CAC Undercover Operations Ontology
type: Ontology
comment: An ontology for representing undercover law enforcement operations in Internet Crimes Against Children investigations, extending UCO and CASE with gUFO foundational ontology enhancements. This ontology covers undercover identities, infiltration tactics, surveillance operations, and evidence collection through covert means.
version IRI: https://cacontology.projectvic.org/undercover/3.1.0
version info: 3.1.0
creator: CAC Ontology Team
issued: 2024-12-19
modified: 2026-08-09
imports: https://ontology.unifiedcyberontology.org/uco/core/1.5.0
imports: https://ontology.unifiedcyberontology.org/uco/identity/1.5.0
imports: https://ontology.unifiedcyberontology.org/uco/observable/1.5.0
imports: https://ontology.unifiedcyberontology.org/uco/action/1.5.0
imports: https://ontology.unifiedcyberontology.org/uco/role/1.5.0
imports: https://cacontology.projectvic.org/3.1.0
imports: http://purl.org/nemo/gufo#/1.0.0

Undercover Operation
type: Class
comment: A law enforcement operation using false identities or covert methods to investigate crimes and gather evidence.
subclass of: InvestigativeAction

Chat Room Infiltration
type: Class
comment: Undercover operation involving infiltration of online chat rooms or messaging platforms to investigate criminal activity.
subclass of: Undercover Operation

Online Platform Surveillance
type: Class
comment: Covert monitoring of online platforms for criminal activity without direct participation.
subclass of: Undercover Operation

Controlled Meeting
type: Class
comment: Planned in-person meeting between undercover agents and suspects under controlled conditions.
subclass of: Undercover Operation

Sting Operation
type: Class
comment: Coordinated undercover operation designed to catch suspects in the act of committing crimes.
subclass of: Undercover Operation

Preparation Phase
type: Class
comment: Phase involving setup of undercover identities and operational planning.
subclass of: Phase

Infiltration Phase
type: Class
comment: Phase involving initial contact and establishment of undercover presence.
subclass of: Phase

Evidence Gathering Phase
type: Class
comment: Phase focused on collecting criminal evidence through undercover interactions.
subclass of: Phase

Extraction Phase
type: Class
comment: Phase involving safe withdrawal from undercover operation.
subclass of: Phase

Undercover Identity
type: Class
comment: A fictitious identity created and maintained by law enforcement for undercover operations.
subclass of: Identity
subclass of: PersonLikeEntity

Parent Persona
type: Class
comment: Undercover identity portraying a parent or guardian of a child victim.
subclass of: Undercover Identity

Child Persona
type: Class
comment: Undercover identity portraying a minor child for investigative purposes.
subclass of: Undercover Identity

Platform Account
type: Class
comment: Account created on digital platforms for undercover operations.
subclass of: DigitalAccount
subclass of: DigitalSystemEntity

Undercover Agent
type: Class
type: Role
comment: Law enforcement officer or authorized civilian operating under false identity in an investigation.
subclass of: Role

Operation Handler
type: Class
type: Role
comment: Supervising officer responsible for managing undercover operations and agent safety.
subclass of: Role

Technical Support
type: Class
type: Role
comment: Personnel providing technical infrastructure and monitoring for undercover operations.
subclass of: Role

Undercover Communication
type: Class
comment: Communication conducted while using an undercover identity.
subclass of: MessageThread
subclass of: Artifact

Criminal Solicitation
type: Class
comment: Request or instruction from suspect to undercover agent to commit illegal acts.
subclass of: Message
subclass of: Artifact

Incriminating Statement
type: Class
comment: Statement made by suspect that provides evidence of criminal intent or past crimes.
subclass of: Message
subclass of: Artifact

Undercover Evidence
type: Class
comment: Evidence obtained through undercover operations.
subclass of: Artifact

