How Many "Unrelated" Crime Cases Are Unrelated Only Because Nobody Can See Across Them?

Cleophus Cooksey Jr. was arrested in Phoenix on December 17, 2017, on suspicion of killing his mother and stepfather. It read, on the intake sheet, like a contained domestic tragedy: one address, two victims, one suspect already in custody. Within about 48 hours, that case file had absorbed other homicides from across the city. Cartridge casings fired from his handguns matched shell casings already sitting, unconnected, in evidence lockers from earlier shootings¹. Those killings had not been sitting in a “serial killer” queue waiting to be noticed. They had been logged as separate, closed or open cases, worked by different detectives, until a ballistic imaging match, not an investigator’s hunch, told the department it was looking at one shooter across multiple scenes¹.

The technology that did the linking, the ATF’s National Integrated Ballistic Information Network, is not new; it has existed since 1997². What is worth sitting with is not that NIBIN found the connection. It’s that the connection existed for months inside case files that nobody had a structural reason to compare, because the unit of record in a police case management system is the incident and, once one exists, the suspect, not the tool that produced the physical evidence.

Case Files Are Built Around Who, Not What

Records management systems, and the investigative habits built on top of them, are organized to answer “who did this.” A case gets a number when there’s an incident. Fields capture victim, location, date, narrative, and, if there’s a lead, a suspect. Object-level detail, the specific gun, the specific pry bar, the specific vehicle, the specific packaging, the specific phone number recycled across three separate fraud complaints, gets recorded as an attribute of the incident rather than as an entity in its own right that might have its own history across other incidents. There is nowhere in the workflow that asks, by default, “has this object appeared somewhere else in the system, attached to a different case, a different jurisdiction, a different victim, a different suspect or none at all.”

NIBIN exists precisely because that gap is real and consequential for gun crime, and the numbers show both its value and its limits. NIBIN now holds more than 7.7 million pieces of ballistic evidence and has generated more than 1.26 million leads over its 28-year history; in fiscal year 2025 alone, 418 NIBIN sites acquired more than 623,000 pieces of evidence and produced more than 193,000 leads². ATF’s own description of the payoff is direct: the system “helps reveal previously hidden connections between violent crimes in different states and jurisdictions”². That is an admission, built into the program’s own marketing language, that without object-level matching, those connections stay hidden.

But an NIJ-funded, four-university study of NIBIN’s actual operation, covering 2006 through 2012 data from 150 sites and detailed casework from 65 serious violent crimes, found something more uncomfortable than “the tool works.” In half of those 65 cases, investigators had already identified a suspect before the NIBIN hit was produced; in 34 percent, the suspect had already been arrested³. Across the sample, a confirmed hit helped identify an unknown suspect only about 10 percent of the time and helped make an arrest only about 2 percent of the time³. The researchers’ bluntest finding was structural, not technological: “the majority of evidence in NIBIN is never connected with other offenses, events or weapons”³. The median time between a shooting and a confirmed hit was 101 days, and the mean was 337 days, long enough for cases to be reassigned, deprioritized, or closed by the time a match existed³. NIBIN is a working cross-case linkage system, and even inside it, most of the linking capacity goes unused, because the surrounding workflow, evidence routing, feedback loops, investigator access, was never rebuilt around the idea that an object could be the primary key.

When It Works, It Works Across Cases That Looked Nothing Alike

The cases where NIBIN did surface a hidden connection are instructive precisely because the linked incidents had no obvious relationship to a person. In November 2022, ATF Dallas and Dallas police charged Laquavana Goode with murder after NIBIN tied a handgun to two events that had nothing in common on their face: a fatal shooting into a homeless encampment near Deep Ellum in July 2021, and an accidental self-inflicted gunshot wound at a Walmart parking lot in Lewisville six months later, called in by the man who shot himself⁴. One was a homicide investigation with a dead victim and no suspect. The other was worked, if it was worked at all, as an accident report. Nothing about victim, location, or case type pointed investigators toward each other. The gun did⁴. ATF’s Dallas field division processed more than 3,600 cartridge cases in the first eleven months of 2022 alone and generated 513 leads from that single site, part of roughly 490,000 acquisitions and 150,000 leads nationwide that year⁴. In Utah, the state’s Crime Gun Intelligence Center reported 69 confirmed NIBIN hits linking 170 separate cases from January through Project Guardian reporting in late 2019, out of 1,644 entries submitted by 38 agencies⁵, a ratio that says a meaningful share of “separate” cases in that one state, in less than a year, were actually the same weapon moving through different scenes.

