In employing social media services as a potential intelligence source, it is important to understand the composition of the various respective user groups. Below are findings from the latest Pew survey (Duggan and Smith, 2013) highlighting the user characteristics in the most prevalent examples of social media services:

• LinkedIn is especially popular among college graduates and users from higher income households.

• Twitter is frequented mostly by younger adults, urban dwellers, and non-whites.

• Instagram is frequented mostly by younger adults, urban dwellers, and non-whites; also users that live in urban as opposed to rural environments.

• Pinterest attracts about four times as many women as men and has a slightly higher amount of users with higher degrees of education and higher rates of income amongst its users.

• Facebook is used more often by women than men, but shows a nearly equal distribution across ethnicity groups (white-non Hispanic, Hispanic, black-non Hispanic), educational levels, pay scale, and urban versus suburban and rural environments.

These disparities demonstrate that social media services differ in the people they attract, especially with respect to the age, gender and educational level of their users. This has consequences for the style, frequency of postings and type of content that can be expected on disparate services. It also has consequences for the way users approach different networks.

Interestingly, users tend to stay with the services they know (Manso and Manso, 2013). This “stickiness” not only creates comparatively stable user groups, but also creates challenges for the introduction of new apps (e.g., specialized apps for crisis communication).

Rationales for Social Media Use

While people once went online to seek anonymity (McKenna and Bargh, 2000), today one of the main purposes of online activities is socializing. Still, the main reason to use social media in this sense is not for the creation of new relationships with strangers, but the maintenance of existing relationships (e.g., Campbell and Kwak, 2011; Ellison et al., 2007). Estimates are that 85–98% of participants use social media to maintain and reinforce existing offline networks consisting of friends, family or of people sharing similar interests (Choi, 2006; Lenhart et al., 2013). Users of mobile technologies thus tend to stay within close-knit networks, so-called monadic groups (Gergen, 2008). These groups tend to be closed to external influences and hard to approach online, unless someone is part of their offline communities.

Individuals vary greatly in their approaches to social media use. In general, five distinct user types can be differentiated (Brandtzæg, 2012):

1. Sporadic users: This group is closest to nonusers, as they connect only rarely. Their main reason for SNS (Social Network Service) use is to check whether someone has been in touch with them.

2. Lurkers: The main reasons of SNS use for this group is the passive consumption of content others have provided online, for instance to look at photos, find information about friends, see if somebody has contacted them or simply to “kill time.”

3. Socializers are interested in using SNS primarily for social activities with friends, family and like-minded people.

4. Debaters actively contribute content by writing and uploading their own contributions, especially through participation in discussions and debates.

5. Advanced users are the most active group on SNS and show the broadest and most diverse range of behaviors.

Differentiation of these user groups is important, as they vary in the likelihood with which they may engage in activities put forth by LEAs, such as requests for help in investigations, and the reasons and ways in which they may be engaged online (i.e., attracting socializers may need a different approach than attracting, for instance, debaters or lurkers). This differentiation may be especially relevant as content creators, i.e., the more active user groups, tend to be from relatively privileged backgrounds in terms of education and socio-demographic standing (Brake, 2014). This not only means that social media content may be biased toward these groups, but also that disadvantaged groups may be harder to reach and activate.

Influences on Social Media Behaviors

Online behaviors and the perception of what is acceptable to post or not are influenced by a number of factors most prominently user characteristics such as gender, personality and national culture, attitudes toward the service or people approaching them online as well as the technological setup of social media services themselves.

User characteristics. Early studies of internet usage suggested that introverted people used the internet more heavily than their more outgoing counterparts (Amichai-Hamburger et al., 2002). This is no longer the case, with social media now attracting people with a high level of extraversion and openness for new experiences (Ross et al., 2009; Zywica and Danowski, 2008). Especially among younger users there is a strong link between extraversion and heavy social media use (Correa et al., 2010). In addition, heavier social media use is also linked with a higher degree of emotional instability, albeit only for men (Correa et al., 2010). Emotional (in)stability also plays a role in the number of times and the length of time spent on social networking sites. Individuals who are less stable emotionally tend to spend longer on the sites, while more emotionally stable and more introverted users frequent sites more often (Moore and McElroy, 2012). Emotional instability further impacts the type of information posted. Users with a lower level of emotional stability are more likely to post problematic content such as substance abuse or sexual content on their profile, as are compulsive internet users (Karl et al., 2010).

