C O R P O R A T I O N Using Social Media and Social Network Analysis in Law Enforcement Creating a Research Agenda, Including Business Cases, Protections, and Technology Needs John S. Hollywood, Michael J. D. Vermeer, Dulani Woods, Sean E. Goodison, Brian A. Jackson n April 2017, the National Institute of Justice convened an expert panel to assess, and identify high-priority needs Key Findings for, law enforcement’s use of two closely linked tech- nologies that have potential to provide key information • Expert panelists characterized business cases for employing social Ineeded to address crime risks, hold offenders accountable, media and social network analysis in law enforcement, including and ensure physical safety: social media analysis and social monitoring for short-term safety threats in postings; identifying network analysis. Social media analysis consists of meth- those at high risk of involvement in violence, either acutely or ods and tools to collect and analyze text, photos, video, chronically; and investigating specific crimes and organized crime and other material shared via social media systems, such networks. as Facebook and Twitter. Social network analysis is a type of data analysis that investigates social relationships and • The panel also specified a core case not to do: monitoring of First structures as represented by networks (which can also be Amendment–protected activity for vague purposes. called graphs). Social media, given that it reflects relation- • The panel specified a framework for providing computer security, ships inherently, is a key source of data for social network privacy, and civil rights protections when employing social media analysis; conversely, social network analysis is one key type and social network analysis. of social media analysis. • Finally, the panel identified and prioritized needs for innovation In all, the panel discussed five core business cases for related to social media and social network analysis. The four employing social media analysis and social network analysis themes of this innovation agenda are (1) supporting working with in law enforcement: communities to develop policies and strategies for using social 1. Social media analysis: Monitoring for activity media analysis and social network analysis; (2) technical develop- indicating short-term safety threats in postings, and ment, starting with assessing current tools and how they might be communicating responses as needed. better tailored to law enforcement; (3) law enforcement–specific 2. Social network analysis, possibly with social media training on these types of analysis; and (4) creation of a help desk data: Identifying those at high risk for involvement in to help law enforcement agencies navigate requests to social violence. media companies and interpret the resulting data. 3. Social media analysis: Actively monitoring the high- risk to see whether violence may be imminent. 4. Social media analysis and social network analysis: Investigating organized crime networks. 5. Social media analysis and social network analysis: Investigating crimes. The panel also discussed one core case not to do: 1. Monitoring First Amendment–protected activity for vague or unspecified purposes. 2 The panel identified a framework for providing computer disseminating best practices for transparency and collaborative security and protecting privacy and civil rights. This framework decisionmaking for employing social media and social network is shown in Figure S.1 and consists of the following types of analysis technologies, as well as collaboratively creating a series protections: of model policies for employing and securing these types of • Data protections ensure that legal backing is there for all analysis. data collected for law enforcement purposes; that covert The second part of the agenda is technical research on law and undercover operations using social media analysis enforcement–specific social media and social network analysis. similarly have legal backing; and that the collected infor- The initial recommendation is to assess the capabilities of cur- mation is protected from both external and insider threats. rent tools and methods and how they might be better tailored • Analysis protections similarly ensure that legal backing to law enforcement, with the first step of that assessment being is there for all law enforcement analyses, and that analysis to create and disseminate a market survey of what tools and results are protected from external and insider threats. methods are found useful by practitioners now and how well More broadly, these protections help ensure equitable they are working. justice outcomes by protecting against inaccuracies and The third part of the agenda is supporting law biases. enforcement–specific training on social media and social net- • Action protections ensure that policing practices are not work analysis. Here, the initial recommendations are to develop distorted and that both enforcement and social service requirements for training and assess gaps between current com- actions are employed consistently and equitably. mercial- and defense-focused training and what is needed for law enforcement training. This implicitly includes studies and The core business cases and protection framework elements analyses of what tools and methods are working best in support are outlined in this report. of law enforcement operations. Training on legal implications Reflecting both the business cases and the protection and protections is a short-term need that can be addressed by framework, the expert panel identified a series of needs for developing a model curriculum. innovation to better support the use of social media and social The final part of the panel’s innovation agenda is a help network analysis in law enforcement. These needs fall across desk to help law enforcement agencies navigate requests to four themes that define an innovation agenda (Figure S.2) to social media companies. The help desk would help agencies support the appropriate and sustainable use of these tools for with making process requests more likely to result in data public safety purposes. returns and/or content takedowns that address the needs of The first part of our expert panel’s innovation agenda is specific cases; it would also help agencies process and interpret to support working with communities to develop policies and the data returned from process requests. strategies for using social media and social network analysis. Here, the initial recommendations relate to developing and Figure S.2. The Innovation Agenda Figure S.1. An Initial Privacy, Security, and Civil Rights Protection Framework 1. Enable working 2. Technical with communities research for law to develop policies enforcement- and strategies for specific use of using social media social media and and social social network Data network analysis analysis Community relations 4. Help desk to 3. Support law Analysis assist agencies enforcement- with social media specific training companies Actions RAND RR2301-S.2 RAND RR2301-S.1 3 of the technology and because social media is commonly used for INTRODUCTION sensitive and private discussions. Many modern communication and analytic technologies are Social network analysis is a type of data analysis that investi- becoming mature enough that they are increasingly accessible gates social structures as represented by networks (which can also to the average law enforcement organization. Responsible access be called graphs). In these networks, each person is a “node” or and analysis of these technologies hold promise for identifying “vertex,” and each relationship between pairs of people is a link and halting crime threats, investigating crimes and holding (also called an “edge” or “tie”). Figure 2 shows an example social offenders responsible, and detecting and responding effectively network diagram. to emergencies and hazards (all of which are core objectives of Social media, given that it reflects relationships inherently, is law enforcement; see Hollywood et al., 2015, pp. 4–6). At the a key source of data for social network analysis; conversely, social same time, law enforcement access to and analyses of commu- network analysis is one key type of social media analysis. nications data raise concerns about, and require protections for, Often, the purpose of social network analysis is to iden- individual privacy, civil rights, and information security. tify the most “important” or “central” node in a network; how This report describes an expert panel’s deliberations on two “important” or “central” is defined varies but is usually based on such key and closely interlinked communications technolo- the number and types of relationships a person has. As examples: gies: social media analysis and social network analysis. The panel • A person who has more links (i.e., known direct brought together both practitioners and researchers with experi- relationships) than others has a high “degree centrality.” ence in using these technologies within law enforcement appli- • A person who acts in a bridging role, linking different cations. Figure 1 summarizes these two technologies and their subgroups that would otherwise not be related to each relationships. other, has a high “betweenness centrality.” Social media analysis consists of methods and tools to col- • A person who has a high number of indirect relationships, lect and analyze text, photos, video, and other material shared meaning that the person is related to others who