Social Media Update: Facebook, Tumblr, and Vine

Recently, social media sites have been making changes to their platforms that are favorable to online researchers. Facebook is making changes to the system which will make it easier to locate users’ timelines. Tumblr has made it easier for users to tag one another and search for tagged content. Also, Vine has implemented a web-based interface with user profiles. All of these changes will assist online researchers in more efficiently gathering information on persons of interest.

Facebook

Screenshot of the warning users see when logging into Facebook

In December 2012, Facebook announced it was going to retire the “Who can look up my timeline by name?” setting using a phase out approach. In October 2013, Facebook reminded the public that this change would be implemented soon. This month, Facebook has ramped up their alerts about the change on both the site and via email. However, they do not have a date for expected full implementation.

This change is very important to follow for online research and analysis. Current restrictions often force us to look at related parties’ Facebook accounts or scrape the link from another site in order to locate individuals who have removed themselves from Graph Search. Once this privacy setting is fully removed, investigations on Facebook will be streamlined. We will be able to locate all users via the Graph Search interface.

Tumblr

Screenshot of Tumblr search results for Game of Thrones language creator dedalvs

On January 14, the Tumblr staff added a post telling users that they should start tagging other users in their posts. Previously, users would communicate by using tags for topics. The search functionality topics worked well, but the search functionality for other blogs/users was limited. Tumblr has recently upgraded their search features to include a user friendly interface and search filters. Now, researchers can search for content related to the user of interest by taking advantage of the usernames embedded in the post.

Vine

Screenshot of Batdad’s Vine profile

On January 3, Vine announced the addition of Vine on the Web. Previously, users were restricted to finding content for Vine users on the mobile application or by finding links to vines embedded in other social media sites. During the creation of Vine on the Web, Vine added online profiles for each user. Profiles list profile information and show the users’ vines and revines (reposts). These profiles will now allow analysts to examine Vine content in one place instead of piecing it together using data fusion techniques.

The Future

Social media is a dynamic system and will never stop changing. Keeping up with these developments is necessary to success in the long run. As investigators, our time is precious. Even the smallest alterations to the social media landscape can present us with new challenges, and this information is vital for us to fine tune our best practices.

3 Key Takeaways from the SMILE Conference

It is fall, so it must be conference season. From September through October, members of the PRISM team will be in various locations across the country. Last week, three members of the PRISM team were in Omaha for the SMILE Conference. As we have a great relationship with law enforcement agencies, we thought it was pertinent to share some of the major takeaways from #smilecon.

Law Enforcement Agencies are Successfully Using Social Media

For those of you who are not familiar with SMILE, it is a conference at which law enforcement agencies network with one another and share best practices regarding the use of social media in law enforcement, from both a marketing and investigative perspective. It allows these agencies to learn new, innovative ways to harness the power of social media to build relationships with the community and combat crime. Throughout the conference, many speakers discussed how their agencies are successfully using social media to keep tabs on known offenders, curtail gang activity, monitor events, respond to disasters, and conduct undercover investigations. Officer Eric Draeger of the Milwaukee Police Department spoke about his department’s success doing a multitude of those things at once: They successfully use social media to disrupt gang activity and prevent incidents from occurring at large public gatherings.

Data Fusion is Imperative

As we wrote about from our experience at the i2 User Conference, agencies are integrating a variety of data sources into their process. With the proliferation of social media activity, law enforcement agencies now understand the fundamental need to incorporate social media data into their day-to-day operations. Social media records are now combined with traditional investigative data to conduct more thorough investigations. At SMILE, many agencies reported impressive results using social media information in their investigative processes.

Tools are a Must

In order to conduct social media monitoring and investigations, law enforcement agencies need tools. Nearly every presenter at SMILE was using some form of tool to assist them with the investigative process. The amount of readily available social media data is unfathomable and can be extremely overwhelming. Investigators and analysts must rely on tools to assist them with harvesting, processing, and analyzing social media data. Otherwise, they would be inundated with records and have difficulty making timely analyses.

