Introduction to Social Media Investigation: A Hands-on Approach, 1st Edition (2015)

Chapter 23. Beyond the individual

Abstract

Social media is a good place to find information about groups. Whether they are people organizing around a shared interest or a demographic group that has a common behavior, understanding a group's behavior can reveal a lot about the people who are associated with it.

Keywords

Social media

Social networks

Groups

Investigation

This book has focused on how to find individual people and information about them on social media. However, it is worth dedicating one chapter to how social media can be used to understand groups of people. That could be organizations, communities, or people who share a common trait or demographic attribute.

What kind of things might an investigator want to know about a group? It depends on who or what you are investigating and what you want to know. If an organization is the target, like a terrorist group or organized crime syndicate, then any information you can find on the group might be useful. You can see how they are using social media, what their goals are, who participates, where they are posting from, etc. While large organizations (like al-Qaeda) may not be targets of investigation by anyone outside government groups, law enforcement has successfully used social media to investigate street gangs and other small organizations. Law firms have used social media to investigate disruptive groups' plan to sue. In these situations, any information can potentially be useful.

It may be that an individual person is a target, but you know he or she is an active member of an organization or community or a participant in an event. In that case, learning about the group the target is part of can help an investigator understand more about the target's life and world views. You can learn about the target's motivations, interests, activities (through association with group activities), and interactions. You can also learn who might be an influential person to contact if you are trying to reach out to or influence the target.

Finally, when you have an individual target in mind but you do not know much about him, it can be helpful to understand information about the demographic groups that the target is a member of. These can be broad categories, defined by age or race, or more specific categories, like people with the same profession or background. The characteristics common to the group may not necessarily describe your target, but they can provide insights about where to start looking for information specific to the target.

Organizations

All types of organizations have presences on social media, from small town community service groups to international terrorist organizations like al-Qaeda. As we will see in this section with a number of excellent examples of work done by individuals and groups, investigating the behavior of a group can lead to excellent insights that apply to individuals and that often lead to critical information about events. However, even when that connection to individually interesting behavior is not there, understanding a group that a target is a member of can lead to valuable insights about that target.

Note that this chapter is separating out formal organizations, addressed in this section, from communities and events that tie people together (discussed in the next section). In one sense, it is a somewhat arbitrary distinction. However, the line generally falls in a way that separates people who identify with a particular organization that may have a hierarchy from those who identify with an issue, event, or philosophy. Both of these “groupings” are interesting, but the way you approach them can differ.

In particular, when looking at organizations and their members, there may be a greater assumption that the actions endorsed or encouraged by the organization will be embraced by its members. Therefore, understanding the activities, motivations, and online statements of the organization can be valuable background for understanding an individual target.

Terrorists

Though not everyone might expect it, terrorist groups are extremely active on social media. Facebook, Twitter, YouTube, online forums, and other social media sites are all hosts to terrorist activity.

Gabriel Weimann of the University of Haifa asserts that 90% of organized terrorism online is conducted through social media.¹ They use it for recruiting, intelligence collection, and communication with the general public.

In earlier chapters, we saw examples of people who were investigated for their individual terrorist activity. Those people were recruited through the online social media activity of terrorist groups.

The Department of Homeland Security (DHS) created a report in late 2010 addressing this issue, titled “Terrorist Use of Social Networking Sites: Facebook Case Study”. That report was restricted to dissemination among law enforcement, but copies of it are available online. This chapter relies on a version provided by Public Intelligence.²

The report summarizes terrorist use of Facebook as follows:

As part of this trend, jihad supporters and mujahideen are increasingly using Facebook, one of the largest, most popular and diverse social networking sites, both in the United States and globally, to propagate operational information, including IED recipes primarily in Arabic, but in English, Indonesian, Urdu and other languages as well. While some tactical information is available on Facebook, the majority of extremist use of Facebook focuses on disseminating ideological information and exploiting the site as an alternative media outlet for terrorist propaganda. However, to a lesser degree, the site is used as a gateway to radical forums and jihadi sites with explicit radical agendas (and easily downloadable operational information) and as a platform to promulgate some tactical and operational information.

Terrorist Use of Facebook:

• As a way to share operational and tactical information, such as bomb recipes, AK-47 maintenance and use, tactical shooting, etc.

• As a gateway to extremist sites and other online radical content by linking on
Facebook group pages and in discussion forums.

• As a media outlet for terrorist propaganda and extremist ideological messaging.

• As a wealth of information for remote reconnaissance for targeting purposes.

