NORA and ANNA

“Non-obvious relationship awareness” (NORA) software probes databases in any language, searching for obscure matches between relevant information. Anonymized data (ANNA) software uses the same technology to investigate data that has been encrypted.

SRD’s patented technology allows users to discern obvious and so-called “non-obvious” relationships between data sets in multiple databases. This view can help identify connections that can span more than 30 degrees of separation.

One degree of separation would be two people who work at the same casino who also listed the same address on their resumes. The second degree might be finding out that a third-party vendor providing cards to the casino attended the same high school as one of those two employees. The third degree might be discovering that all three of these individuals maintain checking accounts at the same bank. In the case of Atta, NORA would have identified that he at one point shared a home address with two other 9/11 terrorists, Khalid Al-Midhar and Salem Alhazmi.

The software instantly triggers a “trip wire” that flags high-risk individuals—from casino cheats to known terrorists—and then compares what it knows about them with information in airline-reservation, passport and other databases.

The CIA, FBI and DHS all have started to deploy NORA in the past two years. Such software allows organizations to make “critical conections that otherwise would never have materialized,” says Shepherd at the Venetian.

SRD chief executive Jonas says that, had the government been using NORA prior to 9/11, most, if not all, of the terrorists involved in those attacks could have been captured long before they boarded those flights. He says a list of names supplied by the State Department listing foreign nationals still in the U.S. on expired visas could have been used to identify anyone of a similar name making an airline reservation or taking a room for a night at an Econo Lodge.

“There’s so much information out there available, but making sense of it and finding links between people, locations and events is the tricky part,” Jonas says.

Soon, the government and casinos—along with virtually every other industry that tracks and records large volumes of data—will have another tool from SRD that takes information gathering and relationship awareness to a whole new level.

ANNA, an offshoot of NORA, is in its final testing stages right now. This “double-blinding” technique of encryption makes it possible for investigators to search databases without seeing the names, addresses and other information they’re picking through.

With ANNA, owners of data would send data to a third party in a conventionally encrypted form. That third party would act as an independent holder of the data, using SRD’s software to index its contents and, at same time, apply a second level of encryption that makes it impossible to read or restore the data to its original form. This second level of encryption is what’s known as a “one-way” hashing algorithm.

An investigator can then pose queries to this hashed set of numbers and letters. But the person or organization making the queries can’t see or figure out the original names, addresses or information that is contained in the scrambled data.

Then, if the investigators’ queries produce matches in two separate databases—such as, say, every physics student enrolled in the past 10 years at any U.S. university and anyone granted a temporary visa from Saudi Arabia in the past 10 years—they can then go back to the original sources and ask for the specific information underlying those matches.

That underlines the importance of the third party, which will have to “unblind” those numbers and letters to their original form so the investigating party can ask the source for information on a specific person, date and locale.

At the same time, it makes it possible for a variety of investigating organizations to share data without exposing it in any way.

This is crucial to the FBI, CIA and other government agencies. Because the hashed data cannot be reconstructed into its original form, the information cannot be compromised, sold or accidentally transmitted to the very organizations they are pursuing.

“We could one-way hash the list of all the Al Queda terrorists the State Department has and send an e-mail to Osama bin Laden and he wouldn’t be able to decipher it,” Jonas says. “That’s the beauty of the software. It allows you to find matches of data that otherwise means nothing to anyone.”

How This Applies to Domestic Security: Homeland Security and FBI investigators using NORA and ANNA can now compare lists of suspected terrorists and other criminals on the lam to, for example, a database containing the names and addresses of anyone who has purchased a firearm in Florida or Oregon or, for that matter, the entire U.S. without compromising the names and addresses of every gun owner. Requests for data can be precise.