Gender impacts social media use in that women tend to use social networking sites for longer periods and post more photos and more comments about themselves than men. On the other hand, men tend to use the sites more frequently than women (Moore and McElroy, 2012).

National culture impacts user expectations as well as usage behaviors. Comparing, for instance, US, Korean and Chinese users, Ji et al. (2010) found that individuals from Korea and China use social networking sites as a tool to search for experts to obtain advice for important decisions and for emotional support. US users are interested rather in the formation of relationships, in which the sharing of content plays an important role. The link between content sharing and relationships was not found for Korean and Chinese users. Comparing US students with German students further suggests that US students are more likely to post problematic behaviors such as substance abuse or sexual content on their Facebook page (Karl et al., 2010).

Minority status impacts behaviors too, as members of minority groups tend to use social media more commonly for occupational than private purposes, while members of a majority group are more interested in the social potential of social media (i.e., chatting and personal relations with family and friends) (Mesch, 2012). Minority groups also seem less willing to use social media services offered by the police (Bayerl et al., 2014).

These are clear indications that online behavior is shaped by demographics as well as national contexts and their cultural norms and standards. These differences are relevant when LEAs try to engage with disparate user groups as well as for better understanding of the disparities of online information provided by users.

Attitudes towards services or people. Generally speaking, trust precedes information sharing. The more people trust another person, the more willing they are to grant even intrusive information requests, at least if they feel that the interaction will remain private (Joinson et al., 2010). If the communication partner is trusted, sensitive information is provided even in a situation where privacy is low (Joinson et al., 2010). Online trust can go so far that even pretending to be a friend can be enough to bring users to divulge personal information (Jagatic et al., 2007). The central role of trust is also relevant for the engagement of LEAs with individuals on social media, as user's willingness to engage is linked to their trust in the organization with which they are engaging (Bayerl et al., 2014).

Technical setup. Site features, such as the ability to set status messages, send private correspondence or provide public feedback to other users' content strongly influences how people behave as well as the type of information they choose to reveal online (Skog, 2005). In addition Hampton et al. (2010) identified that not only physical features of social networks impact user behaviors, but also the social setting in which the users are conducting their interactions, with users commonly using online networks in order to maintain existing networks when using social networks in a social environment. Further, power users (i.e., highly expert technophiles) rate the quality of content higher when it has a customizable interface, while non-power users tend to prefer personalized content (Sundar and Marathe, 2010).

Disclosure and Trustworthiness of Information

A great deal of discussion exists around the question of whether information provided online is trustworthy. Do users report who they really are or do they consciously fake and falsify information? Teens, for instance, often provide false information on purpose in their profiles (Lenhart et al., 2013). It is also common that users consciously include or omit personal information such as age or relationship status to achieve an interesting, “well-rounded” personality (Peluchette and Karl, 2010; Zhao et al., 2008).

Generally, women are more risk aware and risk adverse when it comes to divulging information online than men (Fogal and Nehmad, 2009; Hoy and Milne, 2011). Yet, privacy concerns often fail to lead to more privacy-oriented behavior (the so-called privacy paradox; Barnes, 2006). Aspects such as the social relevance of a network in influencing a user's general willingness to disclose personal information seem to be more prevalent when deciding whether personal information is posted publicly or not: the higher the relevance of a network for maintaining social relationships, the stronger a person's generalized willingness to reveal private information is (Taddicken, 2013). Individuals also tend to disclose more information in blog entries, when they are more visually identifiable (i.e., share a picture of themselves) (Hollenbaugh and Everett, 2013); while people with higher levels of privacy concerns tend to use fewer social media applications (Taddicken, 2013).

