On September 18, 2026, INTERPOL published an account of Operation Shams II, a June operation that combined AI-assisted automation, image analysis, police databases and cryptocurrency tracing tools. According to the announcement, 28 specialists from 11 countries extracted 108,076 facial images from content published by jihadist groups. Programmed AI agents and scripts assisted collection, deduplication and quality control, narrowing the material to 6,362 unique, high-quality images for further processing. Officers and analysts reviewed and verified the generated output. By publication, INTERPOL reported that 126 suspected Foreign Terrorist Fighters had been identified.
The same operation also used advanced cryptocurrency tools to trace illicit funding. That work led to three urgent requests asking a Virtual Asset Service Provider to disclose customer information. The connection matters, but not because AI, biometrics and blockchain together form a truth machine. Each source can instead produce a better question for another source. An image may suggest a possible identity. An address may reveal a path of value. A provider record may link an account to a customer. An analyst must determine whether those connections corroborate or contradict one another.
The lesson for blockchain intelligence products extends beyond one operation. When an organisation joins algorithms, public-ledger data, provider records and sensitive databases, the central challenge is no longer finding a connection. It is preserving the distinction between a signal, lead, attribution, evidence and decision. If an interface or report collapses those categories, a powerful system can produce a weak conclusion at high speed. If it preserves them, source fusion can reduce response time without surrendering explainability.
A signal, lead, attribution, evidence and action are not the same thing
A signal is an anomaly or match worthy of examination. A lead is a working direction that suggests a source, entity or possible next step. Attribution is a claim that an address, account or item is connected to a person or organisation. Evidence is information presented with provenance, context, integrity and a chain of handling appropriate to its intended use. Action is an operational or legal decision: preserve records, contact a provider, restrict access, refer a matter or close the inquiry. All five can exist in one case, but there is no automatic shortcut between them.
A facial match may be computationally strong while still requiring review of image quality, pose, origin, similarity thresholds and alternative candidates. Blockchain data presents an equivalent problem. An address cluster is not necessarily one legal entity. A deposit address may belong to a custodian. A transfer may reflect a customer action, treasury consolidation or automated process. The product should require analysts to select the kind of claim they are adding rather than allowing one line in a graph to look like a final fact.
Evidence fusion is not data blending
Sound evidence fusion does not pour every source into one lake and search for correlation. It preserves each source in its domain and connects them through testable assertions. On-chain data has different properties from an image, login log or KYC record. A public transaction can be reproduced with a block number and transaction hash. A screenshot may have lost metadata. Provider data may be accurate but dependent on platform definitions. A model result is a computation that must remain attached to a version and parameters.
The data model should therefore separate source item, transformation, observation and claim. The source remains unchanged. A transformation describes image extraction, format conversion, address normalisation or transaction clustering. An observation records what was found: a face, address, amount, timestamp or account. A claim joins observations and states confidence. This separation allows an incorrect attribution to be withdrawn without deleting original material, a better model to be rerun and investigators to see exactly which conclusion changed because of it.
Preservation comes before prediction
An investigative system should begin with the ability to preserve. Online content can disappear, a page can change, a service can amend a record and a model can be upgraded. The system should record collection time, source location, file hash, collection method, version and the person or process responsible. Blockchain records require network and contract identifiers, block height, full transaction hash and a documented verification method. When a commercial provider supplies intelligence, the record should say whether a label came from direct provider information, community tagging or a heuristic.
This discipline prevents a team from presenting a persuasive visual while being unable to reconstruct it. It also enables genuine quality control. When an algorithm removes duplicates, investigators need to know which items were grouped and which representative was retained. When an image is enhanced, the original must remain beside the output. When addresses are clustered, the rule and version must be recorded. A model that leaves no path back to the input and transformation can assist search, but it should not be the sole evidence layer.
Good AI narrows the review space; it does not eliminate review
INTERPOL described a meaningful but bounded role for AI in Operation Shams II: automating parts of collection, deduplication and quality checking before further processing. It also stated that trained officers and analysts reviewed and verified the output. That is a sensible division of labour. A machine can scan volume, identify repetition and rank candidates. An analyst can inspect context, understand exceptions and decide whether a result justifies another step. The value is not replacing judgment; it is moving specialist time from an unstructured mass to a smaller set that can be examined properly.