Conclusion

Every time we go to a conference, we learn something new that allows us to improve our products and services for our clients. SMILE was no exception. We have been following trends of the use of social media, embracement of data fusion, and need for social media tools in law enforcement for some time now. It is one of the main reasons we developed PRISM. Both the i2 User Conference and SMILE reinforced our use of social media, data fusion, and PRISM in our investigative process.

3 Key Takeaways from the 2013 i2 User Conference

This week, two of our analysts attended the 2013 i2 User Conference. We were able to network with and attend sessions led by individuals working in the law enforcement, intelligence, and financial communities in the United States and Canada. Although many of us work in seemingly different fields, many of us concluded that we were ultimately doing similar tasks and face similar issues. At the end of the conference, there were three major takeaways that can relate to any investigator or analyst, regardless of their industry or what tools they use.

Data Silos are the Past and Fusion Centers are the Future

The key issue discussed by almost every speaker and attendee was the difficulty we all face gaining access to and sharing information across departments and agencies. One problem almost every agency reported was having too many data silos housing their information. Multiple storage locations fragment the information in such a way that individuals can be consumed by looking through disparate sources for data, even in their own agency. It also impedes the flow of information between both coworkers and partner organizations. This problem was stressed by multiple law enforcement agencies during their presentations, especially in the case of the Boston Marathon Bombing.

Now, these agencies are working together to tear down the walls between organizations to adapt a fusion center model. The Tucson Police Department, Massachusetts State Police, and the Miami-Dade Police Department have all reported they are working on initiatives to bring together interagency data sources to assist with investigations and prevent agencies from stepping on one another’s toes. Similar collaborations are happening in the financial industry in Canada through the Canadian Banker’s Association. It is becoming imperative that agencies share information to be effective in their day-to-day intelligence and investigative endeavors.

Nothing Exists in a Bubble

Multiple speakers discussed the need for us all as investigators, analysts, researchers, and intelligence operatives to understand the world around us. It is extremely important to understand the world around you from culture to events to societal changes. Dr. Steve Chan really drove the point home that nothing we examine exists in a vacuum, and in order to fully understand the issue at hand, we have to educate ourselves about the larger picture as a whole, including historical and present context. To be truly effective, we must keep up with items such as current events, changes in society, trends, new technology, and pop culture. In addition, we also need to ensure we are constantly engaging coworkers and individuals from other agencies to share information.

Social Media is Paramount

It was evident from the start of the i2 Conference that social media was going to take the main stage. Most of the sessions at this conference touched on the importance of social media, and the sessions specifically regarding social media were standing room only. Social media is now becoming widely regarded for its ability to give analysts and investigators new leads in cases when all internal data and public records information have been exhausted. It also is a fantastic resource for network building because we can identify underlying connections that may have been missed through other investigative means. However, there are still some issues with data normalization and legal admission of social media evidence. People are now looking for new ways to better extract, analyze, authenticate, and fuse data from the social media goldmine. As researchers, it is imperative that we stay abreast of all of the changes in the social media landscape.

Conclusion

For us, the i2 User Conference was a success. We were able to learn from individuals in related industries about the challenges they face and how they are working to conquer them. One of the only ways we can learn is to work together to create new, innovative solutions to the issues that plague our organizations.

Using Analysis to Curtail False Positives

Some of us ran into false positives while recently travelling. One person on our team was in the airport and set off the body scanner machine. He was sweaty from carrying a backpack through the line, so his scan showed a heat source emanating from his back. This prompted security to examine him to ensure was nothing hidden under his clothing. Without this analysis, he could have been put through a much lengthier security procedure because of his initial false positive.

Investigators seek to corroborate facts with other supporting facts or artifacts to validate or verify source data. When we talk about our services, many people want to know how we combat false positives. They want assurance the data we provide is legitimate and relevant to our investigations. In order to avoid false positives, we employ a few techniques to examine data.

Big Data vs. Smart Data

First and foremost, we employ data analysis. Currently, there is a large trend towards capturing big data for intelligence and business purposes. Most of our investigations deal with the big data pools originating from social media. During the primary stages of our work, we capture large amounts of data about the subject of interest. However, instead of taking big data at face value, we work in the business of “smart data” by using our data FUSION approach.