Users concerned about their privacy may choose three approaches to mitigate possible risks: avoidance (e.g., choosing ways other than the internet to communicate, buy products, etc.), opt-out (e.g., opt-out of third-party collection of information), and proactive self-protection (e.g., using privacy-enhancing technologies, erasing cookies, etc.). The choice of the method seems to be influenced by cultural factors. For example, in Sydney and New York users were unlikely to choose an avoidance strategy, while users in Bangalore or Seoul were more likely to avoid the internet than employ privacy-enhancing technologies (Cho et al., 2009). Attitudes toward privacy seem to differ along a North-South and South-East divide, at least in Europe (cp. Lancelot-Miltgen and Peyrat-Guillard, 2013): Users in Northern European countries considered privacy as a question of personal responsibility, whereas users in the South saw it rather as a question of trust. Users in South-European countries further considered the disclosure of information as a personal choice, while users in Eastern countries saw it rather as a forced choice.

Disclosure and falsification of private information are thus linked to demographics and trust (Joinson et al., 2010), but are also a question of the larger environment in which the user operates.

Relevance to LEAs

In the acquisition of intelligence, LEAs may want to utilize this information in their models and assumptions. If different demographics vary with respect to the reasons and ways they employ social media, LEAs need to consider these disparities when tracking and garnering intelligence from groups of interest. Further, because offline relationships often precede online relationships, inferences can be made about an individual's social circle. Understanding the normal pattern of engagement with social media for a particular user may also prove to be an indicator of critical changes in attitudes. For example, gradual changes in language may indicate radicalization, while a single threatening post out of the blue may warrant more attention than if an individual posts such comments on a continuous basis, but are clearly not serious. In this respect it is important to know that such behaviors are also impacted by personality and cultural differences, which makes the application of a single standard of “normal” versus “problematic” online behaviors questionable. LEAs need to be able to match online profiles with real people. In this respect, knowing the attitudes toward the falsification of personal information across user groups is vital to appraise likelihood as well as possible motivations to differentiate “normal” from possibly “problematic” behaviors.

Social Media in “Lone-Wolf” Scenarios for Early Assessment and Identification of Threats

Currently, policing intelligence relies on reports from the public, or the recipients of threats in order to take appropriate action in response to the posts made online indicating possible criminal behavior. Due to this reliance on public reporting, there is potential for these threats to go ignored, or to be drowned out by the noise of the sheer unquantifiable amount of information being posted to social media sites each day. Often in cases such as those identified, the perpetrators are not acting on behalf of a wider criminal organization, or executing a planned course of action. Instead, these threats are regularly instinctive attacks that are unplanned and irrational, and in response to events that draw emotion, executed by individuals out for vengeance, often with histories of social instability and psychological problems. In cases such as this LEAs are unable to draw upon robust intelligence sources to identify a current or emergent threat from the individual as, one off, unplanned events such as the lone-wolf school shooting scenarios identified previously rarely have a bread-crumb trail of evidence that can be picked up by LEA's existing intelligence operations.

Recent reviews of the US intelligence infrastructure have led to the development and formation of “fusion centers” aiming to coordinate intelligence and serve law enforcement agencies (LEAs) across entire states in the acquisition, analysis and dissemination of intelligence (U.S. Department of Justice, 2005). Within these fusion centers, there is potential for the application and integration of social media analytics in the crawling and analysis of social media as an open-source intelligence repository in response to emergent, unplanned “lone-wolf” scenarios such as those discussed in Chapter 10. In these situations, there are two potential streams of information that is of potential value to LEAs. Firstly, there is the identification of posts made by the perpetrator containing explicit signals of intent to cause harm, and secondly, the sentiment being expressed by situational stakeholders in regards to the threats and actions of the individual.

Through the application of technologies such as Natural Language Processing (NLP) and sentiment analysis techniques, it is possible to identify specific postings that (a) contain criminal intent and (b) contain references to specific concepts such as target locations, and methods to be used by the individual(s). Named entity and concept extraction techniques provide the user (in this case envisaged to be an analyst within the fusion centre setting) with explicit reference to the location and nature of the threat being made, in addition to the name and location of the individual making the threat. From this information, the threat can then be analyzed and cross referenced using robust, “closed-source” intelligence sources such as the healthcare and criminal records of the individual making the threat, and the individual's proximity to the location that the threat is being made against. This cross-referencing of intelligence then builds up a robust portfolio of knowledge that then can be used to assess the severity and validity of the threat being made, which in turn can be filtered down to operational officers in instances where further, on scene action is required.

