one geo area. Useful when trying to see from a Macro view on a map, Screen
Shot 79, below.

(2). Uncluster is used when signals initially appear as clusters on a map and the user wants to
quickly break them down either into smaller clusters or into individual signals, Screen Shot 80,
below. A new way to view clustered signals has been added and can be seen in paragraph V. F. at
the end of the SOP.

21
 Screen Shot 79 Screen Shot 80 Screen Shot 81

b. Displaying all the Devices listed under a project can be done by clicking on the number of
Devices (Signals)Heading (example: 186 Devices and 523 Signals in Screen Shot 77 above) which
will open up and list all the devices in descending order by number of signals, Screen Shot 81
above. Once opened, all the devices and signals associated with that Query will appear and be
listed by a unique Device registration number and, to their right, the number of signals associated
with those Devices. Device registration numbers are machine generated alphanumeric serials
that the software uses to associate specific signals to a particular device. Their association is only
unique to this program’s server and portal tools. Cell phones have advertising IDs embedded
within their phones. If in possession of a phone and its advertising ID, a correlation can be made
between that phone and the alphanumeric numbers used in the portal. The reverse is not
possible-using the registration numbers to identify individual mobile device numbers or owners.

c. Clustered Signals, shown in Screen Shot 81, above, allows the user to check and cluster or un-
cluster the devices and signals displayed on the map.

d. Pattern of Activity, shown in Screen Shot 81, above, is located directly below Cluster Signals.
It graphically shows travel patterns of devices as depicted in Screen Shot 82, below.

Screen Shot 82

e. All Devices. The number in parenthesis to the immediate right of the All Devices heading is the
number of devices that were discovered. The number to the far right of the screen indicates the
number of signals from those devices. Signal origins, strengths and abnormalities can also be
found by turning on the Show Flagged Signals in the drop down menu under the users name. The
circle shown in screen shot 83, below, will be red. This means that all the individual devices
within an open query will show up as red on the map, Screen Shot 84, below. Clicking on the
circles again will turn off all the devices on the map, Screen Shot 85, below. Clicking on select for a
particular device will allow that color to appear and be quickly identified from the remaining
devices, Screen Shot 86, below. Clicking select on more than 1 device will cause those devices to
be displayed in different colors for easier identification on the map, Screen Shot 87, below.
Clicking on the red circle will turn off all the red dots and only display the color you selected,
Screen Shot 88, below. Clicking on the individual devices will bring up a pop down menu, Screen
Shot 89, below.

22
 Screen Shot 83 Screen Shot 84

Screen Shot 85 Screen Shot 86

Screen Shot 87 Screen Shot 88

Screen Shot 89 Screen Shot 90

(1) Signal Lists. Clicking on the block that shows the number of devices and signals, Screen Shot
77, above, brings up the list of all individual devices and signals in that query, screen Shot 83,
above. Clicking on an individual device from the list of devices brings up a dropdown screen as
shown in Screen Shot 89, above. Clicking on Signal List in the dropdown will open up a complete
CSV Signals file for all the Devices listed in that individual Device. Clicking on the red doted “All
Devices” will bring up the signals list box shown in Screen Shot 90, above, for all the Devices
within that query. Screen Shots 91 & 92 are examples of those Files. A File shows all the signals
detected by that device, their lat/longs and their date/times. (Screen Shots 91 & 92, below.
Exporting these lists to a CSV File and then to an Excel spread sheet is explained in greater
detailed in paragraph VI below.

23
 Screen Shot 91

Screen Shot 92

(2) Tag This Device is a way to save a selected Device of interest. User must first assign it a
name and then click on save. The selected Device is then identified as labeled in a column to the
right of that device (in this case, named cleared) in the Devices listing, Screen Shots 93 & 94,
below.

Screen Shot 93 Screen Shot 94

Screen Shot 95

(3) Query This Device (90 Days) will show a 90 day pattern of activity for the most recent 90
days and, if a fenced query, will automatically break it out of its fenced location and will display it
geographically over the full range of time of the query, Screen Shot 95, above. When running the
90 day query, a particular location can be typed in the “Search box”, at the top of the screen as
shown In Screen Shot 9, at the beginning of the SOP, that will allow the user to see if a particular
device was at that particular location during any period within that range of time. After this

24
Query is run, it will be added as a New Query within the Device Query Results heading (Screen
Shots 96 & 97 (before and after), below.

