Open source intelligence,social media and law enforcement: Visions,constraints and critiques

Introducing open source intelligence

This article considers police uptake of open sources of intelligence, which now include social media. By automating and otherwise facilitating the monitoring of social media content, this uptake augments the visibility and exploitation of social life. Open source intelligence (OSINT) refers to a process whereby police or other investigative agencies gather and analyse data that are in principle accessible to any organisation or individual. With its origins in security and intelligence, OSINT relies on

publicly available information appearing in print or electronic form. Open Source information may be transmitted through radio, television, and newspapers, or it may be distributed by commercial databases, electronic mail networks, or portable electronic media such as CD-ROM’s. [I]t may be disseminated to a broad public, as are the mass media, or to a more select audience, such as gray literature, which includes conference proceedings, company shareholder reports, and local telephone directories. Whatever form it takes, Open Source involves no information that is: classified at its origin; is subject to proprietary constraints (other than copyright); is the product of sensitive contacts with U.S. or foreign persons; or is acquired through clandestine or covert means. (Steele, 1992)

The above definition counters a conventional understanding of security intelligence, as it explicitly targets information that is in plain sight to virtually any social actor. Indeed, inclusion of social media in OSINT means its content can be authored by any such actor. This inclusion is manifest as an assemblage (Haggerty and Ericson, 2000) that links personal information, private platforms and police organisational cultures. This is indicative of a broader ambition of police to maintain direct access to social life, as activity that is represented on social media platforms and further mediated through OSINT technologies is then treated as actionable. Policing and control are not manifest in terms of prohibition and censorship, but instead through encouraging circulation and visibility (Brighenti, 2007; Deleuze, 1995). The emergence and repurposing of social media content may therefore render social life immediately accessible to police (Bolter and Grusin, 2000).

On first pass, the features that render social media ‘social’ also make them suitable for inclusion in OSINT. Platforms like Facebook and Twitter mark a convergence of social contexts, data sources and surveillance practices (Trottier, 2012a; Marwick and boyd, 2010). Yet folding social media into open sources provokes changes in the perception and enactment of the former by a host of social actors. More specifically, conversations and other content on social media become strikingly non-ephemeral when retained as open sources. The fact that these platforms retain otherwise fleeting and contextually limited content is a longstanding concern for users, starting with university-based early adopters (Trottier, 2012a). Yet the developments detailed below further cement this concern. This is manifest as a potential criminalisation of spaces and those who dwell within them, but it entails a broader re-evaluation of the purpose and potentiality of these spaces by police. Social media have been discursively framed as a kind of public sphere (York, 2014), and there are a range of limitations to this ideal, including issues of privatisation, categorical discrimination and unequal access. Yet public spaces are historically ephemeral, as any social actor’s engagement and disengagement with that space is relatively frictionless (Juris, 2012). Furthermore, the social actor can be present and visible in a public space while protected by the guise of relative anonymity. As an ideal, the outburst in the public square or the incendiary letter to the editor does not have an absolute bearing on the social standing of its author. Yet folding social media into open sources furthers the potentiality that the former are simultaneously a kind of public sphere and public record.

Social media OSINT uptake is also shaped by a media logic of hypermediacy, or an awareness of and preoccupation with the fragmented and tenuously assembled nature of some media (Juris, 2012: 37). Social media inclusion in OSINT exemplifies hypermediacy, as it rests on a tension between obviating/obliterating information sources (erasure of contextual boundaries; a singular stream where attribution is relegated in importance relative to data’s function in the interface) and a preoccupation with mediation and origin (metadata about data sources remains visible, albeit minimised). This tension is manifest in police institutional cultures, where the possibility of extracting data from ‘open’ and ‘social’ sources depends on partnerships with public and private entities, which may be cause for concern (Ericson and Haggerty, 1997). This tension is also fuelled by a contradiction whereby social media, OSINT and big data render social life transparent and are in turn meant to be broadly accessible (Mayer-Schönberger and Cukier, 2013), yet policing-based assemblages amount to a kind of nodal governance (Shearing and Wood, 2003) that furthers asymmetrical relations of visibility between police and the public (Schneider, 2014), which includes furthering the opacity of how this information circulates and is enacted. Indeed, relative secrecy about how OSINT is extracted from social media contradicts Steele’s claim that it does not rely on covert methods. This article considers these tensions as manifest in origins, configuration and tentative consequences of police use of OSINT and social media.

