Gangs & Street Crime: Mission Domain Intelligence Guide

Retaliation after a stabbing is usually measured in days, sometimes hours. The intelligence question is not who did it but which three addresses, two schools and one hospital ward now sit inside the blast radius.

What Gangs & Street Crime covers as a mission domain

Gangs and street crime intelligence supports violence reduction and the protection of children drawn into criminal exploitation. It covers territorial and affiliation-based groups, drug retail markets, robbery and violence, weapon carrying, and the exploitation of children and vulnerable adults as couriers, dealers and cuckooed occupants of other people's homes. Effective practice is a public health model as much as an enforcement one, combining incident and hospital data, community intelligence and network analysis to identify both those at risk of causing harm and those at risk of suffering it.

Structures are more fluid than the term gang suggests: loose affiliations, sibling and school networks, and market-driven crews that form and dissolve. Distinct sub-areas include county lines style distribution where children are moved to satellite markets, cuckooing of vulnerable adults' homes, online provocation and reputation dynamics that escalate disputes, and robbery markets in phones and vehicles. Exploited children frequently appear in records as offenders before they appear as victims.

Why it matters

Serious violence concentrates in small numbers of people and places, and the harm falls hardest on the same communities that are most heavily policed and least trusted by services. Children recruited into distribution suffer trafficking-level exploitation with lifelong consequence. Meanwhile, imprecise gang labelling has produced documented discriminatory outcomes and legal challenge, so the analytic quality of this work has direct civil liberties implications.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Retaliatory incidents clustering within short windows of a serious assault, in locations linked to the original parties
• Emergency department attendances for sharp force injury without a corresponding police report, visible only in health surveillance data
• Children reported missing repeatedly with recovery in a distant market town, sometimes with cash, multiple phones or unexplained injuries
• A vulnerable adult's address showing sudden footfall change, new occupants and utility or noise complaints consistent with cuckooing
• Social media provocation geotagged to a rival area, or music and video content referencing a specific incident or individual
• Territorial tagging and graffiti shifts, particularly overwriting of established marks, preceding disputes over retail locations
• Anniversaries, funerals, court dates and release dates acting as predictable flashpoints for further violence
• Weapon caching in communal areas, stairwells, parks and vehicles rather than home addresses, indicating anticipated confrontation

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• National police recorded crime and homicide statistics — Baseline incidence, weapon type and demographic breakdowns for measuring change rather than perception
• Emergency department violence surveillance (Cardiff Model) — Anonymised assault location and weapon data capturing incidents never reported to police
• Violence Reduction Units and public health partnerships — Local multi-agency problem profiles combining health, education, social care and enforcement data
• National Crime Agency county lines assessments — Analysis of drug line structures, child exploitation methods and cross-boundary market dynamics
• US National Gang Center and Bureau of Justice Statistics — Comparative research on group structure, prevalence and evaluated intervention effectiveness
• Court judgments and sentencing remarks — Judicially established facts about group structure, roles and specific incidents, safe to cite
• Local authority safeguarding and education data — Exclusion, absence and missing episode patterns that identify children at risk before enforcement contact
• Serious case reviews and child safeguarding practice reviews — Detailed post-incident analysis of how agencies missed exploitation indicators in real cases

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Define geography and window — Set a specific area and time period tied to a decision, since group boundaries are contested and analysis without limits becomes labelling.
2. Build the incident timeline — Sequence violent incidents, arrests, releases and court dates to expose action and reaction chains rather than isolated events.
3. Separate risk of harm from risk of causing harm — Assess exploited children and cuckooing victims through a safeguarding route, distinct from any enforcement targeting of those directing them.
4. Integrate health and community data — Incorporate anonymised emergency department and community reporting under agreed information sharing arrangements to capture unreported violence.
5. Identify flashpoints — Map anniversaries, releases, hearings and events likely to trigger escalation, and share with those able to intervene beforehand.
6. Deliver into multi-agency response — Route findings to the combination of enforcement, safeguarding, education and outreach best placed to reduce harm, and review outcomes afterwards.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

• Criminal Intelligence — Intelligence Supporting Criminal Investigation
• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Geospatial Intelligence — Intelligence Derived from Place
• Human Intelligence — Information from People, Ethically Obtained
• Threat Actor Intelligence — Tracking Adversary Groups Over Time
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence

Worked in these data points

• Person / Name — A named individual — the subject of identity resolution and profiling.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
• Phone Number — Telephone number for voice, SMS, or messaging identification.
• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
• License Plate — A jurisdiction-issued vehicle registration mark — the primary field identifier for a vehicle.
• Court Case / Docket — A filed legal proceeding — the authoritative record of disputes, judgments, and enforcement.