Screen Shot 96 Screen Shot 97

Screen Shot 98

(4) Add to Device ID Query. One feature of this box is to search where a device has been over a
selected Date Range. Click on the “Add to Device ID Query” on the menu in Screen Shot 89,
above, and the device’s identification number will automatically appear in the Query Search box at
the top of the map, Screen Shot 98, above. The user can select 90 days of a more definitive range
of dates and times by selecting ”Date Range”. This cannot be done until the white arrow at the
top of the device list is clicked and the list clears the screen, exposing the date/time calendar box
on the dashboard. The user can select any desired date range of the device’s activities. Selecting
the red “Run Query” , will then geographically display the query across the map. More
importantly, it also allows the user to run and observe multiple selected devices running
simultaneously to see if there are common places where they cross or come together. Once run,
they will also be added as a new Query to the current project.

IV. Timelines

Screen Shot 99

Screen Shot 100

Once the user clicks on Show Timeline, located in the black space at the bottom of the dashboard
under “Devices/Signals”, Screen Shot 99, above, a timeline of up to 90 days, Screen Shot 100,
above, will appear across the top of the screen. Displayed under each date are the number of
signals that were identified on that particular day. If individual devices with a query, vice queries,
are selected up to 10 devices can be displayed. They will be color-coded in sequentially layered
lines beneath the dates. Timelines can be used within or outside fenced areas; however, the vast
majority are displayed as a timeline outside a fenced area.

25
A. The First Step in running a timeline, either on a named query or on a single device, is to open
up a query. Once opened, the box below “Devices and Signals” will read “Viewing Timeline”
and will initiate the appearance of the timeline at the top of the page, the number of signals
recorded per day depicted under each date, and the signals for that day depicted on the map
below. Starting with the first date, which will be highlighted by a blue dot, and by clicking on the
left-hand arrow, the blue dot will move sequentially across the dates while simultaneously
changing the location of the signals on the map to correspond to that particular day’s signals. For
more granularity, the time line can be viewed in hours vice days.

B. Device vs Query Timelines can be used when the user only wants to see a device timeline.
After opening up the query and high-lightening the circle next to the desired device, select show
timeline and only that devices signals will appear on the chart.

C. Movement by Seconds Interval. The timelines speed across the dates can be adjusted in
intervals of seconds by typing the number of seconds the user wants into the white box to the left
and then selecting the Interval (sec) arrow to its left.

D. Exiting the Timeline can be initiated through the x Button at the far right of the line.

V. Steps for Conducting a Single Site Query. Queries are used in conjunction
with either a known or an approximate geographic location together with either an estimated or a
known date and time. After logging into the portal, a world map will appear displaying a
dashboard with the previously explained search tools, Screen Shot 101, below.

Screen Shot 101

Screen Shot 102

A. Find a Location Box is the first step in a starting new Query and requires entry with either a
lat/long, geographic location or an exact address entered in the search box shown in Screen Slide
102, above. This will automatically trigger the Google map to move and open to that site and pin
point its exact location.

26
 Screen Shot 103

Screen Shot 104 Screen Shot 105

B. Date/Time is the second step in starting a new Query, Screen Shot 103, above. The user must
enter both a beginning and ending date and times (a beginning and ending time must also be
given for a single date). All times applied should be in local times. Once completed, select Apply.
Even though search dates may only fall on one calendar, the minutes for beginning the period (left
calendar) and ending the period (right calendar) must be used and the date(s) touched before
adding the times.

C. Geofences selection is the third step required in starting a new Query. There are 3 types of
geofences that can be applied and dragged to the map.
1. Geofence types One is a circle, one is a square and the third is a free hand form, Screen Shot 104,
above. Enlarge the site on the map, select one of the geometric figures, move the cursor to the
geographic area or address and click and apply/adjust the fence. As previously discussed, there
are limitations to the size of fenced areas. When a geofence is drawn, it automatically selects and
posts the name of the time zone that fence is in within, Screen Shot 105 above.