An underlying concern in the context of the research below is how recent developments in OSINT impact the visibility of social life through the remediation of personal information on social media platforms, and how these changes are a reflection of both technological affordances and institutional constraints. Social media data subjects’ visibility is configured through their own online practices, alongside the actions of peers, platform operators and other social actors. This configuration is furthered by police uptake of OSINT and manifest as a simultaneous subsumption (immediacy) and isolation (hypermediacy) of social media content. In consequence, OSINT surveillant assemblages render social life visible, yet their constituent parts as well as the manner in which they collect, process and retain personal information remain opaque. Furthermore, framing social media data as public knowledge occurs in a context where Twitter content is included in Library of Congress records (Stone, 2010), even if private content can be designated as public mistakenly or maliciously through peer activity (Meeder et al., 2010). While monitoring social media marks a further expansion of the range of open sources, this inclusion furthers a potential criminalisation of online spaces and non-ephemerality of online activity. For this reason, police express ambivalence about these platforms, and are simultaneously transcending media to access these data, while heavily preoccupied with the process involved in accessing these data.

What follows is a critical account of the adoption of social media in OSINT by law enforcement and intelligence agencies. This focus extends from earlier work on social media surveillance (Trottier, 2012a, 2013) that treats the adoption of social media platforms in user practice as producing new conditions of visibility, for these and other social actors. It also extends from work on social media policing (Trottier, 2012b), as one institutional context where the aforementioned visibility configures and is in turn reconfigured by police adoption. This uptake bears a resemblance to an earlier push to adopt closed-circuit television (CCTV) networks in the realm of police monitoring (Norris and Armstrong, 1999), as well as attempts to market social and digital media intelligence in marketing and other domains (Andrejevic, 2013).

The site of inquiry comprises the localised contexts in which social media OSINT is trialled in Europe. While the European Union (EU) presents a united front in terms of data protection vis-a-vis the Silicon Valley (Fioretti, 2014), in practice it is a tenuous assemblage of local institutional cultures, social media platforms and third-party mediators. National privacy advocates, including data protection authorities and civil society groups, also oversee social media uptake among police. This article draws on interviews with 19 police and intelligence officials, as well as 14 privacy advocates from 13 EU member states. Interviews were face-to-face and semi-structured, and took place between September 2012 and March 2013. This data collection was part of a broader European Commission project on the uptake of new technologies in the context of security, with a focus on perceived social costs. Respondents considered their motivations to adopt open source social media monitoring technologies in their jurisdiction. After an overview of OSINT in the context of public policing, findings are arranged into six thematic settings. The first two consider uptake and concerns related to immediate institutional constraints. The third and fourth themes consider automation and interoperability as key features of social media remediation through OSINT, while the final two themes consider perceived social costs in relation to the aforementioned tensions, including the furthering of categorical suspicion, the repurposing of platforms and content as well as the criminalisation of online spaces. These findings provide an exploratory understanding of the assemblage of OSINT and social media data with police practice.

