Investigate illegal or suspicious activities
Most of the output can be produced by software today.
An agent can find, read and summarise the sources this work depends on, and it can cover far more of them than a person would ever open. What it does not do is decide which sources deserve trust, or what the findings mean for your situation.
| How automatable | Mostly automatable |
|---|---|
| Kind of work | Research and retrieval work |
| Jobs that do it | 12 occupations |
| Tool categories that apply | Web, data and docs, Generalist agents |
| O*NET activity | Getting Information (4.A.1.a.1) |
What this looks like on the job
Not our paraphrase. These are real task statements recorded against this activity, spread across the 12 occupations that perform it.
- Coordinate or conduct internal investigations of problems such as employee theft and violations of corporate loss prevention policies.
- Identify new threat tactics, techniques, or procedures used by cyber threat actors.
- Conduct investigations of information security breaches to identify vulnerabilities and evaluate the damage.
- Investigate disturbances on the premises, such as security alarms, altercations, and suspicious activity.
- Study activities relating to narcotics, money laundering, gangs, auto theft rings, terrorism, or other national security threats.
- Investigate hunting accidents or reports of fish or game law violations.
- Investigate illegal or suspicious activities.
- Institute civil and criminal prosecutions and cooperate with other law enforcement agencies in the investigation and prosecution of those in violation of immigration or customs laws.
- Investigate or direct investigations of freight theft, suspicious damage or loss of passengers' valuables, or other crimes on railroad property.
- Investigate reports of animal attacks or animal cruelty, interviewing witnesses, collecting evidence, and writing reports.
- Answer alarms and investigate disturbances.
- Investigate instances of illegal tapping into service lines.
- Link or chart suspects to criminal organizations or events to determine activities and interrelationships.
- Monitor, note, report, and investigate suspicious persons and situations, safety hazards, and unusual or illegal activity in patrol area.
- Study the assets of criminal suspects to determine the flow of money from or to targeted groups.
What we would actually use
One recommendation rather than a shortlist, because a shortlist is just your problem handed back. This is what we would buy for research and retrieval work, and what it costs.
Research is the one shape of work that needs no integration at all, so a single $20 assistant with browsing is the whole stack. Add a crawler only once you are pulling hundreds of pages on a schedule rather than reading a few.
Chosen for the cheapest thing that does the job, not the best funded. Nothing on this site is sponsored, and the full landscape is there when you want to disagree with us.
The rest of the category
Context, not alternatives to weigh up. We name the layer rather than promise a named product does your specific task.
Generalist agents
Matched from the kind of work, not from vendor marketing. Check any of them can reach the system your records actually live in — that connection, not the model, is where these projects stall.
How people actually do it
No workflow names this activity yet, but these automate the same kind of work, with the prompts to paste and what to keep for yourself.
Who does this work
12 occupations in the O*NET database perform this activity. Each one has a full breakdown of its other tasks.
- Animal Control Workers
- Control and Valve Installers and Repairers, Except Mechanical Door
- Customs and Border Protection Officers
- First-Line Supervisors of Security Workers
- Fish and Game Wardens
- Information Security Engineers
- Intelligence Analysts
- Loss Prevention Managers
- Penetration Testers
- Police and Sheriff's Patrol Officers
- Security Guards
- Transit and Railroad Police
Work that goes with it
O*NET groups these under “Investigate criminal or legal matters”. In practice they tend to be done by the same person, in the same sitting.
Method. The activity, its taxonomy placement and the occupations that perform it come straight from the public-domain O*NET 30.3 database. The automatability band is ours: we map each of O*NET’s 41 generalized work activities to how much of its output current software can produce, assuming a person still reviews and owns the result. It is a coarse three-way judgment on purpose. A precise-looking percentage here would be invented.