News / Features



Stopping bad guys with social data

Basics of social media analytics for counterterrorism specialists

By Rebecca Garcia, Director of SAS Federal

It is well-known that extremist organizations have embraced the Internet for its vast and immediate worldwide reach for recruitment. In 2006, the University of Haifa's Gabriel Weimann published groundbreaking research in his book Terror on the Internet: The New Arena, the New Challenges, and discovered approximately 4,300 terrorist-related websites affiliated with 40 active terrorist groups as defined by the US Department of State. This parallels the increasing role websites play in funneling information to all of us.

As consumers spend more time using social media, it should not be surprising that extremist organizations are as well. They see social media as a primary tool for bringing together communities of interest, regardless of geographic location, and for discussing ideas in a seemingly anonymous manner.

In recent years, SAS has been working with commercial interests in the area of social media analytics, helping make sense of the vast number of conversations on the Internet to better determine how organizations are perceived. This can entail culling textual and numeric data from websites in various formats (semi-structured and unstructured), including blogs, message boards, chat rooms and other social media and social networking sites to summarize the conversations about a given topic. It involves analyzing nouns to determine relevance to a given topic and understanding the use of adjectives to determine positive, negative and neutral sentiment across many different languages.

Ultimately, a variety of insights can be delivered, whether it is the trending of negative sentiment associated with a brand, detailed analysis of key phrases that resonate among certain groups of people, or determining which individuals have the most influence in a given social network.

The premise of this article is that many of the techniques used to distill the essence of online conversations for businesses serving their customers can also be applied to analyzing conversations among terrorist cells. The area of social media analytics could feasibly emerge as an indispensable counterterrorism tool by enabling proactive monitoring, analysis, and engagement through extremist social networks and associated digital properties.

The Challenge: Information Overload
It has become obvious that the Internet is not only the communications infrastructure of choice across the full spectrum of society; it also serves as an effective operational infrastructure for various organizations, including terrorist cells. It can be accessed from anywhere at low or no cost, knows no physical boundaries, provides the means to transfer funds, offers media-rich training to facilitated stance learning, operates in real time and is always on. And much as a system administrator has tools to understand and diagnose traffic on an internal network, businesses increasingly expect, and are realizing, similar capabilities in dealing with social media chatter. But analyzing this information includes the following challenges:

  • Too many websites to monitor/toomuch information flowing through in real time.

  • Messages are unstructured text, written in various languages, and subject to language nuances, such as slang, colloquialisms, abbreviations, misspellings, etc.

  • Difficulty of determining a user's identity.

  • Difficulty of differentiating legitimate actors from the casual visitors.

  • Difficulty of seeing any trends or emerging topics due to volume, veracity and velocity of data.

  • Significant subject matter expertise required to understand the messages.

To address these challenges, public and private organizations are turning to social media analytics.

The promise of social media analytics
The biggest immediate benefit companies see from social media analytics is eliminating the need to analyze social media data in a piecemeal and ad hoc fashion. Instead of logging into hundreds of discrete sites, the information is all represented in one place. Instead of a
chaotic, jumbled mess of sentences, businesses can impose order, categorizing sentences on the basis of how their nouns map to specific business attributes. For example, a sentence containing a complaint about phone call wait times becomes categorized as a negative instance specific to customer service. Millions of sentences add up to millions of insights on challenges and opportunities like pricing, corporate reputation, customer loyalty and quality.

As businesses have embraced the brave new world of social media analytics, there are lessons that can be applied to counterterrorism analytics.

  1. Treat online conversations as information assets.
    Many organizations in the private sector track and archive customer activity through sales data, yet they often have no capture or archival strategy for analyzing and retaining what those customers say about the business publicly. Similarly, intelligence organizations often have detailed information on the criminal history of an individual, yet lack the ability to connect that with public conversations.

    As businesses have learned, what is beingsaid online can be a leading indicator of what is about to happen to that business. Anyone who has read a negative hotel review on Expedia or a negative product review on Amazon can attest to the power of crowds to influence opinion. But the ability to link online perception to offline activities is completely undermined if those same conversations are not properly categorized as relevant to an organization, or not archived long enough for a good analyst to discover that linkage.