Our analysts scale the mountains of data to extract only the relevant pieces of data for analysis. As we discussed last week, this method has helped us in many investigations, especially while vetting employees. When we look at a subject and identify potentially relevant information, we dig deeper to see if something is an isolated incident, part of a larger pattern, or a false positive.

It is also extremely pertinent to vet information during event monitoring. For a training exercise, members of our team conducted real-time monitoring of Game 5 of the NBA Eastern Conference Semifinals. During the course of our monitoring, we uncovered a retweeted post of someone claiming they would kill themselves if the Heat lost.

Normally, this would be a high level threat to an event, so we vetted the post to ensure it was not a false positive. Upon completion of some cursory Internet-based research, we discovered there was no cause for concern. This post was simply a meme of something that was previously posted on Instagram. (Note: This post has since been removed by the original poster.)

Look Beyond the Person of Interest

We often think of data sources as originating from the person of interest. However, not everyone has a substantial Internet-based footprint, potentially because they have implemented privacy settings to hide information. To avoid missing pertinent information, we have to examine individuals other than the subject. In cases such as these, we have to identify content curated by their friends and family.  

During an employee vetting investigation, our subject used privacy settings to restrict access to his content. Previously, this employee had passed his background investigation with flying colors. On his application the employee stated he did not use drugs, and he passed a drug test. However, his friend posted a picture of “purple drank,” including the bottle of codeine cough syrup, and tagged the employee in the tweet. (Above is a screenshot we captured of a similar post.) This tweet indicated the possibility of a false positive during the initial application process and flagged the subject for further investigation into his habits.

Photos are Key

As we just discussed, photos can be key to unlocking an investigation. However, it is not possible to analyze photos using traditional big data means. Organizations often rely on textual analysis to flag content, but the text surrounding photos can be unrepresentative of the photo itself or use terms which are not currently being monitored. This means we have to look at the photos themselves to analyze content. Currently, there are no photo analysis programs which can conduct comprehensive contextual and photographic analysis for investigators. Analysts still have to use their skills to conduct an assessment of photographic evidence to ensure there are no false positives.

Conclusion

It is in everyone’s best interest for investigators to be thorough during investigations and report accurate findings. It is our responsibility to fully vet pertinent information before presenting it to our clients. Whenever a piece of potentially important information cannot be verified without further investigation, we must report it as a possibility instead of a fact. We give our customers more than just raw data; we give them analyzed information pertinent for decision making. Our investigations have real world consequences, and it is our duty to ensure we conduct and report them in an ethical manner.

The Importance of Employee Vetting and Continuous Evaluation

In the past few months, employee vetting has been at the center of the debates regarding two major public relations nightmares.

One is the case of Edward Snowden, the Booze Allen employee who exposed the NSA’s PRISM program. Some have claimed Snowden provided false information on his resume yet somehow still successfully passed his background check. Gaining access to the information available in this position is what both prompted Edward Snowden to apply for the position and allowed him to expose the government’s dealings in dark data. In response, legislators are attempting to overhaul the background check and security clearance process.

The other is the current murder investigation focusing on former New England Patriot Aaron Hernandez. When Hernandez played at the University of Florida, he began displaying a propensity for violence and even took a photo of himself with a glock. Over the past few years, Hernandez has been connected to many violent encounters which have ultimately been publicized in light of the current investigation. In response to the investigation, the New England Patriots released Hernandez and lost approximately $250,000 on a jersey swap program that allowed fans to swap out their Hernandez jerseys for another player’s. It also spurred EA to remove Hernandez from two upcoming game releases.

In both cases, officials and commentators often cite the failure to properly assess the employee’s background and character prior to employing them as one of the major causes for these incidents. These incidents have brought bad publicity to both organizations which could ultimately prove to be costly and fundamentally damage their reputations. To avoid making this mistake, it is important that organizations embrace a holistic approach to employee vetting that goes beyond standard background check objectives.

