The Pattern Is the Crime: How Predictive Analytics Could Change the Law Enforcement Response to Harassment Schemes

Coordinated harassment campaigns leave data trails that individual incident reports cannot capture. Predictive analytics gives law enforcement the ability to see the pattern across the noise, but the same tools carry documented risks of enabling the very abuse they are meant to stop. The question is not whether to use the technology. It is whether there is enough institutional discipline to use it correctly.

What Coordinated Harassment Actually Looks Like in a Report Log

The structure of a coordinated harassment scheme is not accidental. It is designed around a specific vulnerability in how law enforcement processes complaints: the single-incident frame. An officer responding to a complaint, or a dispatcher logging a call, is working with one data point. They do not have, and typically cannot access, the twenty prior data points that establish the pattern.

A harassment campaign might involve false police reports filed against the target in multiple jurisdictions, each designed to consume the target’s time and credibility while generating an official paper trail that serves the harasser’s narrative. It might layer in frivolous civil filings that create additional legal exposure and costs. It might include a coordinated social media operation, doxxing, impersonation, or fabricated screenshots circulated to the target’s employer or professional network. And it might escalate to swatting: filing a false emergency report designed to trigger an armed law enforcement response at the target’s address.

The target of such a campaign, meanwhile, experiences it as a unified, escalating assault on their professional life, personal safety, and institutional credibility. The gap between the target’s lived reality and what the institutional record reflects is not a failure of documentation. It is a structural feature of siloed, incident-based reporting that organized bad actors learn to exploit.

This is not a hypothetical vulnerability. The National Association of Attorneys General published analysis in 2025 documenting that doxxing and swatting incidents have increased significantly since 2024, with perpetrators using automated data scraping tools to assemble detailed personal profiles and AI-generated synthetic voices to place fraudulent emergency calls. Synthetic media tools lower the technical barrier to fabricating evidence. Bot networks can distribute that evidence at scale. The sophistication of the attack surface is growing faster than the institutional capacity to recognize it as a unified campaign.

What the Data Tools Already Know How to Do

The analytical methods that would surface coordinated harassment patterns are not experimental. They are in production use in adjacent investigative contexts, and they translate directly.

Link analysis, which maps relationships between actors across large datasets, is standard in insurance fraud investigation, financial crime enforcement, and gang network analysis. Applied to harassment, the same technique maps relationships between multiple false complainants targeting the same individual, between litigation filings and concurrent police contacts, between online accounts and physical-world incident timing. The question “is this person appearing repeatedly across distinct incidents involving the same target” is a structurally identical question to “is this body shop appearing repeatedly across distinct claims from the same zip code.” The algorithm does not care which problem domain it is in.

Temporal pattern analysis, which tracks the escalation trajectory of incidents over time, is what distinguishes a harassment campaign from coincidental contact. A genuine dispute might produce two or three incidents over a short period before resolution. A harassment scheme produces an escalating series of incidents over months or years, with incident frequency often increasing after the target attempts to seek legal relief. That escalation signature is detectable, documentable, and legally significant.

Cross-jurisdictional data sharing is the operational prerequisite that makes pattern detection viable. The Interstate Stalking Statute already recognizes that coordinated harassment frequently crosses jurisdictional lines: federal anti-stalking law supplements state prosecution specifically because the multi-jurisdictional nature of the conduct can frustrate local enforcement. The data infrastructure to match that legal framework has not kept pace. Agency coding systems that assign unique case numbers that follow across jurisdictions, as recommended by the Stalking Prevention, Awareness, and Resource Center guide for law enforcement agencies, would allow pattern analysis that is currently impossible when each jurisdiction treats its piece of the campaign as a standalone matter.

Weaponizing Law Enforcement: The Harassment Scheme Inside the Response

The most operationally sophisticated harassment schemes do not just evade law enforcement. They recruit it.

A serial false complainant who understands incident-based reporting can use it as a weapon. Every false police report filed against a target creates an official record that the target was the subject of a law enforcement contact. That record can then be used in civil proceedings, custody disputes, professional licensing challenges, or employment background checks to suggest a pattern of concerning behavior, one that exists entirely in fabricated filings but carries the institutional weight of official documentation. The target is not the subject of a crime investigation. They are the subject of a document-manufacturing operation that uses law enforcement as its printer.

This is why the case for analytics in harassment detection cannot be made without a simultaneous case for audit infrastructure. The Brennan Center for Justice’s 2025 analysis of AI in policing documents that when the LAPD’s Operation LASER flagged individuals as “chronic offenders,” officers created and circulated personal information about those individuals department-wide, resulting in home visits and increased police contact for people with no active warrants and no arrest history for violent crime. A predictive system with no oversight mechanism is an accusation engine. It produces designations that carry real-world consequences without the evidentiary standards that would attach to a formal charge.