Adjacent mission domains

• Organized Crime
• Drug Trafficking
• Human Trafficking
• Kidnap, Hostage & Extortion
• Child Protection
• Weapons Trafficking

Inside the platform: where Gangs & Street Crime lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• domain.php?d=gangs — Gangs & Street Crime dashboard
• theater.php?d=gangs — Threat theater view
• search.php — Person / Name profile
• phone-profile.php — Phone Number profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Gangs & Street Crime:

• Human Trafficking Triage — a step-checked workflow with the pivots, sources and handling rules already wired in.
• Cryptocurrency Tracing — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Correlate Infrastructure
• Run Alert Rules
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define geography and window is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Separate risk of harm from risk of causing harm turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Deliver into multi-agency response feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Gangs & Street Crime

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence relevance is mainly in stabilisation and partner nation settings where armed gangs contest territory, control routes and displace populations, and in domestic settings only through support to civil authorities. Analysts assess group structure, territorial control, weapon availability and the recruitment of young people, which affects freedom of movement and the viability of local partners. Constraints are firm: no arrest powers, no collection against civilians beyond authorised limits, and a requirement to route criminal matters to civilian authorities. Any assistance to local security forces requires human rights vetting, given documented abuses in heavy handed gang suppression operations.

🕵 National intelligence

National agencies engage where gangs intersect with organised crime, firearms supply, drug importation and, occasionally, with political violence or state tolerated militias. Requirements focus on the supply layer and the organisers rather than street level activity, which belongs to local policing. Fusion of communications data held lawfully, financial intelligence, firearms tracing and open source material is the method. Handling is sensitive because material frequently identifies children who are being exploited rather than offending independently, and because disclosure can expose informants in tightly connected communities where retaliation is immediate.

👮 Law enforcement

Policing runs violence reduction, investigation and safeguarding simultaneously. Evidence must be lawfully obtained and carefully handled: communications data under proper authority, forensic and ballistic linkage, social media evidence preserved with continuity, and financial records. Gang association evidence is contested and databases have faced legal challenge for discriminatory effect, so inclusion criteria must be documented, reviewed and proportionate. Charging decisions must screen for criminal exploitation of children and vulnerable adults, since custody, transport and storage roles are routinely coerced and statutory defences may apply.

🔍 Private investigation and corporate security

Private sector involvement is limited and mostly protective: employers, transport operators and retailers assessing risk to staff and premises, and schools and housing providers managing safeguarding. A private actor may not conduct surveillance of young people, maintain informal association lists, or share suspicions in ways that stigmatise individuals, which creates serious legal and ethical exposure. Suspected exploitation is referred to police and children's services. Security advice should focus on environmental measures and staff safety rather than on identifying individuals, and records about young people carry heightened data protection obligations.

📰 Journalism and OSINT media

Coverage shapes outcomes in this area more than in most. Naming young people, publishing group iconography and reproducing conflict content can escalate violence and expose individuals to retaliation, and reporting restrictions protect under eighteens in proceedings. Verification matters because gang labels are applied loosely and a wrongly attributed association can follow someone for years. Ethical practice avoids glamorising, avoids amplifying provocative content, includes the exploitation dimension, and treats bereaved families with care. Reporting on systemic failures in safeguarding, exclusions and youth provision usually serves the public interest better than incident coverage.

🌍 NGO, humanitarian and human rights

Youth work, violence reduction and advocacy organisations hold the trust that enforcement cannot. Practice is relationship based and confidential within safeguarding limits, and any perception that an organisation shares intelligence with police destroys the access that makes it effective. Children involved in county lines style exploitation are victims and should be referred through the national trafficking mechanism as well as children's services. Documentation for accountability includes disproportionate enforcement and school exclusion, which are drivers rather than incidental context. Duty of care extends to frontline workers exposed to trauma and to threat.

