Continuing the Investigation from Part 3….
4. Given the data sources provided, identify potential informal or unofficial relationships among GASTech personnel. Provide evidence for these relationships.
To visusalise potential relationships relationships, network analysis was used to look at the relationships. Figure 1 shows an interactive network analysis of each car ID employee and the locations that they made transactions at with their GAStech cc. From the network analysis throughout the two weeks of data, we can uncover some relationships among employees.
cc_data <- cc %>% mutate(day=lubridate::day(datetime), hour=lubridate::hour(datetime))
sources <- cc_data %>% mutate(hour=lubridate::hour(datetime)) %>%
distinct(last4ccnum) %>% left_join(final_tagging, by=c("last4ccnum")) %>%
mutate(name=paste(LastName,FirstName)) %>%
rename(label = name) %>% drop_na(id) %>%
mutate(CurrentEmploymentType=ifelse(is.na(CurrentEmploymentType),"Driver",CurrentEmploymentType))
destinations <- cc_data %>%
distinct(location) %>%
rename(label = location)
cc_nodes <- full_join(sources,
destinations,
by = "label") %>% rename(car_id=id)
cc_nodes <- cc_nodes %>%
rowid_to_column("id") %>%
mutate(CurrentEmploymentType=ifelse(is.na(CurrentEmploymentType),
"Locations",CurrentEmploymentType),
title=label) %>%
rename(group=CurrentEmploymentType)
edges <- cc_data %>%
mutate(last4ccnum = as.character(last4ccnum)) %>%
filter(last4ccnum %in% final_tagging$last4ccnum) %>%
group_by(last4ccnum, location, day, hour) %>%
summarise(weight = n()) %>%
ungroup()
cc_edges <- edges %>%
inner_join(cc_nodes,by = c("last4ccnum")) %>%
rename(from = id)
cc_edges <- cc_edges %>%
inner_join(cc_nodes,by = c("location" = "label")) %>%
rename(to = id) %>%
dplyr::select(from, to,day, hour, weight) %>%
mutate(time_bin = case_when(hour>=0&hour<6~"Midnight",
hour>=6&hour<12~"Morning",
hour>=12&hour<18~"Afternoon",
hour>=18~"Night"),
weekday.weekend = ifelse(day %in% c(11,12,18,19),"Weekend","Weekday"),
day.week = case_when(day==6|day==13~"Monday",
day==7|day==14~"Tuesday",
day==8|day==15~"Wednesday",
day==9|day==16~"Thursday",
day==10|day==17~"Friday",
day==11|day==18~"Saturday",
day==12|day==19~"Sunday",))
visNetwork(cc_nodes, cc_edges, main="Network analysis by location and employee") %>%
visIgraphLayout(layout = "layout_on_grid") %>%
visOptions(highlightNearest = TRUE, nodesIdSelection = TRUE) %>%
visLegend()
Figure 1: Network analysis by location and employee
- Desafio Golf Course was visited by GAStech Executives only. Based on the boxplot in part 2, we observed that there are only cc transactions made on Sunday at the location. Hence, we can infer that all five executive of GAStech might have some after working hours relationship by gathering at the Desafio Golf Course on both Sundays. They might be playing golf or a regular gathering at the location.
- Chostus Hotel was visited by Orilla Elsa, Tempestad Brand and Sanjorge Jr. Sten throughout the 2 weeks of data. Table 1 below shows the transaction at Chostus Hotel only and we can observe that Orilla Elsa and Tempestad Brand made transactions on 4 separate dates during lunch. The transactions were relatively expensive for a lunch meal in comparison to other food and beverage location in Abila. Alternatively, they might have paid for a hotel room during their visit to the location. Furthermore, both of them are from the same department with the same title in GAStech and there might be some relationship between them.