Operational Evidence
type: Class
comment: Evidence collected during undercover operations including recordings, communications, and observations.
subclass of: Undercover Evidence

has operation phase begin point
type: DatatypeProperty
comment: Temporal begin point for undercover operation phase.
sub property of: hasBeginPointInXSDDateTimeStamp
domain: Phase
range: dateTimeStamp

has operation phase end point
type: DatatypeProperty
comment: Temporal end point for undercover operation phase.
sub property of: hasEndPointInXSDDateTimeStamp
domain: Phase
range: dateTimeStamp

has role begin point
type: DatatypeProperty
comment: Temporal begin point for undercover role.
sub property of: hasBeginPointInXSDDateTimeStamp
domain: Role
range: dateTimeStamp

has role end point
type: DatatypeProperty
comment: Temporal end point for undercover role.
sub property of: hasEndPointInXSDDateTimeStamp
domain: Role
range: dateTimeStamp

operation phase duration
type: DatatypeProperty
comment: Duration of undercover operation phase.
domain: Phase
range: duration

operates under identity
type: ObjectProperty
comment: Links an undercover agent to the false identity they are using.
domain: Undercover Agent
range: Undercover Identity

handled by
type: ObjectProperty
comment: Links an undercover operation to its supervising handler.
domain: Undercover Operation
range: Operation Handler

targets subject
type: ObjectProperty
comment: Links an undercover operation to the suspect being investigated.
domain: Undercover Operation
range: Person

covers timeframe
type: ObjectProperty
comment: Time period during which the undercover operation was active.
domain: Undercover Operation

portrays age
type: DatatypeProperty
comment: The age that the undercover identity claims to be.
domain: Undercover Identity
range: integer

backstory details
type: DatatypeProperty
comment: Biographical details created for the undercover identity.
domain: Undercover Identity
range: string

platform username
type: DatatypeProperty
comment: Username used for the undercover identity on digital platforms.
domain: Platform Account
range: string

communication platform
type: ObjectProperty
comment: Digital platform where undercover communication took place.
domain: Undercover Communication
range: DigitalService

contains criminal content
type: DatatypeProperty
comment: Whether the communication contains content of criminal nature.
domain: Undercover Communication
range: boolean

evidentiary value
type: DatatypeProperty
comment: Assessment of the communication's value as evidence (high, medium, low).
domain: Undercover Communication
range: string

safety protocol
type: DatatypeProperty
comment: Safety measures implemented for the undercover operation.
domain: Undercover Operation
range: string

backup team assigned
type: DatatypeProperty
comment: Whether a backup/surveillance team was assigned to the operation.
domain: Undercover Operation
range: boolean

emergency signal
type: DatatypeProperty
comment: Predetermined signal or code word for emergency situations.
domain: Undercover Operation
range: string

judicial authorization
type: ObjectProperty
comment: Court order or warrant authorizing the undercover operation.
domain: Undercover Operation
range: ObservableObject

supervisory approval
type: ObjectProperty
comment: Administrative approval from law enforcement supervisors.
domain: Undercover Operation
range: Person

operation classification
type: DatatypeProperty
comment: Security classification level of the undercover operation.
domain: Undercover Operation
range: string

evidence collected
type: ObjectProperty
comment: Evidence gathered during the undercover operation.
domain: Undercover Operation
range: Operational Evidence

leads to development
type: ObjectProperty
comment: Additional investigative leads generated by the undercover operation.
domain: Undercover Operation
range: Action

operation outcome
type: DatatypeProperty
comment: Result of the undercover operation (successful, compromised, terminated, ongoing).
domain: Undercover Operation
range: string

chat room topic
type: DatatypeProperty
comment: Stated topic or theme of the chat room being infiltrated.
domain: Chat Room Infiltration
range: string

participant count
type: DatatypeProperty
comment: Number of active participants in the chat room.
domain: Chat Room Infiltration
range: integer

infiltration duration
type: DatatypeProperty
comment: Length of time the agent spent in the chat room (in hours).
domain: Chat Room Infiltration
range: decimal

Physical Location Sting
type: Class
comment: Undercover operation conducted at physical location to apprehend suspects responding to trafficking advertisements.
subclass of: Undercover Operation

