Dark Web Threat Intelligence for Cyber Investigations

Overview

Development stage

DeployedSource: c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.

High-impact designation

Presumed high-impact, determined notSource: b) Presumed high-impact, but determined not high impact

Impact justification

This use case provides a more efficient way to process, review, summarize, translate, and analyze dark web data for use in HSI investigations. The AI output may be used to produce investigative insights, but the output itself is supporting information for HSI personnel to use for ease of review, for further analysis, and to produce leads. Insights derived from translated data allow investigators to identify the most relevant data that, if deemed critical for court proceedings, can be submitted to certified human translators for final review. Personnel may use investigative insights for law enforcement actions such as identifying criminal suspects; however, all insights are reviewed and validated by both personnel and supervisors before being included in any official case management system, and do not serve as a principal basis for any law enforcement action or decision. Any enforcement decisions related to these insights are outcomes of the full Federal Investigation Process involving verifying any insights as evidence (including validating AI-translated material by a certified interpreter), presentation to a U.S. Attorney’s Office and potentially a District Court judge, decision to prosecute, judicial review, and trial and sentencing.

Start date

2024-08-01 (day precision)Source: 2024-08-01T00:00:00

Withheld from public reporting

Not reported

Mission

Topic area

Law Enforcement

Operational functions

Summarization, Translation and transcription Derived by keyword rules; see methodology

Problem the AI is intended to solve

This use case intends to solve the problem of quickly identifying and summarizing relevant cyber threat data from the dark web, which can be difficult and time-consuming for analysts.

Expected benefits

The summarized information helps analysts quickly identify threat actors, trends, and illicit platforms, enabling them to prioritize their investigative efforts. The data analysis and extraction techniques connect related information across data holdings and generate metadata to help analysts review and search results. The translation capability helps analysts identify non-English data responsive to an investigation and saves time otherwise spent translating non-responsive data.

System outputs

The system’s AI outputs are concise summaries of search results, English translations of non‑English data, and metadata that highlights potential connections and leads. These outputs assist analysts in quickly identifying key findings while retaining access to the original data for deeper analysis and verification. All outputs are part of a broader investigative process and are not used as the sole basis for enforcement actions.

Technology

AI classification

Generative AISource: Generative AI: AI that generates new or synthetic content (e.g., images, videos, audio, text, code).

System name(s)

Not reported

Custom-developed code

No

Public source code

Not reported

Sourcing

How it was built

Purchased from vendorSource: a) Purchased from a vendor

Vendor (as reported)

Law Enforcement Sensitive (LES)

Vendors (standardized)

None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

Yes

Privacy Impact Assessment

Not reported

Authorization to Operate

No

Demographic features

Not reported

Training and evaluation data

Not reported

Federal Data Catalog

Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported