20140821 comprehensive impact of social media to the ic by Contingent Security Services, Ltd

1 UNCLASSIFIED

A COMPREHENSIVE ASSESSMENT OF THE IMPACT OF SOCIAL MEDIA IN THE UNITED STATES INTELLIGENCE COMMUNITY.

Joel Vargas, Assistant Director for Law Enforcement Operations 2014-08-21 This research was performed for the US only and not to be disseminated to any foreign government. The contents in this research are the work in partnership of Contingent Security Services, Ltd. and the International Association of Airport and Seaport Police (InterPortPolice). UNCLASSIFIED Correspondence: CONTINGENT SECURITY SERVICES, LTD. 10 Martingale Rd #400 Schaumburg, IL 60173 Office: 1-312-650-9363 E: joel@contingentsecurity.com www.contingentsecurity.com

UNCLASSIFIED

ABSTRACT The rise of social media brought to the Intelligence Community (IC) many surprises. While Open Source Intelligence (OSINT) for the longest time had been the â&#x20AC;&#x153;ugly stepchild,â&#x20AC;? the discipline has now been reinvented into an important intelligence discipline. The creation of Facebook in 2004 began to transform the way people share and network with others. In the last 4 years, the new impact in social media is the concept of mobility. Everyone wants to be mobile. People can post to their social media profiles text, photos and video with their smart phones at any location. The opportunity to exploit social media for intelligence purposes then created Social Media Intelligence (SOCMINT), a category of OSINT. Local criminals, transnational organized crime, and terrorists have joined the social media frenzy as well. Tasks for the Intelligence Community collectors and analysts most times start with OSINT and SOCMINT. Social media has impacted every intelligence collection discipline and every job in the IC. The new generations of employees in the IC are also exploring the potential in social networking in the IC. The social media impact in the IC is unprecedented and this research provides a comprehensive analysis of the impact.

UNCLASSIFIED

TABLE OF CONTENTS ABSTRACT .................................................................................................................................................2 I. Introduction and Purpose Statement ..........................................................................................5 II. Statement of the Problem .............................................................................................................. 17 III. Theoretical Framework ................................................................................................................ 19 Theory #1: American Theory of Intelligence .............................................................................................20 Theory #2: Historical Theory of Intelligence .............................................................................................20 Theory #3: Explanatory Research Theory .................................................................................................21

IV. Working Hypotheses ..................................................................................................................... 23 V. Significance of the Study ................................................................................................................ 24 VI. Research Design and Methodology ............................................................................................ 27 A. .. Independent Variables (IV) and Dependent Variables (DV) in the SOCMINT Intelligence Cycle (in a linear process): .................................................................................................................................................27 B. ................... This research focuses in the following dependent variables inside the Physical and Verbal Intelligence (DV): ...............................................................................................................................................29

VII. Literature Review ......................................................................................................................... 30 A. Informal Networks.........................................................................................................................................30 B. Physical Limitations on Social Networking ...............................................................................................31 C. The Open Source Revolution in Intelligence .............................................................................................31 D. Social Media Monitoring and Privacy ........................................................................................................32 E. Economic Espionage .....................................................................................................................................32 F. Policy in the Private and Public Sectors on Social Media ........................................................................33 G. Social Media in Terrorism ............................................................................................................................33 H. Social Media and Propaganda ......................................................................................................................34 I. Authoritarian Governments Attempt to Control the Media ......................................................................35 J. Mobility in Social Media ...............................................................................................................................35 K. A Networked Society ....................................................................................................................................36 L. Social Media in Public Safety ......................................................................................................................36

VIII. Analysis and Findings ................................................................................................................ 38 A. Law Enforcement ..........................................................................................................................................46 Public Safety................................................................................................................................................................... 47 White-Collar Crimes .................................................................................................................................................... 48 Social Media and Local Crime ................................................................................................................................. 49 Social Media and Sophisticated Cybercrimes .................................................................................................... 49 Social Media and Police Investigations................................................................................................................. 50 Modern Crimes in Cyberspace ................................................................................................................................. 51 The Role of the Fusion Centers in Law Enforcement ....................................................................................... 52 Gangs and Social Media............................................................................................................................................. 53 Human Trafficking and Social Media .................................................................................................................... 56 Civil Unrest ..................................................................................................................................................................... 58 B. Homeland Security ........................................................................................................................................59 SOCMINT During Homeland Security Crisis ....................................................................................................... 61 Social Media in Natural Disasters .......................................................................................................................... 62 Information Sharing to the Public with Social Media ....................................................................................... 64 Social Media during High-Profile Events ............................................................................................................. 64 Domestic Terrorism and Social Media .................................................................................................................. 65 C. Counterintelligence........................................................................................................................................67 Social Engineering ....................................................................................................................................................... 69

UNCLASSIFIED

Social Media Impact in Politics ............................................................................................................................... 71 National Security Personnel and Social Media................................................................................................... 72 Drug Traffickers and Social Media......................................................................................................................... 73 D. Foreign Intelligence Operations ..................................................................................................................75 Some History of OSINT ............................................................................................................................................... 76 The Relationship of SOCMINT and HUMINT..................................................................................................... 77 Social Media for Foreign Intelligence Operations ............................................................................................ 79 The Social Media Influencers ................................................................................................................................... 79 Clandestine Operations .............................................................................................................................................. 80 Limitations of Social Media....................................................................................................................................... 81 The Involuntary Intelligence Collector for the IC .............................................................................................. 82 Social Media Privacy Concerns in Foreign Operations .................................................................................. 82 Foreign Governments SOCMINT Collection Efforts ........................................................................................ 83 Special Activities Division (SAD) ............................................................................................................................ 84 Counterterrorism (CT) ............................................................................................................................................... 87

IX. Conclusion........................................................................................................................................ 91 Bibliography ........................................................................................................................................... 96 Appendix A ......................................................................................................................................... 101 Appendix B .......................................................................................................................................... 102 Appendix C .......................................................................................................................................... 103 Appendix D .......................................................................................................................................... 104

UNCLASSIFIED

I. Introduction and Purpose Statement Social media has changed the collection and analysis of intelligence in the world today, unlike any other technological development in the last 60 years. While the exploitation of social networks is not a new area of intelligence, counterintelligence, and law enforcement, the social media technology is a new phenomenon. The invention and rapid adaptation of social media by people around the world began to transform the interaction between government and civil society, as early as the first Facebook posting took place. The Media Evolution Theory states that for successful adoption of new technology two stages must take place: the technology must be invented and it must be integrated into society.1 Social media today is being adopted by societies around the world, including places where government censure of anti-government expressions is punishable in some cases by jail time and in other cases by death. It has also been integrated by society by the number of users. Moreover, this research discovered that the integration process is heavily influence by culture, language, beliefs, values, and traditions.2 For over a century, formal and informal social networks have been infiltrated by intelligence agencies in order to overthrow governments or to control society from seeking social change. A breakthrough in intelligence was that social media helps people in these countries “self-organize” and they handle the overthrowing of their own governments. Cynthia M. Grabo writes that an indicator is something that can help the analyst anticipate and prepare for hostilities and these indicators should be incorporated in the “indicator

Julie B. Wiest and Nahed Eltantawy, “Social Media Use among UAE College Students One Year after the Arab Spring,” Journal of Arab & Muslim Media Research 5, no. 3 (September 2012): 212, accessed July 26, 2014, EBSCOhost. 2 Ibid. 1

UNCLASSIFIED

list.”3 The intelligence professionals today are left with little room for error as they try to obtain indicators as to what people are trying to do in Social media. Social media has also impacted criminal organizations and terrorist networks. As the result of these needs, Social Media Intelligence (SOCMINT) was created to assist the Intelligence Community (IC) in most of their operations. SOCMINT can be used to monitor every place in the world where social media is used and it can produce reliable indicators. The social media impact to the IC has been unprecedented. Social media has also impacted criminal and terrorist organizations. They have been shifting their operations from an established hierarchy to a more decentralized and cellular form. In regards to terrorism in the Middle East, North Africa (MENA) and in Mexican organized crime, social media influenced change to their network structures. SOCMINT operations against the Sinaloan Cartel in 2013 and 2014 helped authorities map out cellular groups of the “juniors” and the new generation of Sicarios (enforcers) that extended around the globe. SOCMINT was instrumental and law enforcement in the US began to see cells of some of the most powerful criminal organizations in Mexico crumble. On November 20, 2014, Serafin Zambada, son of Ismael “El Mayo” Zambada, partner of Joaquin “El Chapo” Guzman Loera, was arrested in Nogales, AZ, in part, because of the work created with SOCMINT. It appears the kingpin juniors could not stop posting in social media their daily activities and many still can’t. Later, on December 30, 2013, Jose Rodrigo Arechiga Gamboa aka “El Chino Antrax” head of Los Antrax the enforcer group of the Sinaloan Federation in Juarez was arrested in Amsterdam. El Chino Antrax had plans for a New Year’s celebration; something based on intelligence

Cynthia M. Grabo, “Anticipating Surprise: Analysis for Strategic Warning,” (Maryland: University Press of America, 2004), 3. 3

UNCLASSIFIED

gathered in social media he loved to brag about. Both arrests were conducted with the help of SOCMINT operations, which included infiltrating the entire cell structures with Sockpuppets. The leadership of traditional hierarchal structures is getting replaced for these able to organize people in less-formal networked organizationsâ&#x20AC;&#x201D;either open or covert.4 As the result, social media caused terrorism and organized crime (as well as local criminals) to shift from local (real) to virtual (digital), while maintaining their local control and presence. Social media also caused turf wars among the criminal organizations, terrorists with conflicting agendas (Syria and Iraq), and gangs. SOCMINT brought clarity to the analysts about the informal and formal networks of these organizations. A phenomenon began to occur as some unidentified targets became visible only after they went into social media. This began to challenge authorities because the there was a lack of evidence and a lack of HUMINT on the newly discovered targets. The cellular networks, especially the enforcers from most Mexican drug cartels flooded social media with postings. The same situation occurred in terrorism as modern cellular groups began to build significant momentum in different battlegrounds, thanks to social media. Until recent years before social media, criminal organizations and terrorist organizations had a more defined social network. These targeted social human networks could be infiltrated only in covert operations, until the Internet arrived. Before the Internet, gathering intelligence from these networks with HUMINT was very intensive and high-risk. It is important to highlight that underground social networks are complete opposite to social media; but underground networks may be identified with SOCMINT. SOCMINT can also assist in analyzing a realistic

Terrill L. Frantz and Kathleen M. Carley, â&#x20AC;&#x153;A Formal Characterization of Cellular Networks,â&#x20AC;? Carnegie Mellon University, CMU-ISRI-05-109, (September 2005): 5, accessed July 17, 2014), http://www.casos.cs.cmu.edu/publications/papers/CMU-ISRI-05-109.pdf. 4

UNCLASSIFIED

picture of capabilities and intentions in light of capabilities.5 The importance of SOCMINT today is to assist in defining intentions versus capabilities, a process that the IC has struggled with in the past. Social media triggered changes in underground organizations. After the Soviet invasion of eastern Poland on September 1939, the Jews launched one of the most well-hidden and secret underground movements to protect the Jewish people.6 Underground organizations that serve any purpose, as was the case in Poland during WWII, are still harder to infiltrate. In Poland not even the Russians were able to detect them. On the dark side of social networks, social media brought criminal and terrorist networks a platform where they could extend their reach to a global audience. Recruiting and spreading their Jihadist message became a matter of creating the right profiles in any of the social media platforms. Additionally, there was one group that also jumped into the social media frenzy. Totalitarian governments learned that social media could build or destroy their government very quickly. Social media also began to be used for revolutions in the 21st Century. Social media became the new means to launch a Revolution against a government. In history, revolutions start with society uniting to make a significant change in the direction the government is going. Social media showed a significant power during the political and social unrest in many African countries.7 Countries in the Middle East and North Africa (MENA), such as Egypt, Libya, and Tunisia, rebelled against their dictators in hopes of having a democratic form of government.8 The impact is still felt in these nations.

Grabo, Anticipating Surprise, 22. Bogdan Musial, “Jewish Resistance in Poland’s Eastern Borderlands during the Second World War, 1939-41.,” Patterns of Prejudice 38, no. 4 (December 2004): 371–382, accessed July 25, 2014, EBSCOhost. 7 Wiest and Eltantawy, Social Media Use, 211. 8 Ali Sarıhan, “Is the Arab Spring in the Third Wave of Democratization? The Case of Syria and Egypt,” Turkish Journal of Politics 3, no. 1 (2012): 82, accessed July 29, 2014, EBSCOhost. 6

UNCLASSIFIED

The emergence of social media networking technology or social media began to impact the intelligence collection and analysis of social networks. As the result, SOCMINT introduced new tools for intelligence collection and analysis of human targets or recognizance tools in locations around the world. In this research, it was discovered that social media is not perfect. It provides an incomplete or imperfect social network of a target. This deficiency/limitation causes the analyst to collaborate SOCMINT with other intelligence in order to validate it. Another limitation that was discovered in this research was that many of the social media collection platforms available for the IC may only provide a sample of what is actually being posted in social media and this could create bias or erroneous results.9 Nevertheless, social media is capable of providing valuable insights of the targeted social network. The social media phenomenon began to expand in the world with people regardless of socioeconomic status and without territorial boundaries. This was a complete departure from the local view of community, as a local social network. In the intelligence field, social media also media began to impact how intelligence can be gathered, measured, and analyzed inside these social networks. This research discovered that the social networks found in social media were not necessarily an authentic reflection of a place (community, town, city, state, region, country, or particular location). It was like dealing with two parallel worldsâ&#x20AC;&#x201D;one real and one virtual. Also this research discovered that the networks in social media are more complex webs of networks of people. Many of the relationships formed in these social networks in cyberspace were direct and indirect connections, with nodes many times to complete strangers. A phenomenon discovered was that people were very open to associating to complete strangers without a vetting process. It was discovered that a personal relationship was not required to be

David Omand, Jamie Bartlett, and Carl Miller, â&#x20AC;&#x153;Introducing Social Media Intelligence (SOCMINT),â&#x20AC;? Intelligence & National Security 27, no. 6 (December 2012): 808, accessed July 6, 2014, EBSCOhost. 9

UNCLASSIFIED

part of a “virtual network” in social media. Because of this variable, the research does not discuss the process of validating social media connections. In many ways, social media was capable of helping intelligence professionals learn about the complexity of the social networks of the targets (criminal or terrorist). A shortcoming in SOCMINT is that it requires priorities in the tasking process. So reliance on massive collection efforts is useless without priorities and a good tasking process. A network could consist of 1000 social media profiles, but the priorities would be looking for only 3 targets (3/1000). Then comes where to strike the organization. A Ghemawat-Levinthal simulation revealed that striking a terrorist network at the highest levels of the hierarchy is the most effective way to destroy it.10 SOCMINT has the capability to provide clues of cellular networks and hierarchies inside these complex networks. It assists building operation priorities as well. And yet, another component that must be integrated with SOCMINT is Social Network Analysis (SNA). It is necessary to fully understand which targets become of higher priority and which ones require more monitoring. SOCMINT is not the magic bullet but it is an important tool that complements the other intelligence disciplines. Therefore, it is in the best interest of the IC to begin to maximize the benefits of social media and properly assess the impact of social media in their operations.

Phillip V. Fellman et al., “Disrupting Terrorist Networks—A Dynamic Fitness Landscape Approach,” New England Complex Systems Institute, (August 12, 2007), accessed July 17, 2014, http://necsi.edu/events/iccs7/papers/260ac11fea9946cfeb6da3e9fa2a.pdf. 10

UNCLASSIFIED

This research distinguishes the social networks in two forms:

Type of Social Network

Communication Methods

A. Local community network

B. Social network inside networking websites

            

Low technology Local setting Word of mouth People know the others in the network Direct connection Personal relationship High and low technology Local, regional, national, and international reach Word of mouth, plus strong opinion based sharing People know others in the network but not everyone Connections are direct and indirect Sharing takes place many times by people not directly tied up the person Personal relationships Networking with strangers

For example, something a person does can be read by hundreds if not thousands of people that are located scattered around the world when it is posted in social media. Today, using social media is also considered a form of “crowdsourcing;” a topic that deserves some attention in this research. Social media now brings together local communities and creates virtual human networks from around the world by sharing information in ways not previously possible. Crowdsourcing information can be crucial especially when facing serious emergencies.11 Social media also has the power of global information sharing and global collaboration, plus all the benefits of a local social community environment.

Omand, Bartlett, and Miller, Introducing Social Media, 804.

UNCLASSIFIED

During World War II (WWII) the â&#x20AC;&#x153;train watcherâ&#x20AC;? performing surveillance on a railroad used by the German Army had to be there physically in order to collect the intelligence of military personnel and equipment movements. Today, the same intelligence collector can rely on postings to social media by people around the train route and people in the train. The information collected can be analyzed and SOCMINT can be obtained. This research revealed that there was a historical evolution where social media emerged: 1. It began with the introduction of the Internet. 2. People then began to bring their own personal computers home. 3. Later, businesses and people began to plug everything the World Wide Web (WWW). 4. And, in the last decade, social media arrived. Since 2010, the breakthrough in social media networking is the concept of Mobility. One of the biggest distinctions between the traditional social human networks and the virtual social networks is that social media is a more powerful way to learn about human networks. Social media removed the local limitations and barriers to humans to network with others. Intelligence may still need the train watcher to stand outside watching trains. However, with SOCMINT the agency can have another person monitoring the entire train system. Since the introduction of Facebook in 2004, the social media revolution started and it became evident that people wanted to be networked. In the year 2014, people in social media are willing to let their networks and the public know just about anything. They are leaving privacy concerns behind. This of course is a significant advantage for the IC in SOCMINT collection and analysis, especially when assessing intentions and capabilities. Another discovery is that the SOCMINT analyst can forecast future behavior with social media analysis as wellâ&#x20AC;&#x201D;something nearly impossible before social media. Grabo states that errors in judgment and misstatements of

UNCLASSIFIED

what the adversary was up to are attributable to lack of perception and understanding.12 Analysts must be aware of this in SOCMINT as well. SOCMINT also has a Temporal Factor that began to challenge the IC. A person or group planning something needs to get the word out. SOCMINT can actually extract that information and project when something will happen. This is a form of early warning for the IC. The collector could collect OSINT and produce an All-Source Intelligence report but Twitter could be showing conflicting stories. For example, during the conflict in Crimea and the unrest in eastern Ukraine, Putin would make certain statements, propaganda oriented, but things on the ground via social media provided a different story. After social media became highly embraced by people everywhere, an All-Source Intelligence collector could not simply collect OSINT without collection of social media. The changes in social media give the intelligence collector and analyst a real time sense of conditions on the ground. Yet, places like China created its own social media ecosystems for Chinese people to network and have not allowed social media from the US.13 Tweets from foreign legislative government buildings in targeted countries can provide intelligence about what legislators are doing real time. Most politicians have received no training on what to share and what not to share in social media, which poses a real danger of becoming potential targets of intelligence operations. In this research it became clear that the members of the IC are not the only ones interested in monitoring social media for intelligence purposes. During the crisis in Ukraine in 2014, news media networks like CNN were monitoring social media in order to beat the

Grabo, Anticipating Surprise, 47. Thomas Crampton, â&#x20AC;&#x153;Social Media in China: The Same, but Different,â&#x20AC;? China Business Review 38, no. 1 (January 2011): 28, accessed July 29, 2014, EBSCOhost. 13

UNCLASSIFIED

competition. A Ukrainian legislator could Tweet after a high profile meeting and provide “sufficient clues” as to the direction legislation was moving. Social media also keeps interfering with the Russian propaganda campaigns in the region. While the Ukrainian/Russian conflict continues, social media will continue to provide SOCMINT for IC. When social media is complemented with the reporters on the ground, and the alternative media sources, the IC has the best possible OSINT/SOCMINT money can’t buy. Some countries have been slow to adopt social media. Closer to home, the idea of causing a Cuban Spring has also been entertained by Cuban-Americans and politicians like Republican Senator Marco Rubio for the state of Florida. The problem is in Cuba only about 3.3 per cent of the people have computers and fewer go to cyber cafés to access the Internet.14 On a positive note, there is a small number people using Twitter in Cuba and the number is growing.15 Cubans do have high levels of “social capital” and have a powerful word of mouth program, but more is needed in order to cause a Cuban Spring.16 In the 21st Century, it is hard to organize a revolution in a country without having social media widely used by people. SOCMINT also began to ignite transformation and modernization in the IC. One of the biggest breakthroughs was collaboration of the intelligence collection and analysis processes with different agencies in the IC. It also began to change compartmentalization in sharing OSINT and SOCMINT in the IC. If SOCMINT collectors and analysts want to avoid “intelligence gaps” in the product, they need to collaborate with others in the IC. It is not unusual to see analysts sending a Twitter post to an analyst they work with in another country to validate

14 Lana Wylie and Lisa Glidden, “THE ‘CUBAN SPRING’ FALLACY: THE CURRENT INCARNATION OF A PERSISTENT NARRATIVE,” International Journal of Cuban Studies 5, no. 2 (2013): 146, accessed July 29, 2014, EBSCOhost. 15 Ibid., 147. 16 Wylie and Glidden, THE ‘CUBAN SPRING’, 150.

