From the manual, a brief explanation of how AT&T uses it (or at least, did some years ago):
Hancock’s stream construct models data that can be viewed as a sequence of values in a fixed format. Typical examples include records of telephone calls on a long-distance network, session logs from an Internet service provider, and billing records from a credit card company. Hancock constructs make it easy to filter streams to remove unwanted records, to sort streams to improve access locality and hence performance, to detect user-defined events in streams, and to execute user-specified code in response to those events.
[...]
At AT&T Labs we have a suite of Hancock programs that run daily to calculate signatures or profiles of AT&T’s long-distance customers. These signatures are used for fraud detection and marketing. The programs process roughly nine gigabytes of stream data daily. The most complex application produces a Hancock map that stores values of 120 bytes for over 300 million active keys (from a space of 10 billion possible keys). These maps require roughly seven gigabytes of space on disk.
This sounds like the sort of tool your credit card company would use to freeze your card if it shows up at POS in different states at too short an interval, buys gas 10 times in an hour, etc.
Real-time data analysis is useful for surveillance, but there are legitimate uses as well, credit card fraud being one of them.
Hancock’s stream construct models data that can be viewed as a sequence of values in a fixed format. Typical examples include records of telephone calls on a long-distance network, session logs from an Internet service provider, and billing records from a credit card company. Hancock constructs make it easy to filter streams to remove unwanted records, to sort streams to improve access locality and hence performance, to detect user-defined events in streams, and to execute user-specified code in response to those events.
[...]
At AT&T Labs we have a suite of Hancock programs that run daily to calculate signatures or profiles of AT&T’s long-distance customers. These signatures are used for fraud detection and marketing. The programs process roughly nine gigabytes of stream data daily. The most complex application produces a Hancock map that stores values of 120 bytes for over 300 million active keys (from a space of 10 billion possible keys). These maps require roughly seven gigabytes of space on disk.