A key concern that has been associated with applying data mined from social media in this way is that it is considered extremely challenging to separate genuine threats from the emotional outbursts and tongue-in-cheek musings of disgruntled individuals. This is where an understanding of different types of user behavior on social media is of significance. The cross-referencing of threat indicators from social media with robust closed-source intelligence sources is extremely valuable in aiding to distinguish likely and probable threats from the “noise” of social media. For further validity, threat indication can also trigger additional analysis of an individual's social media presence, as individuals commonly use the same alias' and user-names across services, looking to identify any other potential indicators that the individual may be capable, and intent upon committing the crime to which they have been threatening across a range of social media platforms. For example, this process could entail the identification that an individual has photographs of themselves posing with weapons, thus providing further validity to the case that the individual is capable of carrying out the threat to which they have eluded.

Social Media-Based Approach in a Hostage Scenario

Hostage situations are defined as events whereby the actor(s) (i.e., the hostage taker(s)) are holding one of more persons captive against their will. The motives for these attacks can be diverse, and vary from expressive motives such as voicing an opinion or religious view to instrumental motives such as for financial gain through ransom demands (Alexander and Klein, 2009). There are a number of possibilities for communication and the use of social media during hostage situations with the victims, hostage takers, LEAs, media outlets and public bystanders all possessing the potential to comment and monitor the situation before, during, and after the event itself.

In addition, the hostage takers may monitor the outside situation and make identity checks on hostages using social media profiles and web searches such as that exemplified during the Mumbai attacks (Oh et al., 2011); they may also select their hostages via social media by monitoring movements or personal possessions. On rare occasions, hostages themselves may also be able to covertly contact family, friends or LEAs, real-time comments and updates can also be posted by news organizations and bystanders, LEAs are also able to use social media to communicate official information while they can also obtain background information on hostage takers' political, religious, and personal standpoints posted online to facilitate negotiation by understanding their motives. For example, two scenarios where LEAs could use social media are for the prevention of the spread of sensitive operational details and to understand the motives behind a given hostage situation.

While the public can often be helpful, providing key information to LEAs, social media also provides an outlet where people often post without thinking, unaware of the potential consequences of their actions (Gaudin, 2013b). The posting online of current tactics or operational details, such as that which happened during the Mumbai bombing attacks, poses a risk to the success of any operation. Finding ways to mitigate the spread of this information when it is beyond the immediate control of the LEAs is vitally important—the police cannot put a cordon around Twitter—to help in the successful resolution of these situations. While LEAs cannot force people to remove information, by crawling tweets in real-time, identifying those with relevant information, and contacting those who have posted potentially sensitive operational information to request its remove, the threat of information leakage can be mitigated. Natural language processing can be used to identify keywords and hashtags that are associated with the event, and systems put in place to facilitate the provision of an automated, credible response to alleviate the spread of damaging rhetoric and foster a virtual community of moderate, trustworthy advice and positive reinforcement. Keeping this communication from the hostage takers is also a key objective. otherwise this would act as a red flag toward important information.

A second scenario is based around understanding the motives of the hostage takers and how to bring the situation to a resolution. Without understanding the background to a hostage situation it is difficult to take the necessary steps to resolve it peacefully without further incident, or potentially aggravating the situation further. Assembling all potential evidence rapidly and connecting the dots from the intelligence garnered from social media postings and profiles arms negotiators with the knowledge to do their job more effectively. LEAs need to quickly mine relevant and discard irrelevant information about the hostage taker(s), their social interactions, and their political or religious sympathies to rapidly build up a user profile, complementing pre-existing information already held on file by the police. This information may be taken from social networks, forums, blogs, personal websites and video postings such as those on YouTube. While this may not represent their complete profile it may give vital clues about their personality and motives that negotiators can latch on to and use to their advantage (Mandak, 2012).