The Harder Question

If a purpose-built, federally funded, three-decades-old national database dedicated to exactly one category of physical evidence still only connects unknown suspects to crimes in roughly one case out of ten, and still leaves most of its own evidence unlinked, what should that suggest about every other category of object-level signature that has no NIBIN equivalent at all? There is no national, queryable network for tool marks left by a specific pry bar across burglary scenes in different counties. There is no routine cross-jurisdictional matching for a distinctive shipping label, a repeated counterfeit packaging defect, a reused shell company registration number, or a recurring phone number across fraud complaints filed in different states, different agencies, different case management systems that don’t talk to each other. Firearms got a dedicated infrastructure because gun violence commanded federal investment and because a cartridge casing happens to produce a machine-readable image. Most other object and method signatures never got that investment, which means the NIBIN experience, a tool that works but is chronically underused because the workflow around it never stopped being suspect-first, is close to the best case, not the worst case, for object-level linkage generally.

What a Higher Standard Actually Requires

The NIJ researchers who studied NIBIN did not conclude that the agency needed a better algorithm. They concluded that the sites getting real strategic value out of the system treated it “as a process involving people, interorganizational relationships and information sharing, and not merely as a piece of technology”³. That is worth taking seriously before reaching for new tools: a department that never routes hit reports to its crime analysts, never closes the feedback loop between the lab and the detective, and takes a year on average to confirm a match will not solve its linkage problem by buying more cameras or software. Sometimes the right answer is discipline, staffing, and routing, not novelty.

But there is a ceiling on what process improvements alone can do if the underlying case record has no place to hold an object as a persistent, searchable entity that accumulates history independent of which incident or suspect it’s currently attached to. A higher standard treats a firearm, a tool, a vehicle, a phone number, a packaging defect, or a method signature the way NIBIN treats a cartridge casing: as a record that exists whether or not a suspect has been named, that surfaces automatically when the same signature reappears anywhere in the system, regardless of jurisdiction, case type, or which detective owns the file. That is a data model and workflow question as much as an investigative one. It’s also the design premise behind investigative environments built for deep discovery across people, entities, incidents, and evidence rather than case management tools organized strictly around incident numbers and named suspects, which is the direction Hubstream’s platform is built toward, though the diagnosis here holds regardless of which vendor or in-house system a department is running.

Questions Worth Asking About Your Own Program

• Does your case management system let an investigator search by object or method signature (a serial number, a tool mark description, a packaging defect, a repeated phone number) across all case types, not just within a single crime category?
• How long does it take, on average, from evidence collection to a confirmed cross-case match, and has anyone measured whether that delay causes cases to be closed or reassigned before the link is found?
• When a match or lead is produced, is there a defined feedback path back to the original investigators and to crime analysts, or does the information stop at the lab?
• Are officers and analysts trained, and incentivized, to log physical evidence for cases with no injury or no known suspect, or does collection only happen when a case already looks serious?
• If your jurisdiction relies on a specialized network like NIBIN for one evidence type, what is the equivalent process, however manual, for object or method signatures that have no dedicated national database?
• Has anyone gone back through your unsolved or closed case backlog specifically looking for shared objects or methods, rather than shared suspects or victims?

The Cases Sitting in the Queue Right Now

Cooksey’s mother and stepfather were never an isolated case. They were part of a string of killings, and the file said otherwise for two days simply because nobody had a reason to look sideways until a lab technician did. The uncomfortable arithmetic from NIBIN’s own performance data, a system that still only helps identify an unknown suspect about one time in ten, is that the Cooksey outcome is the exception that ballistic imaging makes possible, not the norm it guarantees. Somewhere in an evidence room right now, a tool mark, a vehicle, or a shipping label is doing the same quiet, unglamorous work that those cartridge casings did, sitting inside two or three files that nobody has any structural reason to open side by side. The question worth asking isn’t whether the connection exists. It’s whether the case management system was ever built to let anyone find it before the trail goes cold.