—Department of Homeland Security “Terrorist use of Social Networking Sites: Facebook Case Study”

For each of the bullet points above, the report goes on to detail how terrorist groups are using the site. The report even appears to contain screenshots of some of their posts. Figure 23.1 shows an example post with instructions on how to make a bomb.

FIGURE 23.1 This Facebook screenshot is reported by Fox News to have come from a Department of Homeland Security report on terrorist use of Facebook. The post describes how to make a bomb.

This report, from 2010, came quite early in the timeline of online social networks; Facebook was around one-third of its current size at that time. As social media has grown in popularity, so has terrorists' use of the sites. As described in the 2010 DHS report, that activity is largely used for outreach and propaganda and often appears in English to reach Western audiences.

Many major international terrorist groups have social media accounts, including al-Qaeda, ISIS, and the Taliban. Boko Haram, the Nigerian terrorist group well known for kidnapping over 200 school girls,³ makes extensive use of YouTube to post videos of propaganda messages and even videos of mass executions (Figure 23.2).

FIGURE 23.2 A still from a Boko Haram video posted online.

As another example, the Taliban was active on Twitter from 2011 on. Figure 23.3 shows screenshot of their Twitter feed from May of 2014. Note that it is in English.

FIGURE 23.3 The Taliban Twitter feed. Note the tweets are in English.

You can see that each post has a link at the end to a news story. These link to the Taliban's English website, also used for propaganda. Figure 23.4 shows the top of the main page of the Taliban's website, which features strongly in their social media presence.

FIGURE 23.4 The Taliban's English language website, used extensively in their social media posts.

The Taliban's Twitter feed has since been shut down, and this is a common back-and-forth battle between terrorist groups and social media sites. The social media sites have policies against much of the language and intention that terrorist groups use. Thus, they eventually find the accounts of the terrorist groups and shut them down, but new accounts pop up.

And while the contents of these accounts are often disturbing, understanding the propaganda and messaging terrorist groups are putting out can be an excellent way to understand the group's (and thus its members') motivation and activities.

Street Gangs

Street gangs also have a strong presence online, and indeed, a lot of interaction between rival gangs takes place online. In 2013, Ben Austin wrote an excellent article for Wired, “Public Enemies: Social Media Is Fueling Gang Wars in Chicago.”⁴ He describes the violence that has overtaken Chicago in the past few years resulting from the fractious street gang environment. He explains, through extensive examples, how gangs interact with one another and with rivals. With examples from Facebook, Instagram, and Twitter, he explains how gang members post photos of themselves with guns, drugs, and cash, unconcerned about whether parents, teachers, or police see the posts. The term “Facebook driller,” describing a gang member who starts problems with rivals online, is not just introduced but demonstrated through examples that sometimes lead to real killings.

Austin's article is extensive and so thorough that I would like to reprint the whole thing here. Short of that, here is one excerpt that shows the role social media plays through one specific example:

Increasingly, disagreements that end in bloodshed have their origins online. The Chicago police department, which now patrols social media along with the streets, estimates that an astonishing 80 percent of all school disturbances result from online exchanges. At one point on Morgan Street, a 15-year-old joins us at the stone table. He calls himself Boss Nick, and he says he regularly posts pictures to Instagram of himself with guns. He doesn't care if the police or his teachers or really anyone sees it. He feels he has to let rivals know he is out there “with these poles.” Boss Nick had been friends with Shondale Gregory, known as Tooka, a 15-year-old killed in 2011. Gregory was shot in the head, and rivals soon posted pictures of his corpse to Facebook, doctoring the image with horns and splattered brains. The Chicago police said that within minutes of the images' appearing on the site, 81 kids at Gregory's high school were suspended for fighting and an additional 200 students walked out. Gregory's clique of Gangster Disciples, which had called itself the St. Lawrence Boys for their block on the South Side, started referring to their turf as Tookaville and to themselves as the Tooka Gang.

“All that 'cause of Facebook,” Baskin's 20-year-old grandson says. “That's why Tooka blew up.”

—Ben Austin from “Public Enemies: Social Media Is Fueling Gang Wars in Chicago”

Police have embraced this kind of investigation. Particularly for street gangs, investigating the entire group often leads to the arrests of individuals because of their participation. Consider one example from New York. Police arrested Melvin Colin for weapons and drug crimes and for murder. His Facebook page had some public material, but in his posts that were restricted to his friends only, he made many incriminating statements. Police were able to convince one of Colin's friends to give them access to those private posts.