knitr::kable(cc %>% mutate(last4ccnum=as.character(last4ccnum)) %>%
left_join(final_tagging, by=c("last4ccnum")) %>%
filter(location=="Chostus Hotel") %>%
select(name, CurrentEmploymentType, CurrentEmploymentTitle,
location, timestamp, price),
caption="Table of transaction at Chostus Hotel")
| name | CurrentEmploymentType | CurrentEmploymentTitle | location | timestamp | price |
|---|---|---|---|---|---|
| Orilla Elsa | Engineering | Drill Technician | Chostus Hotel | 01/08/2014 12:56 | 107.51 |
| Tempestad Brand | Engineering | Drill Technician | Chostus Hotel | 01/08/2014 13:19 | 111.89 |
| Tempestad Brand | Engineering | Drill Technician | Chostus Hotel | 01/10/2014 13:08 | 133.25 |
| Orilla Elsa | Engineering | Drill Technician | Chostus Hotel | 01/10/2014 13:11 | 197.41 |
| Orilla Elsa | Engineering | Drill Technician | Chostus Hotel | 01/14/2014 13:17 | 109.54 |
| Tempestad Brand | Engineering | Drill Technician | Chostus Hotel | 01/14/2014 13:21 | 113.08 |
| Tempestad Brand | Engineering | Drill Technician | Chostus Hotel | 01/17/2014 13:49 | 114.22 |
| Orilla Elsa | Engineering | Drill Technician | Chostus Hotel | 01/17/2014 13:54 | 159.62 |
| Sanjorge Jr. Sten | Executive | President/CEO | Chostus Hotel | 01/18/2014 12:03 | 600.00 |
- Bean There Done That location had only transactions made by the engineering department (yellow nodes in figure 1). Bean There Done That is the furthest location from GAStech but a certain group of customer still visits and purchase from them. Visualising the GPS stationary data for the 7 customers from the engineering team in figure 2, we observe that 5 out of 7 of the customers resides in the area of Carnero Street and Parla Park whereas the remaining 2 customers, Frente Birgitta and Dedos Lidelse resides between Arkadiou Park and Sannan Park. The 2 customers residential location are at the same coordinates yet far away from Bean There Done That. However, they still patronise and purchase from there might signify some relationship between both of them.
bean_cust <- final_tagging %>% filter(name == "Frente Birgitta"|
name == "Calzas Axel"|
name == "Frente Vira"|
name == "Azada Lars"|
name == "Balas Felix"|
name == "Dedos Lidelse"|
name == "Cazar Gustav")
gps_stop_points_bean <- gps_pts %>%
filter(id %in% bean_cust$id) %>%
mutate(time.stop = difftime(next.start.time, end.time,units=c("mins")),
time.stop = as.numeric(time.stop),
name=paste(LastName,FirstName))%>%
filter(time.stop < 300 ) %>%
dplyr::select(id, start.time, start.gps,name) %>%
mutate(id=as.character(id))
## Plot interactive map
tmap_mode("view")
map_bean<-tm_shape(bgmap) +
tm_rgb(bgmap, r=1, g=2, b=3, alpha=NA, saturation=1,
interpolate=TRUE, max.value=255) +
tm_shape(gps_stop_points_bean)+
tm_dots(col="name",palette="Dark2",id="start.time")
tmap_leaflet(map_bean)
Figure 2: Stationary GPS points of Bean There Done That customers
To investigate non-official relationships, we will focus on after working hours transactions. The network analysis was drilled down to transactions performed on Weekday Nights only and dining locations that had transactions in the afternoon or night to reduce cluttering of the network analysis. Figure 3 shows the network analysis for weekday nights transactions only. The edge line connecting the employees to location are colored by day to visualize if any group of employees visited a particular location on the same day in the night.
