Saturday, August 20, 2011

Flash Mobs: Good Results, Bad Tradecraft

I am delighted by the fact that American youths are embracing networks, commencing netwar, and performing swarm attacks for criminal purposes. It is important that our juveniles keep up with the rest of the world's juveniles. More importantly, the phenomenon makes people like me a little more relevant, and makes it easier to explain to my family what I do when I see them once a year for Christmas gatherings.


A flash mob, as described by the eminently authoritative Wikipedia, is "a group of people who assemble suddenly in a public place, perform an unusual and sometimes seemingly pointless act for a brief time, then disperse, often for the purposes of entertainment, satire, or artistic expression." Flash mobs are typically coordinated through web sites and social media applications for mobile devices. Flash mobs are also a permutation of what network gurus John Arquilla and David Ronfeldt describe as "swarming." Swarming is a type of non-conventional warfare facilitated by the information revolution, in which networks of small units engage an adversary from all angles and coordinate their attacks through IT. Refer to Arquilla and Ronfeldt's RAND products Swarming and the Future of Conflict as well as the much quoted Networks and Netwars for more information on this phenomenon.



What I would like to suggest, at least through anecdote, is that flash mobs get good results, but they are prone to poor tradecraft. Results are key in open conventional warfare, but tradecraft is critical for criminal and terrorist operations (assuming that the adversary wants to "get away with it").

Let us consider examples of a 7-11 store that is 1) struck by a single thief and 2) struck by a flash mob.

First, we will start with a single juvenile who enters the store to steal a Baby Ruth. A single juvenile is eyeballed by the 7-11 clerk as he walks in. If he manifests signs of malintent (or is racially profiled), the 7-11 clerk will likely keep an eye on him. If the juvenile pockets a Baby Ruth and makes for the door, the 7-11 clerk may confront the juvie or obstruct his path of egress, forcing the juvie to escalate the situation, or pay for the Baby Ruth. If the juvie gets away, the 7-11 clerk can file a police report and hand over CCTV footage of the juvie, but unless the juvie is already known by all parties involved, it is a waste of resources to investigate this case further. The crime is forgotten. The juvie has gotten away with chocolatey, nougaty goodness.  

SOLO ATTACK VERDICT: Lame results, high operational risk, decent tradecraft.

Now, the flash mob. Before the flash mob strikes, the 7-11 clerk has little intelligence that the event is about to occur (that is the whole point of flash mobs: they gather and disperse in a flash). He suddenly has a massive influx of teenagers who seem to be making a run on Baby Ruths, and then running for the door. The clerk will not risk confronting a mob, so he watches helplessly as an entire crate of Baby Ruth is walked out the door. But, when the cops show up, the 7-11 clerk has been a victim of a shocking and provocative crime... a flash mob of the unwashed masses has ransacked his store. The cops are all over this one. They are also assisted by CCTV footage of 28 teenagers, which exponentially increases the likelihood that someone seeing this footage on TV will recognize at least one of the teens. The first teen confronted by police will sing like a canary and rat out his alters, who will rat our their alters, who will rat our their alters, until all 28 have not only narc'd on eachother, but have weaved elaborate stories which can be summarized as "I was a pawn, acting against my will, but that guy was the architect."  

FLASH MOB VERDICT: Awesome results, low operational risk, terrible tradecraft.

As to the anonymity of crowds, reconsider.


Caveat: This was a thought experiment about a particular type of attack performed by a particular type of adversary performed in a particular operational environment. The mileage for mobs and swarming might vary widely as these variables change. A formal model of flash mob risk is in order.

1 comment:

  1. Turns out that this event was not a "flash mob" in the traditional IT-assisted sense.

    "Montgomery County Police Chief J. Thomas Manger told CNN he believed the youths organized their raid on social networks, and the news media quickly embraced the flash mob angle.

    Instead, police later discovered through interviews with suspects that the group was on a bus returning from the county fair when its members decided to raid the convenience store."

    http://articles.cnn.com/2011-08-19/tech/flash.mob.violence_1_flash-mob-social-media-mob-violence?_s=PM:TECH

    ReplyDelete