IHS
RISK AND
SECURITY
Information
| Analytics
| Expertise
AUGUST 2014
SOCIAL MEDIA
INTELLIGENCE
Practical Strategies for Using Social Media to Enhance Security
Dr. Nina Laven
IHS Economics & Country Risk
Dr. Nathalie Wlodarczyk
IHS Country Risk
David Hunt
IHS Country Risk
© 2014 IHS
SIC SINGAPORE / AUGUST 2014
• Social media intelligence = SOCMINT
Key Message
© 2014 IHS
• ‘SOCMINT’ cannot be used alone for
security. Social media intelligence needs
to be paired with other forms of
information and intelligence to be
effective.
2
SIC SINGAPORE / AUGUST 2014
• What is social media intelligence?
Agenda
• How to use social media smartly:
• Apply Social & Country Expertise
• Use Data Science
• Create Network Analytics
• Emerging SOCMINT Capabilities
• Key Takeaways
© 2014 IHS
3
What is SOCMINT?
SOCMINT involves placing data in context
• Social media insights are of limited
Data
Science
Country &
Social
Expertise
Social Media
Intelligence
(SOCMINT)
intelligence value without the context
provided by other sources.
• Country & Social expertise: expertise
on the society and country being
assessed, including how people there
use social media.
Social
Network
Analytics
• Data science: guides the choices we
make about how to identify signals in
large datasets – which models to use,
what samples are valid etc.
• Network analytics: patterns in digital
social network data.
© 2013 IHS
4
What is SOCMINT?
Four platforms
Social
Networking
© 2013 IHS
Blogs &
Microblogs
Content
Communities
Instant
Messaging
5
Country & Social Expertise
Know your platforms: what matters where
© 2013 IHS
6
Country & Social Expertise
Know your platforms: how they are used
© 2013 IHS
7
Country & Social Expertise: Yemen case study
Know your sources: who matters more
VALUE
• Location
• Cultural Proximity
• Access
• Timing…
RELIABILITY
• Track record
• Endorsement…
Source: IHS Country Risk
© 2013 IHS
8
Country & Social Expertise
Know your sources: how to focus further
© 2013 IHS
9
Data science: Twitter data case study
Data issues: is your data representative?
We want large and valid datasets but we do not always have
the resources to purchase and analyze them. How do we find
the right balance?
© 2013 IHS
10
Data science: Boston Bombing Tweets case study
Data issues: is your data trustworthy?
Only 20% of tweets had true information about the attacks.
Source: IBM Research Labs
© 2013 IHS
11
Network Analytics: UK Riots 2013 case study
With analytics, social media can aid detection
Source: IHS Country Risk
© 2013 IHS
12
Network Analytics: UK Riots 2013 case study
With analytics, social media can aid detection
Source: IHS Country Risk
© 2013 IHS
13
Network Analytics: UK Riots 2013 case study
With analytics, social media can aid detection
Source: IHS Country Risk
© 2013 IHS
14
Network Analytics: Limitations
Automated sentiment has limitations
Source: IHS Country Risk
© 2013 IHS
15
Network Analytics: Emerging capabilities
How to use the Geolocation of tweets
Source: IHS Country Risk
© 2013 IHS
16
Network Analytics: Emerging capabilities
Social media can map leaderless movements
Source: IHS Country Risk
© 2013 IHS
17
The strengths and limitations of SOCMINT
What SOCMINT can do
Limitations of SOCMINT
1 Situational awareness of fast-moving complex
developments (e.g. protests, coups)
Only a portion of the drivers of global risks
are observable through social media
2 Information on events poorly reported in other
sources (e.g. due to state control of media)
Most data related to networks and
communications between individuals is
not publically available.
3 Measure the scale and sentiment of online
discussion of a topic of interest
Algorithms can only go so far in spotting
relevant emerging risks
4 Provide timely warning of emergent risks
5 Identify key influencers and groups of users to
inform monitoring and outreach
© 2013 IHS
18
SIC SINGAPORE / AUGUST 2014
 What is the right balance between
false positives and false negatives in
a system?
Questions
 How do you ensure there aren’t blind
spots in your collection approach?
 The ethics of SOCMINT
 How can traditional tradecraft co-exist
with and enable data analytics
insights?
 How can new analytics tools help the
security team build conversations
across the enterprise?
© 2014 IHS
19