sources <- cc_data %>% mutate(hour=lubridate::hour(datetime)) %>%
distinct(last4ccnum) %>% left_join(final_tagging, by=c("last4ccnum")) %>%
mutate(name=paste(LastName,FirstName)) %>%
rename(label = name) %>% drop_na(id) %>%
mutate(CurrentEmploymentType=ifelse(is.na(CurrentEmploymentType),
"Driver",CurrentEmploymentType))
destinations <- cc_data %>%
filter(location =="Ouzeri Elian"|
location=="Guy's Gyros"|
location=="Katerina's Cafe"|
location=="Hippokampos"|
location=="Abila Zacharo"|
location=="Gelatogalore"|
location=="Kalami Kafenion"|
location=="Chostus Hotel") %>%
distinct(location) %>%
rename(label = location)
cc_nodes <- full_join(sources,
destinations,
by = "label") %>% rename(car_id=id)
cc_nodes <- cc_nodes %>%
rowid_to_column("id") %>%
mutate(CurrentEmploymentType=ifelse(is.na(CurrentEmploymentType),
"Locations",CurrentEmploymentType),
title=label) %>%
rename(group=CurrentEmploymentType)
edges <- cc_data %>%
mutate(last4ccnum = as.character(last4ccnum)) %>%
filter(last4ccnum %in% final_tagging$last4ccnum) %>%
group_by(last4ccnum, location, day, hour) %>%
summarise(weight = n()) %>%
ungroup()
cc_edges <- edges %>%
inner_join(cc_nodes,by = c("last4ccnum")) %>%
rename(from = id)
cc_edges <- cc_edges %>%
inner_join(cc_nodes,by = c("location" = "label")) %>%
rename(to = id) %>%
dplyr::select(from, to,day, hour, weight) %>%
mutate(time_bin = case_when(hour>=0&hour<6~"Midnight",
hour>=6&hour<12~"Morning",
hour>=12&hour<18~"Afternoon",
hour>=18~"Night"),
weekday.weekend = ifelse(day %in% c(11,12,18,19),"Weekend","Weekday"),
day.week = case_when(day==6|day==13~"Monday",
day==7|day==14~"Tuesday",
day==8|day==15~"Wednesday",
day==9|day==16~"Thursday",
day==10|day==17~"Friday",
day==11|day==18~"Saturday",
day==12|day==19~"Sunday",))
cc_edges_dn<- cc_edges %>%
filter(time_bin=="Night", weekday.weekend=="Weekday") %>%
mutate(color=rainbow(max(day))[day])
# cc_edges_dn$color <- palette(rainbow(7))[cc_edges_dn$day]
visNetwork(cc_nodes, cc_edges_dn,
main="Network analysis by location and employee") %>%
visIgraphLayout(layout = "layout_on_grid") %>%
visOptions(highlightNearest = TRUE, nodesIdSelection = TRUE) %>%
visEdges(smooth=FALSE, color="color") %>%
visLegend()
Figure 3: Network analysis on Weekday Night
- Employee Baza Isak and Calixto Nils patronised Ouzeri Elian on several night at the same time. From table 2, we observe that on 08/01 and 16/1, Baza Isak and Calixto Nils transaction timing were only 1 minute apart and on 17/1, both had transactions in the evening. A probable deduction could be that they are of good friends since they are in the same department who hang out and have dinner together after working hours.
final_cc <- cc %>% mutate(left4ccnum=as.character(last4ccnum)) %>%
left_join(final_tagging, by="last4ccnum") %>%
mutate(day=lubridate::day(datetime), hour=lubridate::hour(datetime),
time_bin = case_when(hour>=0&hour<6~"Midnight",
hour>=6&hour<12~"Morning",
hour>=12&hour<18~"Afternoon",
hour>=18~"Night"),
weekday.weekend = ifelse(day %in% c(11,12,18,19),"Weekend","Weekday"),
day.week = case_when(day==6|day==13~"Monday",
day==7|day==14~"Tuesday",
day==8|day==15~"Wednesday",
day==9|day==16~"Thursday",
day==10|day==17~"Friday",
day==11|day==18~"Saturday",
day==12|day==19~"Sunday",))
knitr::kable(final_cc %>%
filter(weekday.weekend=="Weekday"&time_bin=="Night") %>%
filter(location =="Ouzeri Elian"&(name=="Baza Isak"|name=="Calixto Nils")) %>%
select(location, datetime, name, price, CurrentEmploymentType,CurrentEmploymentTitle)
, "simple",
caption="Baza Isak and Calixto Nils transactions at Ouzeri Elian on Weekdays Nights")
| location | datetime | name | price | CurrentEmploymentType | CurrentEmploymentTitle |
|---|---|---|---|---|---|
| Ouzeri Elian | 2014-01-08 21:16:00 | Calixto Nils | 30.81 | Information Technology | IT Helpdesk |
| Ouzeri Elian | 2014-01-08 21:17:00 | Baza Isak | 29.85 | Information Technology | IT Technician |
| Ouzeri Elian | 2014-01-09 19:42:00 | Baza Isak | 27.08 | Information Technology | IT Technician |
| Ouzeri Elian | 2014-01-10 18:52:00 | Baza Isak | 19.92 | Information Technology | IT Technician |
| Ouzeri Elian | 2014-01-13 19:30:00 | Calixto Nils | 28.75 | Information Technology | IT Helpdesk |
| Ouzeri Elian | 2014-01-14 20:32:00 | Baza Isak | 11.86 | Information Technology | IT Technician |
| Ouzeri Elian | 2014-01-15 20:29:00 | Baza Isak | 23.18 | Information Technology | IT Technician |
| Ouzeri Elian | 2014-01-16 20:25:00 | Baza Isak | 23.89 | Information Technology | IT Technician |
| Ouzeri Elian | 2014-01-16 20:28:00 | Calixto Nils | 9.91 | Information Technology | IT Helpdesk |
| Ouzeri Elian | 2014-01-17 19:40:00 | Baza Isak | 38.60 | Information Technology | IT Technician |
| Ouzeri Elian | 2014-01-17 20:28:00 | Calixto Nils | 35.81 | Information Technology | IT Helpdesk |
Apart from the transactional data performed by employees, we will look into the GPS data to observe for any gathering and potential relationships. Figure 4 shows every employee car GPS stationary coordinates.
