The Police Chief, the Professional Voice of Law Enforcement
Advanced Search
September 2016HomeSite MapContact UsFAQsSubscribe/Renew/UpdateIACP

President's Message
Chief's Counsel
Legislative Alert
Technology Talk
From the Director
Police Chief Update
Highway Safety Initiatives
Line of Duty Deaths
New Members
Products and Services
Product Update
Survivors' Club
Current Issue
Search Archives
Web-Only Articles
About Police Chief
Law Enforcement Jobs
buyers Your Oppinion


The Northern Virginia Military Shooting Series: Operational Validation of Geospatial Predictive Analytics

By Colleen McCue, PhD, Senior Director, Social Science and Quantitative Methods, GeoEye Analytics; Lehew Miller, Lieutenant, Virginia State Police, Criminal Intelligence Division, Director, Virginia Fusion Center; and Steve Lambert, Captain, Virginia State Police, Criminal Intelligence Division, Bureau of Criminal Investigations

In October 2010, someone deliberately fired a number of rounds at the National Museum of the Marine Corps in Triangle, Virginia. This was the beginning of a series of shootings that targeted multiple locations of interest to the military in northern Virginia. Five shooting incidents occurred over the next several weeks, targeting the U.S Marine Corps (USMC) Museum, the Pentagon, and Marine Corps and Coast Guard recruiting stations, after which the shooter went dormant.

More than six months later, on June 17, 2011, Yonathan Melaku, a former Marine Corps reservist, was apprehended in Arlington Cemetery. Searches of his backpack and home revealed bomb-making materials; instructions for making improvised explosive devices (IEDs); videotaped evidence of the shootings; extremist materials; and spray paint, which he planned to use to vandalize markers in the cemetery.1 He subsequently plead guilty to the series of shootings.

Given that these incidents were eerily reminiscent of those perpetuated by the Washington, D.C., sniper several years earlier, the public safety and homeland security challenges associated with responding to this latest series of incidents were significant. The response was further complicated given the fact that the shooter was targeting facilities of interest to the military, which are abundant in northern Virginia and the National Capital Region. Moreover, during this time, the co-occurrence of several high-profile events including the Marine Corps Marathon, Veteran’s Day, and the Marine Corps Birthday further heightened the concern and complicated the response requirements. This was particularly challenging as it was unclear whether the shooter would continue to be satisfied with shooting unoccupied buildings during the night or would escalate to targeting people. Finally, the area of concern was extremely large, including multiple jurisdictions and numerous agencies. Even if the resources had existed, covering the entire area of concern was not practical.

As the agencies involved worked aggressively to respond to the shootings, geospatial predictive analytics was considered as an asset that could enable information-based decisions regarding resource allocation and optimization. By statistically characterizing the environment associated with previous or known incidents, geospatial predictive analysis allows the end user to identify statistically similar areas at increased likelihood for future or even previous, yet undetected incidents. The resulting model allows the end user to focus resources on areas at increased likelihood for a future incident. This so-called area reduction supports risk-based deployment wherein resources are deployed specifically when and where they are likely to be needed.2

Representing one of the foundational elements of the predictive policing model, the primary goal of risk-based deployment is to prevent future incidents by identifying the when, where, and what of crime in support of proactive resource allocation and related tactics and strategy. The second goal of risk-based deployment is rapid response to incidents that do occur, increasing the likelihood of apprehension and associated crime reduction through arrest. Again, the ability to know when, where, and what provides the insight necessary to anticipate future incidents, which supports information-based decisions regarding the prepositioning of resources, thereby enabling prevention and rapid response. Ultimately, the ability to anticipate crime supports proactive approaches to crime prevention, thwarting, mitigation, and response—changing outcomes while enabling agencies to do more with less.3

