How Delta Uses Resolver to Manage Corporate Security Incidents Globally

With security issues scattered around the globe, ranging in severity from minor to life-threatening, it is critical that Delta’s Corporate Security department has instant access to information concerning incidents at hand, as well as past incidents. And since Corporate Security is composed of several different teams, each handling a unique subset of interrelated issues, it is essential that all security personnel utilize an incident reporting system that functions across the organization—facilitating the sharing of information, encouraging collaboration and allowing complete analysis and reporting of Delta’s entire security operation.

Until quite recently, Delta’s incident reporting process consisted of a variety of disparate methods, with each team in Corporate Security utilizing their own individualized set-up. Across the various teams, incident reporting methods included handwritten logbooks, Microsoft® Excel® spreadsheets, Microsoft® Access® databases and a now obsolete software system. While each of these methods had been developed to meet specific needs within the Corporate Security department’s various teams, they could not be integrated to provide cross-divisional tracking, analysis or reporting— essential requirements for a global airline combating 21st century security challenges.

According to Kim Hodgkin (Manager, Security Administration), the inability of Delta’s fragmented incident reporting process to consolidate or share data across divisions severely inhibited the quality of information available to personnel:

“Because information recorded by one group was not necessarily available to other groups or divisions, we had limited means of identifying repeat offenders or repeat situations. And, of course, trending and pattern analysis and those sorts of things were not possible due to the process’ disjunctive tracking and reporting capability.”

Clearly, Delta was in need of a more comprehensive Incident Reporting and Investigation Management solution capable of tracking, analyzing and reporting on incident activity across all divisions.

In order to achieve this, the new system would have to be extremely customizable—capable of being tailored to the specific needs of the air transportation industry, including the unique needs of each team within Delta’s Corporate Security department and those divisions providing supplemental incident information.

After researching over a dozen different incident reporting systems, Delta selected two vendors — Resolver and a competitor — to bring in to their Atlanta headquarters for product demonstrations. Each vendor was given the opportunity to present their system to the various groups within Corporate Security, and ultimately, Resolver was selected as the system best able to manage Delta’s needs.

Resolver’s features, functionality and potential for customization proved capable of meeting the requirements of each of the teams within Corporate Security. But the truly distinctive element separating Resolver’s proposal from the competition’s was the inclusion of Visual Analysis and i2® Analyst’s Notebook®. These additional products presented Delta with opportunities for link analysis, pattern analysis and trending that simply were not available with any other Incident Reporting and Investigation Management system on the market. States Hodgkin:

“Resolver certainly provides the flexibility to be customized to the unique needs of the air transportation industry. And with its direct integration with Analyst’s Notebook, also included in the proposal, Resolver’s capabilities just blew everybody away.”

In August 2007, Delta’s Corporate Security department launched Visual Analysis and i2 Analyst’s Notebook with users in six different teams: Investigations, Operations Control Center (OCC) Security Desk, Compliance, Computer Forensics, Revenue Protection and Passenger Misconduct/Workplace Violence. Currently, these groups document more than 230 incidents in Resolver each month (nearly 3,000 per year), and once Delta’s merger with Northwest Airlines is complete, these numbers will increase significantly.

One of the most notable customizations Delta has made to Resolver is their transformation of the Vehicles section to Flifo or Flight Information. Rather than tracking vehicle license plate numbers, VINs, drivers, etc., Delta has customized field labels in the Vehicles section to read Flight Number, Departure City, Arrival City and so on. If a flight must be diverted, the circumstances leading to the diversion are tracked, as well as any other associated details (e.g., the city the flight was diverted to). Even the costs associated with the diversion are recorded so that restitution may be sought from any individuals held responsible.

The ability of Resolver to track such airline specific data allows Delta to query and report on a huge array of issues relevant to flight safety. As Hodgkin states, Resolver allows Delta to gather analytical intelligence on a number of issues that would otherwise be difficult to pinpoint:

“With Resolver, when we go back and query all of our flight information, we can determine exactly where our problem areas are. For example, where are the majority of the passenger misconduct issues coming from? If we have a flight from here to somewhere overseas and there are a lot of incidents involving overconsumption of alcohol, do we have an issue with alcohol that we need to address between those two particular cities? Are we seeing more of these incidents on international or domestic flights? The answers to these questions give us an area to concentrate on.”

By using Visual Analysis in conjunction with Resolver’s built-in querying and reporting tools, Delta’s Corporate Security department is able to extract an even wider range of information from incident records. When investigating passenger misconduct incidents, the link charts generated in Visual Analysis— highlighting links and associations between seemingly disparate incident, item, person, organization and flight data—are especially helpful in quickly identifying patterns and trends in an individual’s history of incident involvements.

If Visual Analysis identifies a particular passenger as having been involved in several disruptive incidents on flights in the past, Delta can then use this information to determine an appropriate course of action. As Hodgkin explains, documented proof of a passenger’s incident history is critical in justifying any actions that Delta may take:

“Once we have verified that a person has been involved in incidents in the past, we can then decide what kind of action we want to take— from not letting them use their frequent flyer program because they’ve abused it, to not letting them fly with Delta any longer, to engaging law enforcement to charge them with a criminal offence. We could decide to act in any number of ways, depending on what we find out in Resolver. Resolver gives us that indexing piece to go back and check a person’s history. If a passenger has a history of acting up, then Resolver will give us the details.”

