Tracking and Monitoring E-mail Traffic Activities of Criminal and Terrorist Organisations Using Visualisation Tools

In defensive information operations, knowing about the actions or behaviour of the adversary is important for countering any attacks posed by the adversary. Obtaining information about the activities and behaviour of criminal or terrorist groups from electronic communication sources, such as e-mail, will be useful given that criminal or terrorists may utilise different electronic communication mediums to contact each of their agents or members. In this paper, we describe the development of an e-mail traffic analyser system for analysing the interactions between different e-mail clients in the e-mail system. We discuss how different visualisation tools are used and how the information provided by such tools would be useful to an intelligence analyst. The use of decision trees for locating 'interesting' e-mail traffic interactions and the type of information revealed via the technique is also described.