gps_stop_points <- gps_pts %>%
mutate(time.stop = difftime(next.start.time, end.time,units=c("mins")),
time.stop = as.numeric(time.stop),
time.location = difftime(next.start.time,end.time),
time.location = as.numeric(time.location),
name=paste(LastName,FirstName),
id=as.character(id),id=as.numeric(id),
gps.coord=end.gps)%>%
filter(id<100 ) %>%
dplyr::select(name, CurrentEmploymentType,CurrentEmploymentTitle,
end.time, end.gps,next.start.time,time.location) %>%
rename(Arrival.Time=end.time, Coordinate=end.gps,
Next_move_off_time=next.start.time,Time_at_location=time.location)
## Plot interactive map
tmap_mode("view")
fullmap<-tm_shape(bgmap) +
tm_rgb(bgmap, r=1, g=2, b=3, alpha=NA, saturation=1,
interpolate=TRUE, max.value=255) +
tm_shape(gps_stop_points)+
tm_markers()
tmap_leaflet(fullmap)
Figure 4: Stationary GPS points of all cars
- Hovering around the location in between Arkadiou Park and Sannan Park with coordinates (24.89, 36.06) reveals 57 GPS stationary coordinates at that location. The 57 GPS points belongs to Dedos Lidelse, Osvaldo Hennie and Frente Birgitta cars. From the GPS timestamp in table 3, Dedos Lidelse car stops at the location overnight daily. We can deduce that the location is likely the home of Dedos Lidelse. Alluvial diagram in figure 5 was used to visualise the time spent at Dedos Lidelse house for the three employees. We can observe some trends based on the time spent at the location.
knitr::kable(gps_stop_points %>% st_drop_geometry() %>%
filter(name=="Dedos Lidelse", Time_at_location>450) %>%
select(name, Arrival.Time, Coordinate,
Next_move_off_time, Time_at_location),
"simple",
caption="Table of transaction at Chostus Hotel")
| name | Arrival.Time | Coordinate | Next_move_off_time | Time_at_location |
|---|---|---|---|---|
| Dedos Lidelse | 2014-01-06 20:18:01 | POINT (24.89612 36.06343) | 2014-01-07 07:01:01 | 643.0000 |
| Dedos Lidelse | 2014-01-07 20:20:05 | POINT (24.89616 36.06332) | 2014-01-08 07:12:01 | 651.9333 |
| Dedos Lidelse | 2014-01-08 21:22:01 | POINT (24.89617 36.0634) | 2014-01-09 07:17:01 | 595.0000 |
| Dedos Lidelse | 2014-01-09 17:39:39 | POINT (24.89615 36.06342) | 2014-01-10 07:08:01 | 808.3667 |
| Dedos Lidelse | 2014-01-10 23:39:30 | POINT (24.89611 36.0634) | 2014-01-11 18:51:01 | 1151.5167 |
| Dedos Lidelse | 2014-01-11 20:57:00 | POINT (24.89635 36.06331) | 2014-01-12 12:30:01 | 933.0167 |
| Dedos Lidelse | 2014-01-12 20:56:03 | POINT (24.89614 36.06337) | 2014-01-13 07:05:01 | 608.9667 |
| Dedos Lidelse | 2014-01-13 21:09:01 | POINT (24.89612 36.06339) | 2014-01-14 07:43:01 | 634.0000 |
| Dedos Lidelse | 2014-01-14 20:36:01 | POINT (24.8961 36.06338) | 2014-01-15 07:41:01 | 665.0000 |
| Dedos Lidelse | 2014-01-15 20:40:08 | POINT (24.8961 36.06341) | 2014-01-16 07:13:01 | 632.8833 |
| Dedos Lidelse | 2014-01-16 19:49:08 | POINT (24.8961 36.06338) | 2014-01-17 07:28:01 | 698.8833 |
| Dedos Lidelse | 2014-01-17 17:45:39 | POINT (24.89608 36.06337) | 2014-01-18 12:38:01 | 1132.3667 |
| Dedos Lidelse | 2014-01-18 19:40:05 | POINT (24.89612 36.0634) | 2014-01-19 18:25:01 | 1364.9333 |
1.1 Frente Birgitta and Osvaldo Hennie often arrive at the location around 1700 hrs and leave at 1900 hrs on weekdays only.
