by Michele Riccardi (Crime&tech e Transcrime – Università Cattolica del Sacro Cuore)
As it often happens, this time the cooperation with IrpiMedia starts in a late night chat on Whatsapp with Lorenzo (Bagnoli).
Lorenzo: Have you seen this?
And he pastes the web link of a media news describing an enormous real estate investment project in an abandoned railway station in Milan.
Lorenzo: Do you know who is behind?
Michele: No, I don’t
Lorenzo: Me neither
[All the conversation is held in a typical late night northern Italian writing style – aridity and essentiality at its maximum]
Michele: You know what
Lorenzo: What
Michele: At the research centre we started looking into who are the owners of the real estate industry in Milan
Lorenzo: […]
Michele: How much do we know about the owners, how many of them are concealed by odd corporate veils
I show him a project made by a UK NGO (Private eye) which mapped the real estate properties in London acquired by overseas companies: holding firms, shell companies, unknown trusts based in offshore jurisdictions.
Lorenzo: Fico [which in the 80s youngsters’ slang meaning “cool”]. Do you think this can be done in Milan, too?
Michele: I do not know. We need to check
Lorenzo: What is the result of your research, so far?
Michele: Too many data, so far.
Lorenzo: How many?
Michele: Nearly 50,000 thousands firms. We need to filter them down. Understand which are the riskiest ones.
Lorenzo: I need only few, for some stories, for some investigations I am doing
Michele: Yes, and I cannot share them all with you. Remember. Our DPO [Data Protection Officer] would kill me.
We meet few days later, at our University office. The COESO project has started since few weeks. We start talking, planning. We feel this is a good case study on which to work together. As usual, we will follow different paths. I will take care of the “big picture”. I eventually need an analysis which can become a scientific publication. Understand why real estate firms distribute in a certain way and why they have certain patterns. Lorenzo will take care of the “big story“. He needs plots, he needs a story to further investigate and which, after solid fact checking, can become a Pulitzer-to-win news on IrpiMedia or on some other European newspaper. As it often happens, we feel like two gold diggers just landed in a cold and troubled water of a river that somebody told us is full of precious stones, which however are very hard to find.
Sometimes it happens that our gold pan (the batea) is glittering more than usual. There is some gold inside, and we need to exchange the pan so as we could double check and share the result of the harvest. And this is the problem. We, as researchers, work on very voluminous datasets, stored on protected servers, and every time somebody else needs to access this information we face significant legal and technical challenges (see this blog post).
We then understand that this can become a perfect case-study for COESO. Thanks to the project, we are theorizing and formalizing a cooperation method – and a data exchange method – between researchers and journalists. Let’s apply the method to this real case example. Let’s see how this works. This is the story – or the logic sequence – of how we cooperated together and we exchanged data in our analysis of the corporate transparency risks in the housing market in Milan. The results of our respective works – the research and the journalistic investigation – are illustrated by other blog-posts. This is the behind the scene documentary.
First, the definition of the object
The first step (after a good espresso) is to define what we want to look at. First, in terms of object of observation. Second, in terms of patterns we are interested in.
We immediately discard the possibility to access real estate ownership data (i.e. cadastral data). The property registry is not public in Italy. One could access it, but can eventually just perform individual searches. Too small, for two of us interested in “big pictures” and “big stories”. A third party private data provider has acquired the entire cadastry, and is selling data via APIs. But it is too costly. We cannot sustain it. We therefore decide to focus on real estate companies (i.e. those registered in the NACE L.68 economic sector). We will not look directly at the owners of properties, we will look behind the firms which, in Lombardy (the region of Milan) buy and sell real estate. This is not ideal (as a property, let’s say, in Piazza Cordusio may not be owned by a real estate firm, but by a financial holding firm). However, it is the best proxy we can count on, and nobody to date did this research.
Second, the definition of the patterns
In which firms are we interested in? What does it mean to focus on the riskiest ones? Lorenzo tells me some stories of housing entrepreneurs in Milan related to an organised crime group, and a broker sentenced for corruption some years ago. He describes the mechanisms they employ, and therefore which patterns shall we then look into. Some of these anomalies coincide with the same ones we mapped in previous research projects. Among them: the employment of opaque legal arrangements such as trusts or Dutch foundations; the presence of firms with an anomalous complexity which is not justified by the size (or the location) of the firm itself; links with individuals targeted by previous sanctions or enforcement (ops! This is a pretty sensitive example of personal data!); links with holding companies based in some offshore or blacklisted jurisdiction with low level of corporate transparency links with owners located or born in territories characterized by high presence of mafia groups. We agree on a list of red-flags. We need now to apply them to the sample under analysis, and understand how many gold nuggets are inside.