UNCLASSIFIED

the information. One thing that became evident is that intelligence professionals must process social media information into SOCMINT. In many ways, the SOCMINT analysis may require different levels of specialties in the IC. It was discovered that at times SOCMINT requires subject matter experts and collaboration horizontally and vertically within the agency and outside the agency. The private sector has also joined the social media revolution. The private sector performs collection and analysis of social media for marketing purposes and for research and development (R&D). The IC has been launching new technology ventures, such as Recorded Future and NetBase, in order to maximize what is possible with social media monitoring and analysis. These ventures have not been exclusively for the use of the IC. As the matter fact, these have been ventures that offer services for the private and public sectors. While this research provides a comprehensive assessment of the impact of social media, it is intended to reveal the many opportunities in social media. Perhaps one of the biggest challenges for intelligence collectors and analysts is to make sense of the vast amounts of social media information. Every day, millions of postings, countless hours of videos and images are taken by the public. The amount of information is overwhelming. According to Fan and Gordon, social media analysis requires three steps: Capture, Understand, and Present.17 Keeping the process simple appears to be working for the IC in the SOCMINT arena. But more research is needed on how to bring integration of this new intelligence discipline. One of the biggest misconceptions by the public is that the governments are collecting everything in social media sites. The truth of the matter is that collecting social media does not serve any real government purpose. Furthermore, the IC found interest in social media when the

WEIGUO FAN and MICHAEL D. GORDON, “The Power of Social Media Analytics,” Communications of the ACM 57, no. 6 (June 2014): 74–81, accessed July 26, 2014, EBSCOhost. 17

UNCLASSIFIED

platforms went from social diversions into “engines of political change that upended decades of Arab authoritarianism.”18 It would be impossible to see every post that comes to social media. Not even if all of what is collected is crowd-sourced to every person working in the IC. This misconception appears to be more of a myth than a reality. It is also important to note that social media has blurred the definition of territorial jurisdictions and social media has brought globalization into the picture. Even small police departments all over the US are now impacted by the globalization of crime. Analyzing social media with algorithms and programs with Natural Language Process (NLP) have now become widely available for the IC in order to assist in this daunting task. Therefore, collection of everything open source including social media is of little value without analysis. In concluding this introduction, everyone involved in intelligence and law enforcement must take note of the globalization of crime and the impact of social media to their profession individually. This research offers a comprehensive assessment of the impact of SOCMINT in the IC and answers this question: How is social media impacting the intelligence collection and analysis process for the US Intelligence Community?

18 Jon B. Alterman, “The Revolution Will Not Be Tweeted,” Washington Quarterly 34, no. 4 (October 2011): 103, accessed July 29, 2014, EBSCOhost.

UNCLASSIFIED

II. Statement of the Problem In the last ten years, there has been little or non-existing research in how social media is impacting the collection and analysis of intelligence. While there is a lack of research in uses of social media in the intelligence field, the private sector and governments have not stopped the deployment of programs to collect and analyze social media. However, there is little or no research published on the impact social media has caused to the intelligence field in the US Intelligence Community. The intelligence agencies in the world, such as the National Security Agency (NSA) in particular, began to invest in the collection of information from open sources (not just social media). However, a lot criticism about NSAâ&#x20AC;&#x2122;s collection efforts has been written about, but research in social media impact to the IC is nearly non-existent. It is important for this research to provide some sense on the impact of social media without discussing any particular agency in the IC. SOCMINT requires collection and analysis of social media in just about all the different functions in the IC. This research addresses the social media impact in the variables and the relationship to collection and analysis of intelligence. This research recommends that the All-Sources Intelligence approach continues and not simply rely on social media for OSINT. Alterman states that Twitter and Facebook together with television are powerful in expanding protests from the thousands to the millions of participants, citing the Arab Spring in northern Africa.19 Therefore, the social media impact is real but it must be considered along with the other open source collection opportunities. Privacy is also a concern. However, the problem about privacy for the IC is much broader, since it tends to have blanket significance to secret and open source intelligence. It is clear that people do not want governments to look and analyze their social media interactions. In

Alterman, The Revolution, 102-103.

UNCLASSIFIED

their minds, it is government interference to their right to privacy. Social media channels have implemented mechanisms and privacy selections. In fact, depending on the privacy settings by the social media user, posting may not be available for SOCMINT in open source. There is a lack of research on SOCMINT and the impact to the intelligence field. It is possible that the IC would have opted to keep all their research outside the public domain. It is also possible that the IC may be applying similar rules/policy (standard operating procedures) as hidden or secret intelligence collection. Social media falls under open source and should not be treated with the same rules as secret intelligence. This research can offer additional opportunities in SOCMINT that go beyond the narrative of the impact. Moe and Schweidel write, “Previous exchanges with familiar and trusted individuals have been replaced by large scale chatter accessible to acquaintances and strangers. Discussions that once went unrecorded now leave traces that can be explored years later.”20 The purpose of this research is to identify and analyze the impact of social media in the intelligence collection and analysis, as it pertains to the US Intelligence Community, even when other parties may make use of this research.

Wendy W. Moe and David A. Schweidel. “Social media intelligence,” Cambridge University Press, 2013, 1, accessed July 29, 2014, ProQuest. 20

UNCLASSIFIED

III. Theoretical Framework On June 15, 2005, the Office of the Director of National Intelligence (ODNI) and RAND Corporation met in a one day workshop with 40 practitioners, academics, and other intelligence professionals from Europe and North America.21 In one of the sessions the discussion was in regards to theory and intelligence and the relationship between the two.22 Michael Warner from the ODNI stated that having one standard definition or theory that everyone can agree is difficult because everyone in the field of intelligence sees intelligence different.23 However, there was one concept that made a lot of sense to most people in the room. During this particular workshop, most of the participants agreed that intelligence is ‘information for decision makers in the public and the private sectors.’24 In this research, there is an assumption that all forms of intelligence product ultimately have some purpose for the private or public sector; but this research is made for the purposes of the Intelligence Community, which falls under the public sector. This research makes a contribution to three research theories. David Kanh, from Newsday writes, “Theories of intelligence may be explored in three main ways—historical, mathematical, and psychological. A historical theory looks at intelligence in the past, the present, and the future. Intelligence can be divided into physical or verbal.”25 This research contributes to three primary theories in more detail:

21 Gregory F Treverton et al., “Toward A Theory Of Intelligence.” Workshop Report (2006): iii, accessed June 13, 2014, http://www.rand.org/content/dam/rand/pubs/conf_proceedings/2006/RAND_CF219.pdf. 22 Ibid., 2. 23 Ibid. 24 Ibid. 25 Ibid., 3.

UNCLASSIFIED

Theory #1: American Theory of Intelligence This research makes a contribution to the American Theory of Intelligence. It is important to reflect in the intelligence practice in the Intelligence Community, as it is seen in the United States. For the last five decades, there has been a consistent process that outlines a theory of an American Theory of Intelligence.26 Some of the main views and theories that have built the American Theory of Intelligence include: 1. The way the IC has organized the tasking to all their intelligence bodies. 2. The IC’s own way to separate intelligence collection and analysis of domestic and foreign intelligence. 3. The ways intelligence is gathered in the US for law enforcement purposes. These are all factors that make a unique theory in the US Intelligence Community. 27 Therefore, in this research the American Theory of Intelligence is used to examine the different variables, as it is viewed in the IC. Theory #2: Historical Theory of Intelligence In this research, the theory of intelligence is explored in the “Historical Research Theory of Intelligence,” since social media is a factor that emerged in technology and it has now transformed the historical collection and analysis processes.28 When analyzing the impact of a technological advance for the intelligence field, it is important to see it as past, present and

Treverton et al., Toward A Theory, 11. The SAGE Encyclopedia, 11. 28 Ibid. 27

UNCLASSIFIED

future, as Kahn describes it.29 By using this research theory, this research can provide new paradigms to the intelligence practitioner by discussing the history of intelligence. Theory #3: Explanatory Research Theory Additionally, this research contributes to the “Explanatory Research Theory” to describe the impact of social media in the intelligence field, as human and social networks are analyzed and researched. The SAGE Encyclopedia of Qualitative Research Methods describes this research method as research intended to explain and not just describe phenomenon.30 In this research, explanatory research is used to test the hypotheses and the relationships between the variables. The Concept of Physical and Verbal Intelligence is a concept that simplifies intelligence collection and analysis of SOCMINT into two parts: one physical and one verbal. While the concept is not a theory, it is discussed in this research. Kahn explains this concept, “Physical intelligence consists of information drawn from things—seen troops, hearing tanks, or smelling food.”31 This research uses this concept as a model to collect physical intelligence from social media, while the purposes may vary. Lastly, Kahn adds, “Verbal intelligence acquires information from written or spoken source such as an order or a plan… Verbal intelligence transformed intelligence into a significant instrument of war.”32 SOCMINT analysis has the ability to collect, analyze and produce intelligence product based on these two forms of intelligence. When SOCMINT is simplified, the

Treverton et al., Toward A Theory, 5. The SAGE Encyclopedia of Qualitative Research Methods (2455 Teller Road, Thousand Oaks California 91320 United States: SAGE Publications, Inc., 2008), accessed June 22, 2014, http://srmo.sagepub.com/view/sage-encyc-qualitative-research-methods/n164.xml. 31 Treverton, Toward A Theory Of Intelligence, 3. 32 Ibid. 30

UNCLASSIFIED

goal for SOCMINT is to provide verbal and physical evidence of what is going on the ground and SOCMINT performs that activity well. There are independent and dependent variables that are discussed in this research where social media has impacted the intelligence field. The word “intelligence” is used as it is applied in all the different forms of intelligence. The scope of this research is not to focus on certain functions on one particular activity (independent or dependent variable), as it is explained later in this research. This research excludes discussions on the collection of secret or hidden intelligence. The processes of analyzing social networks, while mixing (integrating) databases are not discussed, since that is beyond this research. Some of the systems used for analysis may be discussed because they are available to the public. Lastly, concepts such as “Blogosphere” when referencing to social networks is discussed in this research. A blogosphere consists of communities of users that form links, cliques, and sub-communities.33 This concept is related to social networking but these platforms are more static than what is seen in Facebook, Twitter, or any other social media with mobility capabilities. The concept of Blogosphere is important to be noted in the framework of this research, even when it is not part of this comprehensive research. The framework of this research is to provide a comprehensive impact of social media in the IC.

Soumya Banerjee and Nitin Agarwal, “Analyzing Collective Behavior from Blogs Using Swarm Intelligence,” Knowledge & Information Systems 33, no. 3 (December 2012): 527, accessed July 29, 2014, EBSCOhost. 33

UNCLASSIFIED

IV. Working Hypotheses The hypotheses attempt to close the significant gaps in current research about the social media impact in intelligence collection and analysis. The three hypotheses test the different variables, while covering areas where social media is showing the greatest impact. The three hypotheses are: 1. SOCMINT can be used to meet single or multiple objectives or tasks. 2. SOCMINT is can be used for tactical, strategic, and actionable intelligence. 3. SOCMINT impacts the five intelligence disciplines in the IC: HUMINT, SIGINT, IMINT, MASINT, and OSINT. In the context of this research, the hypotheses have a more direct relationship with the collection and analysis than with individual agencies. This research reveals the impact in the different activities of the IC, as the impact is felt in the workstations for the intelligence collectors and analysts.

UNCLASSIFIED

V. Significance of the Study Social media has been impacting the way people live in the world. It is irrelevant if a person uses social media or not to sustain some form of impact by social media. On September 5, 2013, a protest that was organized in social media by the teacher’s union, Seccion 22 de la Coordinadora Nacional de Trabajadores de la Educacion (CNTE) in México City to block access to the Aeropuerto Internacional de la Ciudad de México (AICM). This one incident ruined many people’s plans to fly out of Mexico City and the cost in productivity and commerce was in the millions of dollars. Pilots, attendants, airport workers, security personnel, and passengers were prevented from coming or leaving the airport.34 The event was completely planned, coordinated and executed by using social media. This event in Mexico City surprised everyone in public safety, while posts had been circulating in social media for a few days. Social media now raises the bar in OSINT collection to new heights. One of the biggest reforms after 9/11 was for the IC to increase the collection OSINT in order to prevent intelligence failures.35 Businesses are increasing their open source and social media collection efforts in order to gather competitive intelligence in most of their day-to-day operations. An attack to US government personnel or other key asset can be broadcasted in social media by eyewitnesses at the site, real time, and unfiltered. According to Eijkman and Weggemans, “online open sources may in times of crisis—e.g. a war—be a more reliable and safe way of acquiring intelligence than by polarized human

34 “Maestros de México Bloquean Paso a Aeropuerto Por Protesta,” El Universal Cartagena, September 5, 2013, accessed July 5, 2014, http://www.eluniversal.com.co/mundo/maestros-de-mexico-bloquean-paso-aeropuertopor-protesta-133645. 35 Quirine Eijkman and Daan Weggemans, “Open Source Intelligence and Privacy Dilemmas: Is It Time to Reassess State Accountability?,” Security & Human Rights 23, no. 4 (December 2012): 286, accessed July 17, 2014, EBSCOhost.

UNCLASSIFIED

intelligence.36 Evidence can be collected before, during, and after the incident by using social media. Social media leaves a permanent footprint that can be accessed and analyzed later, even if the person decides to delete the post.37 After the Boston Marathon bombings, social media provided valuable intelligence that was used to trace every movement of the Tsarnaev brothers. Social media has also impacted law enforcement as well, even in small towns. Moreover, this research focused only on the social media platforms that have “mobility” i.e. Facebook, Twitter, and Instagram to name a few. The protests in Caracas Venezuela in February 2014 revealed that SOCMINT could complement other intelligence collection efforts. Later in this research, the social media influencer is examined in regards to covert operations. OSINT with SOCMINT can provide a complete picture and provide a great sense of what is taking place on the ground. The physical and verbal intelligence that social media can produce is valuable for operations (actionable intelligence) and for intelligence reports. SOCMINT temporal factors/indicators can be used as a form of early warning. SOCMINT is tactical and strategic intelligence as well, as this research begins to discuss each area separately. SOCMINT is capable of providing the IC, including law enforcement, a sense of what people are writing, images and videos of what they see on the ground. SOCMINT gives the analyst street level view from the battlefield as well as behind enemy lines. It is now important to highlight the five disciplines of intelligence collection, which have been impacted by social media: 

Human Intelligence (HUMINT).



Signals Intelligence (SIGINT), which also includes Electronic Intelligence (ELINT), and Communications Intelligence (COMINT).

36 37

Eijkman and Weggemans, Open Source Intelligence, 289. Moe and Schweidel, Social media, 1.

UNCLASSIFIED

UNCLASSIFIED 

Imagery Intelligence (IMINT) and its subcategory known as Photographic Intelligence (PHOTINT).



Measurement and Signatures Intelligence (MASINT).



Open Source Intelligence (OSINT), and its new subcategory SOCMINT.

Social media has impacted all of these disciplines. As a side note, social media has been very timely when North Korea has fired weapons into the Ocean in recent years. The South Korean people have been great at providing valuable information by simply posting to social media. In South Korea, SIGINT and MASINT analysts used these social media postings to try to identify visually what they collected with by other means. It would be easier for this research to focus on the five disciplines rather than the impact on the several variables, which in a sense define the different operations and analysis specialties. However, this research departs from the traditional view of these disciplines. This research engages the reader into finding the impact of social media inside each of their individual professions. This research attempts to provide guidance and support for the professional (collector and analyst), the policymaker, and the manager of these different intelligence disciplines of the impact of social media to their careers. When intelligence collection is impacted, the analysis is impacted. The job of the analyst is to close the gaps and provide the most complete picture to the customer. This research maintains the focus on the three hypotheses of this research. This research is without a doubt a comprehensive assessment of the impact of social media to the IC.

UNCLASSIFIED

VI. Research Design and Methodology This research was conducted by using a qualitative research method. The primary purpose of this research is to gather primary and secondary sources. This research collected and reviewed scholarly and peer reviewed materials in the different variables. Some recent and current events were incorporated to this research as well. The research used an inductive data analysis in order to build on the patterns, processes, and themes (variables) in the research, while providing a comprehensive set of themes.38 The intelligence collection and analysis paradigms before social media were very linear in nature and centered in the intelligence cycle. This research reveals SOCMINT is a nonlinear form of intelligence, while it preserves some linear characteristics when dealing with single or simple targets. Since SOCMINT has impacted the entire IC, the timing is opportune to make a contribution to the American Theory of Intelligence in this research. Social media has changed the intelligence collection and analysis paradigms held by professionals in the intelligence field for decades. Therefore, it is necessary for this research to have a design and method that covers the impact in the different functions inside the IC and not simply provide theory. The variables in this research are as follows: A. Independent Variables (IV) and Dependent Variables (DV) in the SOCMINT Intelligence Cycle (in a linear process):

(IV) SOCIAL MEDIA

(IV) INTELLIGENCE COLLECTION

(DV) PHYSICAL INTELLIGENCE (DV) VERBAL INTELLIGENCE

(IV) INTELLIGENCE ANALSYIS

(IV) SOCMINT

John W. Creswell, â&#x20AC;&#x153;Research Design: Qualitative, Quantitative, and Mixed Methods Approaches,â&#x20AC;? (Los Angeles: Sage Publications, Inc., 2009), 175.

UNCLASSIFIED

The independent variables are processes that must take place in order to obtain SOCMINT. The processes are steps and/or results, similar to how the intelligence cycle in other disciplines occurs. The direct variables in this research were compartmentalized for purposes of simplification. In other words, in this research the discussions on the impact are related to what happens in their workstations. In this research direct variables are all themes that will be tested by the hypotheses and by the application of the theories in this research. The SOCMINT Intelligence Cycle has many similar characteristics as more traditional intelligence cycle. Even when SOCMINT is mostly used as a supplemental form of intelligence and not as a primary form of intelligence, it has gained a high degree of utility by the IC. Inside the context of the SOCMINT intelligence cycle, there are two dependent variables that become important in this research: 1. Physical Intelligence 2. Verbal Intelligence It is important for intelligence professionals that follow the intelligence cycle to keep in mind that SOCMINT may at times alter the final product. Additionally, social media brings a degree of uncertainty that is not found in other forms of open source information but also creates focus and clarity for the intelligence collector and analyst.

UNCLASSIFIED

B. This research focuses in the following dependent variables inside the Physical and Verbal Intelligence (DV):

Law Enforcement • Public Safety. • White-Collar Crimes. • Social Media and Local Crime. • Social Media and Sophisticated Cybercrimes. • Social Media and Police Investigations. • Modern Crimes in Cyberspace • The Role of Fusion Centers. in Law Enforcement. • Gangs and Social Media. • Human Trafficking and Social Media. • Civil Unrest.

Homeland Security • SOCMINT During Homeland Security Crisis. • Social Media and Natural Disasters. • Information Sharing to the Public with Social Media. • Social Media During HighProfile Events. • Domestic Terrorism and Social Media.

Counterintelligence • Social Engineering. • Social Media Impact in Politics. • National Security Personnel and Social Media. • Drug Trafficking and Social Media.

Foreign Intelligence Operations • Some History of OSINT. • The Relationship of SOCMINT and HUMINT. • Social Media for Foreign Intelligence Operations. • The Social Media Influencers. • Clandestine Operations. • Limitations of Social Media. • The Involuntary Intelligence Collector. • Social Media Privacy Concerns in Foreign Operations. • Foreign Government SOCMINT Collection Efforts. • Special Activities Division (SAD). • Counterterrorism.

This research intends to provide a complete picture of the impact social media in the different intelligence fields. This research is intended to be practical for the intelligence professional.

UNCLASSIFIED

VII. Literature Review One of the biggest challenges in the uses of social media is centered in the issues of privacy. Reconciling some of these differences is greatly needed. It is possible to find connections from previous research in terms of social networks, but nothing has been written on the impact of social media to the IC. One of the challenges in this research was to find literature that discusses social media applicable to the intelligence field. Penetrating social networks has been a practice in the intelligence field for decades and even centuries. It is possible to argue that social media is simply a modern way for the IC to perform the same activity. This research found no research that discussed the impact of social media to the IC. While a few papers have been written about social media intelligence, the few are agency focused and some cover only theory and concepts related to technology. Therefore, conclusions had to be drawn about literature that touched on social media and how that literature could be applicable for this research. Here is a comprehensive literature review available and relevant to this research. A. Informal Networks In an article by Eastern European Quarterly, titled “Friends and Foes: Informal networks in the Soviet Union,” Alya Guseva writes a great paper on the issue of social networks and how they can be different from one nation to another.39 Guseva writes that after the fall of the Soviet Union, there was a process of making people there feel free to conduct their lives just like western states.40 Western economies consider that informal networks play an important role in

Alya Guseva, “FRIENDS AND FOES: INFORMAL NETWORKS IN THE SOVIET UNION.,” East European Quarterly 41, no. 3 (2007): 323, accessed June 12, 2014, Academic Search Premier, EBSCOhost. 40 Ibid. 39

UNCLASSIFIED

free economies but in Russia, “personal loyalties, reciprocity and informal relations instead of formal institutions, often take precedence.”41 While this research is insufficiently tied to social media, informal networks in social media are very important and they require further research. B. Physical Limitations on Social Networking In an article by the American Business Law Journal, titled “Blurred Boundaries: Social Media Privacy and the Twenty-First-Century Employee,” Patricia Sanchez Abril, et al. write that before social media, social control took place in places defined by location and by “fixed barriers to perception.”42 The article explains that the introduction of social media began to challenge some of the old views on privacy, since people began to share details of their personal lives into the public domain.43 More research needs to be performed that discusses the intricate details of how these privacy concerns may impact the employees in the IC, who are using social media. C. The Open Source Revolution in Intelligence Social media intelligence is a topic intelligence agencies are not very willing to discuss. It is clear that this topic poses little or no troubles for the public, since social media is for the most part open source information available to everyone. In an article by InformationWeek, titled “CIA Monitors YouTube for Intelligence,” Thomas Claburn writes that the DNI Open Source Center (OSC) is gathering information from YouTube for intelligence purposes.44 The blogs, the mainstream and alternative media sources bring a serious amount of information for intelligence

Guseva, FRIENDS AND FOES, 323. Patricia Sánchez Abril, Avner Levin, and Alissa Del Riego, “Blurred Boundaries: Social Media Privacy and the Twenty-First-Century Employee.,” American Business Law Journal 49, no. 1 (2012): 63, accessed June12, 2014, EBSCOhost. 43 Ibid., 64. 44 Thomas Claburn, “CIA Monitors YouTube For Intelligence,” InformationWeek, accessed May 25, 2014, http://www.informationweek.com/cia-monitors-youtube-for-intelligence/206105311. 42

UNCLASSIFIED

analysis. In this public and open source environment opportunities are found for collection and analysis of OSINT and SOCMINT. The OSC is a revolutionary platform that not only enhances the situational awareness in the open source environment but also enhances the other intelligence collection disciplines. D. Social Media Monitoring and Privacy SOCMINT has impacted how the intelligence field manages its intelligence cycle. It is possible that governments still have the notion that open source is a matter of privacy. In an article in Oxford University Press, titled “One Nation Under Surveillance: A New Social Contract to Defend Freedom without Sacrificing Liberty,” Erik D. Jens writes that governments are increasing their information collection capabilities on people.45 The article argues that after 9/11 legislation opened many opportunities for the US government increase its information collection efforts from the Internet.46 This article is an illustration of how the IC collection efforts are seeing as privacy concerns for people, which is a relevant to this research. E. Economic Espionage Social media inside the open source spectrum brings risks and threats of economic and commercial espionage in the US and the world. The Washington Quarterly, in their Autumn edition in 1996, provided valuable thoughts about what was going to take place in the future with economic espionage by governments and private enterprises.47 Governments are constantly

45 Erik D. Jens, “One National Under Surveillance: A new social contract to defend freedom without sacrificing liberty,” American Intelligence Journal 30, no. 1 (March 2012): 155–56, accessed June 12, 2014, Academic Search Premier, EBSCO Host. 46 Jens, “One Nation Under, 57. 47 “ECONOMIC ESPIONAGE.,” Washington Quarterly 19, no. 4 (October 1996): 173, accessed June 12, 2014, Academic Search Premier, EBSCO Host.

UNCLASSIFIED

engaging in economic espionage against the United States government and US companies. This article is a great article about a very serious problem. Economic espionage costs billions of dollars for governments and businesses. In the open source and social media arena, very little has been written about economic espionage. F. Policy in the Private and Public Sectors on Social Media In an article by AnalystWatch, Andrew Walls writes that the amount of personal, corporate, and government information been shared by people in social media is vast.48 Walls writes that there are a great deal of commercial opportunities in social media analysis and the “feedback loop for information controls” in social media are rarely explored. 49 Walls explains that there needs to be more policies in place to prevent these companies and governments to fall into the hands of competitors or adversaries.50 This article explains that policy and monitoring of social media is recommended not only by the private sector but also the public sector. However, more research is needed that is tailored for the IC. G. Social Media in Terrorism In an article in the Journal of Counterterrorism & Homeland Security International, titled “Terrorism And The Use Of Social Media In Mumbai Attacks,” Justin S. Nachsin writes the details of one of the biggest terrorist attacks, post 9/11. Nachsin writes that social media made a significant debut during the Mumbai attacks as terrorists began to share their pictures and

Andrew Walls, “Everyone’s a Spy: Mining Social Media for Security Intelligence,” Computer World Hong Kong 27, no. 10 (December 2010): 22, accessed June 12, 2014, Academic Search Premier, EBSCOhost. 49 Ibid. 50 Ibid. 48

UNCLASSIFIED

details of their attacks on social media, a purpose that social media had not been built for.51 Nachsin explains that a decade ago, terrorists were very limited in how they were able to spread their message by using blogs and underground newspapers.52 This article does a great job explaining how social media impacted security forces in the Mumbai terrorist attacks. It brought social media to the attention of the intelligence communities from around the world. H. Social Media and Propaganda The introduction of social media began impacted the intelligence community like no other recent change in social networking. MIS Quarterly, published an article titled “Community Intelligence and Social Media Services: A Rumor Theoretic Analysis of Tweets During Social Crisis.” Onook Oh provides an analysis into the rapid transformation of social media and how social crisis could be started by the use of social media.53 Among some of the discoveries in this research was that the decision-making process of people by using social media was found to be a great influencer.54 The Arab Spring and several other incidents revealed that society could pool a collective opinion and possibly be deceived by propaganda via the use of social media as well. The article fails to provide any real substance on the impact of Denial & Disinformation (D&D) campaigns that could be launched by social media.

Justin Scott Nachsin, “Terrorism And The Use Of Social Media In Mumbai Attacks.,” Journal of Counterterrorism & Homeland Security International 16, no. 4 (2010): 16, accessed June 12, 2014, Academic Search Premier, EBSCO Host. 52 Nachsin, Terrorism And The Use, 17. 53 Onook Oh, Manish Agrawal, and H. Raghav Rao, “COMMUNITY INTELLIGENCE AND SOCIAL MEDIA SERVICES: A RUMOR THEORETIC ANALYSIS OF TWEETS DURING SOCIAL CRISES,” MIS Quarterly 37, no. 2 (June 2013): 407, accessed June 12, 2014, Academic Search Premier, EBSCO Host. 54 Oh, Agrawal, and Rao, COMMUNITY INTELLIGENCE, 407.

UNCLASSIFIED

I. Authoritarian Governments Attempt to Control the Media In the article by Asian Journal of Latin American Studies, titled “The Chavez Government and the Battle Over Media in Venezuela,” Mark Dinneen explains how the government of Venezuela has been dealing with the conflicts of government controlled media, corporate media and how the press has been attacked by the Chavez regime.55 Dinneen writes that Venezuela had in recent years began to censure what media say about his government.56 During the Chavez presidency journalists who expressed anti-Chavez views suffered attacks and many were killed.57 Governments like the Venezuelan now view social media as a new threat that they intend to censure and control of any form of media, including social media. More research is needed that addresses this problem. J. Mobility in Social Media In the book titled “Mobile Marketing: How Mobile Technology is revolutionizing marketing, communications and advertising,” Daniel Rowles provides an interesting perspective in the transformation of social media.58 Rowles writes that mobile devices and smart phones have become personal to humans.59 Marketing companies using social media to see what people are doing real time. Rowles explains that mobility is providing the businesses a mobile marketing platform that can be very powerful when it is used right.60 The person/consumer

Mark Dinneen, “The Chávez Government and the Battle Over the Media in Venezuela.,” Asian Journal of Latin American Studies 25, no. 2 (June 2012): 27, accessed June 12, 2014, Academic Search Premier, EBSCOhost. 56 Ibid., 28. 57 Ibid. 58 Daniel Rowles, Mobile Marketing: How Mobile Technology Is Revolutionizing Marketing, Communications and Advertising (London: Kogan Page, 2013), Introduction. 59 Ibid., 2. 60 Ibid., 9.

UNCLASSIFIED

transmits text, images, and video real time, all valuable for intelligence collection and analysis. While this book provides great information in the latest marketing opportunities for social media, most of the book can be beneficial for the intelligence field. K. A Networked Society In the book titled “Thinking Critically: Social Networking,” Andrea C. Nakaya makes several points of how society today has become a digital society.61 Nakaya describes the daily routine of student Kaitlin Kerry Eckrote at Pennsylvania State University. Nakaya writes that from the time she wakes up to the time she goes to bed around some kind of digital device.62 Among some of the details that Nakaya points out, are the widely use of Facebook (social media) around the world, the fast adaptation of social media around the world, and the fact that Facebook has more than one billion users.63 Another significant point that Nakaya makes is that people today are now using social media to communicate with others and social media is showing a measurable shift/impact on how people communicate with others.64 This transformation is a big reason for the IC to aggressively begin to exploit and monitor social media. L. Social Media in Public Safety In the article titled “Hiding in plain sight: criminal network analysis,” Hutchins and Benham-Hutchins write the complexity that performing public safety activities has become for

Andrea C. Nakaya, “Thinking Critically”, (San Diego, CA: Reference Point Press, 2013), 6. Ibid. 63 Ibid., 7. 64 Ibid., 8. 62

UNCLASSIFIED

governments.65 As more people become involved in social media, the criminal organizations are also exploring new horizons. The globalization phenomenon in communications is providing new means for criminal networks to also expand and pass by legitimate businesses in the eyes of law enforcement.66 Police forces around the world continue to think of crime as a local behavior while the world continues to shrink and people become more networked than ever before.67 The article urges law enforcement to begin to use software programs to analyze big amounts of information. More research is needed to identify the potential of SOCMINT in public safety, since SOCMINT is a form of big data.

65 Christopher Hutchins and Marge Benham-Hutchins, â&#x20AC;&#x153;Hiding in Plain Sight: Criminal Network Analysis,â&#x20AC;? Computational & Mathematical Organization Theory 16, no. 1 (March 2010): 89, accessed June 12, 2014, Academic Search Premier, EBSCOhost. 66 Hutchins and Benham-Hutchins, Hiding in Plain Sight,, 90. 67 Ibid., 89.

UNCLASSIFIED

VIII. Analysis and Findings The findings in this research begin with examining and setting in perspective the challenges in the IC of sharing and networking with others. Social media began to transform the lives of people, including the lives of the intelligence collectors and analysts, both personally and professionally. In the 90’s, before social media, the IC began to adapt to the need of “networking” by creating social networking technology programs that are similar to Facebook or LinkedIn. Intelink was created in 1994 and today it networks thousands of databases.68 The biggest challenge for all these sites has been the indexing of the information.69 The FBI has also created several sites for law enforcement and intelligence personnel to network with others. One of them is Law Enforcement Online (LEO), now called Law Enforcement Enterprise Portal (LEEP) that contains a lot of great sections for people to network with others.70 LEEP is a great platform but very few people in law enforcement and intelligence actually use it to the fullest extent. Perhaps ahead of its time, the IC also created a classified “A-Space” that contains blogs, databases, libraries and other places for analysts to update and edit information.71 Another great program was the creation of Intellipedia,72 which in fact consists of JWICS, SIPRNet, and Intelink-U. As the result of these early networking developments, it appears the networking capacity by the IC and law enforcement personnel has been improving.

June Crowe and Thomas S. Davidson II, “The ‘Grey’ Intersection of Open Source Information and Intelligence,” Grey Journal (TGJ) 5, no. 3 (2009): 7, accessed July 5, 2014, Academic Search Premier, EBSCO host. 69 Ibid. 70 FBI, “Law Enforcement Online,” accessed July 5, 2014, https://www.cjis.gov/static/CJISEAI/20140327_leo_trifold.pdf. 71 Crowe, The ‘Grey’ Intersection, 7. 72 Ibid., 8. 68

UNCLASSIFIED

The separation wall that existed to separate intelligence personnel and law enforcement has been lowered after 9/11. Also the stovepipes and silos are getting replaced by networking platforms. However, there still needs work to get people to network with each other, vertically and horizontally. The day for the police officer of small town to only network with his or her police department personnel is history. Moreover, the threats have become global threats. Criminals and terrorists are heavily networked with other criminals and other terrorist networks (or cells) from around the world. They have been adapting to social media. Today, social media is a new technological development that has been impacting the IC and law enforcement in ways that they may have not anticipated. OSINT and law enforcement sensitive information (LES) are more widely shared in police and intelligence networking sites. As long as the information does not contain thoughts from an analyst, it can be (U). A caveat is that Unclassified does not mean that the information can be handle out to the local newspaper. As far as where to access OSINT, the Open Source Center (OSC) has the best platforms for vetted government officials to access translated information from around the world.73 In the OSC platform Tier II subject matter expert intelligence briefings and research are also made available for the communities. InterPort Police and its intelligence contractor Contingent Security Services, Ltd. have produced intelligence for OSC since 2012. Unfortunately, there is no platform yet in existence where agencies can go for SOCMINT. It appears that each agency uses different platforms to collect and analyze social media. More technology is coming into the market to produce SOCMINT. Much of what is available is limited and requires the analyst to check several other platforms. The CIA also created In-Q-Tel that funds the creation of classified and unclassified technology ventures to

Open Source Center, accessed July 5, 2014, www.opensource.gov.

UNCLASSIFIED

perform collection and analysis of intelligence.74 The OSC is now able to stream YouTube videos for analysis. A lot of good innovation is taking place at OSC and the leadership has shown a high degree of commitment to bringing more tools into the platform. Analysis of some SOCMINT makes it to the OSC site once in a while. InterPort Police has been actively with its intelligence contractor Contingent Security Services, Ltd. featuring several key reports on significant events and arrests by using SOCMINT.75 As OSINT becomes more essential for the IC, the need for more SOCMINT will also increase. A challenge is dealing with the massive amounts of social media information available. This research revealed that in order to be effective in SOCMINT, there must be a purpose for collecting social media and producing SOCMINT. This is one of the many shortcomings of SOCMINT. A possible solution to guide the SOCMINT collector and analyst was found in a newer concept. “Exploitation Intelligence” (EXINT) is a new concept that assists collectors and analysts in understanding the purpose of the intelligence being collected.76 With this idea, comes a “Purposes of Joint Intelligence,” which states the following premises: 77 

Inform the commander



Identify, define, and nominate objectives



Support the planning and execution of operations



Counter adversary deception and surprise



Support friendly deception efforts

74 John T. Reinert, “In-Q-Tel: The Central Intelligence Agency as Venture Capitalist,” Northwestern Journal of International Law & Business 33, no. 3 (2013): 677–709, accessed July 25, 2014, EBSCOhost. 75 “Social Media Intelligence,” accessed July 5, 2014, www.contingentsecurity.com. 76 Charles D. Faint, “Exploitation Intelligence (EXINT): A New Intelligence Discipline?,” American Intelligence Journal 29, no. 1 (March 2011): 66, accessed July 17, 2014, EBSCOhost. 77 Ibid.