Apartment Sting Operation
type: Class
comment: Undercover operation using residential apartment as location for sting operation targeting trafficking clients.
subclass of: Physical Location Sting

Residential Sting Location
type: Class
comment: Residential property (apartment, house, etc.) used as staging area for undercover sting operations.
subclass of: Location

Surveillance Position
type: Class
comment: Position maintained by backup officers for observation and safety during physical sting operations.
subclass of: Location

Website Advertisement Response
type: Class
comment: Undercover operation responding to existing trafficking advertisements posted by suspects.
subclass of: Undercover Operation

Live Advertisement Monitoring
type: Class
comment: Real-time monitoring of trafficking advertisements to identify and respond to active postings.
subclass of: Website Advertisement Response

Client Response Interception
type: Class
comment: Undercover response to trafficking advertisement posing as potential client to gather evidence.
subclass of: Website Advertisement Response

Advertisement Photography Evidence
type: Class
comment: Photographic evidence of minor victims posted in trafficking advertisements.
subclass of: Operational Evidence

Phone Instruction Monitoring
type: Class
comment: Monitoring and interception of phone communications used to instruct victims in trafficking operations.
subclass of: Undercover Operation

Client Communication Interception
type: Class
comment: Interception of phone communications between traffickers, victims, and clients.
subclass of: Phone Instruction Monitoring

Victim Instruction Evidence
type: Class
comment: Evidence of traffickers providing phones and instructions to victims for client communication.
subclass of: Operational Evidence

Privacy Violation Investigation
type: Class
comment: Investigation of trafficking activities involving forced undressing and privacy violations.
subclass of: Undercover Operation

Bathroom Violation Evidence
type: Class
comment: Evidence of traffickers forcing victims to undress in bathrooms or other private areas.
subclass of: Operational Evidence

apartment type
type: DatatypeProperty
comment: Type of residential property used for sting (studio, one_bedroom, two_bedroom, etc.).
domain: Apartment Sting Operation
range: string

floor level
type: DatatypeProperty
comment: Floor level of apartment used in sting operation for tactical planning.
domain: Residential Sting Location
range: integer

has secure exit
type: DatatypeProperty
comment: Whether the sting location has secure exit routes for officer safety.
domain: Residential Sting Location
range: boolean

surveillance team count
type: DatatypeProperty
comment: Number of surveillance officers assigned to the sting operation.
domain: Physical Location Sting
range: nonNegativeInteger

advertisement URL
type: DatatypeProperty
comment: Web address of trafficking advertisement being responded to.
domain: Website Advertisement Response
range: anyURI

website platform
type: DatatypeProperty
comment: Name of website platform hosting the trafficking advertisement.
domain: Website Advertisement Response
range: string

advertisement live time
type: DatatypeProperty
comment: Duration the trafficking advertisement was active before response in hours.
domain: Live Advertisement Monitoring
range: decimal

victim photo count
type: DatatypeProperty
comment: Number of victim photographs identified in trafficking advertisement.
domain: Advertisement Photography Evidence
range: nonNegativeInteger

phone number monitored
type: DatatypeProperty
comment: Phone number under surveillance for trafficking instruction calls.
domain: Phone Instruction Monitoring
range: string

instruction type
type: DatatypeProperty
comment: Type of instruction provided to victim (client_communication, pricing, location, safety).
domain: Victim Instruction Evidence
range: string

client contact method
type: DatatypeProperty
comment: Method victims are instructed to use for client communication (phone, text, app).
domain: Client Communication Interception
range: string

violation type
type: DatatypeProperty
comment: Type of privacy violation investigated (forced_undressing, inappropriate_touching, voyeurism).
domain: Privacy Violation Investigation
range: string

violation location
type: DatatypeProperty
comment: Specific location where privacy violation occurred (bathroom, bedroom, changing_area).
domain: Bathroom Violation Evidence
range: string

operates at location
type: ObjectProperty
comment: Links physical sting operation to specific location where it occurs.
domain: Physical Location Sting
range: Residential Sting Location