D. Run Query is the final step in running a new Query. The “Run Query” button will appear
below the geofence box, Screen Shot 106, below. Once the Query is initiated, a screen may appear
and ask if the user understands that the process “May take some time to render “ because of the
size of the search criteria and will also ask if the user “would like to continue”., Screen Shot 107,
below. The normal response is yes. Once the Query is completed, it will either provide a notice
saying “no Signals found for your query”, Screen Shot 108, below, or it will display the devices
and signals within that fenced in area. The picture in Screen Shot 109, below, is what a typical
single location site query would look like.

27
 Screen Shot 106 Screen Shot 107

Screen Shot 108 Screen Shot 109

E. Query Results. When a query is requested for an extended period of time, and the fence is
dropped to allow for a search of signals worldwide, the signals may first appear as large, red
circles with numbers in the middle, Screen Shot 110, below. This happens because the map
feature is in a macro view and all the signals within that large geo radius are rolled up into one
large dot. Example: When a map is zoomed out (say to a metropolitan area) all the local signals
will roll up, cluster and be displayed as large circles. The number within the circles represents the
number of signals, not devices, within each. As the analyst zooms in on a particular cluster or
circle by enhancing the map or clicking on the number, the circle will continue to break down,
first into smaller clusters and eventually into individual dots. Single dots represent both the
individual devices found and the number of signals radiating from them. A single device that
remained in one location but periodically broadcasted could have multiple signals attached to it.

F. Opening a Device. Placing the curser over a single dot will open it up, Screen Shot 109, above,
and provide that device’s registration or serial number (a number randomly assigned by the
software), its latitude/longitude and the date and time(s) it was broadcasting. A device could
remain in a single spot for a long period of time and, while there, make multiple broadcasts.
When that device is opened up, it will show a signals list of all the times that it broadcasted. When
a curser is applied to a specific device within a fenced in area, the other locations of that device
within the fence will change to blue so that it can easily be identified amongst all the other devices
also located in that particular fence. When there are multiple clusters, Screen Shot 110, below,
and the user wants to open one up to single dots, Screen Shot 111, below, a continuous touch of
the dot by the curser will open it up. Simultaneously, the data from those signals will be displayed
to the right of the screen, Screen Shot 112, below. If the User would like to isolate and only look at
a particular cluster, touching the white dot in the “Show other Signals” box at the bottom of the
screen, Screen Shot 113, below, will make all the other map clusters disappear and only the
individual devices from the selected cluster selected will remain, Screen Shot 114, below.

28
 Screen Shot 110 Screen Shot 111

Screen Shot 112 Screen Shot 113

Screen Shot 114

VI. CSV Files. One way to share a Query’s or an individual Device’s signals’ lat/long/and
times with another user is through a CSV file. This can be done from a current Query/Device or
from previously saved Queries/Devices.

Screen Shot 115 Screen Shot 116

29
 Screen Shot 117

A. Devices/Signals. If working from a new query, go to the portion of the dashboard that says
Devices/Signals, Screen Shot 115, above, and in the black box click on the numbered Devices and
Signals (in parenthesis). A new screen, Screen Shot 116, above, will appear. Make sure the “All
Device” circle is all red. Once clicked, it will open to a listing of all devices and at the top of the
list a circle next to “All Devices”. Click on “All Devices” and a pop up “Signal List” box will appear,
Screen Shot 117, above. Clicking on the Signals List box will bring up all the devices in one list in
order by date/time in both current time zone and UTC times, Screen Shot 118, below. As
previously explained, Signal Lists can also be called up for individual devise using their dropdown
menus.

Screen Shot 118

B. Downloading a CSV File. This capability is located by the button labeled “Download CSV” in
the lower right of the screen, Screen Shot 118 below. The list will be downloaded to your
computer and from there can be opened and transferred to an Excel Spreadsheet for attachments
or for printing.

Screen Shot 119

C. Download Complete. Once the download is completed, Screen Shot 119, above, click “Done”
and it will return the user back to the All Devices listing.

VII. Questions. Any questions regarding the use of this Portal or any part written in the
FOG User Manual can be sent to [email protected].

30
31