Written by experts on the frontlines, Investigating Internet Crimes provides seasoned and new investigators with the background and tools they need to investigate crime occurring in the online world. This invaluable guide provides step-by-step instructions for investigating Internet crimes, including locating, interpreting, understanding, collecting, and documenting online electronic evidence to benefit investigations. For more information, check out www.computerpo.com.

Investigating Social Networking Sites

There’s a danger in the Internet and social media. The notion that information is enough, that more and more information is enough, that you don’t have to think, you just have to get more information - gets very dangerous.

Edward de Bono (physician, author, inventor, and consultant)

Social networking’s impact on legal systems

Social network use among the public has reached the point where it can no longer be ignored as a passing fad, or considered a high-tech crimes investigation specialty. Detectives, patrol, intel, and gang officers, administrators, private and corporate investigators, prosecutors and corporate counsel need to know who’s online, what kinds of crimes they’re committing, what evidence they’re leaving and, where it can be found. More importantly from a legal standpoint is obtaining online evidence in a manner so that it can be used to win convictions or in litigation. Why is it that we need to care about social networking sites? The answer is that is where the people are and it is where the criminals will go to victimize them. Let’s look at some social networking statistics for some perspective on the issue. GlobalWebIndex reported that Facebook has 701 million active users, with Google Plus and Twitter at 359 and 297 million active users, respectively. (Watkins & Presse, 2013) Seventy-two percent of online US adults use social networking sites. (Brenner & Smith, 2013) Surely, the sheer number of users is large and obviously has an impact. But that is only part of the concern. Specifically, how much are these users on social media and how much data is being generated as result? Smith (2013) provides clues to these questions, with the following user stats for Facebook and Twitter:

• Average number of monthly posts per Facebook user page: 36
• Average number of friends per Facebook user: 141.5
• Average time spent per Facebook visit: 20 minutes
• Average time spent on Facebook per user per month: 8.3 hours
• Average followers per Twitter user: 208
• Average number of tweets per user: 307
• Average amount of time on Twitter per month: 170 minutes

These stats represent another investigative concern, specifically the number of profiles a target may have on various social networking sites. Having more than one profile on a social networking site can occur as well as having profiles on a number of different sites. A social networking investigation can involve a lot of data particularly if the target and those associated with the target (the victim, witnesses, and associated targets) have more than one social media profile.

If the target or victim is a corporation the investigator needs to be aware that most corporations will have more than one social networking site account. Owyang (2011) details a 2012 Altimeter Group survey, which received responses from 140 companies with over 1,000 employees. The survey found that the respondent companies averaged 178 official social networking accounts per company. This includes 39.2 Twitter accounts, 31.9 Blogs, 29.9 Facebook accounts, 28 LinkedIn accounts, and many others on various forums, message, image, and video sites. The point here is a social media investigation, without focus, without a plan, could easily become an Odyssey with no clear accomplishment.

Social networking investigations are not without other challenges. Many officers do not know how to navigate the myriad of social networking sites. To compound the investigative issues many government agencies have restricted access to those sites out of fear of what employees will say or do online. To address these issues, they need to understand effective investigative techniques as well as a suitable policy. Receiving detailed social network training becomes very critical in today’s Internet-connected society.

A Social Networking Site Definition

Boyd and Ellison (2008) defined “… social network sites as web-based services that allow individuals to (1) construct a public or semi-public profile within a bounded system, (2) articulate a list of other users with whom they share a connection, and (3) view and traverse their list of connections and those made by others within the system. The nature and nomenclature of these connections may vary from site to site.”

Law enforcement, social media, and the news

In the last few years articles have claimed to expose a new offensive by the FBI to invade the privacy of people on the Internet. (McCullagh, 2010; Parrack, 2010) The Electronic Freedom Foundation (EFF) filed suit, along with the Berkeley Law School, against various Federal agencies trying to expose their investigative use of social networking. Using a Freedom of Information Act, the EFF obtained their smoking gun. They obtained a US Department of Justice PowerPoint presentation discussing the general issues surrounding social networking and how to go about using it effectively as an investigative tool. Nothing earth shattering, but apparently many in the press seemed to be surprised that the FBI was doing their job. The EFF was so impressed with the revelation that they have made their own webpage “FOIA: Social Networking Monitoring” just to track their progress at exposing law enforcements’ use of social networking to the world.