maintains surveillance
type: ObjectProperty
comment: Links sting operation to surveillance positions maintained by backup officers.
domain: Physical Location Sting
range: Surveillance Position

responds to advertisement
type: ObjectProperty
comment: Links undercover operation to specific trafficking advertisement being responded to.
domain: Website Advertisement Response
range: WebPage

identifies victim photos
type: ObjectProperty
comment: Links advertisement evidence to specific victim photographs identified.
domain: Advertisement Photography Evidence
range: Image

monitors phone communication
type: ObjectProperty
comment: Links investigation to phone communications being monitored.
domain: Phone Instruction Monitoring
range: PhoneCall

intercepts instruction
type: ObjectProperty
comment: Links monitoring operation to specific trafficking instructions intercepted.
domain: Client Communication Interception
range: Victim Instruction Evidence

investigates violation
type: ObjectProperty
comment: Links investigation to specific privacy violation being investigated.
domain: Privacy Violation Investigation
range: Bathroom Violation Evidence

documents violation at
type: ObjectProperty
comment: Links violation evidence to specific location where violation occurred.
domain: Bathroom Violation Evidence
range: Location

Social Media Undercover Operation
type: Class
comment: Undercover operation conducted on social media platforms to identify predators seeking to meet children.
subclass of: Undercover Operation

Undercover Chat Investigation
type: Class
comment: Investigation using chat communications on various platforms with agents posing as minors.
subclass of: Chat Room Infiltration

Minor Persona Operation
type: Class
comment: Undercover operation where agents pose as minors to identify individuals seeking inappropriate contact.
subclass of: Social Media Undercover Operation

In Person Meeting Solicitation
type: Class
comment: Targeting individuals who seek to arrange in-person meetings with minors for illegal purposes.
subclass of: Undercover Chat Investigation

Multi Platform Undercover Operation
type: Class
comment: Undercover operation conducted across multiple social media platforms simultaneously.
subclass of: Social Media Undercover Operation

Predator Targeting Operation
type: Class
comment: Undercover operation specifically targeting online predators who seek contact with children.
subclass of: Undercover Operation

Multiple Persona Operation
type: Class
comment: Undercover operation where agent poses as multiple fictitious minors (e.g., 14-year-old and 12-year-old sisters). Extends MinorPersonaOperation.
subclass of: Minor Persona Operation

Sibling Persona Operation
type: Class
comment: Undercover operation where agent creates related minor personas (siblings).
subclass of: Multiple Persona Operation

Suspect Communication Action
type: Class
comment: Base class for criminal communication actions initiated by suspect during undercover operation.
subclass of: ExploitationEvent

Explicit Message Request Action
type: Class
comment: Suspect requesting explicit pictures or content from undercover persona.
subclass of: Suspect Communication Action

Video Call Request Action
type: Class
comment: Suspect requesting video call with undercover persona, often to confirm alone or for explicit purposes.
subclass of: Suspect Communication Action

Transport Arrangement Action
type: Class
comment: Suspect arranging to pick up and transport alleged minor to meeting location.
subclass of: Suspect Communication Action

Disguise Request Action
type: Class
comment: Suspect requesting alleged minor wear disguise items (sunglasses, etc.) to avoid detection.
subclass of: Suspect Communication Action

Criminal Item Agreement Action
type: Class
comment: Suspect agreeing to bring items for abuse (condoms, vape, alcohol, etc.).
subclass of: Suspect Communication Action

Meeting Location Arrangement
type: Class
comment: Suspect arranging specific meeting location (motel, hotel, other private location).
subclass of: Suspect Communication Action

Age Acknowledgment
type: Class
comment: Suspect explicitly acknowledging the stated age of the minor persona during communication.
subclass of: Suspect Communication Action

Sexual Intent Statement
type: Class
comment: Explicit statement by suspect expressing intent to engage in sexual acts with alleged minor.
subclass of: Suspect Communication Action

Minor Persona Agent
type: Class
comment: Undercover agent operating with minor persona identity on social media platforms.
subclass of: Undercover Agent