🎓 University and research

Research covers group formation, exploitation, violence dynamics, and the effect of enforcement and public health interventions. Methodological care is essential because the gang label is inconsistently defined, applied disproportionately to minority communities, and frequently imported from police records into research uncritically. Ethics approval must address risk to participants, confidentiality against legal compulsion and the consequences of publication for identified areas. Publish definitions and inclusion criteria explicitly, avoid identifying neighbourhoods in ways that increase stigma, and evaluate interventions with designs capable of detecting displacement as well as reduction.

Playbook: working Gangs & Street Crime end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define terms before collecting anything

Establish what the work means by a group, an affiliation and a member, and record the criteria. The label is applied inconsistently and carries serious consequences for individuals, including in bail, sentencing and immigration decisions. A good output is a written definition with inclusion and removal criteria that could withstand legal challenge, because vague association criteria have been found discriminatory and have caused real injustice.

Phase 2 — Lead with the safeguarding assessment

Establish whether any child or vulnerable adult involved is being criminally exploited. Indicators include debt to older individuals, travel to other areas to hold or move drugs, unexplained money or phones, missing episodes, and injuries. Where present, refer to children's services and through the national trafficking referral mechanism. The output is a safeguarding referral made before any enforcement step, since enforcement against an exploited child compounds the harm and rarely touches the organisers.

Phase 3 — Build the violence picture

Map incidents over time and space: serious violence, weapon recovery, hospital presentations and non crime reports. Include health data, which captures injuries never reported to police. Identify the small number of people and locations associated with most incidents. A good output is an evidence based picture of where and among whom harm concentrates, which is the basis of any focused intervention and is usually narrower than assumed.

Phase 4 — Identify flashpoints and escalation risk

Track the drivers of retaliation: anniversaries, funerals, court dates, releases from custody, and provocative content circulating online. Escalation frequently follows a predictable sequence, which creates a window for intervention. Work with community organisations that see it first. The output is a short term risk picture with named mediation and safeguarding actions, not simply an increased patrol posture. Share the calendar with community organisations who can act before an incident occurs.

Phase 5 — Analyse online content carefully

Content posted by young people is evidence of harm, threat and sometimes exploitation, and it is also frequently performative rather than a statement of fact. Preserve it properly with timestamps and continuity, and interpret it with people who understand the local context and the medium. A good output distinguishes credible threat from posturing, because treating every provocative post as intent produces both wasted resource and unjust outcomes.

Phase 6 — Trace weapons and supply

Recover, document and trace firearms and knives where possible, and analyse how weapons enter the area: conversion, theft, importation or circulation between groups. Ballistic linkage across incidents reveals sharing. The output identifies the supply route rather than the individual carrier, since removing a weapon from one young person does not reduce availability. Record how the weapon entered circulation, not only who was holding it.

Phase 7 — Follow the drug market economics

Understand the retail market that funds most of this activity: supply lines from urban areas into smaller towns, the use of children as couriers and custodians, phone lines as commercial assets, and the debts used to control people. Debt bondage is the core control mechanism and is a trafficking indicator. A good output identifies the line holders and organisers rather than the replaceable street level participants.

Phase 8 — Focus enforcement narrowly and explain it

Where enforcement is used, direct it at the small group driving serious violence and at those exploiting children, and communicate clearly to the wider community what is happening and why. Broad suppression damages legitimacy and reduces the cooperation that solves shootings. The output is an enforcement plan with defined targets, stated criteria and a communication component, evaluated for displacement as well as effect.

Phase 9 — Offer a credible alternative

Focused deterrence approaches work only when the offer is real: education, employment, housing, mental health support and a route out of debt. Analysis should establish what is actually available and what the waiting time is, because an offer that cannot be delivered destroys credibility permanently. A good output is a mapped provision picture with capacity, which frequently exposes that the offer does not exist in the form assumed.

Phase 10 — Work through trusted intermediaries

Community organisations, youth workers, hospital based violence intervention teams and faith groups reach people that statutory services cannot, and they carry credibility only if their independence is protected. Do not treat them as intelligence sources. Agree what information flows and in which direction. The output is a working relationship that survives an enforcement operation, which requires the boundaries to have been explicit beforehand.