Traditional Background Checks Aren’t Enough

Most organizations employ a standardized method of employee vetting. Companies traditionally use premade application forms and a prepackaged public records background checks to complete their evaluation of candidates. However, as we havepreviously covered, public records data can often be inaccurate or out of date. Similarly, these premade application forms may no longer capture the information vital to the needs of an organization. Standardized methods do not provide a comprehensive means of evaluation, especially for visible and sensitive positions which require a deeper dive into the daily lives of individuals.

Recently, our analysts worked two cases which clearly demonstrate this point. We were asked by a client to investigate two individuals who were hired for security-based positions. These positions required individuals to have a clean criminal record, be drug free, and refrain from having connections to potentially harmful influences, such as gangs. Both of these employees indicated refraining from substance abuse in their applications, passed their drug tests, and showed no history of legal troubles in their public records searches. However, their social media footprints revealed a much different story. One individual had a history of posting stashes of drugs and money on his social media accounts as well as discussing his marijuana smoking habits. The other had a brother who was affiliated with a local gang; his brother posted photos of himself both smoking marijuana and standing in a field of marijuana. These social media investigations revealed that both employees posed potential security threats.

Continuous Evaluation is Necessary

Once employees are on the job, organizations cannot afford to go without continuous evaluation. The circumstances in employees’ lives can change. New financial hardships may arise which make them more susceptible to bribery. Individuals can make new connections to individuals and organizations which put them at risk. People can get into legal trouble during the course of employment. No matter what new circumstances may arise, periodic reinvestigations, similar to those done for security clearances, are necessary to ensure compliance with company regulations and policies. These evaluations can help head off any potential incidents before they manifest themselves.

The Value Added

When organizations conduct tailored, thorough employee vetting investigations and continuous evaluation, they can ensure they are doing their due diligence. This can help them control their image by finding obvious sources of data which exist in social media. Social media data can identify red flags during the pre-screening process which can help organizations avoid marring their reputations by curtailing public relations debacles. In a world in which inordinate amounts of information are available to the public, it is important for employers to ensure they access the intelligence vital to mitigating organizational risk.

The Value of Data Fusion

Recently, the PRISM team has been out on the road discussing our services and methods with potential and current clients. During the process, we generated interest in our data FUSION process and the value it adds to investigations. It made us realize our readers (you) could benefit from the same discussion. To simplify the process, we will discuss the value added from each type of data source. Currently, we utilize three main sources: Public Records, Online Content, and Social Media Content.

Public Records

Public records push a research project off in the right direction. With the abundance of personal information available, these records make it possible for you to look up criminal and litigation history, identify physical locations and property information, map out potential networks of family and associates, and vet out current licensures. Together, all of these records combine to build a base for your research. They provide relevant search terms and locations for the rest of your work. However, many public records databases contain outdated, incomplete, and inaccurate information. You still have to look at other sources of information to verify the data and paint a more complete picture of the individual of interest.

Online Content

General online content is a great way to find out how the individual of interest interacts with society at large. News stories can help research a multitude of issues related to an individual. First, they can help you identify any additional criminal or civil litigation information which may have been excluded from public records. Second, news articles provide a wealth of knowledge regarding business operations which can help you set a general context for the individual’s professional life. Finally, local news also tends to spend time giving lip service to those doing work in the community, which can help you identify additional organizations connected to the person of interest. When you combine this data with personal and professional websites, you have additional contextual data that informs you about what the person is involved in on a routine basis. However, this data, even when combined with public records, tells you very little about the actual person you are investigating and still may contain some inaccurate information.

Social Media Content

Social media content’s best value added comes from the data about the person’s personality, interests, and habits. When a person posts a wide array of information about the things they like, do, and consume, it becomes very easy to identify additional places to locate information. Social media profiles also provide a great wealth of connection data that allows you to confirm connections from public records and build out additional social networks. Additionally, you can verify some of the data that was originally identified in both public records and online content. It is imperative this data is fused together with public records and online data during the research process. Without social media, it is nearly impossible to fully understand an individual.

Conclusion

To add reliable, actionable intelligence to your investigation, it is imperative to use a data fusion approach. Without using a comprehensive online research solution, you can be acting upon inaccurate or incomplete information. In order to provide a truly thorough investigative service to your clients, you should implement a data fusion process as a integral part of your operations.