Two potential use-cases for the use of social media during a hostage situation have been presented: the control of the spread of information in these scenarios, and the use of social media for conducting background checks against hostage takers. By using the social media profiles LEAs can identify the demographics the hostage takers identify with, their motivations based on content sharing or identify their relationships through their online interactions and use this understanding to inform decision makers on how best to act and proceed with the negotiation.

Organized Crime Social Media Data Analysis

The arrest of Bernardo Provenzano, a senior member of the Sicilian Mafia, in 2006, after 43 years on the run, brought to light the question of how could a criminal figure such as this evade authorities and at the same time, continue to run a criminal empire. Provenzano was constantly on the move, communicating using pizzini, tiny typed notes, delivered to him by hand by his trusted assistants (Timelists, 2014). After his arrest, Provenzano was found to be in possession of five copies of the Bible, one of which was littered full of cryptic notes. Arturo Castellanos, a leader of the Mexican Mafia in one of America's toughest prisons, Pelican Bay State in Northern California, sent a letter to Florencia 13, a multi-generational street gang in south Los Angeles. Castellanos, through his letter, underlined a number of rules, or reglas, on how he believed the Mafia should be run at a street level. Specifically, these rules outlined how street gangs and their sub-groups should be governed, how drug sales, prostitution and other illegal activities should be realized, and how disputes should be settled (McCarthy, 2009). In both cases, it is shown clearly that communication plays a major role in the way that organized criminal entities perform their illicit activities in order to remain anonymous. It is safe to suppose that organized crime leaders use social media, such as Twitter or Facebook, in order to communicate with their groups in the same way. This communication can again be conducted in a cryptic manner, using social media accounts with fake personal information and pictures, using specific terms in order to pass on their messages. The complexity of organized crime organizations makes it even more difficult to monitor the communication between members.

A social network can be seen as a structure of nodes (often representing people), connected together by some kind of relationship (Snasel et al., 2008). Text-mining algorithms can be used in order to extract suspicious keywords from social media accounts. The operation of these accounts can then be monitored and all their posts can be collected. A formal context from the collected posts can be developed. Formal Concept Analysis (FCA) software can be used in order to extract the most significant concepts of these posts and visualize them as a concept lattice. The study of the concept lattice will identify keywords that appear most frequently in the collected posts. Based on these keywords, the accounts that have used them can be collected for analysis so that more in-depth conclusions can be formulated. Formal Concept Analysis is but one example of a technology that can be applied to aggregate and summarize data.

Formal Concept Analysis (Priss, 2006) can be very useful in the analysis of social media-based communication between Mafia members. The data collected can clarify the way organized criminals communicate with each other and the hierarchy that they follow. Furthermore, it can clarify the roles of each member in the criminal organization, how a criminal activity is organized and how future criminal activities organized by Mafia organizations can be predicted and prevented. In addition, the application of Formal Concept Analysis in a social media setting can result in easier penetration of mafia-type organizations by the police, so that the dismantling of such groups can be realized (see Chapter 4).

Crowd-Sourcing with a Collective Intelligence Platform

Crowd-sourcing data are of great significance in crisis situations. Crowd-sourcing enables information to flow quickly and efficiently between emergency management specialists and the public. There are a number of tools, such as Pathfinder (Luther et al., 2009), Sense.us (Heer et al., 2007) and Many Eyes (Viegas et al., 2007), that are used for the analysis of crowd-sourced information. Platforms such as Ushahidi (http://www.ushahidi.com/) and Google crisis maps (http://www.google.org/crisisresponse/) are already used to crowd-source information in disaster response situations. Crowdsafe (Shah et al., 2011), a mobile application that allows users to input crime data to help identify hotspots also helps users to plot routes home that avoid them. As well as using crowd-sourcing to coordinate the relief effort, LEAs may also wish to crowd-source information during and after a crisis event to provide both situational awareness and to piece together the true nature of the events, as trawling manually through this data is nigh on impossible. Involving LEAs in the crowd-sourcing loop is also necessary but, as the Boston Bombings in 2013 showed; crowd-sourced, public data alone does not necessarily lead to the correct investigative conclusions (Lee, 2013).

