Many of us think of social networks -- if we think of them at all -- as those "computer things"

our kids use to plan parties and gossip amongst their friends. But, used correctly (and with
careful consideration of any legal restrictions), social networks can come close to giving
us a look inside the very souls of potential crooks and terrorists.
Facebook are Web sites. Indi viduals like you
and me, celebrities like Ashton Kutcher and
Ellen DeGeneres, and possible perps, like
MadDog99, all post to the Twitter servers.
To make a post, you create a personal ac-
count, which you log into wi th a password.
Both Twitter and Facebook do not stri ctly
enforce identity verifi cation, so there 's
always some question who the real person
is behind the account, but if the poster him-
self doesn't leave hi s personal informati on,
he may leave clues to hi s identity, just like
MadDog99 did.
Online social networks like Twitter and Facebook are not just all the rage among teenagers
and young adults. In fact, according to Nielsen Company research, more than two-thirds
of the world's Internet population visit social networking sites at least once a month, and
nearly 10% of all time spent online is devoted to social networking.
W
ith that many people us ing
social networking tool s,
you can al most guarantee
some of them will be bad
guys. With Twitter aski ng its users, "What
are you doing?" and Facebook asking,
"What 's on your mind?," you can almost
guarantee some hooligans or terrorists will
answer. And that ' s when things start to get
rea ll y interest ing.
Let me give you an example. MadDog99
(not hi s real fake name) posts on Twitter
the foll owing note:
Steam wheedle Port , I hate you. Di e and
bum in hell and 99.9% of your residents.
Of course, Steamwheedle Port is the name
of a fictional town, but the message is real.
In fact , the real town where this message
was posted had recently experi enced a ter-
rifying weekend where 13 fires had been
set, and nearly a third of the town wenl up
in flames.
Two weeks earli er, our friend MadDog99
posted thi s on Twitter: dood let's burn the
"city" to the ground.
Now, these two messages do not a legal case
make, but taken toget her -- and given the
recent rash of fires -- MadDog99 suddenl y
becomes a person of interest.
Doing nothing other than reading hi s Web
site of past Twitter posts, we get the follow-
ing impressions of MadDog99:
Hi s name may be Hank L. Feffemlan
(because that 's what's li sted on hi s
Twitter page)
He deli vers Chinese food for Taiwan
Takeout in Steam wheedle Port
He recentl y got a large tattoo and
went to Washington, D.C.
He got arrested and released recent-
ly, with the help from a local poli ce
officer who is his cousin
H is gi rl friend broke up with him
He likes cats
He hates people of color and gays
He has an iPhone
To be fair, Mad Dog may be nothing more
than a profane teenager mOllthing off online.
I found hi s post because I have an ongoing
scan for "Steam wheedle Port" running on
one ormy computers. Twitter allows you to
mn real-time scans of posti ngs and
I keep a bunch of windows open
on my comput er, con-
stantly scanning for terms
of interest, including the
name of my town.
Once the user logs in, he posts a short message,
usually less than 140 characters. But what's
interesting from the perspective of counterter-
rorism and law enforcement is this: posts are
allen public, readable to the entire world.
Both Twitter and Facebook all ow for private
posts, all owing users to communicate their
thoughts and ideas privately amongst a group
of approved friends. But the real appeal for
most users is posting to the world. And so,
most Twitter and Facebook users do not opt
for pri vate postings and, as a result, they are
publi shing to a worldwide audi ence.
I find these real-ti me scans
a great way to get an up-to-
the-minute pul se of what's
going on, both in my town
and for the other terms I'm
tracking. There are regular
posts naming Steamwhee-
di e Port and even quite a
few of the flavor, " I hate
Steamwheedle Port ." But
up unti l MadDog99's post,
there have never been any
posts specifical ly mention-
ing burning or fires -- and
Mad Dog posted two.
Of course, Steamwheedle Port is
the name of a fictional town, but
the message is real. In fact, the
real town where this message was
posted had recently experienced a
terrifying weekend where 13 fires
had been set, and nearly a third of
the town went up in flames.
Understanding
What This Means
It 's important to understand what
we're looki ng at when we read
MadDog99's posts. Twi tt er and
WWW.thcOllrnalofcollntcrtcrrorisln.or
COUNTER
TERRORISM
u. JoImaI cj an;! Hanelard S\.nIy Inll!lnlalJDn.Ji
I' m not an attor-
ney, but thi s may
have profound Ic-
gal impl ica ti ons
fo r law enfo rce-
me nt. I n ma ny
cases, looking at
computer records,
like an indi vid-
ual's ema il log.
requires a COLIrt
order. But since
Twiner posts are
publi s he d , by
choice, to every-
one on the Inter-
net, it may be pos-
sibl e to use publi c
Twit ter and Face-
book post ings in
an investi ga tive
case, poss i b ly
eve n wi tho ut a
judge's approval.
This dynamic, real-time search
approach to counterterrorism and
law enforcemenl isn't jusl a geek's
dream; it's already resulted in
arrests. In one such case, Ihe FBI
arrested an Oklahoma man, Daniel
Knight Hayden.
