The Learner's Guide to Geospatial Analysis



The geospatial aspects of the DC Shooter actions can still help to answer our question as part of a bottom-up process (from data to theory) or top-down (from theory to data). The bottom-up process converts raw information into knowledge of our killers. The top-down process provides evidence to support or disconfirm the assumed spatial signature of the killers. The question we have asked is, who is the DC Shooter (based on the total evidence we have included their spatial profile)?

Referring to the case study, the DC Beltway shooter attacks took place during three weeks in October 2002, in Washington, D.C., Maryland, and Virginia. Ten people were killed and three others critically injured in various locations throughout the Washington Metropolitan Area and along Interstate 95 in Virginia.

There are several important definitions we will use. These are:

  • A serial killer is a person who murders three or more people over a period of more than thirty days, with a "cooling off" period between each murder, and whose motivation for killing is largely based on psychological gratification.
  • Domestic terrorism is violence committed by a group(s) of two or more individuals to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.
  • Foreign terrorism is violence committed by a group(s) of two or more individuals originating outside the US to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.

Maps of the shootings and ballistics information can be found on the Washington Post web site.

Map of Virginia and Maryland where serial killings took place
Beltway Sniper Shootings Map

As discussed previously, there were attempts to spatially "model" the Shooter's behavior. Here is another article about the geographic profiling:

Geographic Profiling of the Beltway Sniper

With no solid leads in their hunt for a sniper who has gunned down eight people in the Washington, D.C., area, investigators have turned to a relatively new technological tool: geographic profiling (Source:

(Court TV) -- Barring a lucky break, the technology currently seems like the police's best chance to find the shooter, who has killed six, left millions on edge, and single-handedly lowered the attendance rate in Maryland suburban schools.The technique, first used in 1990, operates on the assumption that a serial murderer (or rapist) balances his desire to kill far from home to avoid being recognized with his desire to be in familiar territory. The tension between these two desires usually means that serial killers kill close to home, but not too close, leaving a "comfort zone" around their home that can be detected mathematically, according to Dr. Kim Rossmo, the technique's pioneer.

Investigators into the Maryland shootings have good cause to be hopeful about geographical profiling's potential. A software program that Rossmo developed called Rigel -- the only professional geographic profiling software currently available -- has in past cases pinpointed a criminal's home within a few blocks. On average, according to Rossmo, the program narrows the police's target area by 95 percent. But while geographic profiling could help the investigation, it can't point directly to the perpetrator. Even Rossmo warns against seeing geographic profiling as a solve-all investigative device. He has described it as an information management tool that gives police a way to better allocate their time and money. Rossmo has explained that geographic profiling can never solve a case alone. It can only help focus the investigator's search by pointing them in a direction most likely to produce tangible evidence or leads to the criminal.

Rigel works best when used by an experienced geographic profiler on a serial criminal who fits a specific profile. According to Ian Laverty, an engineer who helped develop Rigel and president of Environmental Criminal Research Incorporated, the firm that produces it, the software specializes in "hunters" -- criminals who leave their home base already planning to find a victim."A hunter works from a home site and travels out with a purpose of finding a victim and a location to commit the crime," said Laverty. "So [to best use Rigel] we must look at the nature of the crime and see if it is a hunter pattern." But not all serial killers are hunters. In his textbook on geographic profiling, Rossmo, now research director of the Police Foundation in Washington D.C., defines four other types: trappers who lure their victims to them; stalkers who follow their victims; poachers who travel away from home to hunt; and trollers who perpetrate crimes opportunistically while in the midst of other activities.

While not enough is publicly known about the Maryland shooter to determine his methodology, Rossmo believes that all criminals commit their first crimes close to home, only leaving the areas that they know as they gain confidence. By this logic, even if the shooter at large now modifies his behavior and expands his target zone, his first six shootings, all of which occurred within a five-mile area in Maryland, probably point toward his home. Of course, by the time the profile emerges, the killer could have moved. But if geographic profiling leads to the location of his former base of operations, even that would be a huge boost to the Maryland investigation.