Similar to crowd-sourcing, collective intelligence (Bonabeau, 2009) is the result of the collective and collaborative efforts of a number of people with a common aim or goal. A collective intelligence platform combines data from a number of different sources (e.g., open-source intelligence repositories). Data received through crowd-sourcing appeals via social media and closed data that is not exposed to the public is then combined with the domain-specific knowledge of LEA officers, domain experts and analysts in order to produce actions, outcomes, or knowledge building blocks. The results of these analyses may go back out into the public domain to refine and re-organize the actions of scenario stakeholders based on the intelligence provided by LEAs. This type of platform would not only be useful in a crisis management situation but also to track events such as organized crime involving arms trading, drug trafficking, and money laundering gangs (see Chapters 3 and 10).

A number of technologies can be utilized and integrated within a collective intelligence platform. Formal Concept Analysis is one such example of this and may be used for the analysis of data generated by social media that is potentially related to criminal incidents.

In FCA an object can usually only be placed at a certain hierarchy level if it contains all the attributes that are present at that given level. When analyzing textual data in particular, the wide range of expressions someone can use to explain exactly the same situation is problematic. Two potential ways of tackling this problem are to use a lexical database such as Wordnet (Miller, 1995) to map synonyms for each of the attributes and the second is to introduce fault tolerance for FCA. That is to accept objects at a particular level of the hierarchy even if they do not match all the attributes but match a number of them beyond a predefined threshold. This prevents near misses slipping through FCA's metaphorical net. This means the collective intelligence platform can be refined as more information is added and further analytical techniques such as machine learning, clustering and additional classification can also be applied to further enhance and refine the results.

The dynamics of a crisis situation mean that events can change rapidly. Example technologies such as FCA could mean a constant re-evaluation of the number of objects appearing at different positions in the hierarchy and the introduction of new terms. An increase in objects further down the hierarchy indicates a change in situation or visibility that LEAs may need to react too. An addition of a new term may indicate a new event, for example the word “gunman” may keep appearing with a specific place name but five minutes later a second place name starts being picked up by the system and the objects are divided between the two. This might indicate that there is more than one gunman or that they are on the move.

This type of information usually takes the form of unstructured texts, unverified or partial reports, and human knowledge that is not necessarily included in the paper trail. However, bringing all this information from disparate sources and connecting the dots between them is vital for tracking organized crime. A collective intelligence platform is required to import, aggregate, filter, analyze, visualize and also to present this information in a concise manner. News aggregator app Summly (www.summly.com; now Yahoo News Digest; Kelion, 2014) pioneered the idea of mixing news and social media while recognizing that most users do not want long reports but short summary snippets. The same reasoning can be applied to developing crisis situations to provide reports to first responders, the public and those in control centers.

Crowd-sourcing in particular requires the public to get involved and contribute information. Debaters and the advanced users of SNSs are perhaps mostly likely to participate and LEAs should be aware of any demographic biases that may influence the information they receive. LEAs also have to consider how they want to receive their information as users prefer to stick with services they are familiar with. Users may also have privacy concerns about divulging geo-tagged information or attracting unwanted attention.

Application of Social Media in Human Trafficking Scenarios

Human Trafficking is a diverse and complex international problem. Due to its globalized, cross-border and varied nature, any response to Human Trafficking must be similarly scoped (Rankin and Kinsella, 2011). Human Trafficking consists of any efforts to transport humans illegally across borders by force, or through the use of threats such as abduction, fraud, deception and coercion, with criminal organizations constantly identifying and exploiting new routes, modes of transportation and pretences upon which to illegally traffic human beings (UNODC, 2004). As well as being a global issue, Human Trafficking is also a growing one, with the UK's NCA (National Crime Agency) reporting a 9% year-over-year increase on the number of Human Trafficking-related convictions in the UK in 2012 (UKHTC, 2013). In order to improve the architectural underpinnings of Human Trafficking defense strategies, a co-ordinated, multi-disciplinary approach is required to combine the requirements to maximize the identification of criminal activity, and the reprehension of the individuals and illicit organizations responsible for it (UNODC, 2012).

