Social media monitoring, or is it spying?

For some, it is the beginning of an Orwellian surveillance state; for its users, it is simply the expansion of news monitoring. But social media and Internet monitoring is no longer just the domain of marketing and public relations experts.   

Security professionals, law enforcement and private investigators have also realized that social media can provide additional context and unearth information that is not available elsewhere.  

Despite technical and privacy caveats, the monitoring of social media activity is proliferating. 

Social media monitoring techniques in combination with specialized analytics are now widely used in emergency settings as an early warning system, by the intelligence community as another form of open source intelligence, in fraud and criminal investigations, as an enhanced due diligence and know-your-client tool by financial services firms or by private investigators in commercial disputes.  

One of the advantages of social media data, such as tweets or Facebook posts, is their immediate distribution.  

“Twitter is one of the earliest forms of signal. It beats news and it beats 911 calls by minutes and sometimes by hours,” says Bryan Ware, chief technology officer at Haystax Technology, a company that supports law enforcement and emergency services around major events like the Super Bowl with real time information that integrates social media and other data sources, such as camera feeds, or RFID (radio frequency identification) and GPS systems. 

The U.S. Department of Homeland Security, for instance, monitors Twitter to help coordinate its emergency response. DHS’s National Operation Center monitors several hundred Twitter accounts of interest, including those of news organizations, police and fire departments, emergency management agencies and utility companies. 

As part of its social media monitoring program, DHS also tracks a list of keywords such as “attack,” “Al Qaeda,” “terrorism” and “dirty bomb,” as well as seemingly innocuous terms like “pork,” “cloud,” “team” and “Mexico,” the Daily Mail newspaper revealed in 2012. 

The department says it uses the program only to complete the available information picture. “The Department of Homeland Security’s National Operations Center employs social media monitoring for situational awareness purposes only, within the clearly defined parameters articulated in our Privacy Impact Assessment, to ensure that critical information reaches appropriate decision-makers,” DHS spokesman Peter Boogaard told U.S. News & World Report. 

But privacy advocates were alarmed.  

The Electronic Privacy Information Center, a privacy watchdog group, described the choice of words as “broad, vague and ambiguous” in a letter to the U.S. House of Representatives Homeland Security Subcommittee on Counter-terrorism and Intelligence, which held a hearing on the issue. 

EPIC argued the monitoring by the department covers “vast amounts of First Amendment protected speech that is entirely unrelated to the Department of Homeland Security mission to protect the public against terrorism and disasters.”  

The FBI is also looking for tools to effectively monitor social media, such as Facebook, Twitter and blogs, according to a tender released in 2012. The objective is to use the tool to keep abreast of breaking events and emerging threats, the agency said in a Request for Information (RFI) from IT vendors. 

The tool should be a “secure, lightweight web application portal using mashup technology.” In other words, the agency seeks a single graphic interface that displays information from various unrelated sources.  

“The application must have the ability to rapidly assemble critical open source information and intelligence that will allow [the FBI’s Strategic Information and Operations Center] to quickly vet, identify and geo-locate” potential threats, the RFI said. 

However, advocacy groups are concerned that government agencies may be overstepping the mark of specific public safety concerns and should be prevented from collecting information on political opinions, dissent or disagreement with government proposals and representatives. 

The fact that Internet and social media data on individuals is openly available does not necessarily mean it can be freely collected and stored.  

Speaking at the Offshore Alert conference in May in Miami, Ware said one issue for Haystax’s government and corporate customers is the balance between an individual’s civil rights and civil liberties and the desire and need to monitor.  

“That is a very difficult balance. It has been made a lot harder by Edward Snowden’s revelations last year,” he said. “Anything that almost anyone would assume as reasonable is now subject to question.” 

According to Ware, most law enforcement agencies are currently not active on social media unless there has already been a crime committed. Only then are social media used to find known accomplices and places that suspects may have frequented.  

But even on corporate computers it is not certain that there is clear legal authority allowing the monitoring of employee behavior prior to an event taking place, he noted. “This puts you into a reactive regime rather than a proactive regime, which is probably going to be subject to fierce debate over the coming years.” 