That said, if you th ink you
want to start lI sing Twitter
and Facebook as an inves-
ti gati ve or preventi ve tool,
you may want to consult a
judge or attorney lirst, to make
sure you know the bounds of
your investi gati ve powers.
Using Twitter and
Facebook to Prevent
Attac1(s Before They
Happen
Once you've gott en the legal
go-a head to use Twitt er and
Facebook lor law enlorcell1cnt,
countcI1en'orism, and crime prc-
vention purposes, you can begin
to set up searchcs. As I men-
ti oned, I keep a running Twitter
search for my town's name.
A tool like TweetDeck ( located
at http :// www. Tweet Oec k.
com) can help you keep a se-
ri es of scarches open and con-
stantl y updating. You could set
up sea rches for va ri oll s (own
and city names, sea rches fo r
key locat ions and infrast ruc-
ture ( like a search for "Golden
10
COUNTER
Gate"), or eve n sea rches fo r
indi vidual poss ibl e key phrases
( like " kill him," or " blolV it
up," or " ni ght school").
Once you see an interesting
post, li ke MadDog99's " burn
the city to the ground" post ing,
yo u coul d then open up the
poster ' s Twitter or Facebook
page (again, thi s is a Web page
consciously publi shed fo r the
world to see), and quickl y de-
velop a prolil e, like the one I
listed above.
If enough of what the poster says
raises alarm bell s, then it 's ti me
for the shoe leather to continue
the investi gati on Ilu1hcr.
Thi s dynami c, real -time search
approach to count ert errorism
and law enforcement isn't just
a geek's drea m; it 's <l lready
resulted in arrests. In one such
case, the FBI arrested an Okl a-
Vo1.l5 , No.3
homa man, Dani e l
Kn ig ht Hayd e n .
Pos ting under the
name CitizenQuasar,
I-layden, 52, used
Twi tt er to post the
foll owi ng message:
Th e WA R WILL
start on the s te ps
o f th e Ok lah o ma
State Capito l.
I will cast the first
stone. I n the meantime,
I await/he police.
Apparentl y, the po-
lice were awa iting
him and he was ar-
rc.sted for transmitting
threats to kill or injure
people using interstate
communi cati on tools
over the Intemet. He was
arraigned on April 16, and later
rclcased to a halfway house
aner poli ce later detenni ned he
was more nut than threat.
The thing is with more than two
thirds of all Intemet users using
social networking and at least
10% of all time spent online de-
voted to social networking -- at
some point a post ing by a Mad-
00g990rCitizenQuasar wili
prove to be the real deal.
I r counterterrorism, home-
land security, and law en-
forcement personnel acti vely
keep an eye on these social
networks, there's a chance
all attack, a crime, or a mass
murder might be prevented.
That said, scanning Twitter
feeds is not a li cense to be
intrusive or unnecessaril y
harass ci ti zens. Our job is
not to be arbi ters o f po-
liti ca l correctness or even
to poli ce obnoxious or even
haleful poslings. If we limi t
our investigations to those
postings Ihal are trul y repre-
sentati ve oi' potentialtrouble, law
enforcement wil/likely be able to
cont inue lO use thi s technique to
prevent di saster.
But... ovemse it, overl y harass cit-
izens, or gel on every American's
case fo r every idioti c statement
made and, at some point, access
to these tools for invcsti gati ve
purposes may be much more
tightly limited by the COUltS. So,
li se Twitter, Facebook, MySpace
and all thesocialnctworking lools
to keep safe -- but we
have to play ni ce, too.
About the Author
For more /hllll 20 years. D(II'ic/
Gell'ir/:. Ihe alllllOro/Where l!m'e All
The mail.' GOlle? ami The Flexible
Enlerprise has allaly=ed ell/.,.elli.
hislOrical. lIlIt/emergillg issues relllting
10 leclll1ology. competi/illcll ess.
(lnd policy. David is the Ec/ilOr-ill-
C/tie/o/ ZATZ reglllar(v
commenlm), and ana(I'.\is /01'
CAW:,' All derson Cuoper 360. alld
has II'rillell more 1"(111 7()() al' /ide.\'
lIbo//l fec:llll%gy. Dovid is (I /ormer
prv/e,\' .wl' 0/ cO/lllwler .\cience. has
lecil/red (If Pri ll celoll. Berkeley.
UCLA. (lnd SIOI//ord. has been
(l1\'{/ rded fhe pres/igiolfs Sigma Xi
Re,\'carch AII'llI'd ill Ellgineering, {l nd
W(lS a c{lIIC/ida/c/or Ihe 2008
Plllil=er Pri:e ill He ,
/he Cy/)cr/errorism Adlli.wr -
/01' /ACSR
Join the
IACSP's Linkedln
Homelond Security Network
of Counterterrorism &
Security Professionals.
TERRORISM
Journal of CounterterroriSul & Homeland Security Internation.al
f
1