Phase 11 — Protect witnesses and bereaved families

Intimidation is routine and communities know it, which is why cases fail. Plan protection before any step that exposes a witness, including anonymity in proceedings, relocation where warranted and realistic conversations about what can be provided. Support bereaved families, whose treatment shapes whether anyone else cooperates. A good output is a protection plan agreed with the responsible authority in advance rather than assembled after a threat.

Phase 12 — Evaluate against harm, not activity

Measure serious violence, hospital admissions for assault, and the number of children referred out of exploitation, against a baseline set before intervention. Stops, arrests and database entries measure activity and can rise while harm rises too. A good output is an evaluation capable of detecting displacement, and honest enough to report that a heavily resourced operation moved the problem rather than reducing it.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Violence reduction unit evidence and evaluations	Open	Public health approach programme documentation, needs assessments and evaluations from regional violence reduction units.	Evidence on what interventions changed harm outcomes, and models for local needs assessment.
College of Policing evidence base	Open	Systematic reviews and practice guidance on policing interventions including focused deterrence and hot spots.	Assessing which enforcement approaches have evidence of reducing violence rather than displacing it.
WHO violence prevention resources	Open	Public health framework and evidence on preventing interpersonal and youth violence. Includes the INSPIRE and equivalent frameworks for youth violence prevention.	Grounding a public health approach and identifying evidence based prevention components. Also frames measurement around health outcomes rather than arrests.
Hospital emergency department violence data	Registration	Anonymised assault injury data including incidents never reported to police, shared under information sharing agreements.	The most complete available measure of violence, capturing what police data misses.
National Crime Agency county lines assessments	Open	Assessment of drug supply lines into smaller towns and the exploitation of children used to operate them.	Understanding the supply model and the exploitation indicators associated with it. Also documents the debt model used to control young people.
National Referral Mechanism guidance	Open	Framework for identifying and referring potential victims of trafficking including criminally exploited children.	The correct referral route where a young person is being criminally exploited.
The Children's Society and youth charity research	Open	Research and practice guidance on child criminal exploitation, disruption and support for affected young people.	Practice guidance on recognising exploitation and on support that reduces re-exploitation. Written from direct practice with exploited young people.
Cure Violence and hospital based intervention models	Open	Programme documentation and evaluation of interrupter and hospital based violence intervention approaches.	Evidence on interruption and mediation models and the conditions under which they work.
Youth Endowment Fund toolkit	Open	Evidence synthesis rating the effectiveness and cost of interventions aimed at reducing youth violence.	Rapid assessment of whether a proposed intervention has evidence behind it before funding.
Office for National Statistics crime and homicide data	Open	National statistics on violent crime, homicide characteristics, weapon type and victim demographics.	Baseline and trend data independent of local recording practice changes. Also breaks down homicide by weapon type and victim age.
Independent scrutiny of stop and search and gang databases	Open	Regulatory and civil society review of disproportionality, inclusion criteria and legal compliance.	Evidence on the legal and equality risks of association based records and how to mitigate them.
Firearms and knife recovery and tracing data	Licensed	Records of recovered weapons, ballistic linkage and tracing outcomes held by police and forensic services.	Understanding weapon supply routes and circulation between groups rather than individual possession.
Local safeguarding partnership reviews	Open	Published reviews of cases where children were seriously harmed, including exploitation and violence cases.	Systemic learning on where safeguarding and multi agency working failed a specific child.
Academic research on gang definitions and labelling	Licensed	Peer reviewed work on definitional inconsistency, labelling effects and disproportionality in gang designation.	Ensuring analytical definitions are defensible and aware of the consequences of the label.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Gangs & Street Crime. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Incident mapping and hot spot analysis — Identifies spatial and temporal concentration of serious violence. Limitation: reflects reporting and patrol patterns, so unreported violence is invisible.
• Hospital and police data linkage — Combines assault injury data with recorded crime for a fuller picture. Limitation: requires an information sharing agreement that protects patient confidentiality or clinicians will not participate.
• Social media evidence preservation — Captures threatening or evidential content with timestamps and continuity. Limitation: content is transient, context dependent, and easily misread without local knowledge.
• Network analysis of co-offending — Maps relationships from arrest, incident and intelligence records. Limitation: reproduces enforcement bias, so the resulting network describes who is policed as much as who offends.
• Exploitation screening tools — Structured assessment of child criminal exploitation indicators. Limitation: only useful where practitioners are trained and where referral leads to actual support.
• Ballistic and forensic linkage systems — Connect incidents through weapon and forensic evidence. Limitation: depends on complete submission of recovered items, which is often inconsistent.
• Focused deterrence case management — Coordinates the offer and the enforcement message around a defined group. Limitation: collapses immediately if the promised services do not exist or have long waiting lists.
• Evaluation designs with comparison areas — Detect whether an intervention reduced harm or displaced it. Limitation: rarely built in before implementation, so most programmes cannot demonstrate effect.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• The label carries consequences. Association records affect bail, sentencing, housing and immigration decisions, and have been found to operate disproportionately, so inclusion criteria must be documented, reviewed and removable.
• Most children in these networks are being exploited. Debt, coercion and threats to family are the control mechanisms, and treating a fifteen year old custodian as an offender leaves the organiser untouched and the child worse off.
• Hospital data is the better measure of violence. A large share of assault injuries never reach police, so any evaluation using recorded crime alone will misjudge whether harm actually fell.
• Online content is often performance. Interpreting every provocative post as a statement of intent produces both wasted resource and unjust outcomes, so interpretation requires people with local and cultural knowledge.
• Broad suppression buys short term visibility and long term cost. It reduces the community cooperation that solves shootings, and the resulting fall in clearance rates is rarely attributed back to the operation that caused it.
• The offer must be real before it is made. Focused deterrence works on credibility, and a single person told to expect support who then waits six months destroys the approach for everyone who follows.
• Escalation follows predictable triggers. Funerals, court dates, anniversaries and releases from custody create windows where mediation works, and a calendar of those triggers is one of the most useful products in this domain.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Gangs & Street Crime is producing anything, and they are worth baselining before you change process or tooling.

