Social media and intelligence-led surveillance

July 2019 Editor's Choice, Integrated Solutions, Security Services & Risk Management

Social media has become a major feature of most people’s lives in the last few years. Names of the major social media networks have become commonplace in conversation and many people are users of more than one of these networks.

While the classification of different social networks varies, it includes social networks such as Facebook and Linked In, microblogging types such as Twitter and Tumblr, networks for exchange or sharing of media like Youtube, Snapchat, Instagram, Flickr and MySpace, and communication types such as WhatsApp, QQ, Line and WeChat.

In addition, there are a number of speciality networks and a range of deliberately anonymous social networks. Many of these sites have users in the hundreds of millions a month. As social media, their penetration is across all levels of sociality, and across all groups including church groups, football clubs, the local tea society, criminals, extremists, and disturbed individuals.

These social media groups are seen to provide functions that go to the essentials of a working (or at times dysfunctional society), although this used to be at the level of a local village and now has scope for international interaction. “As users engage with these electronic services, that they create highly interactive platforms through which individuals, communities, and organisations can share, co-create, discuss, participate and modify user-generated content or pre-made content posted online” (Wikipedia).

Indeed, as a response to community issues, including disaster situations, they can be invaluable. Social networks of all types are therefore seen to provide an important social function of contact, communications, being in touch, and sense of belonging. In search of recognition or acceptance, or possibly even notoriety, people express their views, feelings, values, experiences, likes and dislikes, ambition, and at times, prejudices. At times naїvely, at times deliberately, and at times, by accident, such contact may reach beyond people close to them to a much wider audience.

Your unofficial résumé

Ultimately, whether they are aware of it, much of the social media content becomes available for the world to search and see, and for people to make use of it whether the originator likes it or not, or intends for it to happen or not.

Companies have for some time been using social media like Facebook as part of an employment screening process, and this has expanded to professional screening facilities to screen applicants for positions by looking at their social media history. Inappropriate use of media, or expression of views has also lost people their jobs, careers and contracts due to ill-considered or downright prejudicial statements being expressed that are exposed to the whole world on places like Twitter.

However, given that criminals and terrorists are a part of this social network, we have also seen active steps to use social networking to investigate, come close to, and gather information on criminal actions. Use of undercover identities has been used in cases to come become close to criminals through a process of infiltrating and befriending Facebook networks and luring criminals out, including one I know where the investigator portrayed himself as a female model in order to get details of a murder suspect who wanted to meet ‘her’. In another instance, a suspect in a syndicate was confirmed when his Facebook page showed a picture of himself lying on a bed scattered with banknotes, and I’m sure not the first time this has happened on Facebook.

A range of options to monitor

In the US and elsewhere around the world, there is a trend to large companies and certainly government doing scanning on social media for a range of information. This can be related to public relations, marketing, product feedback, and even monitoring of possible movements or clustering of people for emergencies or disasters, major sporting occasions, launches, signing events for prominent personalities, and political movement rallies or meetings.

These may all require some kind of response by organisations to facilitate, secure, or police such organised or even spontaneous events. In addition, potential threats including those of protest, violence, or general social disruption may be anticipated, as well as threats to life including shootings, terrorism and things like bomb threats. The use of social media by organisations or individuals posing a danger to the public is increasingly becoming an aspect of the risk and threat analysis for companies and in some cases has become a standardised form of surveillance.

Social monitoring has therefore moved into the intelligence and risk space as a direct source of information to broader surveillance, including for CCTV applications and physical security on the ground.

Live monitoring

Recently I’ve seen an example of a dedicated social media monitoring room which is used for a variety of purposes include public relations, service delivery feedback, including customer opinions, and social event monitoring. However, built into this process is also a threat detection and intelligence capacity for the safeguarding of customers, visitors, prominent people and critical infrastructure.

It is one of the few times that I’ve seen people on their cellphones in a control room really working, as part of their answering of queries or provision of information. These kinds of facilitates monitor through the detection of words or terms, or possibly users and employ a number of products in order to do this. Being able to search for other characteristics such as gender or other identifiers may be available in certain packages.