OSINT and public policing

OSINT refers to the repurposing of public records for intelligence and investigations, including social media content not protected by privacy settings. While the investigating agent has to manually specify the search criteria and range, tools such as search engines and web crawlers will then automatically retrieve these data and as such are key elements in a process of constructing actionable intelligence from public records. These tools can be used for both retrospective as well as real-time searching. As social media platforms maintain a presence in social life, their users continue to submit information, much of which is publicly accessible by default. Data analytics by law enforcement are located within a context of repurposing social information. In terms of its uptake by police, we may consider how it extends from other, longstanding practices of monitoring public spaces and incorporating novel information sources (Ericson and Haggerty, 1997). As one example, CCTV, whether publicly or privately owned and administered, amounts to a mediated surveillance of public and semi-public spaces. It enables the recasting of otherwise ephemeral social interactions into raw data, to be analysed in the detection and pursuit of criminal events. During their uptake, they were even framed as a kind of fifth utility (Graham, 2002) in part due to their potential as a public service. While some urban initiatives sought to embrace a democratising potential in open-access CCTV, or ‘local community webcams’ (European Urban Knowledge Network (EUKN), 2007; see also Trottier, 2013), in practice, this led to a further mediation of civic life, and a further rupture between social strata with uneven access to this utility, along with uneven exposure by the utility. Such assessments echo earlier assessments of the distancing between police and the public through CCTV (Norris and Armstrong, 1999) as well as a specific professional class of camera operators that relays information about public spaces to law enforcement (Smith, 2004). In the case of OSINT, public information is mediated by definition, and subsequent actions amount to a further remediation (Bolter and Grusin, 2000) of social media data.

OSINT and social media are meaningful in the context of other kinds of relations between police and public. A prominent model is community policing, which suggests a bilateral relation of information sharing (Friedmann, 1992). Some police uses of social media resemble this model, for instance, by soliciting input and feedback from the public, alongside making themselves visible to the public (Crump, 2011). Furthermore, policing models are in practice shaped by what is technologically and economically possible. Cost-cutting measures and limited staff may shape data analysis through OSINT. Public policing initiatives also rely on private media services. These initiatives target and analyse seemingly public data that are relayed on privately owned communication channels and mediated through privacy settings that render data visible to varying degrees. This techno-economic configuration shapes what information is designated as publicly accessible by OSINT analysis, and thus has a determining effect on data subjects who are rendered visible and knowable through police intervention.

Social media monitoring includes, but is not limited to, OSINT. Likewise, in practice, OSINT collapses several types of public records, including social media, but also news media, government reports, satellite photography and industry white papers. The triangulation of these sources is of particular value to police, as it aims to enrich a contextual understanding of the target of an investigation, as well as corroborate any single piece of information (Bartlett et al., 2013). Security researchers are currently considering the specific contribution and affordances of social media data for OSINT. Social Media Intelligence, or SOCMINT (Omand et al., 2012), identifies social media content in particular as a challenge and opportunity for open source investigations. The discursive formation of SOCMINT by proponents aims to strike a balance between ‘public goods’ that include ‘public safety, the right to privacy and the economic and social wellbeing of a nation’ (Omand et al., 2012: 19). SOCMINT proponents also identify a methodological challenge in the sorting and sampling of social media data, with the implication that existing practices fail to fully interpret social media activity (Omand et al., 2012: 54). This resonates with other assessments of the state of social sciences (Savage and Burrows, 2007) as needing to consider new sources of research data as well as methodological innovations. The remediation of social media data in OSINT also raises concerns about the loss of the specific context in which social media content is authored, a risk that is further compounded by interpreter bias (Trottier, 2012a).

From a law enforcement perspective, bringing social media data into the fold of OSINT follows the perception that criminal acts may leave traces on these platforms. In 2011, London, Birmingham and other British cities experienced social unrest. An unanticipated consequence is that an extensive amount of social media content documented what transpired. Twitter users authored approximately 2.6 million tweets, which purportedly rendered these events more legible to law enforcement as well as to journalists and data scientists (Ball and Lewis, 2011). Social media are also platforms where online communication may be reconfigured as criminal acts. One year before these riots, Paul Chambers posted a public message on Twitter in which he threatened to blow up Robin Hood Airport in South Yorkshire. While this was intended as a joke, it was interpreted as a terror threat, and Chambers was arrested, convicted (a decision that was quashed after three appeals) and lost his job (Mitchell, 2010). These discoveries are part of a broader cultural experience of coming to terms with social media as public records, along with the potential criminalisation of these platforms through police-led surveillance.