1.2 Frente Birgitta would often drop by the location twice a days. On those days, Frente Birgitta would arrive around 1700hrs and leave at 1900hrs, similar like above and return subsequently to the location after 2000hrs and leave the following morning.
1.3 Osvaldo Hennie only stay overnight at that location 5 times over this period.
Probable deduction is that they were having dinner together at Dedos Lidelse house. An unofficial relationship might exist between Frente Birgitta and Dedos Lidelse. Furthermore, both employees are from the engineering department which might further support the deduction.
denos_loc<-st_set_crs(st_sfc(st_point(c(24.89612,36.06343))),4326)
denos_home<-gps_stop_points %>%
mutate(dist_denos = st_distance(Coordinate, denos_loc),
dist_denos=as.numeric(dist_denos)) %>%
filter(dist_denos<50) %>%
mutate(arrival.date=lubridate::date(Arrival.Time),
arrival.hour=lubridate::hour(Arrival.Time),
departure.date=lubridate::date(Next_move_off_time),
departure.hour=lubridate::hour(Next_move_off_time),
name2=name) %>%
filter(arrival.hour>16) %>%
select(name2, name,arrival.date, departure.date,arrival.hour,departure.hour)%>%
st_drop_geometry() %>% to_lodes_form(denos_home, key="Variables",axes=2:6)
ggplot(denos_home, aes(x=Variables,stratum=stratum,alluvium=alluvium))+
geom_alluvium(aes(fill=name2),discern=FALSE)+
geom_stratum(width=1/3,alpha=.2,discern=FALSE)+
geom_label(stat="stratum",size=2,aes(label=after_stat(stratum)))+
theme(axis.text.y=element_blank(),
axis.title.x=element_blank(),
axis.ticks.y=element_blank(),
axis.text.x = element_text(size=8),
legend.position="none")+
labs(fill="Name")
Figure 5: Alluvial Diagram of time spent at Dedos Lidelse house
5. Do you see evidence of suspicious activity? Identify 1- 10 locations where you believe the suspicious activity is occurring, and why.
Employees car GPS were analysed to investigate for unusual driving patterns. The GPS data was manipulated to derive the two stationary coordinates for each car trip to determine the start and end coordinates. The distance between the two coordinates was tabulated to determine the displacement between the two coordinates.
Figure 6 shows the scatter plot of the cars plotted with distance traveled against driving time with the line of best fit to show the average speed. The plots was split by time period and only showcase weekday data. The points in red are the outliers in each time period in the 1% quantile range. Although the distance is not the actual distance traveled by the car, it will be a good proxy to determine the average speed require to get from one location to another location.