Colin's lawyers appealed this, claiming he had an expectation of privacy, but the courts struck down that argument. The judge ruled that once Colin shared with his friends, the expectation that the information would remain private disappeared since the friends could do anything they wanted with the posts—including sharing them with police.⁵

Cincinnati also uses social media to track gang activity and has used it to break up street gangs. Officials there report that their officers, in partnership with the University of Cincinnati, use the social media posts to create and maintain a database of gang members and activities that officers can use in their investigations.⁶

Communities and Events

As discussed in the chapter on “Forums and Question Answering Sites,” many online communities find gathering places to discuss their activities. These communities may be in forums, but they can also coalesce around hashtags within certain social media sites. For example, many conferences and conventions have an agreed upon hashtag that people use when they tweet about the event. At ComicCon, an entertainment fan convention, people tweet with the hashtag #comicon or #sdcc. Communities may also have a hashtag they use to identify their social media posts, regardless of whether there is an event. For example, politically conservative Twitter users in the United States often use the hashtag #tcot (Top Conservatives on Twitter) to label their posts.

As with organizations, it can be useful to analyze what is going on within a community or around an event within social media. The content of the posts tells you what topics are of interest to the group, what is going on, what plans are being made, etc. The people within the groups and how they interact can tell you who is important and what role they play.

Recall the chapter on “Analyzing Networks” where we created visualizations of social networks. We can apply those techniques in this domain. Figure 23.5 shows a visualization of an online community. Each circle represents one person in the network, and a line connecting two circles shows those two people have interacted. In this visualization, larger circles indicate people who are more important in the community. The color of the circles indicates different subgroups.

FIGURE 23.5 The network of a discussion group. Larger circles indicate people who are more important and lines connecting circles indicate two people who have interacted.

Without a lot of other data, we can see there are three people who are quite important, represented by three large circles in the middle of the image (two purple ones and one green one). We can also see small pairs of people off to the sides who do not interact with everyone else. This kind of information can be very helpful when you are looking at a community online and want to learn more about who is important and who might be a good person to talk to in order to find more information.

One example of how some communities are monitored comes from the Southern Poverty Law Center, or SPLC. The SPLC is a civil rights organization, founded in 1971 as a law firm. The group sues on behalf of victims of hate crime and is noted for its success in battling white supremacist groups including the Ku Klux Klan.

As part of their activities, they monitor hate groups around the country for all kinds of activity. These groups leverage the internet as much as anyone, and so SPLC monitors the online and social media activity of hate groups.

In the realm of white supremacy, that includes monitoring the online forum Stormfront (see Figure 23.6). Ku Klux Klan leader Don Black established the site in 1995, and it is the first and one of the largest racial hate sites online.

FIGURE 23.6 A portion of the forums at white supremacist site Stormfront.org. Note the variety of topics from site administration to white supremacy events to dating.

SPLC's Intelligence Report on the users is disturbing. They found that the site is a home for perpetrators of violent hate crimes. Author Heidi Beirich said “Stormfront is the murder capital of the racist internet.”⁷ Members of Stormfront were responsible for nearly 100 murders since 2009, and SPLC saw a marked increase in violence after Barak Obama took office as President.

The report⁸ both profiles the killers and details many of their crimes. They begin with a general description of the Stormfront users who go on to kill:

A typical murderer drawn to the racist forum Stormfront.org is a frustrated, unemployed, white adult male living with his mother or an estranged spouse or girlfriend. She is the sole provider in the household. Forensic psychologists call him a “wound collector.” Instead of building his resume, seeking employment or further education, he projects his grievances on society and searches the internet for an excuse or an explanation unrelated to his behavior or the choices he has made in life.

—“White Homicide Worldwide” Southern Poverty Law Center

It goes on to detail the progression from frustration to committing acts of violence as it plays out within the Stormfront site. It then looks at case after case of racially motivated murders committed by members of the site and details their participation on the site leading up to their crimes.

As disturbing as the contents are, the report is an excellent example of the value that comes from close monitoring of a community online. The authors track not just the content of posts, but the traffic rates to the site (which allows them to identify peaks of activity, like the one that followed in the immediate aftermath of the 2011 white supremacist mass killings in Oslo⁹), topics discussed, the relationship between discussions and other current events, and individual members of the site.

Demographics and Shared Traits

Another way to look at groups in social media is to study the use, habits, and feelings of certain demographics. That will not necessarily tell you how your target will behave, since these tend to be broad groups with a lot of diversity within them. However, understanding common behavior for a demographic group may be useful in guiding your investigation. For example, we know that African Americans are disproportionately active on Twitter. Thus, if you are trying to find someone online in that group, Twitter may be a good place to start. As another example, we know teens use a variety of social media but have especially embraced Instagram. Thus, if you have a teen target, you will certainly want to look at all social media sources, but you might first turn your attention to Instagram where you could find richer information.