Third, the preliminary big data analysis
Crime&tech, the spin-off company of Transcrime, the research centre of Università Cattolica, has developed a set of risk scoring algorithms which, by combining various data sources (for example, corporate data, or data on previous sanctions and adverse media, as mapped by Lexis Nexis World Compliance), can be applied to large samples of firms and map how red-flags distribute on these firms. This development is based on a research project – called DATACROS – in which also IrpiMedia was partner. The project also produced a prototype tool which allows to graphically visualize the results, in terms of maps, bar charts, and network graphs. The risk scoring algorithms are applied to the universe of real estate firms in Lombardy – around 40,000 firms. To be run, the algorithm takes some minutes, almost an hour. It is getting late. Another late night chat.
Michele: I have the first results
Lorenzo: So?
Michele: About 1% of all the real estate firms in Lombardy have three red-flags
Lorenzo: How many then?
Michele: 500 more or less.
Lorenzo: Good number. Manageable
Michele: Yes this is ok.
Lorenzo: But how do the riskiest firms distribute? In which geographic areas? With which patterns? How many in Milan?
Michele: This is my business
[Researchers with their statistics can be as jealous as journalists with their deep throats]
Fourth, the data sharing
Now, when reaching the data sharing step we need to wear back our hat of designers of cooperation and data sharing methods. There is an array of principles, fundamental rights and needs which we shall take care of (see this blog post). We need to find a balance between almost opposite poles such as the protection of personal data, the pursue of public interest (and freedom of information), and the need of make these data FAIR (findable, accessible, interoperable, reusable) for future research or citizen science project.
The two north stars guiding us are the principles of proportionality and necessity. Which leads to the notion of data minimization. Share the least – or the minimum essential – data, no more than that. This will help to protect the privacy of most of the individuals involved in the research (i.e. the natural persons owners of real estate firms in Lombardy), but also to preserve the integrity of the data, their investigative sensitivity, and avoid unexpected leaks or losses.
These objectives are also achieved via some technical and organizational means. First, the sample of 500 “riskiest” firms identified by the algorithm is shared with Lorenzo. In this phase, we do not share the names of the firms, but their IDs. How do we do that? We employ a cloud based sharing system (not FTP!) which is approved by our ISO 27001:2013 auditor, and is also tested periodically by some IT firms playing-as-they-were-hackers (the famous VA/PT, i.e. Vulnerability Assessments/Penetration Tests).
Lorenzo accesses the cloud based document management system to download the data. He accesses the folder with a keyword sent him via SMS (he is very fond of Signal to do these things, but I am a more old-fashioned mobile user). Then, he accesses the DATACROS prototype tool to access and visualize the data. Again, the tool was also subject to a strict assessment – both in terms of IT security and personal data protection. Lorenzo could access it and, by uploading the list of 500 IDs he received, see the names of the firms, check their connections, check their concentration and understand why they have been labelled as “risky”, i.e. which red-flags do they have. For checking which of them are connected to individuals (beneficial owners or directors) already mentioned in previous enforcement case, he needs to make a further step and confirm a further query. This is again to minimize further the number of queries involving the more sensitive personal data – such as those, like previous criminal records, listed in Art. 10 of the GDPR.
Fifth, the feedback
Late night chat, again.
Lorenzo: I looked into the list you gave me
Michele: And?
Lorenzo: Some are well known names which we are increasingly hearing about. Some are brand new.
This is exactly the kind of answer we want to hear, as researchers. The algorithms were able to identify targets which are already known to the investigator. In other words, simplistically, the models have been empirically validated. But the algorithms also brought to the surface some names which are new to the ears of our good investigative journalist friend. He can start a new investigation, haunt a new story.
Michele: back to business, now, ok?
Lorenzo: ok
Michele: I will send you the results of our research on the housing, when finalized.
Lorenzo: I will do the same with the media news story.
Photo by NurPhoto on Getty
OpenEdition vi suggerisce di citare questo post nel modo seguente:
Luca Rinaldi (23 Gennaio 2023). Duomo connection. Research-journalism cooperation to investigate the corporate ownership transparency behind the Milan housing market. The Backstory. Recuperato il 13 Marzo 2026 da https://doi.org/10.58079/ur3x