UNCLASSIFIED

UNCLASSIFIED 

Assess the effects of operations78

If the target is a simple target, it is not necessary to follow the entire process, as suggested above. When the SOCMINT product requires a joint effort from other agencies, the analyst may want to take this process to ensure the availability of resources. It is clear that regardless what role the intelligence analyst plays, there may need to be some collaboration. This is an important paradigm shift in the IC, just like the rise of importance of OSINT in the intelligence field after 9/11. After the Purposes of Joint Intelligence, in social media just like OSINT, the challenge becomes the reliability and credibility for evaluating the information. For purposes of this research, there are four categories that are used for evaluating SOCMINT: 

Competence



Veracity



Objectivity



Observational Sensitivity79

While this research does not expand on the different ways to assess the SOCMINT, it is important to have context of what is reliable and credible. There are really no real differences between assessing SOCMINT or OSINT. They are similar, since they are obtained from sources that are available to the public. It is important to note, that when the information contains analysis it becomes SOCMINT. As an intelligence analyst, the IC encourages analysts to differentiate the paragraphs that are (U) and the ones that are (U//FOUO) or contain any other restriction and/or

78 79

Ibid. Crowe, The ‘Grey’ Intersection, 11.

UNCLASSIFIED

classification. After having reviewed some of the findings on the processes and classification of SOCMINT, it is important to talk about the intelligence cycle. It was discovered in this research is that the same or similar intelligence cycle used by other intelligence disciplines is applicable for SOCMINT. The Social Media Intelligence Cycle looks like this:

Social Media Intelligence Cycle Consumer Needs. Customer Feedback & Reassessmen t.

Intellicence is Collected: Physical Information. Verbal Information.

SOCMINT is disseminated to customers.

Social Media Collected is Analzed: Linear & Nonlinear. SOCMINT is produced

The intelligence cycle is an important factor as well and it is also a great guide for collector and analyst to process the information efficiently and effectively. However, SOCMINT has defensive and offensive components that are different from the traditional intelligence cycle. Along the same lines, Arthur S. Hulnick explains that the intelligence cycle ignores two important parts of intelligence work: counterintelligence and covert action.80 The SOCMINT actually can be used for counterintelligence and covert action, while the process for these two operations may be outside the intelligence cycle.

Arthur S. Hulnick, “What’s Wrong with the Intelligence Cycle,” Intelligence & National Security 21, no. 6 (December 2006): 959, accessed July 26, 2014, EBSCOhost. 80

UNCLASSIFIED

Another important distinction has to do with linear and non-linear intelligence collection processes. The non-linear processes of SOCMINT are situations or intervening events that take place that may alter the final intelligence product. Nieto-Gomez writes, “I argue that the patterns that lead to 9/11 are much older, but at the same time they are considerable less linear… homeland security practitioners feel pressured to try to ‘connect the dots’ every time, instead of adapting to an environment of emerging patters and mutating dots that cannot be connected.”81 The intelligence collected today in the open source is, as Nieto-Gomez puts it, non-linear. SOCMINT many times is a non-linear form of intelligence. It literally challenges old intelligence collection and analysis schools of thought. “When a node or link in the network connects to a totally foreign target or an unknown target that is not in the radar, the process comes to a stop for further collection,”82 according to the Head Social Media Analyst, V. Villalobos with Contingent Security Services, Ltd. The collectors and analysts dealing with OSINT and SOCMINT are very familiar with the concept of non-linear processes. The difficulty is to convey the information and change to the analysts that deal with more linear intelligence production process in the IC. It would be irresponsible at this juncture in this research to fail to address the impact of social media inside the very organizations in the IC. Hauptmann and Steger write: Social Media offers many opportunities for organizations but also many challenges. Attention by these organizations and employers, must be paid to these new patterns of behavior emerging with their employees. Patterns of technical characteristics and virtual environments are reflections of new social structures from newer generations. These will

81 Rodrigo Nieto-Gómez, “Preventing the Next 9/10: The Homeland Security Challenges of Technological Evolution and Convergence in the Next Ten Years,” Homeland Security Affairs 7, no. 2 (September 2011): 1–6, accessed July 24, 2014, EBSCOhost. 82 V. Villalobos, “Presentation to United Nations,” Head of Social Media Intelligence Operations (full name omitted for security reasons), “Discussion on Social Media Intelligence,” Contingent Security Services, Ltd., June 2013.

UNCLASSIFIED

be challenges for Human Resources as the new generations enter the job market and begin to challenge the old employment paradigms.83 The new intelligence collector and analyst today are causing change inside some of the oldest and more traditional organizations in the IC. It is not unusual to find people in National Security involved with LinkedIn, Facebook, and Twitter, and other forms of social media. However, this can lead to plenty of opportunities for these individuals to become targets of intelligence operations, including the “Honey Trap” or for the operator to build credibility for an operation. See Appendix C. This is a real counterintelligence nightmare that needs to be examined. The new intelligence personnel from generations X and Y are people who are built to network with others. The IC is dealing with a little bit of a crisis in terms of attracting the new generations, while trying to preserve its policies. The new workplace in the IC is a networking workplace. People/employees are connected with others inside the organization, people outside the organization, and their own personal social networks. In order to properly assess the impact of social media in the IC, the impact to the intelligence professional should also take place. Hauptmann and Steger write, “The management of knowledge, innovation, production processes, and almost all other processes in modern organizations and corporations requires negotiation and discussion… decision-making about and commitment towards goals, for instance, are subject to negotiation – not only in senior positions but also on the shop-floor level.”84 The IC as well as other agencies are rapidly adapting to this new development because the employee talent pool now demands social networking opportunities. Corporate picnics are great, the coffee and kitchen may be great but how are the social networking opportunities?

Stefan Hauptmann and Thomas Steger, “A brave new (digital) world”? Effects of in-house social media on HRM, Zeitschrift Fur Personalforschung 27 (2013), no. 1: 26, accessed July 6, 2014, ProQuest. 84 Hauptmann and Steger, A brave new (digital) world, 27. 83

UNCLASSIFIED

While the IC adjusts to the pool of potential employees, the IC competes for talent with companies like Google and corporate America. This research revealed that social media forced management in the IC to “think outside the box.” It is possible to argue that resisting the change in the social media phenomenon would not benefit the IC. On the other hand, it was surprising to learn that the IC has been quick to take advantage of this social media phenomenon by creating proprietary (closed) social networking places. The good news is that the IC is quickly adapting. The new generations of younger intelligence collectors and analysts are bringing community input and collective community efforts inside the IC. A decade ago, Group Thinking was viewed as a negative in the intelligence profession. Today, the intelligence collector and analyst can access social networks inside his or her agency and across multiple agencies. If the analyst needs the input on a question, in addition to accessing the internal networks (classified blogs), he or she can go to her LinkedIn account and email a subject matter expert or a retired intelligence analyst. It is clear that social media and social networking in the 21st Century have changed the old views that kept intelligence analysts from getting together to think, innovate, share, and collaborate. Hauptmann and Steger write, “Social media, in particular, constitute a frame of interaction that connects organization members constantly; the phenomenon of being virtually present.”85 Social media also began to impact how the IC sees social networks from the locally identifiable network, to the virtual and highly complex social network. While all this technology is changing and transforming the IC, it is still a diverse crowd. It is not unusual to find an

Hauptmann and Steger, A brave new (digital) world, 27.

UNCLASSIFIED

intelligence analyst from the Cold War era working next to a 22 year-old analyst with piercings in every possible place and an interesting hairstyle. More amazing is watching the older analyst type on the keyboard with two index fingers, while the 22 year-old analyst on the next desk, is typing hundreds of words per minute, eating, listening to music, and watching multiple screens—while holding a conversation with the old timer. The social media impact has transcended beyond the collector and analyst. Now, this research turns into the analysis of the findings. A. Law Enforcement In this section, law enforcement is meant to cover any agency with police powers in the US. After 9/11, law enforcement was given significant powers to pursue anti-terrorism and counterterrorism activities. There are a number of subheadings where the social media impact is more noticeable. Perhaps the biggest impact in law enforcement is the globalization of crime. Glenny and Davis write that technology is giving organized crime a significant opportunity where cybercrime is beginning to affect the global economy.86 Organized crime is generating billions of dollars by exploiting social media and cyberspace. This is not surprising but what is surprising is the lack of countermeasures from law enforcement to minimize or stop the threats. Some of the transnational criminal organizations that are heavily involved in cybercrimes today are: the Russian Mafia, the African enterprises, and the Balkan Organized Crime groups, the Chinese Triad, drug cartels in Latin America, the Japanese Yakuza, and the estimate of the money they generate is about 5% of the World’s Domestic Product.87 While a crime committed 86 Misha Glenny and Ronald Davis, “Organized Crime in a Network Society,” Journal of International Affairs, JIA SIPA, accessed July 26, 2014, http://jia.sipa.columbia.edu/organized-crime-in-a-network-society. 87 Giovanni Mastrobuoni and Eleonora Patacchini, “Organized Crime Networks: An Application of Network Analysis Techniques to the American Mafia,” Review of Network Economics 11, no. 3 (September 2012): 1, accessed July 25, 2014, EBSCOhost.

UNCLASSIFIED

via social media falls under the cybercrime category, in this research only the impact on certain law enforcement areas will be discussed. Analysis of criminal networks is a police or law enforcement matter. Using SOCMINT to disrupt criminal networks requires “both reliable data and sophisticated techniques… intelligence and law enforcement agencies are often faced with the dilemma of having too much data, which in effect makes too little value,” according to Xu and Chen.88 This is one reason why this research is broken down in different impact areas. It would be too complicated and confusing to discuss this research in general areas/topics. Too much overlapping occurs with law enforcement and intelligence. Therefore this research provides a breakdown of the main impacts of social media in law enforcement. Public Safety Inside the context of law enforcement, public safety is a matter that covers a much broader area. Private and public sector is involved in public safety. For example, a private hotel will invest in security cameras and several other components to ensure the safety of their guests. Law enforcement, on the other hand, is something the hotel will not able to perform. In this research, the public safety concept pertains to the activities of law enforcement i.e. police or federal agencies and not to the private or corporate public safety/security activities. The impact in public safety covers many different areas because a lot of homeland security impacted areas are also public safety areas. There is one thing in terms of policing where social media began to challenge traditional policing practices. The flash mobs organized by using social media Philadelphia. These mobs swarmed stores to shoplift and other mobs went on to

Jennifer Xu and Hsinchun Chen, “Criminal Network Analysis and Visualization,” Communications of the ACM 48, no. 6 (June 2005): 102, accessed July 29, 2014. EBSCOhost. 88

UNCLASSIFIED

attack pedestrians.89 After the incidents, the arrested individuals would tell the authorities that they came to the location because they saw it in social media. In the case of the flash mobs into retail stores, the problem touched private security as well a police. Hanson adds that police used to print wanted posters and the radio to find suspects; today, they use social networking websites like Twitter and Facebook.90 There are plenty of examples in open source regarding crime and public safety concerns all organized by using social media. White-Collar Crimes On 2011, the National White Collar Crime Center published a “Criminal Use of Social Media” report.91 The article stated that approximately 22% of their time spent by people in Internet is in social media activities.92 The article states, “With social media being adopted by so many in society, it’s only fitting that white collar and hi-tech criminals adapt their skill set to the ever-changing landscape of the Internet.”93 This research discovered that many police forces in the US have not been able to change their policing practices that were created decades before the Internet. As the result, the 21st Century Crimes or modern crimes are bringing criminals billions of dollars in revenues. Modern criminals do not need a gun anymore. With a computer, criminals are stealing billions of dollars from US citizens and law enforcement is unable to stop it.

Wayne Hanson, “How social media is changing law enforcement,” Government Technology, December 2, 2011, accessed July 29, 2014, http://www.govtech.com/public-safety/How-Social-Media-Is-Changing-LawEnforcement.html. 90 Ibid. 91 “Criminal Use of Social Media (2011),” National White Collar Crime Center (NW3C), accessed July 23, 2014, http://www.iacpsocialmedia.org/Portals/1/documents/External/NW3CArticle.pdf. 92 Ibid. 93 Ibid. 89

UNCLASSIFIED

Social Media and Local Crime There exists a misconception that the use of social media is for purposes of high-tech criminal activity, such as identity theft or social engineering in order to empty the bank accounts of the victim. Note: social engineering will be explained in more detail in the counterintelligence and foreign intelligence sections. However, the reality is that even local burglars now exploit social networking sites in order to learn when someone will be out of town on vacation or out of the house for the evening.94 Post the message that the person is going out to watch a movie and it may be an invitation for burglars. A vacation post or pictures of how much the entire family is having fun at Wisconsin Dells and criminals may take their time to empty the victimâ&#x20AC;&#x2122;s house. Facebook has become popular with people with computers skills and people with little or no computer skills. Even illiterate people are using social media. This has opened up opportunities for criminals to target everyone they can, while searching for victims who may fall for their tricks. Criminals can use social media to perform Phishing campaigns and make people install Malware into their computers. The criminalâ&#x20AC;&#x2122;s goal is to get the target to use email outside the social media platform. When that happens, the chances of the criminal succeeding increase to over 50%. Searches in suburban areas of Illinois, it was noted that many people share too many details in social media sites. Social Media and Sophisticated Cybercrimes William Pelgrin writes, â&#x20AC;&#x153;Social media serves as a prime vector for malware distribution. The 2013 Symantec Internet Security Threat Report notes that 43 percent of attacks used on

Ibid.

UNCLASSIFIED

social networking websites were related to malware.”95 After a crime is committed, the police are supposed to come to the people’s aid and put the criminals behind bars. It is obvious that there is a lack of police training in social media and cybercrimes and criminals capitalize on it. The crimes committed by social media require a re-think of what kind of social media monitoring is necessary. There is also a lack of crime prevention education in most communities. In the next decade, technology will advance and so will the creativity of these criminals. A few police departments are using social media to fight back. Perhaps it is time to explore social media for SOCMINT in law enforcement in order to minimize the threat to communities in the US. Social Media and Police Investigations A recent article titled, “In the online hunt for criminals, social media is the ultimate snitch,” Kate Knibbs, talks about a police officer that was looking for a burglary suspect but the investigation was at dead end.96 The detective went into the Facebook account of the suspect and noticed that the suspect had ‘checked-in’ at a strip club.97 The detective drove the strip club and found a car matching the description of the suspect’s car was in the parking lot.98 The vehicle was registered to the suspect and it was the same vehicle seen at the crime scene. An arrest and confession by the suspect followed.99 This is one example where SOCMINT was used to

William Pelgrin, “3 Reasons Why Criminals Exploit Social Networks (and Tips to Avoid Getting Scammed),” CSO Online, last modified June 5, 2013, accessed July 23, 2014, http://www.csoonline.com/article/2133563/social-engineering/3-reasons-why-criminals-exploit-social-networks-and-tips-to-avoid-getting-scamme.html. 96 Kate Knibbs, “In the Online Hunt for Criminals, Social Media Is the Ultimate Snitch,” Digital Trends, accessed July 23, 2014, http://www.digitaltrends.com/social-media/the-new-inside-source-for-police-forcessocial-networks. 97 Ibid. 98 Ibid. 95

UNCLASSIFIED

produce immediate results. If the detective had not been vigilant on the social media monitoring, the opportunity may have been lost. It is important to recognize that the impact of social media for the law enforcement agencies has been significant. The monitoring of social media by police forces including these in national security is increasing. Local police agencies could do more, while ensuring that they are only reading public social media posts. Sockpuppets are a great way to build cases against local and regional criminals but very few police officers know how to do that. SOCMINT can assist in the following: Target identification (human target or crime), investigations, and determine social networks of known targets and discover the “unknown targets.” The upside of social media is that criminals are willing to say what they are doing. The downside is that learning to monitor, collect, and analyze the social media information requires skills and practice. Modern Crimes in Cyberspace Law enforcement is no longer a jurisdictional practice. Sure the local burglar will continue to burglarize homes in his or her neighborhood. However, foreign criminals can be considered a modern kind of criminal. He or she can use social media to commit crimes inside these local communities. As a side note, criminals located in the US can also commit crimes in other parts of the world. Majid Yar writes that criminal activities with social media include computer viruses, malicious software, fraud, piracy, obscene or hateful messages and pornography.100 This research discovered that most law enforcement agencies in the US insist in only focusing resources to local crime. Yar adds, “Children and young people may become increasingly vulnerable to criminal victimization [sic] arising from their extensive use of new

100

Majid Yar, “E-Crime 2.0: The Criminological Landscape of New Social Media,” Information & Communications Technology Law 21, no. 3 (October 2012): 207, accessed July 29, 2014. EBSCOhost.

UNCLASSIFIED

social media.â&#x20AC;?101 By ignoring these cyber threats, police departments may be neglecting the modern crimes and leaving children and young people unprotected. Crimes that are occurring in social media are increasing and not having the tools or the training results in a disservice to these communities. It is possible to argue that more coordination is needed between local, state and federal law enforcement in this area. Creating workgroups and task forces is necessary. Even small towns are experiencing hundreds of thousands of dollars to fraudulent activity initiated in social media and in cyberspace. In many ways, the criminals today are more sophisticated, while law enforcement is falling behind, incapable to investigate these crimes. The Role of the Fusion Centers in Law Enforcement After 9/11 there was a big push for local law enforcement to collect intelligence from their local communities. The creation of Fusion Centers and the Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI) are collaborative initiatives from the FBI, DHS, and local law enforcement.102 A positive discovery in this research was that police agencies could handle their local crimes as well as initiate a referral to Fusion Centers or the FBI about terrorist plots and some cybercrimes. However, there is nothing that can be done in social media criminal activity because it is overwhelming most police departments. Add the cases of identity theft and things get even more complicated. Local law enforcement personnel are first responders when a terrorist act takes place. The need to have this mix of jurisdictions under one roof makes sense.