The law enforcement community has been exploring the use of advanced analytics to support operational decisions for several years.4 Representing an operationally relevant and actionable extension of this model, geospatial predictive analytics is an analytic technique that can be used to assist public safety and national security professionals to make decisions about allocating resources.5 Used throughout the law enforcement, defense, and national security communities, geospatial predictive analytics is based on the premise that human behavior is not distributed uniformly or randomly. Rather, individuals develop certain place preferences that include attractors or enablers, as well as factors that inhibit or deter their behavior. Similar behavioral preferences are seen in the commercial sector and are exploited regularly for marketing purposes.6 In the operational public safety and homeland security environment, the methodology is used to identify and model geospatial preferences associated with a perpetrator’s conscious and unconscious affinities and aversions, planning, and activities leading up to an incident. By applying a structured geospatial model, hundreds or even thousands of geospatial factors or variables can be fused together with past events to identify and characterize geospatial patterns of statistical similarity among criminal or terrorist location preferences. The result is a map that shows areas of low to high likelihood of a future event occurring within a given area of interest.

In contrast to other hot-spot methodologies, though, geospatial predictive analytics enables the analyst to identify new locations, including those that are not contiguous with the previous events. This is particularly important in that it provides the insight necessary to move from chasing crime as it may jump around the community to being able to effectively anticipate and get in front of it in support of proactive approaches to prevention and response.

As part of a U.S. Department of Homeland Security Science and Technology Directorate research and development project focusing on the translation of analytic methodologies developed for defense applications to the law enforcement environment, a team assigned to the Virginia Fusion Center (VFC) created a model of the first four shooting incidents.7 Four shooting incidents targeted facilities of interest to the U.S. military in northern Virginia October 17–29, 2010. The first and fourth shootings targeted the USMC National Museum, the second involved shots fired at the Pentagon, and the third target was a USMC Recruiting Station in Chantilly, Virginia (see figure 1).
Location of the first four shootings in the series

          Figure 1. Location of the first four shootings in the series, including the U.S. Marine
          Corps Recruiting Station in Chantilly, Virginia; the Pentagon; and the National
          Museum of the Marine Corps, which was shot at on two occasions.

Geospatial predictive analysis was then used to create a statistical model of the first four incidents and identify the locations that the shooter would most likely target next, based on areas that were geospatially similar to the first four events. Given the size of the area of interest (AOI) and potential resource constraints, the thresholds on the model were set to capture the top 2 percent “most likely” areas for a future shooting. This feature enables the end user to calibrate the area reduction and identify the highest likelihood locations in a very large area, making informed decisions regarding allocation of limited or otherwise scarce resources. The resulting area reduction map has been illustrated in figure 2. As can be seen in the figure, the locations most similar to the previous incidents have been identified and highlighted on the map as the most likely locations for a future incident. Again, this analytic product visually illustrates the highest likelihood locations for a future incident in an operationally relevant and actionable manner that can be used by nontechnical end users to make information-based decisions in the operational environment.
Assessment layer illustrating the results of the geospatial predictive analysis
          Figure 2. Assessment layer illustrating the results of the geospatial predictive analysis
          on the first four incidents in the series. Due to the size of the area of interest and
          resource limitations, the area reduction was set to depict the top 2 percent most likely
          areas for a future shooting. The arrow highlights a location in Woodbridge, Virginia,
          included in the high likelihood area, which was the location of a subsequent shooting.

Three days after the initial product identifying high likelihood target locations was disseminated and briefed, a new shooting incident was reported (see figure 3). The fifth incident, a shooting at a U.S. Coast Guard recruiting station in Woodbridge, occurred in an area deemed high likelihood by the model, despite the lack of Marine Corps affiliation common to three of the four prior incidents.8 Moreover, this incident occurred in an area physically removed from the previous shooting locations, further underscoring the importance of being able to model incidents statistically and identify new locations, including those that are physically distinct or disparate, rather than being confined exclusively to those locations that are in proximity to or contiguous with prior incidents. This particular benefit allows the public safety community to assume a proactive posture and get in front of crime rather than merely respond to each incident as it occurs.

A shooting incident at the U.S. Coast Guard Recruiting Center in Woodbridge, Virginia.
Figure 3. Three days after the analytic product was disseminated and briefed, a new
shooting incident at the U.S. Coast Guard Recruiting Center in Woodbridge,
Virginia, was reported. As depicted, this incident occurred in a location identified as
high likelihood by the model.