Social Media provides a potential source of competitive advantage for LEAs over criminal organizations perpetrating crimes such as Human Trafficking (Gottschalk, 2010), and is frequently considered to be an under-utilized repository of open-source intelligence that is traditionally under-valued in the minds and practices of police officers as a result of culturally ingrained bias that are deeply embedded within the culture and organizational mechanisms of modern policing (Reiner, 2010). Deep-rooted resistances such as these require any new approaches to be underpinned by knowledge management-enabled organizational mechanisms, facilitating the integration of any new intelligence-led approaches to combatting organized crime threats such as Human Trafficking. In response to this requirement, social media is but one of the resources which can be leveraged in response to the ever diversifying threat of human trafficking through the use of text mining enabled information extraction, categorization and analysis. Although agents of trafficking themselves are unlikely to be detailing the nature of their activities in the text and images they post to social media, observers of the environment (i.e., the general public) are potentially quite likely to make posts in reference to behavior that is suspicious or out of the ordinary.

In a recent case of Human Trafficking in south-east England, a Hungarian trafficking gang were convicted for transporting more than 50 teenage girls into the UK for the purposes of running an illegal prostitution ring. Incidents such as this provide a potential use case to illustrate the application of social media analytics and information extraction in combatting the threat of Human Trafficking. During the case identified, a number of trafficking victims were smuggled into halls of residence at the University of Sussex for prostitution purposes (Campbell, 2014). In events such as this, it is likely that other residents at the halls, and local university students would have made inquisitive posts to social media sites such as Twitter and Facebook in regards to the unusual nature of having a number of eastern European women suddenly appearing at the premises, and rarely being seen or heard from. Although the posts of observers may not have been inferring that the individuals were in fact victims of human trafficking, and operating within a forced prostitution ring, analytical techniques such as natural language processing (NLP) and named entity extraction, enabled through web crawling technologies, can be used in conjunction with a knowledgebase containing the specialist domain knowledge of Human Trafficking experts that could extract textual information from social media indicating multiple reports of unusual behavior being present from the same location that would then be categorized to indicate that it may in fact be related to potential illicit activity, such as Human Trafficking.

By filtering and fusing information sources, law enforcement analysts can begin to accumulate enough information to form a representation of the environment being observed, through the aggregation of information based upon the geo-tagged location data that is embedded within social media content. The repository aspect of any proposed system would be populated with domain knowledge consisting of likely indicators of Human Trafficking activity, both in terms of the victims, the properties being used by those involved and the characteristics of the perpetrators themselves, all tied to linguistic rules designed to pick out slang terms, and posts from social media which would reference activity that coincides with that stored in the knowledgebase. In the past, the police and LEAs would be reliant on the direct reporting of suspicious activity from observers, however in the new environment emergent as a result of the information age, this same information is dispersed within the social media postings of passive, situational observers, enabling the early identification of illicit activities based upon the aggregation of weak indicators expressed via social media platforms such as Twitter and Facebook.

Public Engagement on Social Media

Efforts at crowd-sourcing, for instance, for support in crime investigations or during crises depend on the willingness of citizens to support and engage with LEAs on social media. This may not be a logical step for all citizens, as demonstrated by the variances in potential user characteristics outlined in the section “Features of Social Media Users and Use.” Services like Amber Alert (a US department of justice program aimed at increasing public awareness of missing persons) require a stable community that is available on a continuous basis. But how can LEAs attract and bind citizens to their social media presence?

A non-governmental organization in Kosovo, InternewsKosova together with the Balkan Investigative Reporting Network (BIRN) created an online platform (www.kallxo.com) for citizens of Kosovo to report cases of corruption through social media, SMS and the web. One year after the launch of the platform, 900 cases have been reported and around 30 municipalities in Kosovo have placed an iFrame of the platform in their websites (United Nations Development Program, 2014). The UK released a public service (http://www.police.uk) showing crime statistics for every address in the country allowing UK citizens to view crime statistics about their local area (Garbett et al., 2010).