Social networking has changed many things when it comes to our online lives. Immediate postings of user activities, locations, and the divulging of individual’s feelings are common. Everyone realizes that all of this is posted for the world to see otherwise they would not be doing it. We are becoming a bunch of Internet exhibitionists. With that exposure comes those that would take advantage of our openness. Criminals tend to congregate where victims increasingly gather. Law enforcement is starting to recognize this and is also gathering in the social networking sphere. So with online crime comes policing of the Internet. So, the police, and the FBI, will go where the criminals go. Ergo, the FBI is working undercover on Facebook to catch criminals and terrorist. This is shocking to only those blind to how law enforcement functions.

Social networking’s impact is not just as new undercover tool. On February 18, 2010, Joe Stack, flew his plane into a federal building as both a suicide and antigovernment gesture (Brick, 2010). The story quickly made national headlines. Social media made private citizens into scene reporters telling the world in real time about events as they unfolded. Traditional news media gathered this information and reportedly after confirming it, included it their own coverage of the incident (Gonzalez, 2010).

Austin Police Chief Art Acevedo, apparently unhappy that information was flowing in this matter retorted “There’s a lot of speculation. I can tell you right now that those reports are inaccurate and it is irresponsible journalism to put out information that is not confirmed through law enforcement.” YNN News Channel 8, agreed in their commentary but correctly observed “But law enforcement needs to keep up with the speed of citizen journalism using social media” (Gonzalez, 2010).

We don’t know for sure what context the Chief’s single quote was regarding, but it is a little arrogant to think that his department is the only source for correct information. Social media has changed many things and citizens are regularly using it to report news as well as track crimes. The fact that a person can live stream information from an incident like that changes how we receive our news and how journalists are viewing their position in the reporting of that news. Law enforcement is going to have to adapt to the changing speed of the information flow. Private citizen’s use of social media necessitates that law enforcement respond more quickly. Law enforcement public information officers will also need to learn to track social media at the scene of an incident and respond to the information more timely. Investigators will need to start tracking this information to identify leads related to an incident. Social media has changed dramatically how law enforcement will need to respond to incidents and the news media in the future. The question is how quickly law enforcement can adapt to the changing social media landscape.

The Boston Marathon Bombing is an example of both advantages and disadvantages of law enforcement’s using social media to solve crimes. The FBI posted photos of Suspect 1 and Suspect 2 from surveillance footage to social media, seeking the public’s assistance in identifying the individuals in the photos. Unfortunately, the public erroneously identified one of the subjects as an innocent bystander, requiring a quick correction by law enforcement. Ultimately, law enforcement obtained a clearer picture and was able to identify the correct suspect through their YouTube page (Presutti, 2013).

Many investigators are probably thinking that these kinds of social media events only happen to big cities like Austin and Boston. This is simply not true and the below example should be a sobering warning that law enforcement does have to “keep up with the speed” of its citizen’s use of social media.

Meet the authors:

Art Bowker (@Computerpo) has over 28 years’ experience in law enforcement and corrections. His first book, The Cybercrime Handbook for Community Corrections: Managing Risk in the 21st Century, describes the process of supervising cyber-offenders. Bowker cowrote his second book, Investigating Internet Crimes, 1st Edition: An Introduction to Solving Crimes in Cyberspace, with Todd Shipley. His second book provides step-by-step instructions for investigating Internet crimes, including locating, interpreting, understanding, collecting, and documenting online electronic evidence to benefit investigations. Besides his two books he has written numerous law enforcement and corrections articles published by Perspectives, an American Probation and Parole Association (APPA) publication , Federal Probation, and the FBI Law Enforcement Bulletin. On January 14, 2013, Bowker was awarded the APPA Sam Houston State University Award, for work in promoting awareness and knowledge of cybercrime and tools to combat such crimes in the field of community corrections. On November 22, 2013, he was recognized by the Federal Probation and Pretrial Officers Association (FPPOA) with their top honor, the Richard F. Doyle Award, for having made the most significant achievement in, or contribution to, the Federal Probation & Pretrial Services System or the broader field of corrections. Additionally, Bowker received the Thomas E. Gahl, Line Officer of the Year Award (Great Lakes Region Award), which is named in honor of the only U.S. Probation Officer killed in the line of duty. Both awards centered on his contributions and efforts in managing cybercrime risk.

Todd G. Shipley is a retired Detective Sergeant with over 30 years of law enforcement and civilian experience performing and teaching Internet and digital forensic investigations, speaking internationally, has authored books and articles in the field and holds the Patent for Online Evidence Collection.