The same principle applies to blockchain analysis. Algorithms can identify splitting patterns, bridges, service addresses or temporal connections. A language model can summarise events and propose investigative questions. The system must still expose supporting transactions, the rule that fired and the uncertainty. Analysts need to reject a suggestion, correct an entity and record why. When a product hides the path and shows only a risk score, it shortens review by creating a dependency that cannot be audited.
An investigative graph must represent uncertainty
Ordinary graphs display nodes and edges as though every relationship exists in the same way. An investigative graph needs relationship type, source, time, owner and confidence. A transaction between addresses is a direct observation. The claim that two addresses share control may come from a provider record, seized device, shared deposit endpoint or commercial heuristic. A match between a biometric identity and an account is a different claim with different limitations. Colour and line weight are not enough; every edge should open to show why it exists.
A useful confidence model is not one magical score. It separates source quality, match strength, source independence and recency. Two results derived from the same database are not two independent confirmations. A high score on a poor image is not equivalent to a high score on an original, high-quality file. A wallet label created years ago needs renewed validation. The system should explain which factors raise or reduce confidence and allow the decision-maker to see what remains missing before acting.
Entity resolution is a review mechanism, not a verdict
Entity resolution is where mistakes become dangerous. A name, username, telephone number, image, IP address and wallet may appear consistent while belonging to different people, a shared account or an asset that changed hands. Even a correct match does not prove intent or an offence. A responsible product lets an entity remain candidate, verified or disproven. It keeps the events that changed the status and does not silently display a candidate as fact everywhere else in the platform.
Identity and control must also remain separate. A person may be the registered customer without controlling the account at the relevant time. An address can be created on one device and later managed jointly. A company may own an account that an employee operates. Every attribution should therefore answer two questions: what relationship is asserted, and during which time window? “Registered to,” “signed by device,” “reported by provider” and “assessed by analyst” are distinct claims. The system should never flatten them into “belongs to.”
An urgent provider request is the output of focused analysis
INTERPOL reported that financial tracing produced three urgent requests to a Virtual Asset Service Provider. The small number relative to the source volume illustrates a product principle: the objective is not thousands of alerts but a limited set of precise, supportable requests. A well-formed request contains exact addresses and contracts, the network, relevant time range, transaction hashes, the record types sought, the basis for urgency and the appropriate legal authority.
The clock matters. Some records have limited retention, an address may continue moving assets and a service may operate in another time zone. A process should distinguish a rapid preservation request from a full disclosure request, subject to applicable law. Verified contacts, prepared templates and a status log can reduce delay without bypassing controls. A good intelligence product does more than identify the likely provider. It helps an analyst produce a fact package that an authorised official can use without manual re-entry or loss of context.
Privacy and purpose limitation belong in the architecture
INTERPOL states that its Rules on the Processing of Data govern information in the INTERPOL Information System and have continued to evolve. Its facial-recognition and Biometric Hub materials emphasise governance, rights and information protection. Biometric data uploaded to the BioHub for a search is not automatically added to INTERPOL criminal databases, is not visible to other users and is deleted after the search. Those details demonstrate an important principle: technical ability to join sources does not justify indefinite combined retention.
Architecture should define purpose, access, retention and visibility for each information class. A blockchain team may not need the full biometric file; a verified match and reference may be enough. An external contractor should not see unrelated KYC data. Access needs logging, environments need separation and deletion needs a defined process. Information minimisation is not the enemy of an investigation. It reduces leakage, bias and secondary use while improving the ability to explain who saw what and why.
Human verification must be a real operation
Human in the loop is not a label. If an analyst sees only a recommendation and clicks approve, there is no meaningful review. The interface should expose the source, input quality, competing candidates, reason for the link and limitations. It should support rejection, correction and escalation rather than approval alone. In sensitive work, the person who formed the hypothesis should be distinct from the person validating it, especially before an external request or an action affecting rights.
Workload affects quality as well. A queue of hundreds of similar matches encourages approval fatigue. Teams should measure rejections, corrections, review time and agreement between reviewers. Universal rapid approval may not be efficiency; it may show that the interface prevents examination. Automation should improve the signal-to-noise ratio and give people time to focus on decisions where human judgment changes the outcome.
The system must be tested against an adversary
A subject of investigation may recycle images, alter metadata, use generated or manipulated faces, split funds, change networks, rely on one-time deposit addresses or seed open sources with false information. Evaluation on clean examples is therefore insufficient. Test cases should include partial or distorted images, incorrectly labelled wallets, files containing malicious instructions and external tools returning conflicting information. The system should fail visibly rather than convert uncertainty into confidence.
