Organised Crime Intelligence

Overview#

Investigators building a RICO case against a drug trafficking organisation face a specific problem: the evidence exists across dozens of agencies, hundreds of wiretap transcripts, financial records spanning multiple jurisdictions, and surveillance logs from operations that ran years apart. Connecting those threads into a coherent enterprise picture, one that satisfies the legal standard for pattern of racketeering activity, requires analytical infrastructure that most case management systems were never designed to provide.

Argus Organised Crime Intelligence addresses that gap. It provides investigative capabilities for agencies dismantling criminal enterprises, supporting RICO prosecutions, drug trafficking organisation takedowns, gang violence suppression, and multi-year investigations targeting organised crime groups operating across borders, jurisdictions, and criminal domains.

Built on graph-powered network analysis, AI-driven pattern detection, and multi-domain intelligence fusion, the platform transforms complex investigations involving wiretap transcripts, surveillance logs, and financial records into structured, prosecutable cases with enterprise continuity documentation and leadership hierarchy mapping.

Open Standards#

• OASIS STIX 2.1 / TAXII 2.1: Criminal intelligence, threat actor profiles, and indicator records are exported as STIX 2.1 bundles and shared via TAXII 2.1 feeds, enabling interoperability with Europol, Interpol-aligned networks, and regional fusion centres.
• MITRE ATT&CK: Tactics, Techniques, and Procedures (TTPs) observed during organised crime investigations are mapped to MITRE ATT&CK technique identifiers, supporting structured attribution analysis and adversary profiling.
• Traffic Light Protocol (TLP): All STIX objects carry TLP marking-definitions (TLP:CLEAR through TLP:RED and TLP:AMBER+STRICT), controlling the distribution boundaries of shared criminal intelligence under the FIRST TLP standard.
• POLE Data Model: Persons, Objects, Locations, and Events are structured as first-class POLE entities throughout evidence ingestion, extraction, and prosecution-package assembly, in line with the UK College of Policing POLE intelligence framework.
• FollowTheMoney (FtM) / OpenSanctions: Sanctions screening against OFAC, EU, and UN lists consumes OpenSanctions bulk data published in FollowTheMoney newline-delimited JSON format, covering Politically Exposed Persons and criminal-nexus entities.
• GeoJSON (RFC 7946): Criminal activity patterns, territory boundaries, trafficking routes, and meeting locations are represented as GeoJSON geometries, enabling interoperability with standard geospatial analysis and mapping tools.
• GraphQL: All investigative query, mutation, and subscription operations are exposed through a typed GraphQL API, providing structured access to criminal enterprise data, MITRE techniques, and sanctions records.
• FATF 40 Recommendations / EU AML Directives: Sanctions screening and financial intelligence workflows are implemented with reference to FATF requirements and EU Anti-Money Laundering Directive obligations, supporting compliant asset tracing and forfeiture documentation.

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14

Key Features#

• Criminal Enterprise Mapping: Visualise organisational hierarchies with leadership identification, role analysis, cell structure documentation, and succession tracking using graph-powered network analysis. The POLE model anchors every person, object, location, and event to verifiable intelligence.
• Multi-Domain Intelligence Fusion: Integrate wiretaps, financial data, geospatial tracking, and open-source intelligence into unified analytical views with automated cross-domain correlation. Over 153 third-party integrations feed into a single investigative picture.
• RICO Investigation Support: Predicate act documentation with enterprise pattern analysis, continuity evidence tracking, and prosecution-ready case packaging meeting federal standards.
• Gang Intelligence Database: Track gang membership, territory boundaries, rivalry patterns, leadership structures, and cross-jurisdictional affiliations with historical trend analysis.
• Financial Crimes Integration: Money laundering detection with asset tracing, shell company exposure, transaction pattern analysis, and forfeiture planning. Blockchain transaction analysis covers 15+ networks for cryptocurrency-enabled criminal finance.
• Communication Analysis: Process wiretap transcripts, pen register data, and communication metadata to identify operational patterns, code language, and network relationships.
• Geospatial Tracking: Map criminal activity patterns, territory control, meeting locations, and transportation routes with temporal analysis showing how operations evolve over time.
• Prosecution Support: Generate prosecution packages with evidence indexing, witness coordination, timeline reconstruction, and defence anticipation analysis.

Use Cases#

• RICO Case Development: Build enterprise cases documenting organisational structure, predicate offences, and pattern of racketeering activity with evidence linking individual acts to the enterprise.
• Drug Cartel Investigations: Analyse trafficking organisation structures, map distribution routes, track financial flows, and coordinate multi-agency operations targeting cartel leadership.
• Gang Violence Suppression: Monitor gang activity, predict retaliatory violence, identify escalation triggers, and coordinate intervention strategies across law enforcement and community partners.
• Money Laundering Investigations: Trace criminal proceeds through layered transactions, shell companies, and international transfers to support asset forfeiture and financial prosecutions.
• Multi-Agency Task Force Operations: Coordinate intelligence sharing, deconfliction, and operational planning across federal, state, and local agencies with appropriate access controls.

Integration#

The module connects with wiretap management systems, financial intelligence platforms, correctional and gang databases, geospatial analysis tools, and federal criminal justice information systems. STIX/TAXII-format intelligence exports support sharing with Europol, Interpol-aligned networks, and regional fusion centres. Cross-domain intelligence feeds support comprehensive enterprise investigations within the Argus platform. OpenSanctions integration provides real-time sanctions screening for entities identified during investigations.