The application of analytics to harassment scheme detection is meaningfully different from predictive policing applied to geographic hotspots or individual recidivism risk, and that distinction matters. Hotspot and recidivism models operate on population-level historical data that carries documented racial bias. Harassment pattern detection, properly scoped, operates on documented contact records tied to specific identified actors and specific identified targets. It is closer to financial fraud network analysis than it is to crime forecasting. The civil liberties concerns are different in character, though not absent, and the evidentiary value is higher because the pattern being detected is not probabilistic but documentary.

The Serial False Complainant as a Trackable Actor

One of the most actionable applications of analytics to harassment detection is the identification of serial false complainants: actors who repeatedly file police reports, court complaints, or regulatory grievances against the same target or a rotating set of targets, with no legitimate basis and no consistent follow-through when the reports are investigated.

The behavioral signature of a serial false complainant differs from a genuine victim in ways that are analytically detectable. Genuine complainants typically increase contact with law enforcement during an acute crisis period and decrease it as circumstances resolve. Serial false complainants show the opposite pattern: escalating contact frequency that does not respond to resolution, clustering of reports around significant dates in the target’s life, and a filing pattern that shifts methodologies when one channel is closed off. They also tend to reuse specific language, specific allegations, and specific documentation strategies across their filings, a stylistic consistency that emerges from the operational logic of the scheme rather than from genuine grievance.

Cross-jurisdictional false complainant tracking would require the kind of coordinated case-numbering infrastructure that the Stalking Prevention, Awareness, and Resource Center recommends and that most agencies have not implemented. It would also require clear legal protocols for what happens when a serial false complainant is identified: referral to prosecutorial review, flagging of subsequent reports for elevated scrutiny, and, where the false reporting meets the threshold, criminal accountability for the complainant. Stalking and harassment are crimes in all 50 states, but proving organized, coordinated conduct to prosecutorial satisfaction remains difficult without the documentation that cross-referenced, analytically processed complaint records would provide.

Knowing Who They Are Is Not Enough: Mapping the Threat Network

Here is the problem that identification alone does not solve. Law enforcement can confirm that a specific person is filing false reports, coordinating harassment, and targeting a victim through multiple channels. That confirmation matters. But it is only the first layer of the analytical picture, and stopping there is a strategic mistake.

The more operationally important question is not who the harasser is. It is who they are connected to, what those connections are capable of, and how those connections translate into vectors of harm against the target. A harasser who operates alone is a problem. A harasser embedded in a network of enablers, proxies, and willing instruments is a threat category entirely different in scope and in danger level.

The weaponized attorney scenario is one of the most common and most difficult to counter. A harasser who retains counsel with the specific intent to use litigation as a harassment instrument can file actions, demand discovery, seek restraining orders, and generate official legal proceedings indefinitely, as long as the filings are crafted carefully enough to survive initial scrutiny. Each filing consumes the target’s time, money, and emotional bandwidth. The attorney may or may not know the full context of what they are participating in. What matters analytically is whether the litigation pattern, examined against the full behavioral record of the harasser, fits the signature of a pressure campaign rather than a legitimate legal dispute. Filing frequency, the relationship between litigation events and the target’s life timeline, the absence of genuine pursuit of legal remedies when offered, and the overlap with concurrent non-legal harassment activity are all detectable signals.

The physical safety dimension of network mapping is the one that carries the most immediate stakes. A harasser who is themselves unlikely to make direct physical contact may be connected to individuals who will. Showing up at a target’s home, workplace, or regular locations is a harassment tactic that crosses from the legal system into physical space, and it is not always the named harasser who does it. It may be a contact, an affiliate, or someone who has been fed a distorted account of the situation and recruited into the campaign without understanding their role in it. Knowing that the primary harasser has those connections, and documenting those connections before a physical incident occurs, is the difference between a proactive protective posture and a reactive one that waits for something to happen first.

This is where predictive analytics moves from pattern detection into genuine threat anticipation. The same escalation modeling that identifies a harassment campaign’s trajectory over time can identify the point at which the campaign is likely to recruit additional actors, shift from institutional channels to direct contact, or move from digital targeting to physical presence. Escalation signatures in harassment cases, including the harasser’s response to legal setbacks, the entry of new actors into the contact record, and the narrowing of the target’s documented locations, are analytically modelable. They are not crystal-ball predictions. They are probability assessments drawn from the documented behavior of the network, and they give law enforcement and victims the lead time to act before the next incident rather than after it.

The Doxxing and Swatting Escalation

Swatting is harassment at its most dangerous intersection with law enforcement. A swatting call, designed to trigger an armed response to a target’s location, uses law enforcement as a physical delivery mechanism for threat. It also consumes emergency resources, creates risk of serious physical harm to the target during the response, and generates exactly the kind of official incident record that a harassment campaign is designed to accumulate.

