Identity and biometric data are collected from individuals. The collected data is used to form biometric data packages, each of which contains information about one biometric feature and identity data associated with the corresponding individual. Each biometric data package is stored in a categorical fashion based on its biometric feature. A current query from a requesting source includes at least one monitored biometric feature of an individual of interest. A first correlation is performed between the current query's monitored biometric feature and the same type of biometric feature associated with those of the biometric data packages previously stored in a categorical fashion. A second correlation is performed between the current query's monitored biometric feature and the monitored biometric feature associated with each of the previous queries. Results of the correlations can be indications of suspicious behavior that was used by the requesting source to form the current query.