Resolver’s Visual Analysis is also an invaluable tool for Delta’s Corporate Security department in investigating a number of fraud-related issues, including credit card, check, frequent flyer program and ticket fraud. Investigators can query historical data for commonalities, trends and patterns using Resolver’s analytical tools, and the links and associations between the various people and organizations involved in a fraud ring can then be exposed in clear and easy-to-read Visual Analysis charts. By exporting data from Visual Analysis to Analyst’s Notebook, transaction information—including credit card charges, phone calls and mileage use—can be charted as well, revealing further links between fraud incidents and the people and organizations perpetrating them.

The charts generated in Visual Analysis and Analyst’s Notebook also aid Delta’s Corporate Security department in communicating passenger compliance and fraud information to management, as well as to the various divisions throughout the corporation. Remarks Hodgkin:

“Visual Analysis and Analyst’s Notebook have been marvelous tools for us. Recently, we printed off a fifteen-foot-long banner illustrating the fraudulent activities surrounding one credit card. We brought this banner to senior management and were able to explain the situation to them using a clear visual which was just tremendous. I did the same thing in a department meeting not too long ago. By looking at the spider map, they were able to get the big picture of the situation, and they could easily see the connectivity between the credit card holder and the other people involved. I see a lot of potential between Resolver and Analyst’s Notebook.”

Because analyses and reports generated in Resolver communicate information so effectively, they have also proven useful when Delta must provide documented proof of a person or organization’s incident involvement for a court case. Along with an incident’s complete record in Resolver, charts generated in Visual Analysis or Analyst’s Notebook help to tell an incident’s story, including how particular people and organizations were involved. Explains Hodgkin:

“We can put together an entire case through one incident. All we have to do is pull an incident report and all the information is there. We have all the media that goes along with it, as well as the interviews, the amount of work that was put into it, the witness statements, descriptions, etc. We have everything you can possibly think of at hand,  and we’re even able to go back from the baseline and see if there were other incidents the person was involved in before.”

Ultimately, the documentation of all incident details in one comprehensive system for Delta’s entire security operation ensures they are able to produce reliable, thorough and credible incident information on demand.

The implementation of Resolver as Delta’s comprehensive Incident Reporting and Investigation Management solution has resulted in many positive outcomes. Resolver’s easy to use analytical and reporting options certainly save Delta’s security personnel a great deal of time and allow them to do their job more efficiently. Prior to implementing Resolver, Delta’s analytical and reporting information was often compiled manually; this required much time and effort and was subject to human error. Hodgkin’s security personnel could spend most of their day culling relevant data from piles of incident reports scattered across Corporate Security and various other divisions, and, at the end of their shift, have very little time to actually extract meaningful information for decision making:

“It was extremely resource intensive. We were having staff fulfill an analyst role rather than a security role, and even then, most of the time, they weren’t really functioning as analysts; they were pulling reports, looking for data, that sort of thing. Resolver really helped automate that whole process.”

The complete analytical and reporting output generated by Resolver is valuable to everyone involved in Delta’s security operation, from the ground force personnel inputting data at the start, to senior management with budgetary considerations.

For security staff entering incident data at the front end, seeing the quality of information extracted at the back end allows them to fully appreciate the value of the data they input. Hodgkin endeavors to provide his staff with reports and charts summarizing incident trends and statistical data as much as possible. He finds that this helps them identify the importance of their work within the bigger picture of Delta’s security operations, motivating them to do their best:

“Ultimately, to get the users to do things appropriately—to make sure that incidents are entered correctly—I think they have to be shown the benefits of the system. By showing them overall results from Resolver, they can start to see the capabilities of the system. This really piques their interest, and they seem to get more energized every time we talk and meet.”

And when Hodgkin’s team reports to senior management, Resolver’s analytical and reporting power ensures they are able to access information that matters to everyone up the chain of command:

“The main benefit is that it all talks within the same system. The fact is that no matter how many people input data into Resolver, it’s reportable right up to senior management. The capabilities are there for doing that. It’s just the full package.”

Of course, having all incident data pooled into one system allows Hodgkin’s team to generate a variety of valuable analyses and reports previously unavailable. Trending information and statistical data, extremely difficult to identify and extract with Delta’s former disparate incident reporting methods, are easily accessible in Resolver. This data allows Hodgkin to quickly identify areas of concern and direct his security team to work towards incident reduction where it is most critical:

“Resolver gives us the ability to pull metrics from top to bottom. We can find out what types of incidents we’re tracking, how many we’ve had, and if there have been increases or decreases. Then, with these metrics, we can determine how to improve our operations. So if we’re seeing an increase in passenger misconduct, workplace violence, theft or fraud, we can come up with a plan to reduce or prevent these incidents. Ultimately, Resolver gives us the capability to make better decisions about our security operations and to be more proactive in our approach to incident reduction.”

Having experienced the benefits of Delta’s consolidated system for incident tracking, analysis and reporting, Hodgkin wonders about the positive impact Resolver might have if deployed across the entire industry. In Hodgkin’s perfect world, every airline would utilize Resolver.

As the standard Incident Reporting and Investigation Management system of the air transportation industry, Resolver would allow organizations to share an unprecedented array of information, leading to incident reduction and cost savings for every airline.

For example, the physical description of a person suspected of stealing baggage from one airline’s carousel could be shared with all other airlines in the airport, resulting in preventative measures being instituted before additional crimes could take place. Speculates Hodgkin:

“Why can’t we be reporting this information within Resolver and sharing it between airlines? Take that to the medical field where you have people going into hospitals and getting free treatment by giving false information. Or credit card fraud within retail organizations. If they’re not all using Resolver, then how are they talking to each other? There are so many circumstances where corporations don’t talk to each other but should. There’s a lot of potential there. I