101

Ibid. Nationwide SAR Initiative (NSI), accessed July 17, 2014. http://nsi.ncirc.gov/?AspxAutoDetectCookieSupport=1, 102

UNCLASSIFIED

Cybercrimes are real security threats that must be addressed in the same context as the Fusion Center programs. The Fusion Centers are not necessarily focus on criminal activity only. These analysts from multiple jurisdictions are assigned to collect intelligence from their assigned territory, detect crime around critical infrastructures, investigate possible terrorism, and produce criminal intelligence. The Fusion Center is there also to share intelligence in their territory to all the stakeholders. There is evidence that many fusion centers are now monitoring social media by using software platforms, such as Geofeedia. It is possible that it is done exclusively to monitor bigger risks and threats than looking for gang activity, drugs or guns. This research identified several social media monitoring platforms that tailor their services for law enforcement and intelligence. However, not one application has everything an analyst needs to produce actionable, tactical, or strategic SOCMINT. Therefore, multiple social media tools and platforms must be employed. Gangs and Social Media Gangs are now deeply involved in social media. The emergence of social media began to transform the way criminals interact with each other and their communities. The impact social media has had in law enforcement in the US has been unprecedented. Before social media, gangs for example used to go out and write/paint the walls of buildings in order to mark their territory (even when putting graffiti on buildings is still widely used). Today, the walls are not physical walls found in a town or city. They are the walls of their personal profiles in social media such as Facebook, Tweeter, Instagram, and several other social networking sites. The only thing that has not changed is that when a rival gang disrespects a territory physical wall or a Facebook wall, the response is usually by the use of violence. It is also UNCLASSIFIED

UNCLASSIFIED

possible to argue that social media may actually be a cause for the increased gang violence in many cities. The logic was that in the past, only people driving by the wall would recognize that another rival gang had just disrespected them. Today, thousands of people can see the same gesture of disrespect in social media, which in many ways raised the stakes for a violent response. The lack of graffiti in towns and cities in the US does not mean that “gang banging” has stopped. After the adaptation of social media by gangs, the new term used is “Internet Banging.”103 In this research it was discovered that gang members in Chicago are willing to post images that implicate them in criminal activity. The SOCMINT included pointing guns at the camera with a text that threatens someone, holding large amounts of cash, and making statements about crime including past and future crimes. According to the study at the University of Michigan, “Using the Internet allows gang members to promote their gang affiliation and share/gather information about rival gangs.”104 Local, county, and state police forces today are dealing with a significant threat over social media. This threat if left unattended could potentially endangered the lives of many innocent people in these communities. It has already been reflected in most metropolitan cities with heavy gang presence. The Fourth of July weekend, 2014, in Chicago, 82 people were shot and 14 died, according to the Chicago Tribune.105 “Five of the people were shot by the police over a 36 hours on Friday and Saturday, including two boys 14 and 16 who were killed when they allegedly Jared Wadley, “Internet Banging: Gangs use social media to trade insults, threats,” Michigan University News, January 22, 2013, accessed July 6, 2014, http://www.ns.umich.edu/new/releases/21111-internet-banginggangs-use-social-media-to-trade-insults-threats. 104 Wadley, Internet Banging. 105 Peter Nickeas, “Fourth of July weekend toll: 82 shot, 12 of them fatally, in Chicago,” Chicago Tribune, July 7, 2014, accessed July 7, 2014, http://www.chicagotribune.com/news/local/breaking/chi-fourth-of-july-toll-82shot-14-of-them-fatally-in-chicago-20140707,0,5439185.story. 103

UNCLASSIFIED

refused to drop their guns,â&#x20AC;? according to Chicago Tribune reporter Nickeas.106 The neighborhoods that experienced most of the shootings were Englewood, Roseland, Gresham and West Pullman.107 Children and innocent bystanders are killed regularly in the crossfire in Chicago. A great percentage of the youth involved in gang activity actually in these neighborhoods use social media to transmit their messages. See Appendix A for more details. A social media search in the area by using Geofeedia revealed some interesting images and statements from gang members in Chicago. The monitoring occurred in the neighborhoods mentioned above. The images attached to Appendix A say three things: first, the gang member identifies himself to his own gang and the rival gang the Latin Kings, as he puts the crown down. Secondly, he â&#x20AC;&#x153;disrespectsâ&#x20AC;? the Latin Kings; a gang located a few miles away from his location, which without a doubt will bring consequences. And lastly, he is making a statement to his own gang membership, something that has tangible and intangible value. Monitoring social media could produce some positive results but the infrastructure, the training, and the personnel must be put in place. Additionally, some of the discoveries in this research were that the gang members were using music and the social media platforms to promote their gang image and ideology. In Appendix B, the gang member challenges in a song several rival gangs (lyrics that include a lot of violence). At the time of his posting, the gang member had location services turned on. As the result, the rival gangs would take a few minutes to find this individual and possibly retaliate with violence. In reality, gangs are only one problem in terms of impact for law enforcement. The violence associated with gang wars flood the news daily, especially in Chicago.

106 107

Ibid. Ibid.

UNCLASSIFIED

They amount of postings for example in the City of Chicago in the Englewood community included statements, pictures and videos about selling drugs (and including pictures of the very drugs) and threats to rival gangs. Our collection was able to even see guns, license plates, drugs, associates, etc. Posting songs on their social media wall that make some kind to threat to rival gang members was found everywhere and in all forms of social media. As far as this research, it appears that criminals are undeterred by police. Human Trafficking and Social Media Human trafficking, which is an “old type of crime,” has seen a renascence with the introduction of social media. In order to counter the effects, the FBI for example began to hold Twitter Chats in order to talk about human trafficking and crimes against children.108 In this occasion people came to this virtual chat from all over the US and outside the US. The June 25, 2014 chat was about the arrest of 281 pimps and the recovery of 168 children that were held by the human traffickers.109 It is impossible to assess the gravity of the problem because many of these crimes go unreported.

The FBI is taking a proactive approach to inform the public and

social media is a great way, as people continue to use social media to communicate with the authorities. On a separate incident, on June 23, 2014, Cameron Scot Bivins-Breeden, of King George County, Virginia, pleaded guilty to production of child pornography and enticement of a minor.110 Child pornography is a serious problem in society and social media is facilitating this terrible crime to occur. 108 “FBI Hosting Chat with Special Agent on Twitter,” Federal Bureau of Investigations, June 24, 2014, accessed July 6, 2014, http://www.fbi.gov/news/news_blog/fbi-hosting-chat-with-agent-on-twitter. 109 FBI Hosting Chat. 110 U.S. Attorney’s Office, “Virginia Man Pleads Guilty to Using Facebook to Entice Minors from Across the Country to Produce Child Pornography,” Federal Bureau of Investigations, June 23, 2014, accessed July 6,

UNCLASSIFIED

In the plea agreement, Bivins-Breeden admitted to enticing 38 juveniles ranging from age 11-17 by using Facebook and by posing as a female.111 Bivins-Breeden would contact the possible victims convince them to produce child pornography, and then the material would be sent to him.112 After the victims would decide to stop sending material, threats of publishing the images would follow.113 Charges are pending from states where these victims were found. Bivins-Breeden is one of many sexual predators using social media to commit their crimes. Law enforcement is dealing with significant criminal activity in the Internet by using different channels. However, in most of the cases involving children, the interactions start in social media. Since these interactions are always going to start in social media, it is possible to see many of these initial interactions or at the very minimum preserve the postings for a future investigation. If the police have a good social media-monitoring platform, it is even possible to have the evidence available to build a case. A search conducted in the suburbs of Chicago, it was found that many children were very active in social media. It appears these children are below the age for registration in most social media platforms. Parents of course have a bigger incentive to monitor their children, since they are the first line of defense in their homes. Social media is becoming a preferred way for criminals and sexual predators to commit their crimes. The only way to combat the criminals is go begin a serious effort to monitor and extract SOCMINT but it requires police forces to think outside the box. Police management needs to see social media as an avenue for some real public safety and as a tool to deal with threats in their communities.

2014, http://www.fbi.gov/richmond/press-releases/2014/virginia-man-pleads-guilty-to-using-facebook-to-enticeminors-from-across-the-country-to-produce-child-pornography. 111 Ibid. 112 Ibid. 113 Ibid.

UNCLASSIFIED

Civil Unrest And yet on a different impact to law enforcement, on August 4, 2011, Mark Duggan was killed by a police officer in Tottenham.114 By the morning of the 6th, social media was filled with explicit threats against the police.115 During this incident, large amounts of information was visible in social media but it appears that the police was not prepared to collect and analyze any of that information.116 “Police acknowledged that they had been insufficiently equipped to deal with intelligence gathering via social media,” according to statements from high-ranking police commander.117 The amount of destruction and devastation was significant. In the US, the story is not far off from the story in London; for example the riots in Oakland California and New York with the occupy movements. In the last few years, all social unrest movements have been created, directed, coordinated by using social media. The gangs, the human trafficking cases, and the threats against police are all situations that require law enforcement to bring SOCMINT into their profession. One criminal intelligence analyst stated that searching social media during the incident in North London was like ‘searching the British Library for a page in a book without an index to refer to.’118 It appears that social media is not something that fits their operating procedures such as receiving, corroborating, prioritizing and disseminating information so the results were tragic and costly for the community.119 Social media analysis platforms are necessary tools for police forces. Even more important is training law enforcement personnel to extract SOCMINT.

114

Omand, Bartlett, and Miller, Introducing Social Media, 801. Ibid. 116 Ibid. 117 Ibid. 118 Omand, Bartlett, and Miller, Introducing Social Media, 801. 119 Ibid. 115

UNCLASSIFIED

Adapting to social media also calls for police departments to use social media to interact with the community. NYPD today uses smart phone applications for people to upload images and video of things they see i.e. crime and any other issues.120 In terms of the impact to law enforcement it is evident in this research that patrolling social media activity in US jurisdictions is equally important as patrolling the parks and streets. B. Homeland Security On September 12, 2001, the world was confused on how the US government had failed to “connect the dots” when al Qaeda successfully perpetrated the biggest terrorist attack in the homeland.121 Lack of intelligence sharing was a problem everyone talked about in the IC. One of the biggest questions in the world of SOCMINT is if social media existed back then, could it have saved more lives during 9/11? In the Boston Marathon bombings, the only communication that stayed available was social media and email. The phone circuits were completely overloaded. Starting the discussion on homeland security requires at least a sense of what is the meaning of homeland security. In this research, the points that were researched were selected to sample only a number of social media impacts. Homeland security is one of the biggest law enforcement and non-law enforcement programs that were launched after 9/11. Homeland security is a term that is widely used by different agencies, but it is very much misunderstood. Instead of trying to define homeland security as a definition, this discussion will touch on some of the roles of homeland security in the US. This research covers only a few key areas of great

TOD NEWCOMBE, “New York City to Consolidate IT,” Government Technology 22, no. 11 (November 2009): 8–8, accessed July 8, 2014, EBSCOhost. 121 Nieto-Gómez, Preventing the Next 9/10, 1. 120

UNCLASSIFIED

impact of social media. In homeland security, agencies must adopt an “All-Risks Approach” to their operations. This basically means that the intelligence analyst will have to cover many different intelligence disciplines in his or her day-to-day activities. This distinction is important because the analyst is inside a Fusion Center, analyzes all kinds of criminal and terrorist risks and threats. Becoming an analyst in a Fusion Center requires the analyst to have a good background in law enforcement as well as intelligence analysis. The mission for these analysts has become much broader, than say the CIA analyst working the Ukrainian desk. In the website, the Department of Homeland Security (DHS) states the following about the agency: To secure the nation from the many threats we face. This requires the dedication of the more than 240,000 employees in jobs that range from aviation and border security to emergency response, from cybersecurity analyst to chemical facility inspector. Our duties are wide-ranging, but our goal is clear – keeping America safe.122

Homeland security again has many different meanings to different people but the main goal is to keep the United States safe. Perhaps one of the biggest breakthroughs with homeland security was in inclusion of civilians and commerce in the overall mission. Homeland security recommends that civilians, local governments and businesses should all participate in keeping the country safe by maintaining vigilance and reporting suspicious activity. After the creation of the DHS, the need to have Fusion Centers in several key cities to maximize cooperation and collaboration became necessary, as discussed earlier. Today, the Fusion Centers handle receipt, analysis, and share large amounts of information from local citizens as well as other agencies.123 Social media

“About DHS,” Department of Homeland Security, accessed July 7, 2014, http://www.dhs.gov/about-dhs. “National Network of Fusion Centers Fact Sheet,” Department of Homeland Security, accessed July 8, 2014, http://www.dhs.gov/national-network-fusion-centers-fact-sheet#1. 122 123

UNCLASSIFIED

monitoring has now become a necessity, but there is little training on that area for these intelligence analysts on how to use these tools. Setting aside the issue of the definition of homeland security, this research now turns to the concept of National Security. There is no clear definition on the meaning of national security in the US. The term is used by different agencies from the locals to the federal agencies but each interprets the term according to the agency’s mission. During this research, the idea of social media and national security did not really have a lot to work on. However, there were some things that social media brings to homeland security that have national security implications. For example, transportation security, terrorism, transnational crime, drug trafficking, border security, national disasters, and cybersecurity are all critical issues of national security. Now, this research turns into some specific areas of homeland security impacted by social media. SOCMINT During Homeland Security Crisis After the introduction of social media, SOCMINT has shown to be highly effective when gathering intelligence from the ground during terrorist attacks, active shooting incidents, and natural disasters. Social media has also become an important communication platform for governments. It is important to learn about the United States National Security Strategy. In the National Security Strategy of 2010, they state that, “intelligence and homeland security efforts must be integrated with our national security policies, and those of our allies and partners.”124 This is an important statement in the strategy because without having a good foundation for intelligence collection and analysis, as well as intelligence sharing policies, the IC would fall back to “pre-9/11” mentality.

Barak Obama, “National Security Strategy,” May 2010, accessed July 24, 2014, http://www.whitehouse.gov/sites/default/files/rss_viewer/national_security_strategy.pdf. 124

UNCLASSIFIED

When discussing homeland security crisis, it is important also to make the distinction between a hard target and a soft target. A hard target is the Pentagon and a soft target is a marathon. Terrorists prefer soft targets. The Boston Marathon was a soft target. The Boston Marathon bombings were a wakeup call to law enforcement and intelligence about the vulnerabilities of soft targets in the US. The stories of three people, Sarah Dingle, Jamie Weiner, and Yijing Zhao who were active in their social media before and during the marathon. Their casual activity became crucial evidence to track the attackers.125 However, in this incident, SOCMINT was used investigate the bombing and not to monitor or prevent the attack. SOCMINT fulfilled its mission during the investigation, but it was never disclosed to the public if the police had been monitoring the event in social media. SOCMINT of course assisted in solving a terrorist attack but failed to prevent it. The risks and threats today require obtaining intelligence from all available sources and for the IC to be able to act fast. There are many risks and threats that can be identified and even managed by using social media. A tripwire can be set anywhere to monitor certain words in social media but few agencies are taking advantage of the technology. Likewise, when monitoring an event, all posts should be viewed. Social Media in Natural Disasters The arrival of social media after 9/11 has shown that it can have positive and negative implications to homeland security. Andrew Heighington writes, â&#x20AC;&#x153;Crisis are unpredictable events that demand adaptation and flexibility. During crisis, many communication experts contend that

Mike Beaudet, Kevin Rothstein and Lauren Foster, â&#x20AC;&#x153;Timeline of the Marathon Bombings Preserved on Social Media,â&#x20AC;? accessed August 2, 2014, http://www.myfoxboston.com/story/25257252/timeline-of-themarathon-bombings-preserved-on-social-media. 125

UNCLASSIFIED

the public engages in formation-seeking behaviors to reduce uncertainty.â&#x20AC;?126 Social media allows the fastest and most effective means to distribute information to the masses. Someone may not have social media but may get the information from a person who has the social media. A premise in terms of intelligence sharing is for the IC to share intelligence with the other agencies (local and federal). And when dealing with natural risks or threats (outside manmade threats such as terrorism), the public becomes an important part of homeland security. Craig Fugate administrator for the Federal Emergency Management Agency (FEMA) states: As social media becomes more a part of our daily lives, people are turning to it during emergencies as well. We need to utilize these tools, to the best of our abilities, to engage and inform the public, because no matter how much federal, state and local officials do, we will only be successful if the public is brought in as part of the team.127 In the homeland security strategy, the objectives are to share intelligence even with the private sector, mostly businesses, and in the case of a natural disaster to the public in general. There are many ways to monitor natural disasters and social media has now become a great tool in that area. Social media made a debut during Hurricane Sandy on 2012, mainly because the text, the images, and the video postings were incredible to say the least. Even when the electricity was down for most of the victims of the hurricane, their mobile phones were still in service. Emergency personnel and police created Hashtags to coordinate their efforts in the affected communities, while other agencies monitored social media to direct personnel. SOCMINT can now even monitor electric energy problems and the flu as it moves around the country.

Beaudet, Rothstein and Foster, Timeline of the Marathon. Andrew Heighington, â&#x20AC;&#x153;Homeland Security in Real-Time: The Power of the Public and Mobile Technology,â&#x20AC;? Homeland Security Affairs 7, no. 1 (February 2011): 1, accessed July 24, 2014, EBSCOhost. 126

127

UNCLASSIFIED

Information Sharing to the Public with Social Media The threat of terrorism today in the US is a significant homeland security concern. Weather related crisis are also becoming frequent and these crisis bring a lot of destruction, as highlighted in the previous section. Information sharing with the public becomes very important, especially if human life is at stake. The Mumbai terrorist attacks of 2008 showed the effectiveness of Tweeter by informing people about emergency phones, hospitals, and locations to donate blood.128 After the Boston Marathon bombings social media was used for the investigation and as a public information-sharing platform. In the US, this was the first time that social media had been used after a terrorist attack. It is clear the Mumbai attacks provided plenty of time for the US to prepare to use social media effectively. In another incident, after the Ft. Hood shootings in 2009, social media was employed to give military personnel and military families information about the incident.129 There are other areas of homeland security where the impact has been significant. During the active shooting incident of the Santa Monica College, on June 7, 2013, social media played an important role in tracking down the suspect and later SOCMINT was used to assist in the investigation. Social Media during High-Profile Events Monitoring social media during high profile events, such as the visit of NATO to Chicago on May 2012, was crucial. The City of Chicago was flooded with protesters, including the Black Bloc and extremely violent group. During the NATO visit, four individuals were charged with the state terrorism charges, material support of terrorism, and conspiracy to commit terrorism.

128 129

Heighington, Homeland Security, 1. Ibid.

