A few weeks ago, I had the opportunity to use social media intelligence to monitor a large public demonstration that could have affected my organization. OccupyMN is a Minneapolis-based manifestation of the Occupy Wall street demonstrations happening all over the country. It occured and continues to occur in downtown Minneapolis and is mostly fixed to People's Plaza, a government center several blocks away from my organization's headquarters building, though it is also prone to parading around downtown. My organization is not one of the targets of this demonstration (Wells Fargo and US Bank are getting the brunt of it), but we have been monitoring the actions, rhetoric, and movements of this group and adjusting our physical security personnel and controls accordingly to ensure that our exposure remains minimal.
On the first day of the demonstration, before anyone knew the character it would take or the magnatude of its participation, I got to support our physical security team from a central dispatch center, updating them with intelligence as soon as it came in. My intel inputs were numerous: local television reporting, online local newspaper reporting, Metro-Link radio (which links the security of numerous organizations downtown), and social media in the form of Twitter and live streaming video.
This was my first experience using social media to monitor an event in real time and my feelings about its efficacy are mixed. Twitter tweets, monitored via TweetDeck, proved to be a timely but sometimes unreliable form of intelligence. Forward, I will discuss some of its benefits and challenges.
TweetDesk is excellent tool for monitoring numerous Twitter feeds simultaneously and in real time. For example, I was able to simultaneously monitor the hashtags for "#OccupyMN," "#People's Plaza," and "#(My Organization)," to detect if my organization would become a target of the demonstration. This proved to be useful in gaging and anticipating the movement of the demonstration. At one point, multiple parties on the ground began twittering about how the demonstration was going to march on the Federal Reserve Building in downtown Minneapolis in "about 15 minutes." Sure enough, 15 minutes later, our partners on the Metro-Link radio confirmed that the demonstration had begun marching toward this target. Had my organization been the target destination for this march, we would have had ample time adjust our physical security posture accordingly and minimize our exposure to this threat.
A demonstration's size in terms of number of participants is critical information when allocating resources to mitigate such a threat. I had difficulty acquiring the actual number of participants through Twitter. The numbers reported ranged anywhere from 50 to 2000, and this level of dispartiy was observed numerous times throughout the demonstration. It seems that any individual tweet regarding particpant numbers was influenced by two factors: the tweeter's sentiment and the tweeter's vantage point.
Tweeter Sentiment: By sentiment, I am suggesting that a tweeter's individual feelings about an event proportionally effects that tweeter's account of participation. For example, tweeters who were participating in the demonstration, or virtually participating by watching live stream and chatting in forums, tended to report relatively high numbers: "500+ and growing," "There has to be about 2000 people here." Inversely, tweeters antogonistic toward the demonstration tended to report relatively low numbers: "There is maybe 75 people," "A pathetic showing."
Tweeter Vantage Point: By vantage point, I am suggesting that a tweeter's physical point of observation directly effects that tweeter's account of participation. Tweeters who were on the ground within the crowd reported large numbers and intense activity, "100's more are arriving," "The energy here is incredible." Inversely, tweeters who were watching the demonstration from afar or from a greater elevation reported small numbers and limited activity, "Watching them from the trading floor, maybe 100 people," "Hard to tell who is Occupying and who is just trying to catch a cab."
Unfortunately, these categorizes are not easily parsed. Someone who is "watching them from the trading floor" certainly has an excellent vantage point, being in a skyscraper near the action, but is likely antagonistic toward OccupyMN (which has been primarily targeting banks).
Lastly, and most annoyingly, is tweeter deception and denial.
Tweeter Deception and Denial: My interest in the activities of the participants was greatly heightened when a tweeter named @Commando (sic) began to report that the demonstration had "devolved into looting. Stay classy, OccupyMN." Clearly, this type of deviant behavior insisted that we escalate our security posture immediately... that is, immediately after the report was cooroborated by at least 1 other source. The "looting" theme began to snowball: other tweeter's expressed anger about devolution to looting, saying "shame on them," and "I hope the cops start to beat them." The number of instances that "looting" and "OccupyMN" appeared in the same tweet began to grow. However, all were based on @Commando's original tweet, which I simply could not corroborate through the newspapers or through our Metro Link partners. That is, an increase in the topic's frequency was in no way indicitive of the topic's veracity. According to @Commando, things were getting worse fast. His next tweet: "Police report that some of the looters have mugged and beaten an elderly man in a store." Throughout the day, I could not substantiate a single claim made by @Commando, and as his claims grew more sensational, it became clear that @Commando was a hard-right spoiler spreading disinformation to tarnish the reputation of demonstrators he disagreed with.
How do we capture and measure an individual tweeter's reliability? The tweeter that first suggested the demonstration was about to march on the Federal Reserve Buidling was right on the money, while @Commando was a disinformation-spreading spoiler. One was trustworthy, the other was not. However, I was only able to ascertain this after I compared their tweets with reality, and in the intelligence world, that is simply too late. I now know that @Commando is an unreliable tweeter, so next time I am using social media to monitor the activities of local left-wing events, I will simply ignore his tweets. However, if there was some fair and rigourous means for the Twitter community to rate and display the reliability of an individual tweeter, I may have known that @Commando was a spoiler from the beginning.
Last post, I suggested the development of a formal model of flash mob risk. To continue in that vein, let me now suggest the development of analytical tools to filter Twitter intelligence into a reliable and actionable product. A "reliability ranking" provided by the community of Twitter users, ranking each user from 1 star (unreliable) to 5 stars, would be difficult to implement, as it would likely function like a popularity score. How, then, might we reduce the uncertainty inherent in social media intelligence?
No comments:
Post a Comment