Adversarial testing does not require publishing evasion techniques. It tests principles: is the original preserved, is external input constrained, can a model initiate an irreversible action, are rate limits present, does an anomaly stop the workflow, and can attribution be reversed? Supply-chain change matters too. A new model, tagging provider or blockchain API can alter results without a local code change. Every component needs a version, owner, monitoring and rollback process.
A practical architecture: five zones and transition gates
From Dor Arad’s product perspective, this kind of system benefits from five operating zones. First is a read-only evidence vault holding originals and hashes. Second is an isolated processing workspace for extraction, transformation and normalisation. Third is a graph layer containing observations and provenance-rich claims. Fourth is a review queue presenting candidates, competing results and analyst actions. Fifth is a case package that exports only reviewed assertions together with sources, timestamps, versions and limitations.
Gates sit between the zones. A source becomes an observation only after integrity checks. An observation becomes a claim only with a stated rule or rationale. A claim becomes attribution only after corroboration and reviewer decision. Attribution becomes action only with authority, proportionality and the appropriate approval. Gates do not have to make every task slow. Routine validation can be automated while sensitive steps retain human approval. The essential requirement is that the platform knows the stage of every item and never renders a draft as a conclusion.
Metrics that measure investigative quality
The number of addresses, images or matches is not a success metric. It is a volume metric. Better indicators include time from first signal to verified lead, duplicate reduction without material loss, the percentage of important claims with independent support, review-queue precision, time to preservation request, post-review correction rate and the ability to reproduce a conclusion from scratch. Risk measures matter too: how many people or accounts were affected by an incorrect match, how much unnecessary information was exposed, and how quickly an attribution could be reversed.
Operational value needs measurement alongside accuracy. Did source fusion shorten search time, prevent an overbroad request, expose a contradiction or support closing an unsupported case? Stopping can be a high-quality outcome. A product that rewards only “findings” will tend to create more links. A product that rewards justified decisions can show that evidence is insufficient. That is the difference between a system that generates activity and one that generates intelligence.
The case package must make sense outside the product
The final output is not a dashboard. It is a case package that someone who never used the tool can understand. It should include the investigative question, timeline, source register, principal observations, claims and confidence, alternatives tested, analyst actions and limitations. Every graph element should point back to a source item. Every amount should identify network, asset, unit and time. Every model result should carry a version and date.
FATF’s asset-recovery guidance stresses the technological capability required to identify and trace virtual assets and the role of blockchain analytics. For that capability to withstand review, it must be explainable and reproducible. A flat image or PDF without underlying references is insufficient. Even when work is intended for intelligence rather than court, evidential discipline improves decisions and enables work to move between organisations without losing meaning.
What private organisations can learn from the model
The lessons are not confined to law enforcement. A bank, exchange, fintech company, insurer or audit team can use the same separation. A model detects a signal. An analytics system exposes the path. An analyst tests context. Only an authorised process decides whether to report, restrict or contact a customer. Private organisations should not copy enforcement databases or process biometric information without a valid need and basis. The value lies in proof architecture, not broader collection.
Intelligence vendors should disclose limitations too. A customer needs to know whether attribution comes from public information, provider disclosure, internal investigation or inference. Labels need update dates and a correction mechanism. Contracts should define use, retention, access and notice of material model change. When an output may affect a person, there should be a path for human review and corrective information. That transparency need not disclose trade secrets; it defines the boundary for responsible use.
The advantage is not knowing more; it is knowing what is known
Operation Shams II demonstrates the power of combination: automation reduces volume, recognition systems compare candidates, blockchain intelligence traces funding, a service provider holds records and trained analysts verify. The strength does not come from stacking tools. It comes from orderly movement between sources, compliance with processing rules and each stage creating a more precise question for the next.
The future of blockchain intelligence is multi-source and AI-assisted, but its language must become more modest. A match is not identity. Identity is not control. Control is not intent. Suspicion is not guilt. A mature system does not obscure those distances; it measures them. It allows rapid movement when facts are strong and an explicit stop when they are not.
Dor Arad’s conclusion is that the investigative and product advantage is not merely collecting more information. It is knowing exactly what was observed, what was inferred, who reviewed it, what changed and which decision the material can genuinely support. When AI and blockchain meet inside that architecture, they do not promise certainty. They provide something more useful: a shorter, controlled and defensible path from signal to evidence.