UNCLASSIFIED

On February 7, 2014, all the protesters arrested were acquitted of the terrorism charges but the jury found them guilty of two counts of arson.130 A lot of the SOCMINT obtained prior and during the NATO served to learn about the groups and individuals organizing the protests, including obtaining intelligence on the Black Bloc and other violent protesters. Government monitoring social media is something the civil rights groups still have problems with. SOCMINT during the NATO meeting provided a great testimony that of what is possible with social media. SOCMINT allowed the authorities track the individuals that were in Chicago to cause destruction, as several protests converged in the City of Chicago. This created a tense situation because dealing with a teacher protest, a labor union protest, a pro-immigration reform protest, and the Anti-NATO protest were all a perfect mix for disaster. Even nurses from a county hospital were protesting the same week. The City of Chicago became a perfect soft target for terrorists. The Chicago Police with the help of SOCMINT was able to anticipate crowd movements and used SOCMINT to identify potential threats. Domestic Terrorism and Social Media On April 19, 1995, Timothy McVeigh, a domestic terrorist bombed the Alfred P. Murrah Federal Building in downtown Oklahoma City.131 This domestic terrorist attack marked the law enforcement, intelligence community, and people in the US. This event occurred before the invention of social media but people must not forget that domestic terrorism is a real homeland security threat. Unlike the international terrorist, the domestic terrorists have ample opportunities to plan an attack because they are already inside the US. McVeigh’s terrorist attack showed that

“NATO Protesters Acquitted of Terrorism Charges,” accessed July 24, 2014, http://www.usatoday.com/story/news/nation/2014/02/07/nato-protesters-acquitted/5296171. 131 “Terror Hits Home: The Oklahoma City Bombing,” Federal Bureau of Investigation (FBI), accessed July 14, 2014, http://www.fbi.gov/about-us/history/famous-cases/oklahoma-city-bombing. 130

UNCLASSIFIED

terrorism is not only an international phenomenon. One of the biggest advantages that social media brought is the many of the radical and anti-government movements today are very visible in social media. For example, in terms of monitoring domestic terrorism targets in certain areas in the US is important for the IC. The Lone Wolf is also a real threat that may be harder to track in social media. Dean, Bell, and Newman write that understanding the impact of social media in domestic terrorism, especially homegrown terrorism is something that cannot be ignored.132 Xu and Chen write, “The study of terrorist networks falls into the larger category of criminal network analysis, which often is applied to investigations of organized crimes (for example, terrorism, narcotics trafficking, fraud, gang related crimes, armed robbery, and so on).”133 Social media monitoring of the places where these radicals are located is a must. SOCMINT can be used to place the tripwires on certain words in the entire US. Terrorists and organized crime are using social media to recruit, communicate, indoctrinate, and train.134 The challenge is to monitor the international and domestic terrorist organizations, along with the gangs and organized crime groups. They all pose a variety of public safety and national security threats. It is possible that what is needed today is to deploy a nationwide social media monitoring strategy. However, it is possible to hear objections by the civil rights groups that oppose any form of government social media monitoring. The American Civil Liberties Union (ACLU) is one of them. Heighington writes, “In order to significantly tilt the odds against the terrorists and in favor of the ‘good guys,’ the nation’s crisis communication strategy must be broader and more

Geoff Dean, Peter Bell, and Jack Newman, “The Dark Side of Social Media: Review of Online Terrorism.,” Pakistan Journal of Criminology 3, no. 3 (January 2012): 107, accessed July 26, 2014, EBSCOhost. 133 Xu and Chen, Criminal Network Analysis, 102. 134 Dean, Bell, and Newman, The Dark Side of Social, 107. 132

UNCLASSIFIED

innovative than commercial broadcast alerts, mobile text messages, and social media sites such as Facebook and Twitter.”135 SOCMINT serves an important role in the world of homeland security. Monitoring activities of international terrorists means also that domestic risks and threats, such as domestic terrorists must also be monitored. The identification of videos and images in certain areas of the country where anti-government or rightwing groups are exhibiting their artillery could provide valuable SOCMINT to the FBI, the ATF and other authorities. There is one domestic terrorist group that is making a lot of headlines in the US. The Sovereign Citizen Movement (SCM) makes use of social media to spread their message. According to the Anti-Defamation League, in the past few years the SCM has been exploiting social media platforms like Facebook, YouTube, and blogs to recruit, indoctrinate and train.136 The question is who is monitoring the SCM? Social media provides a great platform to analyze and disseminate SOCMINT to the homeland security professionals. The domestic terrorist and radical movements inside the US still pose the greatest threat to national security. Of course this is without discounting the threats by international terrorism. Regardless of who has the primary responsibility to collect SOCMINT on these domestic or international risks and threats, monitoring social media and producing SOCMINT about these targets is highly recommended. C. Counterintelligence The world of counterintelligence today has many different risk and threats unlike never before. The introduction of social media began to re-shape the way espionage is conducted in the

Heighington, Homeland Security, 5. “The Lawless Ones: The Resurgence of the Sovereign Citizen Movement,” Anti-Defamation League, 2012, accessed August 2, 2014, http://www.adl.org/assets/pdf/combating-hate/Lawless-Ones-2012-Edition-WEBfinal.pdf. 135 136

UNCLASSIFIED

US. Today, electronic espionage to key targets requires the ability to know how to use social media and it requires the ability to keep up with the daily exchange of information. Penetrations and infiltration to national security personnel have also posed a significant challenge. Since many of the personnel are using social media as a form to keep their relationships in cyberspace (both personal and professional) the risks are so serious that requires some attention by the counterintelligence arms of most of the federal government agencies. Hulnick writes, “Counter-intelligence is largely defensive in nature, and is not a part of the traditional intelligence cycle… counter-intelligence follows an entirely different and unique path, with a model of its own.”137 SOCMINT reinforces Hulnick’s idea and proves that counterintelligence cannot follow the traditional intelligence cycle. Counterintelligence is rooted in prevention and investigation; something SOCMINT is perfect for. The exposure of many of the federal agencies in social media is alarming, especially on the US/Mexico border. Hulnick recommends a process for counterintelligence that differs from the traditional intelligence cycle: Identification, Penetration, Exploitation, Interdiction, and Claim Success.138 SOCMINT is able to perform all these processes provide the right collection and analysis is taking place. Nieto-Gomez writes, “When a clandestine actor uses infrastructure to do harm [espionage does great harm to national security], he or she illicitly appropriates the technology to achieve a goal different from what the designers intended.”139 Therefore, it is important to assess the impact of social media in the counterintelligence field and adopt the mechanism to counter the impact. One of the biggest problems today is the threat of social engineering because they take control of the people and the computers with social media.

Hulnick, What’s Wrong with, 968. Hulnick, What’s Wrong with, 973. 139 Nieto-Gómez, Preventing the Next 9/10, 3. 137 138

UNCLASSIFIED

Social Engineering Social engineering is a way for hackers or government operatives to access penetrate a national security target. Border patrol agents and police officers by the border have become primary targets for social engineering operations. Many of these operations commence in person, but the operator may use social media to find targets. Social media has now opened many opportunities for criminals to find targets for recruiting. Looking for police officers that work on the border requires the operator to visit LinkedIn and perform a search for the word police with the town or city. A search on July 31, 2014, of the word â&#x20AC;&#x153;CIAâ&#x20AC;? in LinkedIn revealed approximately 2500 profiles. Just about every agency in the IC was identified in LinkedIn. When the target is located in social media regardless of what platform, the operator then engages the target in deception. See Appendix C for one example. Court officials near the border of the US and Mexico are also potential targets by drug cartels that have become highly effective in the world of cyberspace. In an article by the Washington Post, they describe with great detail the steps for an operation to take place. Here are the steps they highlight: 1. Operative selects a target. It may be a government employee, intelligence contractor, or company. Low-level employee is tricked by Facebook or Tweeter and downloads a malicious malware. The operator has access to everything the target is doing. 2. The operative studies the target to more detail including anything that can serve the operator to build the plan. Friends and acquaintances are studied; even the music and food the target likes.

UNCLASSIFIED

3. The operator then drafts an email that appears to be from someone in the same organization and urges the target to open. Inside of course are the malware that will now give full access to the network. Another idea could be to suggest a bar but the links to the bars have been co-opted by the operator with a malicious code. When the target opens the site, the code is downloaded. 4. The code hides and eventually sends an encrypted message and now the operator has a back-door access to install a remote access program. 5. When the operator has the complete access, the operator will perform many espionage activities including planned disruptions.140 Social engineering is one of the most effective ways to penetrate an agency. A sound counterintelligence operation requires monitoring of crucial agencies in national security and putting in place policy in regards to social media use. Because of the sensitivity of the subject the previous research in this subject, only this illustration will be provided in this subject. It is clear that social media provides plenty of opportunities for intelligence operators and criminals for recruitment and penetration. This takes counterintelligence to a much higher response level. The insider threat is real and so are the risks and threats associated with social media, which are external threats. Social engineering when is used in social media is devastating. A discussion in the law enforcement section highlighted the many crimes launched in social media. All of these crimes require some kind of social engineering. Social engineering used cyber hacking and cyber espionage are real national

â&#x20AC;&#x153;Social Engineering: Using Social Media to Launch a Cyber attack,â&#x20AC;? Washington Post, last modified August 28, 2013, accessed May 21, 2014, http://www.washingtonpost.com/investigations/social-engineering-usingsocial-media-to-launch-a-cyberattack/2012/09/26/a282c6be-0837-11e2-a10c-fa5a255a9258_graphic.html. 140

UNCLASSIFIED

security threats. These are hard to detect and hard to prevent. The Target data breach is a big lesson learned for the private sector as well. Social Media Impact in Politics Politicians began to use social media for their campaigns only after Obama became a candidate. This real-time and information overload meant that foreign governments could easily monitor the politicians activities and anticipate movements. Rachel Weiner wrote that in 2008 Obama was known as the king of campaign by social media.141 Obama raised half a billion dollars online with the assistance of Facebook and founder Chris Hughes assisted Obama and putting together a social media campaign.142 Four years later, in 2012, Romney asked his supporters in Facebook to download his “IPhone app.”143 Politicians not just in the US have embraced social media. It makes them vulnerable to a possible intelligence operation. Today, politicians in the capitol and all over the US are able to engage audiences via Tweeter, Facebook, and other social media platforms to ridicule their adversaries and to rally support.144 While all this takes place, the politicians become more open to share and open to interact with the public. This has not gone without notice by other countries that enjoy taking control of politicians. During the re-election campaign of President Barack Obama, Weiner wrote that Obama and Romney were in some serious competition for “votes, dollars and volunteers.”145 Before social media, many of the efforts had to be done via mainstream media. Mainstream media is still

Rachel Weiner, “How to Win the 2012 Social Media Election,” Washington Post, August 1, 2012, accessed July 8, 2014, http://www.washingtonpost.com/politics/how-to-win-the-2012-social-mediaelection/gJQA1qRyNX_topic.html. 142 Ibid. 143 Ibid. 144 Ibid. 145 Ibid. 141

UNCLASSIFIED

a very powerful way to convey a candidate’s message to the masses, but it is expensive. Social media on the other hand is nearly free and very powerful in its own ways. Before the Internet, the only way foreign nations were able to obtain OSINT on political figures from the US was to be in the location or from information furnished to mainstream media. During the Cold War, the Soviet Union spent a lot of effort penetrating political targets in the US and actually succeeded. Today, the processes by using social media are very different and social media can be more damaging. Foreign governments now monitor campaigns and political targets in their own countries and abroad. In the foreign political front, the US State Department began a Twitter account “UkrProgress” in order to counter some of the propaganda by Russia. The account has 7,000 short messages in Russian and about 14,000 people are following it.146 This kind of counterintelligence programs by the IC must be put in place in order to overcome the propaganda campaigns by the other side. Social media has impacted not only elections but also the way politicians share with the public including in foreign policy. National Security Personnel and Social Media US personnel who are holding positions in national security today more than ever with the use of social media these employees become targets of highly trained intelligence operators. Drug cartels, such as Los Zetas have shown serious abilities in cyberspace. On November 10, 2011, Time featured an article titled “Fourth Blogger Reported Killed by Los Zetas Mexican Drug Cartel.” The article describes how a blogger that used social media to talk about drug cartel

Igor Rozin, “Social media is the new theatre for diplomatic information war,” Russia & India Report, May 26, 2014, accessed July 29, 2014, http://in.rbth.com/world/2014/05/26/social_media_is_new_theatre_for_diplomatic_information_war_35505.html. 146

UNCLASSIFIED

activities was found beheaded at intersection in Nuevo Laredo with a note that said, ‘This happened to me for not understanding that I shouldn’t report on the social networks.’147 The cartels and other criminals can collect a lot of intelligence that is widely available in social media about national security personnel. They use their SOCMINT to handle any threats to their operations and as tools to recruit and penetrate national security personnel. Drug Traffickers and Social Media Personal profiles of personnel in the national security field reveal too much personal information that makes these individuals and organizations vulnerable to attack for penetration. Former National Deputy Chief of the U.S. Border Patrol Ronald Colburn stated in the National Review Online, that gangsters such as Los Zetas, MS-13 and the Gulf Cartel enjoy using social media, including taking selfies and laughing about what is taking place on the border with the immigration of unaccompanied child migrants.148 The drug cartel members show no fears of posting in social media even when they do it in US soil. This was the case when a 29-year-old Joaquin Cibrian. Cibrian was very active in social media as a member of the Texas Syndicate gang. Cibrian also identified himself as member of the Cartel del Golfo (Gulf Cartel) and enjoyed displaying in social media videos of guns and threats to his rivals. On July 23, 2014, the police went to serve a warrant for murder to Cibrian’s residence. They were met with heavy gunfire. By the end of the day, between 500 and 600 rounds were exchanged between the suspect and the authorities. Two officers from the Edinburg

Keith Wagstaff, “Fourth Blogger Reportedly Killed by Los Zetas Mexican Drug Cartel,” Time, n.d., accessed July 25, 2014, http://techland.time.com/2011/11/10/fourth-blogger-reportedly-killed-by-los-zetas-mexicandrug-cartel/. 148 “Ryan Lovelace - Former Border Patrol Deputy Chief: ‘All of the Good That Was Done after 9/11 Up to Now Has Been Reversed Singlehandedly,’” National Review Online, accessed July 25, 2014, http://www.nationalreview.com/corner/382911/former-border-patrol-deputy-chief-all-good-was-done-after-911now-has-been-reversed. 147

UNCLASSIFIED

Police Department were hospitalized with bullet wounds.149 A video in Facebook revealed the start of the shooting.150 The pleading from his family to give himself up to the authorities and the conversations with many different people are chilling to say the least.151 The information on his activity in social media Zello surfaced after the incident. The weapons displayed in one posting included an AR-15 and a 50 Caliber sniper rifle. In Mexico, the YouTube video of Servando Gomez- Martinez aka “La Tuta” head of the Caballeros Templarios, (the Knights Templars Cartel) a cartel operating in Michoacán and many sates in Mexico and in the US, has been viewed 1.8 million times.152 Drug cartels enjoy using social media to post the torture of people, beheadings, and executions. In the border, the drug cartels are in a constant fight with the US Border Patrol personnel. When these criminals begin to share their weapons and make threats to rivals in social media, an alarm bell should go off for law enforcement and federal authorities, especially if the situation is occurring on the US border. The violent criminal groups should never be underestimated. Monitoring social media and obtaining SOCMINT must also include the social media risks to US personnel. The biggest question is who is monitoring the social media use of the personnel entrusted with national security. The exposure found from personnel on the border in social media was serious. Exposure in social media of where the officer lives, what they drive many times, and their family is a dangerous situation that needs further examination.

Jacob Fischler, “Rangers Still Investigating La Joya Shootout, but Some Details Emerge,” The Monitor, accessed August 2, 2014, http://www.themonitor.com/news/local/rangers-still-investigating-la-joya-shootoutbut-some-details-emerge/article_4777bdb4-12e0-11e4-962b-001a4bcf6878.html. 150 https://www.facebook.com/Action4News/posts/10152095680761157, accessed August 2, 2014. 151 Nadia Galindo, “Audio Recording Could Be Stand-off Suspect’s Last Words,” Valley Central, accessed August 2, 2014, http://www.valleycentral.com/news/story.aspx?id=1074202. 152 Nuevo Comunicado de “La Tuta” Y Los Caballeros Templarios. Agosto 10, 2013, 2013, accessed July 25, 2014, http://www.youtube.com/watch?v=j8hARzP_agM&feature=youtube_gdata_player. 149

UNCLASSIFIED

D. Foreign Intelligence Operations In the old days (about 30 years ago), the intelligence and counterintelligence collection efforts on “open source” information were very limited and heavily influenced by locality and human efforts (HUMINT). In this research, it was determined that social media impacted several areas in the foreign intelligence operations including clandestine operations. One of the good things the US State Department has digital diplomacy departments, which include personnel in diplomatic posts and in the IC.153 These individuals work hard to monitor social media and respond to social media posts. Peter J. Jun writes, “old threats to international stability still exist, as the rise of a ‘new world disorder’ has precipitated new challenges to international law and order.”154 Because Foreign Policy plays an important role in the IC, SOCMINT is found to be able to see what people in different parts of the world are thinking. Major Daniel B. Sheets of the U.S. Air Force wrote a paper titled, “Social Media and Open-Source Intelligence Resources for the Modern Foreign Area Officer.”155 Sheets writes, “The human factor is often the most important and most difficult factor to accurately gauge. It has always presented particular problems for anyone tasked to make accurate assessments.”156 Sheets also discusses how social communications with people vary but having the right programs to analyze social networks and communications in open-source including social media are extremely important for intelligence purposes.157 OSINT was collected a hundred years ago or even longer and it has played a very important role in foreign policy.

153

Rozin, Social media is. Peter. J. Jun, “Spy versus spy,” Harvard International Review, 17, no. 1 (95 1994): 60, accessed May 20, 2014, International Security & Counter Terrorism Reference Center, EBSCOhost. 155 Daniel B. Sheets, “Social Media and Open-Source Intelligence Resources for the Modern Foreign Area Officer,” FAOA Journal of International Affairs 16, no. 2 (2013): 5, accessed July 25, 2014, EBSCOhost. 156 Sheets, Social Media and Open-Source, 5. 157 Ibid. 154

UNCLASSIFIED

Another example, on July 17, 2014, Malaysia Airlines Flight 17 was shot down with a missile while flying eastern Ukraine. A big debate as to who is responsible for firing the missile continues. Accusations from both sides continue to blame each other. Russia said that it was Kiev and the rest of the world said that it was the pro-Russian rebels. On July 20, 2014, Ishaan Tharoor wrote that some rebel fighters had been bragging in social media about shooting down a plane in the Donetsk region—posts that were later deleted when they learned it was a civilian carrier.158 Removing the posts did nothing because the IC already had proof of every post. Therefore, monitoring social media in conflict areas is very important. While social media helps the rebels build social approval, it can also backfire. The US State Department has been highly effective in social media by “decentralizing” their social media monitoring to every location they have a physical presence. This research will only cover a few areas that social media has impacted in the area of foreign intelligence operations. Now, this research will discuss some of the impacted areas in more detail. Some History of OSINT Before the information age and the Internet, OSINT was obtained by cutting newspaper stories and making notes on the margins. The collection efforts would be sent with any other physical information collected to corroborate the OSINT. Human collectors of OSINT were common in every single diplomatic, military, and other government posts by the US. This involved a daily routine of obtaining the newspapers of the entire region in order to collect only

Ishaan Tharoor, “The evidence that may prove pro-Russian separatists shot down MH17,” Washington Post, July 20, 2014, accessed July 27, 2014, http://washingtonpost.com/blogs/worldviews/wp2014/07/20/theevidence-that-may-prove-pro-russian-separatists-shot-down-mh17. 158

UNCLASSIFIED

what was important. After the collection, a diplomatic bag would be closed with the file or folder, along with any additional intelligence. If the information required immediate attention, a diplomatic cable could be sent out to headquarters. Intelligence collection as well as counterintelligence collection was a matter of being there and having sources on the ground collecting the information. In a more covert way, infiltrating a social network of a target required a covert operator or operators. Identifying a social network of a target today has become much easier with social media. An intelligence collector can identify a social network of a target and categorize it as local, regional, national and international. Equally as important is the visualization of these virtual social networks and OSINT. Digital communications are leading a revolution for formal and informal social networks and creating new network structures, according to Matthias Tier.159 Visualizing these networks in SOCMINT and OSINT is the “new thing” in the IC. Provided SOCMINT is obtained from all the different processes including visualization of the target network and all other OSINT, it can then be used to complement classified information.160 Therefore, OSINT along with SOCMINT are powerful tools and it appears the evolution continues—as they make history. The Relationship of SOCMINT and HUMINT The Internet of course facilitated collection but in many places the “old methods” are still in practice. SOCMINT and OSINT will never replace HUMINT. The introduction of the Internet brought technology that facilitated massive open source collection and analysis. Also, HUMINT

Matthias Trier, “Towards Dynamic Visualization for Understanding Evolution of Digital Communication Networks,” Information Systems Research 19, no. 3 (September 2008): 335, accessed July 26, 2014, EBSCOhost. 160 SHEETS, Social Media and Open-Source, 6. 159

UNCLASSIFIED

relies on OSINT and SOCMINT more than ever before. Algorithms now make some of the decisions on what to collect and the evaluation process for open source information collected is no longer taking a long time to process. SOCMINT as the new open source discipline complements all other legacy intelligence collection and analysis efforts, such as HUMINT. Software developers, social scientists, intelligence operators and analysts, and natural language process (NLP) experts come together to create the best OSINT and SOCMINT programs. Decision-making is also an extremely short and highly effective process (regardless of final outcomes). The blogs and microblogs and alternative media outlets in the Internet began to change the old traditional ways to collect open source and produce OSINT available to the analysts. Before the invention of the computer and the Internet, OSINT analysts had to be professional librarians. Records were in microfilm and hardcopies. The OSINT analyst was a researcher and librarian. Today, things are much different. In retrospect, this may be the reason why analysts in the IC tried to stay away from OSINT. SOCMINT now assists HUMINT in many different ways, while it will never replace it. The HUMINT operators use OSINT and SOCMINT to become familiar with a location and people, days, weeks, months, and even years before deployment. In fact, the operator could spend time while in the US building a social media profile with strong local relationships of a target location and human targets. When the operator is ready to go to the location a real human network will be waiting. Infiltrating social networks of the target(s) and dealing with the vetting processes by the target or targets are very delicate and should never be left to chance or on the hands of the inexperienced.

