Information | Analytics | Expertise SOCIAL MEDIA INTELLIGENCE Practical Strategies for Using Social Media to Enhance Security AUGUST 2014 © 2014 IHS IHS RISK AND SECURITY Dr. Nina Laven IHS Economics & Country Risk Dr. Nathalie Wlodarczyk IHS Country Risk David Hunt IHS Country Risk

© 2014 IHS Key Message SIC SINGAPORE / AUGUST 2014 Social media intelligence = SOCMINT ‘SOCMINT’ cannot be used alone for security. Social media intelligence needs to be paired with other forms of information and intelligence to be effective. 2

© 2014 IHS Agenda SIC SINGAPORE / AUGUST 2014 What is social media intelligence? How to use social media smartly: Apply Social & Country Expertise Use Data Science Create Network Analytics Emerging SOCMINT Capabilities Key Takeaways 3

© 2013 IHS SOCMINT involves placing data in context 4 Social media insights are of limited intelligence value without the context provided by other sources. Country & Social expertise: expertise on the society and country being assessed, including how people there use social media. Data science: guides the choices we make about how to identify signals in large datasets – which models to use, what samples are valid etc. Network analytics: patterns in digital social network data. Country & Social Expertise Data Science Social Network Analytics Social Media Intelligence (SOCMINT) What is SOCMINT?

© 2013 IHS Four platforms 5 Social Networking Blogs & Microblogs Content Communities Instant Messaging What is SOCMINT?

© 2013 IHS Know your platforms: what matters where 6 Country & Social Expertise

© 2013 IHS Know your platforms: how they are used 7 Country & Social Expertise

© 2013 IHS Know your sources: who matters more 8 VALUE Location Cultural Proximity Access Timing… VALUE Location Cultural Proximity Access Timing… RELIABILITY Track record Endorsement… RELIABILITY Track record Endorsement… Source: IHS Country Risk Country & Social Expertise: Yemen case study

© 2013 IHS Know your sources: how to focus further 9 Country & Social Expertise

© 2013 IHS Data issues: is your data representative? 10 Data science: Twitter data case study We want large and valid datasets but we do not always have the resources to purchase and analyze them. How do we find the right balance?

© 2013 IHS 11 Source: IBM Research Labs Data issues: is your data trustworthy? Data science: Boston Bombing Tweets case study Only 20% of tweets had true information about the attacks.

© 2013 IHS With analytics, social media can aid detection Source: IHS Country Risk 12 Network Analytics: UK Riots 2013 case study

© 2013 IHS 13 Source: IHS Country Risk Network Analytics: UK Riots 2013 case study With analytics, social media can aid detection

© 2013 IHS 14 Source: IHS Country Risk With analytics, social media can aid detection Network Analytics: UK Riots 2013 case study

© 2013 IHS Automated sentiment has limitations 15 Source: IHS Country Risk Network Analytics: Limitations

© 2013 IHS How to use the Geolocation of tweets 16 Source: IHS Country Risk Network Analytics: Emerging capabilities

© 2013 IHS Social media can map leaderless movements 17 Source: IHS Country Risk Network Analytics: Emerging capabilities

© 2013 IHS The strengths and limitations of SOCMINT What SOCMINT can doLimitations of SOCMINT 1Situational awareness of fast-moving complex developments (e.g. protests, coups) Only a portion of the drivers of global risks are observable through social media 2Information on events poorly reported in other sources (e.g. due to state control of media) Most data related to networks and communications between individuals is not publically available. 3Measure the scale and sentiment of online discussion of a topic of interest Algorithms can only go so far in spotting relevant emerging risks 4Provide timely warning of emergent risks 5Identify key influencers and groups of users to inform monitoring and outreach 18

© 2014 IHS Questions SIC SINGAPORE / AUGUST 2014  What is the right balance between false positives and false negatives in a system?  How do you ensure there aren’t blind spots in your collection approach?  The ethics of SOCMINT  How can traditional tradecraft co-exist with and enable data analytics insights?  How can new analytics tools help the security team build conversations across the enterprise? 19