Cyber Crime and Cyber Terrorism

206
CHAPTER 15
Social media and its role for LEAs: Review and applications
reports, the use of an algorithmic approach based on the calculation of Euclidean 
Distances for the identification of identity deceptions by criminals, the tracing of identi-
ties of criminals from posted messages on the Web using learning algorithms, such as 
Support Vector Machines, and the use of Social Network Analysis for uncovering struc-
tural patterns from criminal networks can all aid in improving the quality and diversity of 
information being fed into the intelligence operations of LEAs.
SOCIAL MEDIA IN “LONE-WOLF” SCENARIOS FOR EARLY 
ASSESSMENT AND IDENTIFICATION OF THREATS
Currently, policing intelligence relies on reports from the public, or the recipients 
of threats in order to take appropriate action in response to the posts made online 
indicating possible criminal behavior. Due to this reliance on public reporting, there 
is potential for these threats to go ignored, or to be drowned out by the noise of the 
sheer unquantifiable amount of information being posted to social media sites each 
day. Often in cases such as those identified, the perpetrators are not acting on behalf 
of a wider criminal organization, or executing a planned course of action. Instead, 
these threats are regularly instinctive attacks that are unplanned and irrational, and 
in response to events that draw emotion, executed by individuals out for vengeance, 
often with histories of social instability and psychological problems. In cases such as 
this LEAs are unable to draw upon robust intelligence sources to identify a current 
or emergent threat from the individual as, one off, unplanned events such as the lone-
wolf school shooting scenarios identified previously rarely have a bread-crumb trail 
of evidence that can be picked up by LEA's existing intelligence operations.
Recent reviews of the US intelligence infrastructure have led to the development 
and formation of “fusion centers” aiming to coordinate intelligence and serve law 
enforcement agencies (LEAs) across entire states in the acquisition, analysis and dis-
semination of intelligence (U.S. 
Department of Justice, 2005
). Within these fusion 
centers, there is potential for the application and integration of social media analytics 
in the crawling and analysis of social media as an open-source intelligence repository 
in response to emergent, unplanned “lone-wolf” scenarios such as those discussed in 
Chapter 10. In these situations, there are two potential streams of information that 
is of potential value to LEAs. Firstly, there is the identification of posts made by 
the perpetrator containing explicit signals of intent to cause harm, and secondly, the 
sentiment being expressed by situational stakeholders in regards to the threats and 
actions of the individual.
Through the application of technologies such as Natural Language Processing 
(NLP) and sentiment analysis techniques, it is possible to identify specific postings 
that (a) contain criminal intent and (b) contain references to specific concepts such 
as target locations, and methods to be used by the individual(s). Named entity and 
concept extraction techniques provide the user (in this case envisaged to be an ana-
lyst within the fusion centre setting) with explicit reference to the location and na-
ture of the threat being made, in addition to the name and location of the individual 
making the threat. From this information, the threat can then be analyzed and cross 

---