Cross Case Analysis Police Teams Can Use to Link Suspects

Cross case analysis police teams can rely on compares evidence from separate investigations to identify possible shared suspects, then tests those links against independent records. A matching name, account, or phone number is a lead—not proof of identity. The goal is a documented connection that survives review without merging unrelated people or importing unsupported assumptions.

What makes a cross-case suspect link reliable?

A reliable link distinguishes three questions: Do the records refer to the same identifier? Who controlled that identifier at the relevant time? Does that person connect to the conduct under investigation?

Those questions require different evidence. An identical platform account ID can establish that two returns reference the same account, provided the ID belongs to the same platform and identifier namespace. It does not automatically establish who operated the account or authored a particular message.

Evaluate candidate links using:

• Specificity: How distinctive is the identifier or behavior?
• Timing: Was the identifier associated with the person during both relevant periods?
• Independence: Do supporting records come from genuinely separate sources?
• Contradictions: What evidence points toward another person or explanation?

Three reports repeating one witness statement are not three independent confirmations. Preserve that distinction throughout the analysis.

How should cross case analysis police workflows begin?

Start with a defined question: “Does the unidentified account operator in Investigation B appear in Investigation A?” This is more useful than searching every available record for anything similar.

Identify which datasets investigators are authorized to compare, who may access them, and any restrictions on reuse or disclosure. Procedures vary by jurisdiction; confirm applicable requirements with appropriate legal and supervisory personnel before expanding the search.

Create a comparison inventory that records:

• Case reference and evidence item identifier.
• Source, acquisition date, and covered date range.
• Available identifiers and timestamp conventions.
• Missing records, redactions, and known extraction limitations.
• Access restrictions and the responsible investigator.

Keep the original case records separate. A shared analytical workspace should preserve each observation’s case origin rather than erase boundaries between investigations.

Which identifiers should investigators compare first?

Which exact matches deserve priority?

Begin with identifiers that are relatively distinctive and have a clear source: platform account IDs, complete email addresses, phone numbers with country codes, and other stable values present in the evidence.

Retain both the original value and a normalized comparison value. Standardizing phone formats can reveal matches hidden by punctuation, but filling in a missing country code without justification can create false matches. Email normalization also requires care because address behavior differs between providers.

Record whether a value was supplied by a provider, entered by a user, mentioned in a conversation, or inferred by an analyst. A phone number in a message is not necessarily the sender’s phone number.

Which similarities need more caution?

Names, display names, profile photographs, writing style, and recurring phrases can generate useful candidates. They are usually weaker identity evidence because they can be common, copied, changed, or deliberately misleading.

Use fuzzy matching to find records worth reviewing, not to declare two people identical. If a system suggests a match, the reviewer should be able to identify the underlying similarities and their limitations.

How do timelines and relationship graphs strengthen a link?

A timeline tests whether the proposed identity makes chronological sense. Compare account activity, communications, meetings, and other documented events while preserving original timestamps and recording any timezone conversions.

Look for both supporting sequences and contradictions. A number appearing in two investigations months apart could reflect continuous ownership, reassignment, or a shared device. Evidence tying the number to a person during one period does not settle the other.

Relationship graphs help investigators see repeated contacts and intermediaries. A shared contact becomes more informative when supported by distinctive interactions and relevant timing. A popular business or widely contacted individual may connect many unrelated people.

For each proposed relationship, document:

• The evidence supporting the connection.
• Its direction, frequency, and relevant dates.
• Whether it reflects direct contact or an indirect association.
• Plausible innocent or alternative explanations.

Graph proximity is not participation. Keep “communicated with,” “mentioned,” and “controlled an account” as separate relationship types.

What does a defensible comparison look like in practice?

Consider two hypothetical investigations involving stolen equipment. Investigation A contains an Instagram return for an account using the display name “Northline.” Investigation B includes messages mentioning that name and a phone number.

The display-name match creates a candidate link. The analyst then finds that the same full phone number appears in Investigation A, but only inside a message. That is a cross-case overlap, not yet evidence that the Instagram account operator owned the number.

Next, the analyst checks the surrounding conversation, relevant dates, and any available attribution evidence. The messages might show that the number belonged to a delivery contact rather than the account operator. That finding would redirect the inquiry instead of strengthening the original suspect hypothesis.

A sound interim conclusion would be: “Both investigations reference the same phone number. Its controller and relationship to the account operator remain unconfirmed.” The next step is a targeted, authorized effort to resolve those questions—not an automatic person-record merge.

How should teams validate and document a candidate match?

Use explicit review states such as “candidate,” “supported identifier overlap,” “supported person attribution,” and “rejected.” Define each state so investigators do not interpret a tentative association as a confirmed identity.

For every consequential link, retain a reviewable evidence packet containing:

• The comparison question and proposed connection.
• Source references and relevant excerpts with context.
• Original identifiers and any normalization steps.
• A timeline showing the relevant attribution period.
• Supporting evidence, contradictions, and unresolved gaps.
• Reviewer, review date, conclusion, and next investigative step.

Avoid presenting an unexplained similarity score as the probability that two records describe the same person. Unless a score has been validated for that interpretation, it is a prioritization aid rather than an identity conclusion.

Where practical, have a second analyst challenge the strongest link. Ask what would disprove it, whether shared access explains it, and whether supposedly independent evidence traces back to one source. Record rejected matches so later reviewers do not repeat the same dead end.

Where does Lantern fit in cross-case evidence review?

Lantern ingests search warrant returns, discovery, transcripts, call records, and digital evidence. It produces searchable timelines, entity and relationship graphs, pattern detection, and AI recommendations with concrete next investigative steps. These outputs can support cross-case review, but investigators must verify proposed connections against the underlying evidence.

Distinguish evidence ingestion from live source coverage. Lantern’s live ingestion today covers the Meta suite only: Facebook, Instagram, and WhatsApp. Other sources—including telecom, banks, payments, crypto, identity/DNA, cloud storage, and OSINT—are on the roadmap, not live integrations.

Lantern deploys on-prem or in a private cloud it stands up, with role-based access controls (CJIS support coming soon), audit trails, and court-ready exports. Those capabilities support controlled review and documentation; they do not replace jurisdiction-specific procedures or establish the admissibility of a particular conclusion.

Frequently asked questions

Is a matching phone number enough to identify the same suspect?

No. It establishes an identifier overlap, but numbers can be reassigned, shared, or mentioned by someone other than their controller. Verify attribution during the relevant period and seek independent supporting evidence.

Can AI determine that two accounts belong to one person?

AI can surface similarities and prioritize records for review, but its recommendation is not proof of common control. Investigators should examine source records, timing, contradictions, and alternative explanations before adopting an attribution.

Should linked investigations be merged?

Not automatically. Preserve original case references, evidence provenance, and access restrictions even when conducting a joint analytical review. Decisions about coordination or consolidation depend on applicable procedures and jurisdiction.

What should a cross-case report say when identity remains uncertain?

State the exact overlap and distinguish it from unresolved attribution. Explain what evidence would resolve the uncertainty and identify the next authorized investigative step.

Start free with Lantern to review evidence and develop testable investigative leads. Signing up includes 5 credits; 1 credit equals 1 minute of processing.