Following the 2011 London riots, the Guardian claimed to be able to identify and reconstruct communication flows through an analysis of riot-themed data (Richards and Lewis, 2011). Likewise, the Central Intelligence Agency (CIA) has launched an open source initiative that includes monitoring Twitter data. A group of analysts draw upon ‘up to 5 million tweets a day to gauge public opinion around the world’ as well as ‘messages shared via Facebook and comments made in Internet chat rooms, in addition to listening in on more traditional forms of information dissemination, such as TV news channels and local radio stations’ (Reisinger, 2011). Cross-referencing social media and other publicly accessible sources offers a broad overview of public sentiment, and marks a kind of collapsing of these communication channels into a single category: public data. In some cases, police may repurpose social media content as evidence. Even content that is obscured by privacy settings may be reclassified as public when a potential suspect shares it with a friend, who in turn offers it to police (Kelly, 2012). Police may also use these platforms to solicit information, as in the case of the San Francisco Police Department’s (SFPD, 2014) ‘Anti Bike Theft’ twitter account. These examples illustrate precisely the novelty of OSINT: that individual messages on social media, taken in aggregate, can purportedly provide access to social life on a simultaneously granular and aggregate scale.

Private companies produce technologies that collect publicly available data from social media sites. Israeli-based Nice Systems has developed NiceTrack Open Source Intelligence, which ‘helps Law Enforcement Agencies (LEAs) and intelligence organisations identify new suspicious activities and national threats’ through a ‘mass collection of unlimited web sources’ (NiceTrack, 2014b). Threats and suspicions are extended onto a vastly ‘unlimited’ media landscape. In effect, this justifies the analysis of open sources of social media, while defining this landscape as vaguely borderless. The NiceTrack Monitoring Center ‘is a fully-integrated monitoring and analysis platform that helps Law Enforcement Agencies (LEAs) and intelligence organisations reduce crime levels and fight terrorism’ that collects data from numerous sources, including social media (NiceTrack, 2014a). Nice’s products are designed specifically for police and investigative agencies. In contrast, Maltego (Buley, 2008) is an OSINT tool that generates visual representations of social network data and is marketed to virtually any social actor. These technologies remediate data that may be considered private by users, but remain publicly accessible through Facebook’s default privacy settings. Yet this is a further distribution of that content from the social media platform to a third-party service, to an investigative agency. And while police may have immediate access to social media content through OSINT, the process by which it is rendered to them remains a point of institutional concern.

Such assemblages amount to a curious partnership between private and public entities. Seemingly public information, which is brokered on privately owned platforms and further processed and distributed through private technologies, is then utilised by publicly funded agencies like regional and national police. The seemingly effortless transcendence of private/public distinctions is a troubling development in social media uptake (Andrejevic, 2009; Fuchs, 2011), and is fuelled by an economic drive to repurpose content in as many ways as possible (Bolter and Grusin, 2000: 68; Degli Esposti, 2014). Efforts to account for these data are situated within a broader crisis of representation (Andrejevic, 2013). Attempts to overcome this crisis include an automation of not only access of data but also processing, whereby predictive measures are privileged over analysis and explanation. Such ambitions can be extrapolated to an automation of policing, which is sustained by an immediacy of social life through OSINT. Yet these ambitions are fraught with limitations, not the least of which is the hesitation for police to adopt new information technologies, alongside a preoccupation with origins and credibility of incoming data (Trottier, 2012b).

OSINT in practice as a techno-economic construct

The previous sections consider the introduction of social media content in OSINT, and its potential implications for LEAs as well as data subjects. LEAs in the EU and elsewhere are coming to terms with both a growing social media landscape as well as with OSINT tools that enable the analysis of public content on platforms like Twitter. The interview findings below consider how police in Europe initially engage with social media data via these tools. This uptake is situated in a context of financial constraints, restructuring and legal uncertainty. They are also characterised by a tension between a desire to access social life through OSINT sources, and a preoccupation with the manner in which this information is collected and arranged, especially as the aforementioned sources may radically prolong the shelf life of content from platforms that appear to monopolise social activity.