Social Media Agent
type: Class
comment: Agent specialized in social media platform undercover operations.
subclass of: Undercover Agent

Chat Investigation Agent
type: Class
comment: Agent specialized in chat-based undercover investigations for predator identification.
subclass of: Social Media Agent

social media platforms used
type: DatatypeProperty
comment: Number of different social media platforms used in undercover operation.
domain: Multi Platform Undercover Operation
range: nonNegativeInteger

chat platform type
type: DatatypeProperty
comment: Type of chat platform used (social_media, messaging_app, gaming_platform, forum).
domain: Undercover Chat Investigation
range: string

communication method
type: DatatypeProperty
comment: Primary method of communication (text_chat, voice_chat, video_chat, direct_message).
domain: Undercover Chat Investigation
range: string

persona age
type: DatatypeProperty
comment: Age of minor persona used by undercover agent.
domain: Minor Persona Agent
range: nonNegativeInteger

persona gender
type: DatatypeProperty
comment: Gender of minor persona used by undercover agent.
domain: Minor Persona Agent
range: string

persona location
type: DatatypeProperty
comment: Geographic location represented by minor persona.
domain: Minor Persona Agent
range: string

persona profile
type: DatatypeProperty
comment: Detailed profile information for minor persona (interests, background, characteristics).
domain: Minor Persona Agent
range: string

target behavior type
type: DatatypeProperty
comment: Type of behavior targeted (in_person_meeting_solicitation, sexual_conversation, grooming, image_requests).
domain: Predator Targeting Operation
range: string

meeting solicitation attempts
type: DatatypeProperty
comment: Number of in-person meeting solicitation attempts identified.
domain: In Person Meeting Solicitation
range: nonNegativeInteger

predator contact attempts
type: DatatypeProperty
comment: Number of contact attempts by potential predators during operation.
domain: Predator Targeting Operation
range: nonNegativeInteger

identification success rate
type: DatatypeProperty
comment: Success rate for identifying and prosecuting predators (0.0-1.0).
domain: Predator Targeting Operation
range: decimal

chat duration hours
type: DatatypeProperty
comment: Total duration of chat investigation in hours.
domain: Undercover Chat Investigation
range: decimal

conversation count
type: DatatypeProperty
comment: Number of separate conversations conducted during chat investigation.
domain: Undercover Chat Investigation
range: nonNegativeInteger

conducted on platform
type: ObjectProperty
comment: Links undercover operation to social media platform used.
domain: Social Media Undercover Operation
range: ObservableObject

utilizes persona
type: ObjectProperty
comment: Links operation to minor persona used by agent.
domain: Minor Persona Operation
range: Minor Persona Agent

targets individual
type: ObjectProperty
comment: Links predator targeting operation to specific individuals targeted.
domain: Predator Targeting Operation
range: Person

involves chat investigation
type: ObjectProperty
comment: Links social media operation to chat investigation component.
domain: Social Media Undercover Operation
range: Undercover Chat Investigation

identifies predator
type: ObjectProperty
comment: Links undercover operation to predator identified.
domain: Predator Targeting Operation
range: Person

leads to solicitation
type: ObjectProperty
comment: Links chat investigation to in-person meeting solicitation identified.
domain: Undercover Chat Investigation
range: In Person Meeting Solicitation

agent operates as
type: ObjectProperty
comment: Links agent to persona or identity used in operation.
domain: Social Media Agent
range: Undercover Identity

generates evidence
type: ObjectProperty
comment: Links undercover operation to evidence generated.
domain: Social Media Undercover Operation
range: Undercover Evidence

persona count
type: DatatypeProperty
comment: Number of distinct minor personas used in the operation.
domain: Multiple Persona Operation
range: nonNegativeInteger

primary persona age
type: DatatypeProperty
comment: Age of the primary minor persona.
domain: Multiple Persona Operation
range: nonNegativeInteger