In the summer of 1998, Rossmo assisted an investigation of a Lafayette, La., serial rapist who had attacked as many as 15 women in the area over a period of 11 years. After reading an article on geographic profiling, Maj. Jim Craft of the Lafayette police, who led the task force devoted to the criminal, invited Rossmo to help out. His geoprofile, which he sent to Craft after one or two months, allowed police to narrow the areas they patrolled. "It was helpful to prevent further attacks," Craft said. "Previously there was a pretty large area that we had to focus on to make sure we didn't have any further attacks. As a result of that profile we were able to narrow down our geographic area and focus our resources from an area of 60,000 people to a location with about 30,000 people in it." Although the geoprofile accurately predicted the killer's home area, the information did not end up helping them capture him. The case was solved when the police received an anonymous tip with the rapist's name. At the time of his arrest, the rapist had moved outside the area Rigel predicted. Still, Craft and the Lafayette Police Department were impressed with geographic profiling. "It's not going to specifically identify a perpetrator but it will help you focus your investigative efforts and narrow down or eliminate information from other areas," Craft said.

Whether Rigel will help in finding the Maryland shooter remains to be seen, but some proponents think it can be useful for more than serial murders. Says Laverty, "The technique itself is applicable to all types of serial crimes like robbery, burglary and arson."

Dr. Maurice Godwin suggests that Rossmo's geographical model (See Rossmo's description) was wrong and offered another spatial model for the shooter's behavior. Research findings also indicated that there is a strong relationship among the locations of the terrorist incident, terrorists’ preparatory behaviors, and where these terrorists reside. Research in terrorist geospatial patterns and behavior is found in Geospatial Analysis of Terrorist Activities: The Identification of Spatial and Temporal Patterns of Preparatory Behavior of International and Environmental Terrorists. Based on this information and other profiling efforts, here are some of the inferences and speculations offered about the DC shooter prior to the arrest of the two suspects (

  • FBI / Inductive profilers
    • white male
    • 25 to 40 years old
    • not a shooter and not likely military because of weapon choice (inaccurate round)
    • lives in or near the community>
    • no children
    • >firefighter or construction worker
    • possible terrorist links
    • not a true spree killer because a true spree killer would have kept going south.
  • Deductive profiling
    • no evidence of race
    • no evidence of one or two offenders
    • anger motivation
    • cumulative rage from successive failures in personal life
    • straw that broke the camel's back would be an event in personal life such as divorce, custody battles, and/or loss of job.
    • would want to talk about offenses
    • case would most likely be solved by a tip from alert citizens
    • no shooter training (not a very good shot)
    • possible second or third party involved
    • limited evidence of a terrorist connection

Quality of Information Check

Weighing the validity of sources is critical thinking that the confidence of any analytic judgments ultimately rest upon. Analysts should review the quality of their information and refresh their understanding of the strengths and weaknesses. This is part of becoming grounded in the problem. Without understanding the context and conditions under which critical information has been provided, it will be difficult for analysts to assess the information’s validity and establish a confidence level in an intelligence assessment.

Using the DC Shooter scenario, perform a brief quality of information check as part of your grounding. Specifically:

  • Identify geospatial information sources that might be critical but were not provided;
  • check for corroboration of the locations (coordinates) with the text;
  • validity of the geospatial behavioral models used, and;
  • indicate a level of confidence you have in the sources which are likely to be used in future analytic assessments.

Example Quality of Information Check Results:

The following geospatial evidence could have been useful given more time and resources:

  • High resolution land characterization to determine if shooting locations had sufficient vegetation or other cover within rifle range;
  • geospatial behavioral models for criminal activities associated with shooter events, and;
  • street camera recordings to identify the people and vehicles present at the crime scene locations.

Corroboration of the locations with the text were as stated:

  • Using Google Earth, the site descriptions and addresses matched the coordinates.

Level of confidence you have in the sources, which are likely to figure in future analytic assessments.

  • We are confident in the general locations with respect to the address but not the specific locations with respect to the site and events.