This does come with responsibilities though. Given the international outcry about Cambridge Analytica and its data harvesting of Facebook information in order to psychologically profile voters during the 2016 US election, it shows that any processing of big data can be controversial in terms of how it is gathered and what is done with it. However, a search for ‘social media monitoring’ or using the term ‘listening’ will generate a number of products that can be used for general monitoring.

Key factors for such social media monitoring products include being able to simultaneously listen or track multiple sources, having a concise dashboard or control screen/s to do this, to be able to do so in real time, to have dynamic filters including the ability to define specific types of sources and types of media, to track influencers and sources, quantifying positive or negative nature of comments, and to respond to messages where necessary.

Some products provide pattern analysis and even graphical illustrations such as heat maps, which highlight locations or frequency of terms or users. The ability to analyse changes over time may also be a component that one evaluates as part of your intelligence gathering. To facilitate follow-up action, having a system or access to work out where the messages are coming from, and ideally who from may be possible under some circumstances. This is particularly the case where messages may involve criminal or even terrorist action and police or national intelligence may be involved.

Social media monitoring control rooms

Individualised, or on demand checking of social media at this stage is relatively common. We are more likely to see dedicated social media control rooms in the future though, based on what I have seen recently.

Social media monitoring involves getting access to extremely powerful data. The techniques and tools may be relatively available but the benefits are potentially very high in terms of intelligence information. By contributing to an intelligence-led surveillance strategy, this could lead to much higher success in stopping dangerous events or allowing for the detection and apprehension of potential suspects. Activation during strikes, emergencies and other events may also provide insights and a response method to quickly provide relevant and request driven information.

It also involves skilled usage including the nature of searches, and considered interpretation and evaluation in context. At the same time, to get on the wrong side of social media carries its own risks. Responsible usage and careful handling of the consequences is an important factor in any such use.

Dr Craig Donald is a human factors specialist in security and CCTV. He is a director of Leaderware which provides instruments for the selection of CCTV operators, X-ray screeners and other security personnel in major operations around the world. He also runs CCTV Surveillance Skills and Body Language, and Advanced Surveillance Body Language courses for CCTV operators, supervisors and managers internationally, and consults on CCTV management. He can be contacted on +27 11 787 7811 or


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

FortiGuard labs reports disruptive shift of cyber threats
Editor's Choice
Threat intelligence from the second half of 2020 demonstrates an unprecedented cyber-threat landscape where cyber adversaries maximised the constantly expanding attack surface to scale threat efforts around the world. Adversaries proved to be highly adaptable, creating waves of disruptive and sophisticated attacks.

The worst of times
Technews Publishing Editor's Choice
Cyber resilience in terms of people, processes and technology is where it’s at when it comes to prevailing in a world beset with cybercriminals.

Cyber trends for 2022
Editor's Choice
In the last six months, an organisation in South Africa was attacked on average 1737 times per week. This is more than double the global average (819) of attacks per organisation per week.

Cybersecurity for the board of directors
Editor's Choice
Bike-shedding is a common distraction in boardrooms, especially when discussing issues board members are responsible for, but don’t understand – like cybersecurity.

Cybersecurity is now a digital transformation imperative
Editor's Choice
New research from the IDC reveals cloud security is the number one priority for investment, 50 percent of South African business leaders are concerned with the consequences of security breaches.

Providing real-time visibility
Technews Publishing Editor's Choice
Comprehensive visibility is critical, but not always attainable without the support of a managed service provider dedicated to monitoring and securing your cyber environment around the clock.

Getting the basics right
Technews Publishing Editor's Choice
Cybersecurity is like any other discipline, you can’t start at the top, you need to get the basics right. Hi-Tech Security Solutions asks how to best do this.

How to stop security threats early
J2 Software Cyber Security Integrated Solutions
Integrating a security ecosystem allows one to better protect the company, while also better understanding and improving the company’s risk posture.

Partnering to make South Africa more cyber secure
Editor's Choice
Cybersecurity professionals from the public and private sectors as well as academia have joined forces to establish the Cybersecurity Digital Alliance.

Turnstar ramps up countermeasures
Turnstar Systems Editor's Choice Access Control & Identity Management News Products
Turnstar has developed and patented an early warning and deterrent system which will alert security, and anyone nearby, of any attempt to place ramps over the raised spikes.