Location + Social + Identity: Doing Fusion Right (Not Just Fast)

The news, in brief
Recent reporting shows ICE/HSI contracted PenLink’s Tangles + WebLoc platform to correlate billions of commercial phone‑location points with social‑media signals—re‑entering a controversial market after earlier signs DHS components would stop buying such data. Documentation and coverage describe day‑by‑day feeds and geofencing capabilities aimed at “hundreds of millions of phones.”
This follows DHS OIG findings that components previously used commercial geolocation without required privacy assessments (PIAs).
PenLink markets “Tangles” for OSINT correlation and “WebLoc” for device movement patterns.

Why this matters

Telemetry and OSINT alone are not intelligence. Without normalization, entity resolution, provenance, and legal guardrails, agencies risk over‑correlation (proximity ≠ identity) or policy violations that can sink cases. A modern program needs a fusion layer—not one more feed.

A practitioner’s fusion blueprint

1. Collection with labels: Ingest commercial telemetry, lawful returns, public‑records, and open‑source social content. Tag origin, authority, and retention on arrival.
2. Normalization: Time‑base, coordinate projections, device IDs, handles, doc metadata—standard schemas + unit tests.
3. Entity resolution: Deterministic (exact identifiers) + fuzzy (behavioral/time/space clues) with confidence thresholds and explainability.
4. Provenance & audit: Immutable logs of transformations; policy enforcement by data class (e.g., CTD vs. public OSINT).
5. Analyst surface: Link‑graph + geospatial timeline views; hypothesis tracking; chain‑of‑custody for disclosure.

OWL → the fusion layer; Whooster → verified identity context

• OWLcity (geospatial) to fuse multi‑source location, geofence, and route timelines; link analysis for movement ↔ accounts ↔ events.
• Entity Resolution (OWLgorithms) with prevalence/confidence and full provenance.
• Whooster augments the “identity & phone” side (carrier, associations, verified contact graph) to avoid proxying identity from mere co‑location.

Governance memo: Feed‑level labeling + PIAs aren’t optional. Build policy objects into the platform—don’t rely on playbooks. (See DHS OIG privacy critique.)

CTA: See OWLcity + Entity Resolution on sample telemetry and OSINT.

FAQ

• What is geospatial intelligence software in investigations? — Software that correlates device movement with other sources (records, OSINT) to produce case‑ready timelines.
• Is commercial location data legal to use? — Only within agency policy and law, typically with privacy assessments and strict provenance/audit.
• Why not rely on a single vendor feed? — Single streams miss cross‑validation; fusion platforms prevent overreach and error amplification.