secondary persona age
type: DatatypeProperty
comment: Age of the secondary minor persona (e.g., younger sibling).
domain: Multiple Persona Operation
range: nonNegativeInteger

sibling relationship
type: DatatypeProperty
comment: Relationship between personas (e.g., 'sisters', 'brothers').
domain: Sibling Persona Operation
range: string

request type
type: DatatypeProperty
comment: Type of explicit content requested (images, videos, video_call).
domain: Explicit Message Request Action
range: string

when parent absent
type: DatatypeProperty
comment: Whether request was conditional on parent being absent.
domain: Video Call Request Action
range: boolean

pickup location
type: DatatypeProperty
comment: Location where suspect agreed to pick up alleged minor.
domain: Transport Arrangement Action
range: string

destination location
type: DatatypeProperty
comment: Destination where suspect planned to take alleged minor (motel, hotel, residence).
domain: Transport Arrangement Action
range: string

disguise item requested
type: DatatypeProperty
comment: Item requested for disguise (sunglasses, hat, hoodie).
domain: Disguise Request Action
range: string

disguise purpose
type: DatatypeProperty
comment: Stated or implied purpose for disguise request (avoid_detection, conceal_identity).
domain: Disguise Request Action
range: string

items agreed to bring
type: DatatypeProperty
comment: Items suspect agreed to bring (condoms, vape, alcohol, etc.).
domain: Criminal Item Agreement Action
range: string

meeting location type
type: DatatypeProperty
comment: Type of meeting location arranged (motel, hotel, residence, vehicle, outdoor).
domain: Meeting Location Arrangement
range: string

meeting location name
type: DatatypeProperty
comment: Name of specific meeting location (e.g., 'Princess Motel').
domain: Meeting Location Arrangement
range: string

age stated to suspect
type: DatatypeProperty
comment: Age that was explicitly stated to the suspect.
domain: Age Acknowledgment
range: nonNegativeInteger

acknowledged count
type: DatatypeProperty
comment: Number of times suspect acknowledged the stated age.
domain: Age Acknowledgment
range: nonNegativeInteger

sexual acts intended
type: DatatypeProperty
comment: Types of sexual acts explicitly stated by suspect (vaginal, oral, anal, etc.).
domain: Sexual Intent Statement
range: string

targeted both personas
type: DatatypeProperty
comment: Whether suspect expressed intent toward both minor personas in sibling operation.
domain: Sexual Intent Statement
range: boolean

occurred during operation
type: ObjectProperty
comment: Links suspect communication action to the undercover operation.
domain: Suspect Communication Action
range: Undercover Operation

triggered by
type: ObjectProperty
comment: Links communication action to the message that triggered it.
domain: Suspect Communication Action
range: Undercover Communication

lead to arrest
type: ObjectProperty
comment: Links meeting arrangement to resulting arrest operation.
domain: Meeting Location Arrangement
range: Action

Meeting Location
type: Class
comment: Physical location arranged for meeting with alleged minor. Extends uco-location:Location as this represents a physical place.
subclass of: Location
subclass of: PlaceLikeEntity

Motel
type: Class
comment: Motel used or intended for sexual exploitation of minors (e.g., 'Princess Motel'). Physical location.
subclass of: Meeting Location

Hotel
type: Class
comment: Hotel used or intended for sexual exploitation of minors. Physical location.
subclass of: Meeting Location

Short Term Rental
type: Class
comment: Short-term rental property (Airbnb, VRBO, etc.) used for sexual exploitation. Physical location.
subclass of: Meeting Location

location name
type: DatatypeProperty
comment: Name of the meeting location (e.g., 'Princess Motel').
domain: Meeting Location
range: string

room number
type: DatatypeProperty
comment: Room or unit number at the meeting location.
domain: Meeting Location
range: string

arranged time
type: DatatypeProperty
comment: Date and time arranged for meeting.
domain: Meeting Location
range: dateTime

arranged for meeting
type: ObjectProperty
comment: Links a meeting location arrangement action to the meeting location.
domain: Meeting Location Arrangement
range: Meeting Location