UNCLASSIFIED

Social Media for Foreign Intelligence Operations A way for the intelligence and counterintelligence collectors to see what people say, the pictures and videos they take is to monitor the target location. With social media, it is possible to launch and intelligence and counterintelligence operation, inside the US and outside the US with little difficulty. Social media can assist to identify, follow, and perform any kinds of intelligence activities where the US Constitution may not be applicable. In the US investigative activities as long as they are performed on open source should never pose a Fourth Amendment or a privacy problem. Social media gave intelligence professionals the ability to survey the minds of millions of users of social media. The impact for example in the collection process was a complete shock to these who had for the longest time stated that SOCMINT was useless or that it was not reliable. True that reliability is a process where the analyst ensures that the SOCMINT is somewhat reliable. The process to categorize and evaluate SOCMINT was explained earlier in this research. Purpose, priorities, collection, analysis, and monitoring are processes that must be considered in SOCMINT. The Social Media Influencers Foreign intelligence is a process that is complicated and poses many challenges to intelligence collectors and analysts. However, SOCMINT has made that process somewhat easier. In the area of foreign intelligence operations, finding the social media influencers is very important regardless of the foreign operation. Finding the influencers works great for counterinsurgency and insurgency operations, as well as covert action. The influencers have a lot

UNCLASSIFIED

of power to control what happens on the ground and they have friends or followers they can influence from the mobile phone. In a paper by the Journal of Networks, titled “Predicting User Influence in Social Media,” several points are made that are direct impacts on foreign intelligence operations.161 In the paper the authors recognize that social media is changing the way people interact with others, the way they get their news, the way they purchase things, and many of the people carry significant influence.162 During an intelligence operation, collection of OSINT and SOCMINT are important steps in order to identify the influencers. In the Venezuelan unrest that started in February 2014, the influencers were able to move the masses. The protests were coordinately in the most important cities besides Caracas with great precision. In the same paper, they discuss three ways to analyze the social media influencer. They suggest that the influencer should be analyzed by the number of followers, retweets, and mentions in Twitter.163 Predicting and analyzing moves from these influencers are possible with SOCMINT. Clandestine Operations A social media post by a terrorist group executing five people may have different meaning to intelligence collectors and analysts. However, that one post can provide valuable intelligence such as: routines, geography and terrain, locations frequented, identities of the people being killed, other people in the terrorist group, weapons, and equipment. When social media is collected, it is channeled in a collaborative effort in the IC. Any SOCMINT can be used 161 Chunjing Xiao et al., “Predicting User Influence in Social Media.,” Journal of Networks 8, no. 11 (November 2013): 2649, accessed July 23, 2014, http://search.ebscohost.com/login.aspx?direct=true&db=iih&AN=93332688&site=ehost-live. 162 Xiao et al., Predicting User Influence,2649. 163 Ibid.

UNCLASSIFIED

to supplement other intelligence collection efforts. See Appendix D for details on a collection in Iraq during the US bombings against ISIS. With the use of SOCMINT, the intelligence analyst could quickly map the social network of a target or have an idea of what is taking place on the ground. In the Appendix D, even coordinates are provided. Limitations of Social Media Before social media came into existence, intelligence operations required Human Intelligence (HUMINT) collectors on the ground, especially in clandestine operations. HUMINT is still one of the most important intelligence collection disciplines for the IC. It is a fact that technology will never be able to replace the value of HUMINT. In some parts of the world, where technology is nearly non-existent, recruiting “Assets” and “Volunteers” requires the intelligence operator to make personal contact with the targets for recruiting. The social networks in these places are local with low technology or no technology adaptation. In low technology locations, OSINT can come to the aid of the operator and analyst. Another alternative is to monitor keywords from all open sources and try to analyze all that information, which includes social media posts from people outside the target zone. Therefore, SOCMINT is very dynamic. The social and human networks are very expensive to monitor because intelligence must be obtained by HUMINT for the most part. On the other hand in places where social media is widely used, social media now allows the recruiter to see the potential targets and possibly recruit them on the web, via social media. For example, a target from a foreign embassy posts in Facebook that he or she is looking for a job for his or her spouse. A part of SOCMINT is monitoring the location for social media that can open the door to the intelligence operator.

UNCLASSIFIED

The Involuntary Intelligence Collector for the IC It is important at this juncture in the research to point out that individuals not targeted by intelligence operations (Assets or Volunteers) posting social media have now become “involuntarily information collectors” for intelligence professionals. For example, in the Boston Marathon Bombings, many people who were just taking pictures, videos and writing text about the event. According to Omand, et al., “passive bystanders can become active citizen journalists, providing and relaying information from the ground.”164 The people at the Boston Marathon were busy with their mobile devices and they all become victims and witnesses of a terrorist attack. After the bombings, the people with their mobile devices became important witnesses for the investigation. As the result, social media provides a good way to have eyes on the ground anywhere in the world where social media is used, and produce SOCMINT. The involuntary SOCMINT collector is a valuable asset to the IC in foreign operations. Social Media Privacy Concerns in Foreign Operations As mentioned earlier, the debate of privacy and government intrusion into social media divides society in the United States. There is no consensus and it is unlikely that these diverse opinions will ever come to a consensus on privacy. Social media when posted open to the public is considered open source just like the license plate of anyone driving a car. Omand, et al., makes a distinction between “open sources” SOCMINT and “intrusive intelligence gathering,” and that intelligence collectors and analysts must know that intrusive collection is regulated by legislation in most cases.165 So, why should people be concerned with the social media collection efforts by

164 165

Omand, Bartlett, and Miller, Introducing Social Media, 804. Ibid., 820.

UNCLASSIFIED

the US government in open sources? It is not an easy question to answer. Regardless of public opinion, in foreign operations the privacy concerns do not apply to the IC. Foreign Governments SOCMINT Collection Efforts It is uncertain how much social media foreign governments are performing in the US or in other countries, including their own countries. A big misconception is that because a government uses censure for social media, it may mean they have nothing to do with exploiting social media. The governments of China, Syria, and Iran impose restrictions on the use of social media but gather social media for intelligence purposes—not only inside their countries but also outside their countries. Businesses are also engaging in social media mining because it offers ample opportunities to learn about their customers and the competition. They can even use it for recruiting or engage in corporate espionage. It is possible to argue that businesses would like social media information to continue to be widely available and not restricted or regulated in any way. Some places in Europe are considering restricting some of the mining of social media but there has not been any legislation passed yet. Criticism about how much data mining takes place on social media has come from the American Bar Association, on an article titled “Privacy and Social Media.” Theodore F. Claypoole explains the difficulties with the level of intrusion into the privacy of people with social media.166 Foreign intelligence operations are a real threat that should not be ignored.

Teodore F. Claypoole, “Privacy and Social Media,” American Bar Association, January 1, 2014, accessed July 23, 2014, http://www.americanbar.org/publications/blt/2014/01/03a_claypoole.html. 166

UNCLASSIFIED

Special Activities Division (SAD) Social media impacted the clandestine activities of the National Clandestine Service (NCS) responsible for covert operations. The two groups in this division: Special Operations Group (SAD/SOG) for tactical paramilitary operations and the Political Action Group (SAD/PAG).167 This part of the research is concerned with the impact of social media in Covert Political Action, Insurgency and Counterinsurgency Operations. It is important to clarify that this section will not go into operational techniques and strategic illustration on past, recent, ongoing, or future operations. This section contributes to the research on the impact of social media to foreign intelligence operations the IC is engaged on a regular basis. This topic is important because social media impacted the operations by the SAD in measurable ways. The Benghazi incident, the Arab Spring, the attack to the Westgate Mall by alShabaab militants on September 21, 2013, the unrest in Venezuela and the missile strike of MH17 over eastern Ukraine, to name a few are all examples where social media played a big role. In Venezuela, at the time of this research social media still plays a significant role. However, President Nicolas Maduro has been targeting the influencers in social media by searching their homes and arresting them. It is not clear how long the fight will go on between the protesters and the government in Venezuela. In regards to Covert Political Action, on April 3, 2014, a revelation came out that the CIA had created a Cuban Twitter to overthrow Castro. David Stout writes that the US had been working via backchannels to fund programs to create a social media platform called ZunZuneo to

â&#x20AC;&#x153;National Clandestine Service (NCS),â&#x20AC;? Central Intelligence Agency (CIA), accessed July 17, 2014, https://www.cia.gov/library/publications/additional-publications/devotion-to-duty/national-clandestine-servicencs.html. 167

UNCLASSIFIED

allow Cubans to get into social networking and someday revolt against the Cuban regime.168 It reached about 40,000 followers but stopped because the funding stopped and the idea failed.169 The idea of the Cuban Spring is something that continues to be explored. Connecting the masses is a very powerful way to cause a revolution. In recent history, even before social media, the power of bringing people together showed its force. The intelligence service of Cuba is getting a good amount of training and practice in Venezuela. One of the biggest concerns in the IC may be if revolutions without social media could ever be launched. During the Tajikistan’s civil war in 1992 (before social media), it was discovered that connecting masses with the elites at local, national levels via social networks was one of the most effectives ways for activation and mobilization.170 A gift for SAD today is that the organizing of these masses may take place thousands of miles inside computer labs where the specialists begin to build these human networks on the ground. Social networks are key in any covert operation. Tajikistan provides many lessons for the SOCMINT collector and analyst. Kilavuz writes, “At the local level, networks connected elites with the masses at the level of the kolkhoz [collective farms, in the US could be called cooperatives]. These ties were based on localism, kinship and /or patronage relationships.”171 Here lies the importance of knowing the culture before any operation with social media; if social media is available. The new generations of intelligence practitioners may never get their arms around the idea of managing an overthrow of

David Stout, “Report: U.S. Officials Created a ‘Cuban Twitter’ to Overthrow Castro,” TIME.com, n.d., accessed August 2, 2014, http://time.com/47912/u-s-officials-created-a-cuban-twitter-to-overthrow-castroreport/. 169 Ibid. 170 Idil Tuncer Kilavuz, “The Role of Networks in Tajikistan’s Civil War: Network Activation and Violence Specialists,” Nationalities Papers 37, no. 5 (September 2009): 693, accessed July 26, 2014, EBSCOhost. 171 Kilavuz, The Role of Networks, 696. 168

UNCLASSIFIED

a government without social media. However, low technology insurgencies and revolutions are still possible. It is highly unlikely that there will be any revolutions in the 21s Century without the assistance of social media. On a related subject, the CIA has been questioned in the past of whether objective intelligence product and operations on foreign governments should be handled under the same agency.172 This research does not debate or discuss the different opinions and simply deal with the impact the divisions that handle foreign operations for the CIA and the Department of Defense (DOD). The complexity of the criminal and terrorist networks makes SOCMINT more important than ever. Social networks are compilations of entities, people, groups, and organizations that are connected. They must be analyzed by individual social network, by the group structure, and by the group interactions.173 Protecting US assets and interests as well as performing foreign operations under SAD are crucial and necessary for US national security and to protect the interests of the US. Covert action has had strong resistance by the US legislators and the White House. One example is the intervention in Angola in 1975. According to Robert Gates, after Vietnam the CIA began a process to abandon and terminate most covert action officers.174 By the time Angola came in, the CIA was not ready.175 Today, while not confirmed, the situation in Venezuela reflects that there is a possible lack of HUMINT on the ground from the US. The Russians and the Cubans are aiding Maduro’s administration since the unrest began in the middle of February 2014. Russia and Cuba have sent sophisticated equipment and assets to the country to assist Todd Stiefler, “CIA’s Leadership and Major Covert Operations: Rogue Elephants or Risk-Averse Bureaucrats?,” Intelligence & National Security 19, no. 4 (2004): 632, accessed July 17, 2014, EBSCOhost. 173 David Bright, Caitlin Hughes, and Jenny Chalmers, “Illuminating Dark Networks: A Social Network Analysis of an Australian Drug Trafficking Syndicate,” Crime, Law & Social Change 57, no. 2 (March 2012): 153, accessed July 29, 2014, EBSCOhost. 174 Stiefler, CIA’s Leadership, 639. 175 Ibid. 172

UNCLASSIFIED

Maduro. China is also heavily involved by making loans to Venezuela. So far, (U) reports indicate that these foreign intelligence operators are working in counterinsurgency operations and propaganda campaigns. In MENA, the impact of social media was significant. In Tunisia, Egypt, Libya, Yemen, and 22 Arab countries, social media mobilized and empowered people to voice their own opinions.176 Many of these governments underestimated the power of social media. In Egypt, the people even showed that they can ask for change and if they do not like the change, they will ask for change again. Counterterrorism (CT) The war against terrorism requires that all available intelligence tools be used in order to succeed. Earlier in this research the terrorism topic was terrorism that occurs inside the US, regardless, if the actors domestic or international. SOCMINT has shown significant value in for CT operations, as well. Terrorists today depend on social media to recruit and form alliances with other terror groups. While the Dark Web still plays a role in the terrorist groups, social media has become the primary way to spread their message. Because social media is giving sympathizers and terrorist â&#x20AC;&#x153;wannabesâ&#x20AC;? a global platform, CT personnel need to be able to exploit every available channel. It is important to discuss the important points where social media has impacted in the area of CT, since it is an extensive field.

176

Wiest and Eltantawy, Social Media Use, 211.

UNCLASSIFIED

Terrorism Financing and Social Media One of the disturbing facts that social media created for the terrorist groups was the ability to get money to finance their terror operations. Rick McDonell, from the Financial Action Task Force (FATF) explains, “IT has made it easier for people to finance terrorism and created opportunities to cover up the money laundering activities.”177 The terrorist organization also has the ability to create different organizations that may claim to be charitable and peace seeking. SOCMINT can assist to identify these organizations and the members. After identification, FATF can freeze their available money and confiscate their cash and property. It is a process that takes a lot of time and a lot of investigative work behind it. Social Media is the New Jihadi Recruitment Tool The availability of social media has impacted the counterterrorism efforts in many fronts. It would be great if the CIA were able to have a presence in social media and attempt to work with youth overseas to stop them from joining jihad. The reality is that unlike other members of the IC, the CIA does not lend itself to “Terrorism Prevention.” Perhaps it is a new concept that must be entertained as the CIA now has its own Twitter account. However it is unlikely that it will even achieve the same reputation as the Drug Enforcement Administration (DEA) in their drug prevention campaigns. With the help of social media extremists and terrorists are able to post social media posts from the battleground. See Appendix D for SOCMINT collected in Iraq. Karen Leigh and Bruce Crumley state that these terrorist in the middle of a warzone in Syria are able to recruit Western

Rick McDonell, “Combating Terrorist Financing in the Information Age,” OECD Observer, no. 293 (2012): 20, accessed July 26, 2104, EBSCOhost. 177

UNCLASSIFIED

Muslims because they are able to see what they are doing real time.178 The constant flow of postings along with the use of certain Hashtags and the message is getting across. This is another example on how SOCMINT can assist in identifying these individuals for purposes of CT. Leigh and Crumley also explain that with social media they are able to channel people to other sites such as “Ask” and there they can do Q&A with their fans and financial supporters. Social Media as a Counterterrorism Tool Just how much monitoring can be done in a nation in order to be effective is a matter of opinion. SOCMINT is explored by Israel, the US, and United Kingdom, and India (to name a few), as a CT tool. Some other countries in the Middle East have also implemented systems to monitor social media. There are two things that stand out during the Mumbai terrorist attacks, according to Nachsin.179 The first one was the ability for the terrorists to disseminate their selfproduced media and the second was just how much social media information was discovered regarding terrorism—after CT monitoring of keywords had begun in India.180 The terrorists group responsible for the attack in Mumbai had been active in social media and blogs. It appears that the government of India had not been using the SOCMINT for CT operations to attempt to prevent any terrorist attacks. Monitoring key words and figuring out what it all means is the first thing in SOCMINT. With countries based on democracy and liberty, it is important to be able to identify real threats from thousands of posts. When other factors are taken into account, the SOCMINT analyst can

178 Karen Leigh and Bruce Crumley, “New Jihadi Recruitment Tool: Militants’ Instagram Accounts,” The Christian Science Monitor, last modified June 10, 2014, accessed June 11, 2014, http://www.csmonitor.com/World/Middle-East/2014/0610/New-jihadi-recruitment-tool-militants-Instagramaccounts. 179 Nachsin, Terrorism And The Use Of Social, 18. 180 Ibid.

UNCLASSIFIED

connect the dots. The 9/11 Commission revealed that there were four kinds of failures: “imagination, policy, capabilities, and management.”181 SOCMINT in many ways assists the collector and analyst in using their imagination. Policy in SOCMINT for the most part is easy because it is open source. Assessing the capabilities as an intelligence failure that brought 9/11 is also important. SOCMINT can facilitate capabilities by analyzing the network and finding these who may be “capable.” And lastly in terms of management, SOCMINT is a product that can be shared with other members of the IC.

Efstathios D. Mainas, “The Analysis of Criminal and Terrorist Organisations as Social Network Structures: A Quasi-Experimental Study,” International Journal of Police Science & Management 14, no. 3 (September 2012): 265, accessed July 26, 2014, EBSCOhost. 181

UNCLASSIFIED

IX. Conclusion One of the biggest developments in the intelligence field is the invention of social media. The impact of social media in the IC has been profound. People around the world have been adopting the social media technology to network with family and friends. People also discovered that they could extend their social networking reach with social media. While some countries are still slow in adopting social media, others are quickly allowing the deployment of any social media platform that comes to the market. The IC today faces many other challenges in the secret collection efforts as terrorist organizations such as GIMF, Al-Fajr Technical Committee and ISIS have revamped their encryption programs, after the Edward Snowden leaks.182 The ability to merge all available secret and open source intelligence collected is necessary. In politics, social media has given politicians a platform to meet and interact with people but social media has also empowered people and society to speak up. Social media is fluid and changing. The opportunities for exploitation of social media for intelligence purposes are just beginning to be discovered. The experience in the Middle East and North Africa is without a doubt a great example that social media can bring thousands or millions of people together to overthrow a government. Just like social media has been a great invention, criminals have also been able to capitalize in the technology to inflict harm to society. Criminal organizations have the ability to access open source information about people in the US and make them easy targets for fraud. Countries like the US have become big profit makers for organized crime. SOCMINT is able to monitor some

182

â&#x20AC;&#x153;How Al-Qaeda Uses Encryption Post-Snowden (Part 1),â&#x20AC;? Recorded Future, accessed August 13, 2014, https://www.recordedfuture.com/al-qaeda-encryption-technology-part-1.

