Analyze This (and That): Event-Based Analysis - Changing Your Vantage Point

Vantage Point: a position or standpoint from which something is viewed or considered.

Did you see the 2008 movie Vantage Point? It retells the same story multiple times, each iteration from different a perspective. It’s not until nearly the end of the movie that you understand the whole story. I often refer to this movie as an example of how a single vantage point only tells part of the story – much like that of the content of a communication.

Many of my colleagues have written about the power of event data (e.g., system logs, access logs, communication logs, etc.). For example, iDS’ Neal Lawson and Bobby Williams co-authored It’s the Context, Not The Content for Metropolitan Corporate Counsel, wherein they discuss how to leverage data to tell the story, rather than simply reviewing the content. “. . . we believe that the shift from documents and content to data-based discovery and the search for context is underway.”

As you evaluate your next matters (or reevaluate your current matters), ask yourself if you are considering multiple vantage points – do you understand the whole story. Are you simply reviewing emails? Text messages? GPS data? Or, are you stepping back and looking for the context of the scenario, to see what different vantage points you may want to consider? Let’s take a look at a quick example.

You’re investigating inappropriate disclosure of sensitive company information. There are four instances, that you know of, where company information has been misused. You believe you know who provided the information, who received the information, and the actions subsequently taken, but you don’t know how the information was conveyed. You’ve poured over emails, text messages, social media, etc., but you haven’t connected any dots of value. What if you look at the events surrounding what you do know (e.g., the use of the sensitive information) to look for commonalities?

Here, uncovering a sequence of additional events that preceded the misuse of information revealed not only multichannel communications used, but also additional individuals involved.

  • Telephone conversation (Party A and Party B)
  • Text message sent (Party B to Party C)
  • Tweet (Party C)
  • LinkedIn Post (Party D)
  • Misuse of Information (Party E)

The above sequence of events happened within three hours of the four instances of misuse you’re aware of. A traditional content-based approach would not have traversed the multitude of communication channels, nor would it have allowed you to identify the commonalities across time. Here, you have uncovered that this is not just a two-party investigation, but five. And now that you know this sequence and the five people, you can look for other similar instances. Once you do, you find out it hasn’t just happened four times, but rather twelve over the last six months. That’s the power of analyzing event data.

Content is undoubtedly important. While every matter and data source can pose its own challenges, I encourage you to look at your matters from a new vantage point – event-based analysis – to see if it helps you uncover the real narrative.