The National Association of Attorneys General documented in 2025 that swatting perpetrators are increasingly using AI-generated synthetic voices to place fraudulent emergency calls, voice-altering software, and spoofed caller ID to prevent identification. The same report documented a sharp escalation in incidents since 2024, with bot networks amplifying associated doxxing content to maximize reputational damage and personal exposure for targets.

Detection of swatting as a campaign element, rather than an isolated hoax call, requires exactly the same cross-referencing infrastructure as harassment pattern detection more broadly. A single swatting call handled as a hoax is a misdemeanor-level matter in many jurisdictions. A swatting call that is the fifteenth documented hostile contact against the same target in a six-month period is evidence of a felony-level campaign. The difference between those two characterizations is entirely a function of whether the prior fourteen contacts have been documented, cross-referenced, and presented as a unified record.

Knowing Who Will Actually Act

There is a layer of the threat assessment problem that predictive analytics cannot solve on its own, and it is the layer that determines whether any of the rest of it matters: knowing which agencies will act on what they are shown.

Identifying a harasser, mapping their network, and building a documented pattern record are necessary conditions for an effective institutional response. They are not sufficient ones. A harassment campaign that spans multiple counties does not automatically produce a coordinated multi-county response. It produces a series of independent jurisdictional decisions, each made by an agency with its own caseload pressures, its own risk tolerances, and its own institutional incentives. Those decisions do not always point in the direction of action. Sometimes they point toward deferral, toward routing the victim to another agency, or toward waiting for the conduct to escalate further before treating it as a priority. That is what bunting looks like in practice.

The Lindke situation in Michigan is a documented case study in exactly this failure mode. Kevin Lindke’s harassment history spans multiple counties, multiple courts, and multiple institutional records. St. Clair County, Kalamazoo County, and Macomb County each hold pieces of a pattern that, assembled, meets every threshold for coordinated, escalating conduct. Publicly available court records show PPO violations counted in double digits in a single matter. A St. Clair County Circuit Court sentenced Lindke on three separate dates in 2021 for criminal contempt arising from PPO violations. Michigan family courts suspended his parenting time after documented threatening communications. The St. Clair County Sheriff’s Department, when approached for a police report, warned that Lindke’s followers may reach out to complainants and may engage. That is an institutional acknowledgment of a threat network operating around the primary actor, delivered informally rather than documented as part of a coordinated protective response.

This is where the threat network mapping argument becomes an argument about institutional will as much as institutional capacity. An analyst with access to cross-jurisdictional records can build the unified threat picture. But that picture has to land somewhere. It has to reach an agency that will treat the assembled record as a basis for action rather than as a reason to route it back to the county of origination. The analytics problem and the institutional accountability problem are not the same problem, and solving the first one does not automatically solve the second.

Lindke’s documented litigation strategy compounds the jurisdictional confusion deliberately. His own federal court filings establish a legal framework that depends on the accumulation of non-domestic PPOs as evidence for his constitutional claims. The strategy benefits from a system in which each PPO is processed by a different county court without reference to the others, where each complainant is treated as unrelated to the last, and where the aggregate pattern of who he targets and how he targets them is never assembled into a single evidentiary record. He is, in effect, playing the jurisdictional gaps as part of the operational design. That is not an accident. It is what sophisticated harassment looks like when the perpetrator understands the architecture of the system they are exploiting.

For victims navigating this landscape, the practical implication is stark. Building a documented record is essential but not sufficient. Understanding which agencies in the relevant jurisdictions have historically acted on similar patterns, which prosecutors have a track record of pursuing coordinated harassment cases, and which courts have demonstrated willingness to treat multi-incident conduct as a unified campaign rather than a series of separate matters is a form of threat intelligence in its own right. It is the intelligence that determines where to file, where to escalate, and where to stop waiting for a response that is not coming.

The Accountability Condition

The case for deploying predictive analytics in harassment scheme detection is strong. The case for deploying it without independent oversight is not.

The documented history of law enforcement database abuse is not a peripheral concern. It is the central risk variable. When officers have used official data systems to stalk private citizens, when predictive systems have generated “chronic offender” designations without evidentiary basis, when gang database inaccuracies have been fed into analytics tools that treat them as fact, the technology has not been neutral. It has amplified and laundered the biases and misconduct of the people operating it.

Any serious proposal for analytics-based harassment detection must include, as structural requirements rather than optional add-ons: independent audit of access logs and query histories, clear legal standards governing when a pattern designation is actionable versus merely flagged for review, defined thresholds separating harassment pattern detection from surveillance of individuals without specific predicate, meaningful civil recourse for people incorrectly flagged or targeted by the system, and strict prohibition on the data being used for any purpose outside its defined investigative scope.