Dark Web Threat Intelligence for Cyber Investigations
Description
This use case intends to solve the problem of quickly identifying and summarizing relevant cyber threat data from the dark web, which can be difficult and time-consuming for analysts.
Detailed example
The system’s AI outputs are concise summaries of search results, English translations of non‑English data, and metadata that highlights potential connections and leads. These outputs assist analysts in quickly identifying key findings while retaining access to the original data for deeper analysis and verification. All outputs are part of a broader investigative process and are not used as the sole basis for enforcement actions.
AI / analytics pattern
Generative AI: AI that generates new or synthetic content (e.g., images, videos, audio, text, code).
Automation level / stage
c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.
Expected benefit
The summarized information helps analysts quickly identify threat actors, trends, and illicit platforms, enabling them to prioritize their investigative efforts. The data analysis and extraction techniques connect related information across data holdings and generate metadata to help analysts review and search results. The translation capability helps analysts identify non-English data responsive to an investigation and saves time otherwise spent translating non-responsive data.
Audit / financial statement impact
This use case provides a more efficient way to process, review, summarize, translate, and analyze dark web data for use in HSI investigations. The AI output may be used to produce investigative insights, but the output itself is supporting information for HSI personnel to use for ease of review, for further analysis, and to produce leads. Insights derived from translated data allow investigators to identify the most relevant data that, if deemed critical for court proceedings, can be submitted to certified human translators for final review. Personnel may use investigative insights for law enforcement actions such as identifying criminal suspects; however, all insights are reviewed and validated by both personnel and supervisors before being included in any official case management system, and do not serve as a principal basis for any law enforcement action or decision. Any enforcement decisions related to these insights are outcomes of the full Federal Investigation Process involving verifying any insights as evidence (including validating AI-translated material by a certified interpreter), presentation to a U.S. Attorney’s Office and potentially a District Court judge, decision to prosecute, judicial review, and trial and sentencing.
Controls / human review
ATO: No; PIA: Not published