UNCLASSIFIED

of these criminals and launch counterattacks. Unlike OSINT, SOCMINT can be used for defensive and/or offensive operations. Social media has also been the reason for the fall of many high profile criminals, as well. As an investigative tool, the arrests of Serafin Zambada and Jose Rodrigo Arechiga Gamboa aka “El Chino Antrax” are two examples of what is possible with SOCMINT. While the research covered extensively the impact of social media in the IC, additional points can be made about other social networking opportunities. Some of these opportunities include: weblogs, microblogs, online forums, wikis, podcasts, life streams, social bookmarks, Web communities, social networking (covered in this research), and avatar-based virtual reality, all platforms important for social networking.183 These platforms also have impacted the IC and more research is needed to find ways to exploit these channels for SOCMINT. Mobility has transformed SOCMINT collection and analysis, as more social media applications become available to the public. Google Glass is one development that allows users to interact with the real and virtual worlds via their eyes. The intelligence field has not seen so many changes in the collection and analysis processes until the Internet and social media arrived. Adapting to change and integrating new social media technologies are two things that the IC must do. On a related subject, this research revealed also that the US law enforcement communities are late adopters of SOCMINT technology, while criminals are considered early/fast adopters. This phenomenon is creating a real advantage for the criminals. While SOCMINT alone is not the silver bullet for society’s problems, OSINT today is playing a serious role in the IC. More research is needed in the

183

Daniel Zeng, Hsinchun Chen, Robert Lusch, and Shu-Hsing Li, "The Power of Social Media Analytics," Communications Of The ACM 57, no. 6 (June 2014): 74-81, accessed July 25, 2014, Applied Science & Technology Source, EBSCOhost.

UNCLASSIFIED

integration process of some of these SOCMINT platforms because in this research not one of them has all the tools an analyst needs to complete a full SOCMINT report or briefing. In many occasions, up to five different platforms had to be used. As technology continues to improve in SOCMINT, it is important to continue to develop technology to better collect and analyze OSINT. The real world is a complex world with or without social media. The virtual world in social media is even more complex. Social media provides today a different way to view conflict and social unrest. No longer do people have to wait for the mainstream media to tell them what is happening. Social media most times will beat mainstream and provide information real time. More research is required to further explore the different opportunities for SOCMINT, when it comes to integration with OSINT. The limitations of SOCMINT are minimum. Also, crowdsourcing solutions via social media are opportunities that social media brings to the IC. Existing technology in the market place to produce SOCMINT continues to be tailored for the private sector. Therefore, more R&D is required to build technology for IC and law enforcement purposes. The reality is that between the low and the high technology operations, social media will continue to challenge the IC in the years to come. Low technology operations will not have much use for social media, but social media could be used to obtain support from the target. As more information becomes indexed and that information becomes available in the WWW, OSINT and SOCMINT are going to continue to be important intelligence disciplines. It is nearly impossible to see SOCMINT as a standalone intelligence discipline because it intervenes in so many functions in the IC that perhaps it should remain as it is i.e. part of OSINT. The algorithms and NLP are technologies able to analyze in seconds half a billion posts in

UNCLASSIFIED

Facebook, Twitter, and Instagram. Knowing how many people in Chicago have posted the word “shooting” in social media can take less than 1 minute. The “American Theory of Intelligence” must continue to be explored in future research, especially in regards to technology. Research should continue to find better technology and better processes to interpret the interactions of humans in the world. SOCMINT can meet all the objectives and tasks that the IC demands, even as a supplemental intelligence product. SOCMINT can be used for tactical, strategic and actionable intelligence. It is also a great investigative tool, as it was seen after the Boston Marathon bombings. The social media impact in all five intelligence disciplines has been evidenced in this comprehensive research. The “American Theory of Intelligence” is a promising research theory. Criminals and terrorists are not going to be deterred by the IC or any other government. In the age of speed and mobility, only the proactive culture in the IC will assure success. The risks are real and the threats are complex and asymmetric. The research moved some ideas and concepts in the impact of social media onto the front burner. Social media is not going anywhere and it is in constant evolution. The applications of SOCMINT in this research are practicable and effective. Social networking technology is going to improve and will continue to innovate and surprise the IC. The idea of embedding intelligence into objects is the next frontier in the intelligence field. A paper titled, “Toward a social web of intelligent things,” describes with great detail how it will be possible to have intelligence implanted in many of the things people use.184 Among some of the points the authors write are that “in order to be intelligent a thing should have many capabilities, including the ability to support natural and personalize

Luca1 Console et al., “Toward a Social Web of Intelligent Things,” AI Communications 24, no. 3 (September 2011): 265, accessed July 26, 2014, EBSCOhost. 184

UNCLASSIFIED

interaction, the ability to manage knowledge and exchange it with people and, most notable, social abilities.â&#x20AC;?185 The opportunities to come in social networking/social media are endless. SOCMINT is just scratching the surface of what is to come. The IC must be in a position to be ready when the new technology arrives. Today and this very moment the opportunity is found in SOCMINT, while the IC continues to assess the impact of social media. The comprehensive assessment of the impact of social media in the Intelligence Community in this research is a good start.

185

Console et al., Toward a Social Web, 265.

UNCLASSIFIED

Bibliography Alterman, Jon B. “The Revolution Will Not Be Tweeted.” Washington Quarterly 34, no. 4 (October 2011): 103–116. Accessed July 29, 2014. EBSCOhost. Banerjee, Soumya and Nitin Agarwal. “Analyzing Collective Behavior from Blogs Using Swarm Intelligence.” Knowledge & Information Systems 33, no. 3 (December 2012): 523–547. Accessed July 29, 2014. EBSCOhost. Bright, David, Caitlin Hughes, and Jenny Chalmers. “Illuminating Dark Networks: A Social Network Analysis of an Australian Drug Trafficking Syndicate.” Crime, Law & Social Change 57, no. 2 (March 2012): 151–176. Accessed July 29, 2014. EBSCOhost. Chunjing Xiao, Yuhong Zhang, Xue Zeng, and Yue Wu. “Predicting User Influence in Social Media.” Journal of Networks 8, no. 11 (November 2013): 2649–2655. Accessed July 23, 2014. EBSCOhost. Claburn, Thomas. “CIA Monitors YouTube For Intelligence.” InformationWeek. Accessed May 25, 2014. http://www.informationweek.com/cia-monitors-youtube-forintelligence/206105311. Console, Luca1, Ilaria1 Lombardi, Claudia1 Picardi, and Rossana2 Simeoni. “Toward a Social Web of Intelligent Things.” AI Communications 24, no. 3 (September 2011): 265–279. Accessed July 26, 2014. EBSCOhost. Crampton, Thomas. “Social Media in China: The Same, but Different.” China Business Review 38, no. 1 (January 2011): 28–31. Accessed July 29, 2014. EBSCOhost. Creswell, John W. Research Design: Qualitative, Quantitative, and Mixed Methods Approaches. Los Angeles: Sage Publications, Inc., 2009. Accessed July 23, 2014. EBSCOhost. Crowe, June, and Thomas S. Davidson II. “The ‘Grey’ Intersection of Open Source Information and Intelligence.” Grey Journal (TGJ) 5, no. 3 (2009). Accessed July 5, 2014. Academic Search Premier, EBSCOhost. Dean, Geoff, Peter Bell, and Jack Newman. “The Dark Side of Social Media: Review of Online Terrorism.” Pakistan Journal of Criminology 3, no. 3 (January 2012): 107–126. Accessed July 26, 2014. EBSCOhost. Dinneen, Mark. "The Chávez Government and the Battle Over the Media in Venezuela." Asian Journal Of Latin American Studies 25, no. 2 (June 2012): 27-53. Academic Search Premier. Accessed June 12, 2014. EBSCOhost. “ECONOMIC ESPIONAGE.” Washington Quarterly 19, no. 4 (October 1996): 172–73. Accessed June 12, 2014. EBSCOhost. Eijkman, Quirine, and Daan Weggemans. “Open Source Intelligence and Privacy Dilemmas: Is It Time to Reassess State Accountability?” Security & Human Rights 23, no. 4 (December 2012): 285–96. Accessed July 17, 2014. EBSCOhost.

UNCLASSIFIED

Faint, Charles D. “Exploitation Intelligence (EXINT): A New Intelligence Discipline?” American Intelligence Journal 29, no. 1 (March 2011): 65–69. Accessed July 17, 2014. EBSCOhost. Fellman, Phillip V. et al. “Disrupting Terrorist Networks—A Dynamic Fitness Landscape Approach.” New England Complex Systems Institute, (August 12, 2007). Accessed July 17, 2014. http://necsi.edu/events/iccs7/papers/260ac11fea9946cfeb6da3e9fa2a.pdf. Frantz, Terrill L. and Kathleen M. Carley. “A Formal Characterization of Cellular Networks,” Carnegie Mellon University, CMU-ISRI-05-109, (September 2005): 5. Accessed July 17, 2014. http://www.casos.cs.cmu.edu/publications/papers/CMU-ISRI-05-109.pdf. Glenny Misha and Ronald Davis. “Organized Crime in a Network Society.” Journal of International Affairs, JIA SIPA. accessed July 26, 2014. http://jia.sipa.columbia.edu/organized-crime-in-a-network-society. Grabo, Cynthia M. Anticipating Surprise: Analysis for Strategic Warning. Maryland: University Press of America, 2004. Guseva, Alya. “FRIENDS AND FOES: INFORMAL NETWORKS IN THE SOVIET UNION.” East European Quarterly 41, no. 3 (Fall2007 2007): 323–47. Accessed June 12, 2014. Academic Search Premier, EBSCO Host. Hauptmann, Stefan and Thomas Steger. 2013. "A brave new (digital) world"? effects of in-house social media on HRM**/"A brave new (digital) world"? konsequenzen von in-house social media für das personalmanagement. Zeitschrift Für Personalforschung 27, no. 1 (2013): 2646. Accessed July 6, 2014. ProQuest. Heighington, Andrew. "Homeland Security in Real-Time: The Power of the Public and Mobile Technology." Homeland Security Affairs 7, no. 1 (February 2011): 1-6. Accessed July 24, 2014. International Security & Counter Terrorism Reference Center, EBSCOhost. Hulnick, Arthur S. “What’s Wrong with the Intelligence Cycle.” Intelligence & National Security 21, no. 6 (December 2006): 959–979. Accessed July 26, 2014, EBSCOhost. Hutchins, Christopher and Marge Benham-Hutchins. "Hiding in plain sight: criminal network analysis." Computational & Mathematical Organization Theory 16, no. 1 (March 2010): 89111. Accessed June 12, 2014. Applied Science & Technology Source, EBSCOhost. Jens, Erik D. “ONE NATION UNDER SURVEILLANCE: A NEW SOCIAL CONTRACT TO DEFEND FREEDOM WITHOUT SACRIFICING LIBERTY.” American Intelligence Journal 30, no. 1 (March 2012): 155–56. Accessed June 12, 2014. EBSCOhost. Jun, Peter J. "Spy versus spy." Harvard International Review 17, no. 1 (95 1994): 60. Accessed May 20, 2014. International Security & Counter Terrorism Reference Center, EBSCOhost. Kılavuz, Idil Tuncer. “The Role of Networks in Tajikistan’s Civil War: Network Activation and Violence Specialists*.” Nationalities Papers 37, no. 5 (September 2009): 693–717. Accessed July 26, 2014. EBSCOhost. UNCLASSIFIED

UNCLASSIFIED

Mainas, Efstathios D. “The Analysis of Criminal and Terrorist Organisations as Social Network Structures: A Quasi-Experimental Study.” International Journal of Police Science & Management 14, no. 3 (September 2012): 264–282. Accessed July 26, 2014. EBSCOhost. Mastrobuoni, Giovanni, and Eleonora Patacchini. “Organized Crime Networks: An Application of Network Analysis Techniques to the American Mafia.” Review of Network Economics 11, no. 3 (September 2012): -1. Accessed July 25, 2014. EBSCOhost. McDonell, Rick. “Combating Terrorist Financing in the Information Age.” OECD Observer, no. 293 (2012): 20. Accessed July 26, 2014. EBSCOhost. Moe, Wendy W. and David A. Schweidel. Social Media Intelligence. Cambridge University Press, 2013. Accessed July 29, 2014. ProQuest. Musial, Bogdan. "Jewish resistance in Poland's eastern borderlands during the second world war, 1939-41." Patterns Of Prejudice 38, no. 4 (December 2004): 371-382. Accessed July 25, 2014. Academic Search Premier, EBSCOhost. Nachsin, Justin Scott. “Terrorism And The Use Of Social Media In Mumbai Attacks.” Journal of Counterterrorism & Homeland Security International 16, no. 4 (2010): 16–19. Accessed June 12, 2014. EBSCOhost. Nakaya, Andrea C. Thinking Critically. San Diego, CA: Reference Point Press, 2013. NEWCOMBE, TOD. "New York City to Consolidate IT." Government Technology 22, no. 11 (November 2009): 8. Applied Science & Technology Source. Accessed July 8, 2014. EBSCOhost. Nieto-Gómez, Rodrigo. "Preventing the Next 9/10: The Homeland Security Challenges of Technological Evolution and Convergence in the Next Ten Years." Homeland Security Affairs 7, no. 2 (September 2011): 1-6. International Security & Counter Terrorism Reference Center. Accessed July 24, 2014. EBSCOhost. Oh, Onook, Manish Agrawal, and H. Raghav Rao. "COMMUNITY INTELLIGENCE AND SOCIAL MEDIA SERVICES: A RUMOR THEORETIC ANALYSIS OF TWEETS DURING SOCIAL CRISES." MIS Quarterly 37, no. 2 (June 2013): 407-A7. Accessed June12, 2014. Business Source Complete, EBSCOhost. Omand, David, Jamie Bartlett, and Carl Miller. "Introducing Social Media Intelligence (SOCMINT)." Intelligence & National Security 27, no. 6 (December 2012): 801-823. Accessed July 6, 2014. International Security & Counter Terrorism Reference Center, EBSCOhost. Reinert, John T. "In-Q-Tel: The Central Intelligence Agency as Venture Capitalist." Northwestern Journal Of International Law & Business 33, no. 3 (Spring2013 2013): 677709. Accessed July 25, 2014). Business Source Complete, EBSCOhost. Rowles, Daniel. Mobile Marketing: How Mobile Technology Is Revolutionizing Marketing, Communications and Advertising. London: Kogan Page, 2013. UNCLASSIFIED

UNCLASSIFIED

Sánchez Abril, Patricia, Avner Levin, and Alissa Del Riego. “Blurred Boundaries: Social Media Privacy and the Twenty-First-Century Employee.” American Business Law Journal 49, no. 1 (2012): 63–124. Accessed July 6, 2014. EBSCOhost. Sarıhan, Ali. “Is the Arab Spring in the Third Wave of Democratization? The Case of Syria and Egypt.” Turkish Journal of Politics 3, no. 1 (2012): 67–85. Accessed July 28, 2014, EBSCOhost. Schmidt, Eric, and Jared Cohen. The New Digital Age: Transforming Nations, Businesses, and Our Lives (Vintage). Reprint ed. New York: Vintage, 2014. SHEETS, DANIEL B. "Social Media and Open-Source Intelligence Resources for the Modern Foreign Area Officer." FAOA Journal Of International Affairs 16, no. 2 (Summer2013 2013): 5-9. Accessed July 25, 2014. International Security & Counter Terrorism Reference Center, EBSCO. Stiefler, Todd. "CIA's Leadership and Major Covert Operations: Rogue Elephants or RiskAverse Bureaucrats?." Intelligence & National Security 19, no. 4 (Winter2004 2004): 632654. Accessed July 17, 2014. International Security & Counter Terrorism Reference Center, EBSCOhost. Treverton, Gregory F, Seth G Jones, Steven Boraz, and Phillip Lipscy. 'Toward A Theory Of Intelligence. Workshop Report' (2006). Accessed June 13, 2014. http://www.rand.org/content/dam/rand/pubs/conf_proceedings/2006/RAND_CF219.pdf. Trier, Matthias. “Towards Dynamic Visualization for Understanding Evolution of Digital Communication Networks.” Information Systems Research 19, no. 3 (September 2008): 335–350. Accessed July 26, 2014, EBSCOhost. Walls, Andrew. “Everyone’s a Spy: Mining Social Media for Security Intelligence.” ComputerWorld Hong Kong 27, no. 10 (December 2010): 22–22. Accessed July 17, 2014. EBSCO. WEIGUO FAN, and MICHAEL D. GORDON. “The Power of Social Media Analytics.” Communications of the ACM 57, no. 6 (June 2014): 74–81. Accessed July 26, 2014, EBSCOhost. Wiest, Julie B., and Nahed Eltantawy. “Social Media Use among UAE College Students One Year after the Arab Spring.” Journal of Arab & Muslim Media Research 5, no. 3 (September 2012): 209–226. Accessed July 26, 2014. EBSCOhost. Wylie, Lana, and Lisa Glidden. “THE ‘CUBAN SPRING’ FALLACY: THE CURRENT INCARNATION OF A PERSISTENT NARRATIVE.” International Journal of Cuban Studies 5, no. 2 (2013): 140–167. Accessed July 29, 2014. EBSCOhost. Xu, Jennifer, and Hsinchun Chen. “Criminal Network Analysis and Visualization.” Communications of the ACM 48, no. 6 (June 2005): 101–107. Accessed July 29, 2014. EBSCOhost. Yar, Majid. “E-Crime 2.0: The Criminological Landscape of New Social Media.” Information & Communications Technology Law 21, no. 3 (October 2012): 207–219. Accessed July 29, 2014. EBSCOhost. UNCLASSIFIED

UNCLASSIFIED

100

Zeng, Daniel, Hsinchun Chen, Robert Lusch, and Shu-Hsing Li. "The Power of Social Media Analytics." Communications Of The ACM 57, no. 6 (June 2014): 74-81. Accessed July 25, 2014. Applied Science & Technology Source, EBSCOhost.

UNCLASSIFIED

101

Appendix A Social Media Activity Chicago, Illinois Weekend of July 4th, 2014

The information was accessed via Geofeediaâ&#x20AC;&#x2122;s Social Media Monitoring platform used by Contingent Security Services, Ltd. On July 7, 2014.

This subject decides he wants to put the Latin Kings Crown down. This would put a death sentence on this individual. Social Media Intelligence can provide the exact location where this subject posted. It can also create a profile of where this individual travels and his entire network. It however requires intelligence analysis.186

186

https://twitter.com/BandsTheMotive/status/486251563040927745/photo/1 (accessed July 7, 2014)

UNCLASSIFIED

102

Appendix B Social media used to post video to threaten all the rival gangs.

In the songs he details the rival gangs and what he plans to do when they drive by his turf.187 Click here to hear the song: http://instagram.com/p/qMzi8RwjTi/

187

http://instagram.com/p/qMzi8RwjTi/ (accessed July 8, 2014).

UNCLASSIFIED

103

Appendix C In LinkedIn, high-level officials must be on their guard on who they accept as contact.

This individual took over this identity from a person online. He or she created a profile and now has made over 491 contacts from several countries. It was reported as an impostor.

UNCLASSIFIED

104

Appendix D Situational awareness from the ground during the ISIS incursion and US bombing attacks.

This preliminary search, discloses that there is a large amount of social media available for SOCMINT analysis. The search took place on August 12, 2014.

UNCLASSIFIED