After the initial validation of the model, a decision was made to share the results more broadly with the agencies responding to the series in support of resource allocation, including patrol and surveillance assets. Again, the results of the assessment were depicted visually in a geospatial environment. This format can be used to effectively convey complex statistical relationships in an operationally relevant and actionable manner that can be given directly to nontechnical end users, including operational personnel for direct use in the field. Moreover, the ability to overlay the assessment layer onto an imagery foundation layer enabled the end users to leverage their tacit knowledge regarding the community and the environmental context in support of operational planning and related resource allocation, tactics, and strategy. It also supported additional interpretation of the results with regard to environmental context including operational requirements as they related to access, egress, concealment, cover, and other physical and spatial attributes associated with the areas identified as being at high likelihood for a future incident, providing additional insight into the series. In this particular case, the assessment products were saved as shapefiles that were loaded onto laptops and carried to agencies supporting the resource deployment effort, including proactive patrol and optimization of surveillance detection assets (see figure 4). This approach enabled the team to protect the analytic products generated and associated operational plan.

Another unique benefit that surfaced in this particular series was the fact that the team was able to leverage previous experience with shooting incidents in another locality in support of the model development. Geospatial predictive analysis was used previously in Jersey City, New Jersey, to characterize shootings in support of information-based approaches to crime prevention.9 While not identical in either modus operandi (MO) or motive, the series was similar enough that the models and the analytic tradecraft developed originally for use in this Jersey City case study were employed as starting points in an effort to build on an existing knowledge base and respond to a rapidly evolving public safety threat. The team also was able to share identified MO characteristics, trends, and patterns characterized previously without sharing the original data. This ability to share without disclosure and an emphasis on behavior facilitated the transfer of knowledge in an operationally relevant and actionable manner that supported effective deployment of the capability and rapid analytic response without compromising sensitive data resources. Shared technology, techniques, and tradecraft also supported the development of a virtual fusion center that tapped into existing analytic resources across multiple geographically disparate and distinct locations, including two regional fusion centers, enabling a level of functional interoperability that served as an analytic force multiplier in response to this rapidly developing threat.

Figure 4. The assessment products were loaded onto laptops and shared with
agencies on a “need to know” basis in support of information-based approaches to
deployment, including patrol and covert surveillance.

Given the pending high-profile events, additional specialized analyses were conducted using high-resolution geospatial data to evaluate specific locations and possible high-profile targets using sniper preference models and three-dimensional line-of-sight or viewshed analysis. Briefly, these techniques were used to analyze the space in three dimensions to identify locations where the shooter would have the line of sight necessary to effectively identify and shoot a potential target, with the standoff similar to previous incidents. By integrating these capabilities with the geospatial predictive assessments, the analysts were then able to visually illustrate areas of place preference for the shooter, which also allowed for the standoff consistent with the previous incidents and the line of sight necessary to actually take the shot. In other words, the combination of these two analytic approaches enabled the analysts to visually depict locations that the shooter preferred where they could also set up the shot based on information from the previous incidents, while also considering the spatial attributes and visual constraints of the location. Again, the analytic products generated from this effort included assessment layers and shapefiles that were shared in support of additional location- and domain-specific analysis and resource allocation, including proactive patrol, resourcing, and optimization of limited surveillance detection assets.

On June 17, 2011, approximately six months after the fifth and final shooting in the series, a suspect was apprehended in the Arlington National Cemetery. The suspect identified was a former Marine Corps Reservist, Yonathan Melaku, who was in the cemetery with plans to desecrate the graves of Iraq and Afghanistan veterans and leave explosive materials as part of, “a solitary campaign of ‘fear and terror’ that included the earlier shootings.”10 Materials found in his backpack and the subsequent search of his residence included supplies and instructions for making IEDs; extremist materials including references to Osama bin Laden and The Path to Jihad; videotaped evidence linking him to the shootings; and spray paint, which he planned to use to vandalize the markers of service personnel who died in Iraq and Afghanistan. Investigators familiar with the case noted that it was fortunate that the suspect had been apprehended because it was, “unclear what might have been coming had he not been caught,” suggesting that the suspect may have escalated from shooting into unoccupied buildings to something more concerning. 11 Of note, the location where Melaku was initially discovered and then apprehended had been identified previously as a high likelihood area and was consistent with the shooter’s original place preference in the models created during the active phase of the series, further validating the assessment (see figure 5).

