Targeted anomaly tracking finds operators who search the same license plate or the same text query over and over across weeks: “this person searched this target 40 times over 90 days.” The results now distinguish between a target looked up by a single operator, and one searched persistently by multiple operators across agencies.
The insights tab on agency pages include an Orgs and Users column to show how many distinct agencies, and how many distinct operators, participate in surveillance of the target. The “Reach” filter lets you select which are visible.
Across the whole dataset, roughly three in four sustained patterns are the work of a single operator at a single agency. About 7% involve more than one agency.
#Duplicate releases no longer inflate the counts
While building this we fixed a counting problem that made some results look worse than they are.
Agencies release the same audit log more than once, and the copies do not always match. Different public records responses redact different fields, or transcribe them differently. The result is two rows describing one real search.
Search totals are now deduplicated by operator, target and timestamp, so a search released twice with different query data (e.g. a different reason) counts only once. Some profiles will show lower search counts than before, and a few that only crossed the three-search threshold on duplicates have dropped off the list entirely.
Note
Some duplicates may be included while the dataset is being reprocessed. Processing should complete within 24 hours of this post.