gps_dist <- gps_pts %>%
mutate(distance=st_distance(start.gps, end.gps, by_element = TRUE),
distance=as.numeric(distance), driving.time=as.numeric(driving.time),
id=as.character(id), id=as.numeric(id),
car.type=ifelse(id<100,"Car","Truck"),
speed=round((distance/1000)/(driving.time/60),2), dist=round(distance,2),
time_bin = case_when(
hour(start.time)>=0 & hour(start.time)<6 ~ "Midnight",
hour(start.time)>=6 & hour(start.time)<12 ~ "Morning",
hour(start.time)>=12 & hour(start.time) <18 ~ "Afternoon",
hour(start.time)>=18 ~ "Night"),
time_bin = factor(time_bin,
levels = c("Midnight", "Morning", "Afternoon", "Night")))
speed_0.01<- gps_dist %>% group_by(id,date) %>% summarize(d=sum(dist), dt = sum(driving.time),n=n(),
avg_dist = d/n, avg_time=dt/n) %>% ungroup()
gps_dist_weekday<-gps_dist %>%
filter(!(date %in% c(dmy(11012014),dmy(12012014),dmy(18012014),dmy(19012014)))&
id<100) %>%
st_drop_geometry() %>% group_by(time_bin) %>%
mutate(q=quantile(speed, 0.01),
col=as.character(ifelse(speed<q,1,0))) %>%
ungroup()
speed<-ggplot(gps_dist_weekday, aes(y=dist, x=driving.time))+
geom_point(aes(text=paste("</br>Name:",paste(LastName,FirstName),
"</br>Distance:",dist,"metre",
"</br>Minutes:",driving.time,
"</br>Speed:",speed,"km/hr",
"</br>Date:",date,
"</br>Start time:",start.time,
"</br>End time:",end.time),
color=col)) +
scale_color_manual(values=c("black","red"))+
geom_smooth(method="lm") +
scale_x_continuous(name="Driving Time (minutes)",limits=c(0,NA))+
scale_y_continuous(name="Distance (metre)",limits=c(0,NA))+
theme(legend.position="none")+
facet_grid(~time_bin)
ggplotly(speed,tooltip="text")%>% layout(hoverlabel=list(bgcolor="white"))
Figure 6: Scatter plot of car driving time against distance travelled on weekday
- From the plot, we observed that there are not many cars that traveled during midnight (0000 to 0600 hrs) and the average speed in the morning was significantly slower compared to the afternoon or night based on the gradient of the trend line.
- In the subplot for the Afternoon, Mies Minke took 12 minutes to travel 0.4 metres. The extreme outlier from the trend line might suggest unusual driving pattern for investigation. Coupled with the suspicious cc transaction from earlier section, Mine Minke has several suspicious points throughout the investigation process.
- Among the 24 outliers, 5 outliers belonged to Mies Minke, 3 outliers from Campo-Corrente Ada and 2 outliers from Resumir Felix and Vasco-Pais Willem. The remaining outliers each belonged to different indivduals. From the break down in table 4, we observe that they are mainly from the Executive team or the security team.
knitr::kable(gps_dist_weekday %>%
filter(col==1) %>%
group_by(id,LastName,FirstName,CurrentEmploymentType) %>%
summarize(n=n()) %>%
filter(n>1) %>%
arrange(desc(n)), "simple",
caption="Table of unusual vehicle movement")
| id | LastName | FirstName | CurrentEmploymentType | n |
|---|---|---|---|---|
| 24 | Mies | Minke | Security | 5 |
| 10 | Campo-Corrente | Ada | Executive | 3 |
| 30 | Resumir | Felix | Security | 2 |
| 35 | Vasco-Pais | Willem | Executive | 2 |
Figure 7 shows the map with GPS lines of Mies Minke and the car stationary GPS coordinates are represented by the blue dots. The stationary GPS coordinates of the other employees car were also added as markers on the map. From the map visualisation, we observe that Mies Minke car stop at some unusual location, which were neither his house nor point of interests locations.
1.1 Mies Minke car stopped on the South East of Abila Map near the text: To Port of Abila in the tourist map on 07/01/2014 from 1113 to 1231 hours. Apart from Mies Minke, only Osvaldo Hennie, Ferro Inga, Bodrogi Loreto ever visited the location.
1.2 Mies Minke car stopped somewhere south west of Bean There Done That on 08/01/2014 from 1132 to 1209 hours. Apart from Mies Minke car, only Osvaldo Hennie, Bodrogi Loreto and Ferro Inga car ever visited the location. Bodrogi Loreto car also visited on the same day, 08/01/2014 from 1129 to 1140 hours. The other car GPS reveals that the location was visited on 09/01/2014 and 17/01/2014.
1.3 Mies Minke car stopped near Pilau Street twice, on 10/01/2014 and 16/01/2014. Apart from Mies Minke, only Bodrogi Loreto, Ferro Inga and Osvaldo Hennie car stop at that particular location and Osvaldo Hennie car stop at the location on the same day, 16/01/2014 from 1122 to 1210 hours, which overlapped with Mies Minke car.
1.4 Mies Minke car stopped in the north between Coffee Chameleon and Guy’s Gyros on 09/01/2014 and 14/01/2014. Apart from Mies Minke, only Ferro Inga, Bodrogi Loreto and Osvaldo Hennie car visited the location from 13/01/2014 to 15/01/2014.