Figure 5. On June 17, 2011, Yonathan Melaku was apprehended in the Arlington
National Cemetery. The figure depicts the assessment that was created on the
original series and the location where the suspect was apprehended. The inset box
depicts the location in the cemetery in greater detail, including the general location
where the suspect was apprehended.

Beyond the direct and immediate value of the specific analytic products generated as this particular series was developing, this case study represents a “proof of model” for the fusion centers and the critical role that they play in both vertical and horizontal integration, analysis, and operational support. The fact that this particular series crossed jurisdictional boundaries and functional domains further underscores the unique challenges and the concomitant benefit of the fusion centers in integrated approaches to analysis and functional interoperability. Ultimately, the fusion centers were the ideal organizations to respond to this fast breaking series that transcended traditional law enforcement, homeland, and national security domains. While other agencies supported the investigative mission directly, the VFC’s coordination and leadership role was critical to enabling the regional analysis required to effectively address the resource allocation and deployment challenge, particularly given the broad AOI. Again, the analytic products were operationally relevant and actionable and used by an array of local, state, and federal agencies in the region to prioritize and optimize their resources. Key to this success was the common capabilities, the technology, and the analytic tradecraft that had been established at the regional fusion centers, which enabled cross–fusion center collaboration in support of an analytic force multiplier in response to a rapidly emerging, fluid threat environment, thereby leveraging the fusion center network in support of a common mission.

Recently, budgetary limitations have created an environment where agencies have moved from doing more with less to doing almost everything with nothing, and the agencies directly responding to this series were no exception. The ability to ensure public safety using fewer resources has become an urgent necessity given the economic challenges and associated constraints facing most agencies but also represents a unique opportunity for police managers as they begin to realize the promise of advanced analytics in the operational law enforcement environment.12 Again, the AOI associated with this particular series potentially included the entire National Capitol region, which spans two states and the District of Columbia. It was not practical to put a cop on every corner in this situation, regardless of the urgency of the threat or the resources available to support the effort. Rather, area reduction was necessary to optimize resources and place them in or near locations at greater risk for an incident.

Finally, this work also represents another example of the importance of public-private partnerships, which are being highlighted as the new model of public service delivery. The law enforcement community has been walking the talk, particularly as it relates to the adoption of advanced analytics in support of the predictive policing model, and deserves recognition for their thought leadership and innovation in this area. Moreover, as budgets become increasingly
limited and priorities are reevaluated, the fusion centers provide a unique opportunity to leverage advanced analytics, optimize data and analytic resources, and create a unique force multiplier through their unique vertical and horizontal integration role, as well as the emerging partnerships with the private sector. This particular model mirrors the “managed service” model in the private sector, which has emerged as a method of optimizing scarce or expensive resources, including data, software, and analytic talent, while conferring a level of functional interoperability across agencies supporting a common mission or geographic space. Again, the fusion centers and their constituent agencies bring a unique and direct benefit to local, state, and federal law enforcement, as well as to the larger homeland and national security domains. Their thought leadership and willingness to adopt innovative technology and collaborative models as well as their ability to transcend geographic and functional boundaries underscore the value of the fusion centers to the public safety community.

The Northern Virginia Military Shootings series provided a real-world operational test of geospatial predictive analytics in response to a rapidly emerging series that transcended traditional basic crimes and national security domains and involved local, state, and federal agencies. The results of the model created from the first four shooting incidents accurately anticipated the location of the fifth incident, despite the lack of specific Marine Corps affiliation common to three of the four prior incidents. Moreover, while we cannot state definitively that the heavy deployment in areas identified through the assessment prevented future incidents, the suspect ultimately was apprehended in a location identified as a high likelihood target location. The common capabilities, the technology, and the analytic tradecraft at the regional fusion centers were key to this analytic success. This enabled cross–fusion center collaboration and support, creating an analytic force multiplier that effectively leveraged the fusion center network and underscores the role that information-based approaches can play in operational law enforcement decision making and resource allocation.