On the other side of the preservation of privacy argument are public safety concerns and high profile cases where violent attacks were preceded by open warning signs on social media and the Internet that remained undetected until after the attack.  

Anders Breivik, who in July 2011 bombed government buildings in Oslo, killing eight people, and then killed 69 youngsters in a mass shooting at a youth camp on the Norwegian island of Utoya, was a frequent commenter in extremist, right wing online forums.  

He also had Facebook and Twitter accounts and posted online a manifesto outlining his preparations for the attack.  

Jared Lee Loughner, the man who killed six and injured 13, including U.S. Representative Gabrielle Giffords in Tucson, Arizona, in January 2011 left more than 100 disturbing forum posts at an online gaming site and posted several strange YouTube videos prior to the attack.  

And 22-year-old Elliott Roger, who last month killed six people near the campus of the University of California, Santa Barbara, was described by the New York Post as the first “selfie era killer,” following a series of YouTube videos, Facebook postings and a 141-page manifesto that detailed his sexual frustrations and hatred.  

These indications of extremist and violent tendencies were plain to see. They were not hidden behind passwords and firewalls and had hundreds or thousands of readers or viewers. 

Yet, while it is easy to find out about particular threats on social media after a tip or an incident, it remains very difficult to detect possible threats before the event. After all, not everyone who posts bizarre or disturbed Internet comments is going to carry out violent attacks. 

“Why is it so hard?” asked Ware. “One of the reasons is that people are very curious. It is hard to describe what a normal person is and does, and to define what is abnormal.”  

What can be easy when meeting someone face to face is made all the more difficult when all that is available about someone are only bits of digital information.  

The question is what to look for in all that data and how to process the signal. Generally, the social media security and investigation space is still immature and reliant on experts and investigators who know and understand this space and who can connect the dots. 

“People are really the only ones who see these connections effectively,” said Ware. But experts can be quickly overwhelmed by the magnitude of the data, and the tools have not caught up with the quantity of the data yet. 

Social media monitoring applications are generally not designed for investigators but marketers. They also are not integrated with data that organizations have internally.  

“Most of the time you need both – transactional or network data combined with visibility of what is going on in the outside world,” Ware said. 

This is where new firms are coming in that build applications which integrate various data sources, sort the information using algorithms and prioritize what should be presented to expert analysts. 



D.C. Page, a senior vice president, consulting and investigations, at security firm Andrews International in Miami, uses social media monitoring for a different purpose.  

“The intelligence community and law enforcement are going through this data to anticipate an event or in real time. I kind of migrate into this from an investigative standpoint: how social media monitoring starts to identify perpetrators of crime or fraud,” he said at the Offshore Alert event. 

The purpose of the social media monitoring could be anything from a background investigation on an employee, due diligence in relation to a business transaction or information in support of an ongoing litigation. In addition to the traditional public records and databases as sources of information, social media have become a critical component to any investigation or inquiry, Page said. 

“It is amazing how many people are not looking at social media when they are doing any type of relevant inquiry. And how many people are not protecting the information that they are putting out on social media.” 

Even if people protect their own data on social media, investigators may be drawn to what their friends with lesser privacy settings are going to reveal about them. And data that has been deleted is often still available in website archives and archive databases like 

The biggest challenge for investigators is to identify the subject amid multiple email addresses, legal names, aliases or corporate identities. While software programs can be used to reconcile these, the typical Google and social media searches have to be cross-referenced with historical data.  

From his own investigations, Page said he faces one question over and over again. Why would people reveal so much information about themselves? For instance, in one case a woman had discussed with her brother on Facebook the amount she wanted to extort from a victim. 

A lot of people on Facebook do not turn on their privacy settings or are not aware that they are not fully protected and how much information about them is available online. Moreover, said Ware, narcissistic behavior simply plays out well on social media. 

“There is no greater medium than Facebook to see narcissism rampaging. It is part of our culture now that is useful on the investigation side.”  

Page believes it is also because the youngest users of social media have not been stung before.  

“We know what the repercussions can be if we put certain things on social media and younger people just have not been hurt yet,” he said. “If [one day] they want to become a member of the Bar or they need a security clearance, all this is going to come back to get them.”