    For these reasons, the foundation of any social media analytics effort should be the collection, integration and storage of online conversations for several years of historical analysis, combined with information from internal systems to allow for deeper, more holistic insights. It is crucial to have this depth and breadth of conversation history to understand the difference between a fad and a trend. This is relevant to the counterterrorism community as well. Correctly categorizing a written reference to a known terrorist, belonging to a known
    terrorist cell, pre-9/11 in Afghanistan, is only valuable if it is actually available for analysis and is easily matched with other intelligence data.

  2. Understand the sentiment of conversations linked to specific topics and issues.
    Understanding the Web traffic generated by specific social media activities – or assessing the tone of references to a specific topic–does not go far enough in helping develop insights that drive action. To begin understanding the issues, sources and trends specific to the counterterrorism mission, you must be able to select which topics, media sources and key conversations to analyze, and then choose how to classify them.

    In the past, the level of detail collected from online conversations was insufficient to guide important decisions. For commercial interests, it has long been difficult to accurately determine topics that were important and perceptions that were associated with a particular topic. Unable to link conversations to topics, organizations could not quantify the impact of online content on their overall performance. This is another area where social media analytics provides a critical link. In terms of counterterrorism, the sentiment analysis capability can be used to measure online reaction to changes or initiatives to specific topics, such as "US foreign policy," "military operations," "foreign presence"and "foreign aid." This effectively structures the unstructured, making public sentiment analysis possible.

  3. Eliminate analyst bottlenecks.
    Lack of data is not the pressing issue for most intelligence professionals. It is lack of insights. Even the best data analysis is worthless if it does not reach decision makers on time with clarity. Therefore, it is critical that the very best thinking go into data visualization techniques that are designed for decision makers, not just analysts, with turnkey capabilities in sentiment trending, author analysis, threat tracking, and phrase clustering. In this way, identification of escalating issues, the most influential actors, and emerging trends and topics are delivered to those in the best position to capitalize on that information.

Practical applicationsfor counterterrorism
Through the approaches described previously, there are a number of application areas that social media analytics offers counterterrorism strategies. They include:

  • The What. Businesses expect a real-time read on social sentiment relative to their brands, and counterterrorism specialists should expect the same of the "brand" of any terrorist. Understanding the key phrases, sentiment and volume of conversations encompassing specific terrorists can be an indicator of activities.

  • The Virtual Where. In a world with billions of websites, simply understanding which online properties have a critical mass of disaffected, relevant people is not a trivial undertaking. Being able to consume chatter across all types of websites and determine their relevance to your organization's mission is among the most important benefi ts to any listening platform.

  • The Physical Where. Much of the global population's use of social media sites is driven from mobile devices, which increasingly contain coordinates of a user's location. This allows organizations to begin to understand geographic characteristics of extremist chatter, and more quickly identify domestic sources of unrest. Furthermore, the Internet protocol addresses of devices connected to networks can increasingly serve as accurate sources of location based insights.

  • The Who. There is a treasure trove of information surrounding the connections between people. This can yield an organizational hierarchy of individuals that can be used to determine the more important users across the forums.

  • The Why. Connecting social insights to real events on the ground is the ultimate goal. Correlating online chatter to historical events can yield clues as to why certain chatter is noise, while other chatter can be an indication of more serious events to come.

In the post-9/11 world, government organizations with complex challenges would often see enormous programs created with budgets of $500 million to $1 billion awarded to large systems integrators. More recently, the administration mandated that these enterprise programsbe scaled down to much smaller projects, in an effort to reduce costs and, more importantly, to facilitate more rapidly successful solutions to critical challenges.

Counterterrorism organizations have to straddle technology investment that is proven and current, while staying within budget and ensuring adoption. But technology is only a means to an end; it is ultimately people who understand the specifi c issues inherent to counterintelligence who will ensure success. Therefore, the human intuition of experts in intelligence must inform social media analytics technology on what to look for, so that computer intelligence is better able to inform the humans about the content, correlation and trajectory of social conversations. It is only through this approach that technology of any kind can meet the 21st century needs of governmental intelligence, and perhaps is the most important prerequisite in evaluating a social media analytics effort.

This article originally appeared in  IQT Quarterly , Winter 2012. volume 3, No. 3.

Bio: Rebecca Garcia is a Director at SAS Federal, where she focuses on helping the intelligence community solve mission-and IT-critical challenges. Prior to working at SAS, Garcia worked for The Boeing Company, Northrop Grumman Corporation,and KPMG Federal.

Rebecca Garcia, Director of SAS Federal