Conclusion: coping with OSINT investigations and visibility

Social media uptake in OSINT by police remains in a formative stage. These disparate and exploratory findings indicate the presence of two tendencies among officers and privacy advocates who oversee these developments. On the one hand, there is a tendency to embrace the potential collapsing of social and institutional contexts in which this info is gathered and processed. Yet institutional, legal and societal concerns all compel a reconsideration of this iteration of ‘intelligence-led’ policing (Ratcliffe, 2002). Furthermore, concerns with mediation in practice dovetail with more grounded concerns about budgets and career paths. On the basis of the above findings, the inclusion of social media data in OSINT amounts to a remediation of personal content first located on privately owned platforms. Social media platforms have undergone extensive changes to their interfaces, and also their user populations and functionality in the last decade. These changes are linked to their growing popularity, including their adoption by various social spheres and institutions. Furthermore, while promotional material for OSINT generally presents these technologies as accessible to all social actors, police users differ from other actors who may appropriate social media content (Trottier, 2011, 2013), most notably in terms of a perceived legal mandate to do so. On the basis of the above responses, these configurations may further asymmetrical relations of visibility and control between the police and public. While the uptake of social media monitoring in OSINT is shaped by police institutional cultures, a broader awareness of these practices may in turn be reflected in the practices and perceptions of a broader range of social actors involved. A Dutch officer believes this is a dynamic process, which will ‘result in an increased awareness, in everybody, including those people we would like to keep communicating publicly’. This respondent acknowledges that emerging analytic practices on social media are ‘the result of a relatively severe intrusion on your private life’. As a consequence of a heightened non-ephemerality, social media monitoring may contribute to a public awareness whereby users take measures to be less visible on these platforms. Subsequent research in this area should investigate if user cultures on social media come to include practices that minimise or otherwise manage visibility online.

Many respondents raise concerns about these social costs. An Austrian privacy advocate is of the view that ‘the main risk is that people confine themselves in their communication due to the feeling of being watched’. They add that this risk ‘has already been frequently at issue in proceedings before the Supreme Court in connection with workplace monitoring and the surveillance of public and private space’, indicating that there are precedents of this risk that precede social media monitoring by police. An increased reluctance for self-expression online is ‘by far the most important risk involved’ for a Dutch privacy advocate, due to the fact that

obviously, it would be very harmful if people would stop using, say, Facebook […] simply and solely because there is a risk that data will be revealed, a risk that somebody they would prefer not to read their posts will monitor them, or that the data will be collected and used for other purposes later on.

A Czech privacy advocate invokes a social understanding of security, noting that a public awareness of heavily monitored social media platforms will result in a ‘less secure’ society as a result of ‘less democracy’. Other respondents note that this risk is especially acute in the context of sensitive topics, resulting in citizens hesitating to join online communities for health problems, psychological well-being and religious topics. Another underlying thread for respondents is that any potential impacts are manifest on a societal level as a result of the social convergence so often associated with these platforms but also their remediation as public records. Such impacts, including a heightened criminalisation of online spaces, are manifest as a tension between individuals and collectives in discussing social media and big data: some individuals will experience diminished life chances as a result of the intersection of their public record and their categorical affiliations. Yet a broader societal dependence on platforms like Facebook and Twitter overlaps with a similar emerging dependence by police, especially for purposes of information collection and record keeping. As a result, open social media content not only has a prolonged shelf life by default but multiple shelf lives in dispersed institutional contexts. The potential for social media to be a public sphere seems tenuous, while its potential as public records seems actualised, albeit with some hesitation by police.

The open designation of OSINT, when adopted for police monitoring and analysis, reconfigures the perception of social media as public spaces. Upcoming research should remain attentive to how institutional practices by police and other analytic efforts will shape social media users, alongside other active and passive data subjects. These efforts may compel users – criminal or otherwise – to exclude their online content from OSINT through the use of privacy settings, as well as the migration from particular social media platforms. Yet not all users are actively involved in the authoring and circulation of their personal data. Due to the networked character of social media content, especially relational data, even non-users can be enrolled as data subjects through peers or institutions. Indeed, we may consider whether even active data subjects are also partially passive as a result of peer activity on their behalf. Greater focus on the experiences of data subjects is needed in this area. As well, the boundary between public and non-public data, alongside the practices linked to these designations, should be considered in upcoming research.