In closing, as the use of advanced analytics in the law enforcement and homeland security environment is considered, ask, “Why just count incidents and react when you can anticipate, prevent, thwart, and respond more effectively?” The use of predictive analytics in law enforcement and homeland security analysis enables the development of meaningful, information-based tactics, strategy, and policy decisions in the operational environment. Ultimately, the ability to identify and characterize threats and anticipate incidents represents a game changing paradigm shift in the operational public safety domain. ?

The authors thank Stephen Knox, program manager, Infrastructure Protection and Disaster Management Division, Science and Technology Directorate, U.S. Department of Homeland Security (DHS); Matt Cyr, Intelligence Officer, State and Local Program Office, Office of Intelligence and Analysis, DHS; and Anthony Bursae, Suzen Collins, and Ben Holland for their efforts on the project.

1Josh White, “Yonathan Melaku Admits Shooting at Pentagon, Military Buildings,” Washington Post, January 26, 2012, (accessed December 18, 2012).
2Colleen McCue, Data Mining and Predictive Analysis: Intelligence Gathering and Crime Analysis (Oxford, United Kingdom: Butterworth-Heinemann, 2007); and Colleen McCue and Paul J. McNulty, “Gazing into the Crystal Ball: Data Mining and Risk-Based Deployment,” Violent Crime Newsletter (September 2003): 1–2.
3Charlie Beck and Colleen McCue, “Predictive Policing: What Can We Learn from Wal-Mart and Amazon about Fighting Crime in a Recession?” The Police Chief 76, no. 11 (November 2009), (accessed December 18, 2012).
4Colleen McCue and Andre Parker, “Connecting the Dots: Data Mining and Predictive Analytics in Law Enforcement and Intelligence Analysis,” The Police Chief 70, no. 10 (October 2003), (accessed December 18, 2012).
5Jason R. Dalton and Michael D. Porter, “Geospatial Preference Models in Signature Analyst” (white paper, SPADAC, Inc., McLean, Va., 2009).
6Charles Duhigg, “How Companies Learn Your Secrets,” New York Times, February 16, 2012, (accessed December 18, 2012).
7This case study is based on the testing performed at the Virginia Fusion Center of the Signature Analyst geospatial predictive analytic software produced by GeoEye as part of an ongoing project by the Department of Homeland Security, Science and Technology Directorate to determine the viability of transferring technologies and associated methodologies from the military and intelligence community to domestic law enforcement.
8This particular location was in the top 9 percent area but immediately adjacent to the top 2 percent area reduction depicted in figures 2 and 3, which still enabled the functional exclusion of 91 percent of the AOI.
9Raymond Guidetti and James W. Morentz, “Geospatial Statistical Modeling for Intelligence-Led Policing,” The Police Chief 77, no. 8 (August 2010): 72–76, (accessed December 18, 2012).
10White, “Yonathan Melaku Admits Shooting at Pentagon, Military Buildings.”
12Beck and McCue, “Predictive Policing: What Can We Learn from Wal-Mart and Amazon about Fighting Crime in a Recession?”

Please cite as:

Colleen McCue, Lehew Miller, and Steve Lambert, "The Northern Virginia Military Shootings Series: Operational Validation of Geospatial Predictive Analytics" The Police Chief 80 (February 2013): 48–52.



From The Police Chief, vol. LXXX, no. 2, February 2013. Copyright held by the International Association of Chiefs of Police, 515 North Washington Street, Alexandria, VA 22314 USA.

The official publication of the International Association of Chiefs of Police.
The online version of the Police Chief Magazine is possible through a grant from the IACP Foundation. To learn more about the IACP Foundation, click here.

All contents Copyright © 2003 - International Association of Chiefs of Police. All Rights Reserved.
Copyright and Trademark Notice | Member and Non-Member Supplied Information | Links Policy

44 Canal Center Plaza, Suite 200, Alexandria, VA USA 22314 phone: 703.836.6767 or 1.800.THE IACP fax: 703.836.4543

Created by Matrix Group International, Inc.®