Fused investigative graph — methodology & caveats
Everything on this page is an analytical signal derived from graph structure, not a factual claim about conduct. Findings follow three tiers: documented (a record in the input data says it), credible inference (converging independent layers suggest it), and analytical signal (graph structure flags it; requires corroboration). Nothing rendered here rises above the third tier on its own.
What the graph is
One weighted graph over 8,953 canonical identities — 8,174 persons + 779 entities (organisations, places, companies, aircraft) — and 40,918 edges, fused from four evidence layers:
| Layer | Meaning | Weighting |
|---|---|---|
| correspondence extracted from released emails (header display names) | log-scaled message count | |
| Co-occurrence | named together in the same documents — including passing and news mentions | NPMI, ≥5 shared docs, Bonferroni-corrected significance test |
| Co-flight | shared flights in flight logs | log-scaled shared-flight count |
| Curated KG | hand-curated relationship graph | log-scaled curated weight |
Node positions are a force layout of the fused graph (2D and 3D layouts are computed separately — the 3D view is the same graph, not a projection of the 2D one). Only "closer = more connected" is meaningful; axes mean nothing. Node size is weighted betweenness centrality (√ scale). Communities are Leiden partitions, carried over from the pre-cleaning graph by degree-weighted vote.
Cleaning pass (what changed)
The raw extraction produced 17,997 nodes. Of those, 5,016 were junk — email header fragments ("Sent", "Subject"), dates, document IDs, redaction artifacts — and were removed; a further 3,877 OCR/truncation fragments were merged into the canonical identity they belong to. What remains is 8,953 real identities. Merges are guarded (a variant carrying a different known first name for a shared surname is rejected), but the tail is not perfect: if a node looks wrong, use the flag control in its panel — junk / not a person / wrong merge — and export the flags as JSON. Nothing is sent anywhere; flags live in your browser's local storage.
Read this before trusting anything
- Co-occurrence ≠ relationship, and most co-mentions are trivial. Two people named in the same document may never have met. We checked: of the 2,002 documents co-mentioning "Bill Clinton", ~71% are single passing mentions — news clippings, URLs, even a document about the 1992 Bush–Clinton election. The doc metric in the panel is therefore labelled doc co-mentions (incl. passing/news), and the co-occurrence chip exists so you can remove that layer entirely; node sizes then switch to interaction-only betweenness. Famous names shrink — that shrinkage is the finding.
- The corpus is the lens. All four layers derive from investigation-produced records, so centrality partly measures investigative attention. People whose records were never produced are invisible; redacted names were dropped entirely. The absence of a name here is not evidence of absence.
- Email identity is display-name-based. Spoofing, shared inboxes, assistants sending "on behalf of," and OCR damage all blur identity. Merges are conservative and logged, so weights for OCR-damaged correspondents are floors, not totals, and some tail nodes are still duplicates.
- Doc / email / flight counts are summed across merged name variants, so they are activity floors for the canonical identity, not audited totals.
- Watchlist bias. Document co-occurrence can only connect people already on a ~1,117-entity watchlist — it cannot discover new names. The email layer can, but only above a ≥5-message threshold.
- Pilot/crew inflation. Pilots co-occur on flights with everyone they flew; their flight-layer centrality is occupational, and they are flagged in the detail panel.
- Layers are not independent. Curated-KG travel edges derive from flight logs, so "flight + KG" support is not two independent corroborations.
- Entities are not people. Hollow ring nodes are organisations, places, companies and aircraft. They are legitimate nodes and are shown by default — but a bank or a street address brokering between clusters means something very different from a person doing it.
- Artifact clusters. Four Leiden communities are OCR/parsing debris (travel-booking fields, financial-table fragments, Google Alerts) that survived cleaning — 231 nodes. They are kept for transparency, labeled ARTIFACT, greyed out, hidden by default, and excluded from the brokers list.
The two rankings
Every node carries two betweenness ranks: fused (all four layers) and interaction-only (email + flight + KG, co-occurrence removed). Officials, litigators, and highly-publicized names rank high on the first and collapse on the second — e.g. William Barr: fused #174, interaction-only #8,611; Bill Clinton: #81 → #1,379; Southern District of New York: #36 → #8,106. That pattern is a corpus artifact, not a behavioral finding, and the brokers panel shows both numbers on every row so it cannot hide.
Interact
- scroll — zoom (deep: individual dots separate inside dense clusters) · drag — pan · hover a node — details · click — pin
- names fade in once you zoom past the label threshold (top nodes in view, capped for framerate)
- 2D / 3D switches layout; in 3D drag orbits the camera. Selection survives the switch.
- pinned panel → Open entity page (or document search when no profile exists)
- legend rows filter to one community · brokers rows fly to the node
- edges are drawn for the strongest links plus the hovered node's full neighborhood
Provenance
Built from released email metadata, document-entity mentions, flight logs, and the curated knowledge
graph behind /entity. Data on this page:
/assets/network_viz.json · /assets/brokers.json.
Pipeline is deterministic; every name merge is logged. Related views:
Atlas · Coverage Map · Flights.
Not affiliated with the U.S. Department of Justice, FBI, or any government agency.
Flagged nodes
Nodes you flagged as junk, not a person, or a wrong merge. These are stored in
this browser only (localStorage) — nothing is uploaded. Export the JSON and hand it to the
cleaning pipeline.