1.5 All four locations had the same group of 4 employees car stopping at those locations. Those locations were neither point of interests nor popular locations that other employees would visit. Furthermore, all four employees belongs to Security department and meeting at such unusual locations during weekday lunch time might suggest possible suspicious activity among them.
2.1 Mies Minke car stopped once at SVP/COO Strum Orhan house on 08/01/2014 from 2306 to 09/01/2014 0330 hours. The time period of Mies Minke car at the location is highly suspicious. Furthermore, Bodrogi Loreto car arrives at 0332 hours on 09/01/2014 and left the location at 0723 hrs in the morning.
2.2. Mies Minke car stopped once at SVP/CFO Barranco Ingrid house on the 14/01/2014 from 0331 to 0747 hours. Similarly, Osvaldo Hennie car also stopped at the location earlier from 13/01/2014 from 2308 to 14/01/2014 0330 hrs.
2.3 The group of Security employees that took turn to be at either Executive houses were the same group of suspicious personnel in part 1 of our observation.
3.1 In the earlier sections, we deduce that Mies Minke (car id 24) credit card number is 4434. However, his car GPS data supports the fact that he used credit card number 9951 to perform transactions on 13/01/2014, including the high outlier transaction amount of 10,000 dollars at Frydos Autosupply n’ More.
The four employees in particular Mies Minke are highly suspicious because of their unusual car GPS movement throughout the two weeks data.
gps_path_24 <- gps_sf %>% group_by(id) %>%
summarize(m = mean(timestamp), do_union=FALSE) %>% filter(id==24)%>%
st_cast("LINESTRING")
stop_id24<-gps_stop_points %>% filter(name=="Mies Minke")
tmap_mode("view")
map24<-tm_shape(bgmap) +
tm_rgb(bgmap, r=1, g=2, b=3, alpha=NA, saturation=1,
interpolate=TRUE, max.value=255) +
tm_shape(gps_path_24)+
tm_lines()+
tm_shape(gps_stop_points)+
tm_markers() +
tm_shape(stop_id24)+
tm_dots(col="blue",size=0.1)
tmap_leaflet(map24)
Figure 7: GPS data for Mies Minke
From the map in figure 7, we discovered only five cars ever visited Kronos Capitol. From table 5 we can observe that 4 out of the 5 visits occurred on 18/01/2014 and 3 cars were from the Security department with only Herrero Kanon was from the Engineering department. Furthermore, Herrero Kanon car was stationary at that location from 18/01/2014 12:47:34 till 19/01/2014 12:38:01 where it drove off. The car being stationary at Kronos Capitol overnight was quite suspicious considering that the date was near the disappearance period. A possible deduction could it that Herrero Kanon took either of the 3 other Security cars and left Kronos Capitol before returning the next day to retrieve his vehicle. Another probable deduction could be Herrero Kanon was engaged in some activities during that period inside Kronos Capitol.
capitol<-st_set_crs(st_sfc(st_point(c(24.84936527, 36.05293538))),4326)
gps_capitol <- gps_stop_points %>%
mutate(diff=st_distance(gps.coord,capitol),
diff=as.numeric(diff)) %>%
filter(diff<50) %>%
st_drop_geometry() %>%
select(name, CurrentEmploymentType,CurrentEmploymentTitle,Arrival.Time,
Next_move_off_time, Time_at_location)
knitr::kable(gps_capitol,"simple",captio="Car stop at Kronos Capitol")
| name | CurrentEmploymentType | CurrentEmploymentTitle | Arrival.Time | Next_move_off_time | Time_at_location |
|---|---|---|---|---|---|
| Vasco-Pais Willem | Executive | Environmental Safety Advisor | 2014-01-11 14:01:07 | 2014-01-11 17:24:01 | 202.90 |
| Nubarron Adra | Security | Badging Office | 2014-01-18 10:12:43 | 2014-01-18 13:22:01 | 189.30 |
| Herrero Kanon | Engineering | Geologist | 2014-01-18 12:47:34 | 2014-01-19 12:38:01 | 1430.45 |
| Bodrogi Loreto | Security | Site Control | 2014-01-18 13:14:04 | 2014-01-18 15:13:01 | 118.95 |
| Vann Edvard | Security | Perimeter Control | 2014-01-18 13:23:46 | 2014-01-18 18:21:01 | 297.25 |
In conclusion, the employees in the Security department are very suspicious based on the GPS and credit card transactions data presented. We would recommend to perform further investigation on them to determine if they were linked to the dispparance in Abila town.