• Serious violence and hospital admissions for assault injury in the target area, measured against a baseline and a comparison area.
• Number of children referred out of criminal exploitation who were still out of it twelve months later.
• Clearance rate for serious violence offences, which reflects community cooperation as much as investigative resource.
• Proportion of young people charged who were screened for exploitation indicators before a charging decision.
• Waiting time between an offer of support being made and the support actually starting. An offer that cannot be delivered promptly damages credibility for everyone who follows.
• Disproportionality measures for stops, database inclusion and enforcement action, reviewed independently. Reviewed by a body independent of the force or agency being measured.
• Displacement measured in adjacent areas, so that a local reduction is not mistaken for an overall one.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Applying a gang label based on postcode, ethnicity or association rather than evidence, which has drawn sustained legal and regulatory challenge
• Treating social media bravado, drill lyrics or music video content as statements of fact about specific offences
• Processing exploited children as offenders, ignoring the coercion that placed them in a distribution role
• Over-interpreting small-number changes in local violence data, where ordinary variation reads as a trend
• Ignoring displacement, where enforcement pressure moves a market to a neighbouring area rather than reducing it
• Building network graphs from association data alone, where a shared school year or address history becomes an inferred criminal link

Legal and ethical considerations

Gang databases and similar lists have been found unlawful or discriminatory in several jurisdictions, so inclusion criteria, review periods and removal routes must be documented and auditable. Information sharing between police, health, education and social care needs a lawful basis and a written agreement, and health data is particularly restricted. Children involved in exploitation attract safeguarding duties and non-punishment considerations. Disclosure obligations apply to intelligence that undermines the prosecution case, and community confidence depends on the process being explicable.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Gangs & Street Crime, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 7 data points, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Are gang databases lawful and useful?

They are lawful only with documented, proportionate inclusion criteria, a review and removal process, and evidence that they are not operating discriminatorily. Several have been found seriously deficient on those points, with people included on the basis of association, music or postcode, and with disproportionate representation of minority communities. Analytically their value is also weaker than assumed, because they describe who has been policed rather than who is driving violence. A short, evidence based list of individuals genuinely associated with serious violence, subject to regular review, is defensible; a large association register is usually neither lawful nor useful.