In this section, we will look at three groups: teens as a representative of an age-based demographics, African Americans as a race-based demographic, and family caregivers as a behavior-based demographic. These results are drawn from studies conducted by the Pew Research Center's Internet and American Life Project,¹⁰ which focuses heavily on obtaining balanced and representative samples of people to conduct their research.

Teens

Teens are very active users of social media. This data is drawn from an extensive report from Pew Research Center about teens, social media, and privacy.¹¹

Among 12-17-year-olds, 95% use the internet, and among those, 80% are on social media. Facebook is the most popular site, used by 77% of teens who are online. A typical teen has about 300 friends on Facebook. Twitter is also popular, with 24% of online teens using it, and the median number of followers is 74.

Teens who are very active on Facebook tend also to be active on other social media sites. Those who have more than 600 Facebook friends are three times as likely to have a Twitter account and six times as likely to use Instagram. That means that if you have a teen target who is very active on Facebook, you should look for them on other sites as well.

Teen users share a lot of personal information. The vast majority (91%) have posted photos of themselves. Sharing a school and hometown is also extremely common (71% of teens have done these things). More than half share an email address, which can be used to search for them on other sites and which may reveal a possible username to search on other sites.

At the same time, teens are also concerned about privacy settings. Only 14% say their profiles are totally public. The rest have their profiles restricted to friends only or to friends of friends. Girls are much more likely to keep their profiles private than boys (70% vs. 50%). Some also try to mislead people with fake information to protect their privacy; 26% say they have posted some fake information for this purpose.

African Americans

Pew Research Center has also conducted research on racial demographic groups and their use of social media. In this section, we look at results from a study on African American users.¹²

The “digital divide” between black and white users has been with us for decades, and while it still exists, it is less prevalent on social media platforms. 87% of whites have internet access compared to 80% of blacks, but the numbers are much closer on mobile platforms, which are particularly popular ways to access social media. The divide vanishes with education; black college graduates and higher-income African Americans have the same level of internet access as their white counterparts.

African Americans have high levels of social media use; 73% use social media, and that jumps to 96% among teens (much higher than the overall average discussed in the section above). Twitter is especially popular. Among 18-29-year-old African Americans, 40% use Twitter, much higher than their white counterparts (28%).

Focusing on teens in this group, there are differences that emerge in social media usage. As mentioned above, many teens post false information to protect their privacy. This behavior is more prevalent among African American teens. Compared to 26% of teens overall who have posted false information, black teens are far more likely to do this, with 39% claiming to have done so. Black teens are less likely to disclose their real names on their social media profiles; 95% of white teens use their real names, while only 77% of black teens do.

Family Caregivers

In contrast to the more traditional demographic groups discussed above, in this section, we will focus on a behavior-based demographic group: family caregivers. This is one example of the wide range of behavior-based demographics who use social media in similar ways. Family caregivers are adults who help care for a loved one by doing chores, offering personal care, tending to finances, or regularly checking. Note that this demographic does not include parents raising children as caregivers. The majority of caregivers are taking care of an adult, while a small percentage take care of a child with significant health issues or care for multiple people. A full 30% of Americans qualify as caregivers. Information in this section comes from a Pew Research Center study on this group and internet use.¹³

We see typical internet access rates among this group, with 80% having access to the internet. They have a strong and active interest in medical information—88% report looking for this online, and many are conducting these searches on behalf of someone else. In terms of investigation, this does not speak directly to social media usage, but it might direct you to look at forums and online interest groups related to health issues if your target falls in this group.

Caregivers tend to look for personal connections online regarding health issues. Pew Research Center reports that 26% have looked for others with similar health concerns online, compared to 15% of people who are not caregivers. Caregivers are also significantly more likely to use social media sites in particular to follow other's health experience and to look for health information in general.

Conclusions

There is a lot of information available on social media to better understand organizations and communities of people. Similarly, there is excellent research done on how different demographic and interest groups use social media sites. Learning these insights about groups of people may not reveal exactly what a specific investigation target is doing, but it can provide valuable insight into where that target might be found online, how he or she is using social media as a member of that group, and what topics and activities are of interest. In addition, we saw in some cases that investigation of groups online can also lead to valuable intelligence about individuals within those groups who late become interesting.