A recent study on police social media services with citizens in Czech Republic, Romania, the Former Yugoslav Republic of Macedonia and the UK revealed that trust in police is one of the main deciding factors, of whether people are willing to use such services or not (Bayerl et al., 2014). In this case, LEAs are treated the same as individual users (e.g., Joinson et al., 2010). Furthermore, the lack of knowledge and skills related to the use of Information Technology are restrictive factors in the use of social media for crime reporting by a significant proportion of the populous (Garbett et al., 2010). Also people want to be certain that their anonymity is secured when they report a crime, something that is not always possible or clear when considering social media. LEAs try to attract people to report information about a crime through financial rewards, but even in the case of social media many people are afraid of providing such information.

Yet, while trust is often created offline, LEAs can work on their presentation of social media services and their own behavior toward the citizens who use them. The acceptance of the virtual delivery of public services is linked to the following four aspects: expectations for the performance of the site, social presence (i.e., “the sense of being with each other”; Biocca et al., 2003), social influences by relevant others, who think using the sites is positive, and computer anxiety. Especially affective aspects, and mostly social presence, are important when considering acceptance. This suggests that media that allow for immediate and personal communication that closely resemble face-to-face encounters are more readily adopted by citizens than platforms that allow only intermittent, textual exchanges. For example, when it comes to Virtual Crime Reporting technology, some resistances are identified due to the absence of real human contact. Whether an individual is willing to use a technology or not depends on the individual's cognitive, conative and affective responses. Cognitive responses are related to personal beliefs, conative responses are related to the individual's willingness to engage, and affective responses are related to the individual's emotions (Hoefnagel et al., 2012).

Once a social media platform is established, binding users to the platform becomes an important issue, in order to foster an active, constant community. Reacting and responding to the posts of users is one of the most powerful ways to commit users to a service, as it increases the value of participation in the eyes of the users themselves (Utz, 2009). Hence getting a reply to an initial post increases the likelihood that his person will post again (Joyce and Kraut, 2006).

Further it is crucial that the information on networks is perceived as truthful; otherwise confidence in, and the perceived value of the service will decline (Gentzkow and Shapiro, 2006). Who communicates information also plays a role. Sadly, gender still seems to play a role in how credible information is perceived. For instance, weblogs by male authors are often considered more credible than weblogs from female authors (Armstrong and McAdams, 2009). Furthermore, credibility of information is also higher if the source is official rather than unofficial, but only if the communications are from a male source (Armstrong and Nelson, 2005).

From Social Media to LEA Intelligence

Figure 15.1 shows a representative model of the processes LEAs must go through in order to exploit social media effectively as part of their wider intelligence strategies. As social media is now ubiquitous it can be applied to many LEA scenarios, as demonstrated earlier in the section “LEA Usage Scenarios for Social Media.”

There is a diverse and extensive range of social media platforms available today; and the number and variety of these platforms continues to increase. There are three main ways in which social media can be utilized by LEAs:

1. Crawling and monitoring social media sources by tracking public comments and scraping criminal profiles and posts

2. LEAs direct communication and interaction with public from their own social media accounts

3. LEA coordinated crowd-sourced information

After the collection of these data LEAs must extract, clean, filter and aggregate the unstructured data into machine readable formats. The types of data retrieved can include:

• Unstructured text from tweets and other postings

• Video and images

• Geographic information

• Social network information

• Personal details including age, location, family, likes, dislikes, etc.

Having gathered all these data, it needs to be processed and analyzed so that it can be used as by LEAs in a meaningful way. Examples of such techniques are:

• Facial recognition and matching from picture to images held on file

• Profile matching between social media platforms and police reports

• Natural language processing to make sense of unstructured text

• Sentiment analysis to monitor public opinion

• Geo-tagging and location resolution to track movements and key places

• Social network analysis to map friends, acquaintances and interactions

These disparate analyses can then be filtered, processed and consolidated into actionable, credible information and further assessed by those with domain expertise. The results of these processes may then be applied to a number of scenarios such as organized crime, lone-wolf, human trafficking, hostage situations and crisis and terrorist events as described earlier in this chapter. This, however, is not the end of the loop. Throughout the process as more intelligence is harvested it is fed back into the search to refine and make the tools more accurate and targeted, enabling it to account for new information to strengthen the potential outcomes for LEAs and increase the validity of their intelligence.