How do you tell an exploited child from a willing participant?

You do not need to resolve that question to act, and the framing itself is unhelpful. Look for the control mechanisms: debt owed to older individuals, threats to family, travel to unfamiliar areas to hold or move drugs, missing episodes, injuries, a second phone, and money that does not match circumstances. Where present, refer through children's services and the national trafficking mechanism. Apparent willingness is common in exploitation and does not remove the protection a child is entitled to. Statutory defences may apply to offences committed as a consequence of the exploitation.

Does focused deterrence actually work?

The evidence is reasonably positive where it is implemented properly, and consistently poor where it is not. The conditions that matter are a genuinely narrow focus on the small group driving serious violence, a credible and immediately available offer of support, consistent communication delivered by people with standing in the community, and follow through on both the offer and the consequence. Where the support does not exist or the focus widens into general suppression, results disappear. Evaluate locally with a comparison area, because programme fidelity varies far more than the underlying model.

What is the right way to use social media content as evidence?

Preserve it properly and interpret it carefully. Capture with timestamps, hashes and a record of collection method, because content is removed quickly. Then interpret with people who understand the local context, the genre and the medium, since a great deal is performative, referential or aimed at a specific small audience rather than a statement of intent. Courts have accepted such evidence and have also seen it seriously misread. Where content is used to establish association, the same concerns about the gang label and its consequences apply.

How should analysts work with community organisations?

As partners with protected independence, not as sources. Their reach depends on being trusted by young people who will not speak to police, and any perception of intelligence sharing ends that immediately, which costs far more than any information gained. Agree explicitly what flows in each direction: safeguarding concerns move as they must under statutory duties, and general information about tension and flashpoints can move both ways, but individual intelligence does not. Put the boundaries in writing before an operation tests them, because that is when the relationship usually breaks.

Why do enforcement operations sometimes increase violence?

Removing a stabilising figure can fragment a group and trigger competition over a market, and a supply interruption can cause debt driven violence. Broad suppression also erodes the cooperation that solves shootings, so clearance rates fall and retaliation replaces prosecution. This is why disruption planning should assess what will fill the space, involve mediation capacity ahead of the operation, and set a baseline that allows the effect to be measured honestly afterwards. An operation that produces arrests and more violence has failed, and organisations need measurement capable of showing that.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• UN Convention on the Rights of the Child, requiring that the child's best interests are a primary consideration in all actions concerning them.
• Palermo Protocol and national modern slavery legislation, under which criminally exploited children are trafficking victims.
• National Referral Mechanism and equivalent frameworks for identifying and supporting exploited children and adults.
• Statutory safeguarding frameworks such as Working Together to Safeguard Children, defining multi agency duties.
• Equality legislation and public sector equality duties, which govern disproportionality in enforcement and record keeping.
• Data protection law as it applies to records about children, including retention limits and the right to erasure.
• College of Policing authorised professional practice on intelligence management and on stop and search.
• WHO public health approach to violence prevention, framing measurement and intervention design.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Violence reduction unit programme evidence — UK Home Office and regional violence reduction units. Documentation and evaluation of public health approaches to serious violence.
2. Crime reduction toolkit and evidence reviews — College of Policing. Systematic evidence on the effectiveness of policing interventions.
3. Youth violence intervention toolkit — Youth Endowment Fund. Evidence synthesis rating interventions aimed at reducing youth violence.
4. County lines and child exploitation assessments — National Crime Agency. Assessment of drug supply models and associated exploitation of children.
5. Violence prevention resources — World Health Organization. Public health framework and evidence on preventing youth violence.
6. Research on child criminal exploitation — The Children's Society. Practice research on identifying and supporting exploited young people.
7. Crime and homicide statistics — Office for National Statistics. National baseline data on violent crime and homicide characteristics.
8. Reviews of gang designation and disproportionality — Equality and Human Rights Commission. Independent scrutiny of association records and enforcement disproportionality.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: links incident timelines, exploitation indicators and flashpoint dates to support violence reduction and safeguarding. Explore the platform, or browse the rest of the library by following any tag above.