See

discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/280492843

Impact of social media in security and crisis

management: A review

Article in International Journal of Emergency Management · July 2015

DOI: 10.1504/IJEM.2015.071045

CITATIONS READS

3 324

5 authors, including:

Jean Luc Wybo Francoise Soulie Fogelman

European University Cyprus Tianjin University
90 PUBLICATIONS 494 CITATIONS 135 PUBLICATIONS 1,760 CITATIONS

SEE PROFILE SEE PROFILE

Eric Freyssinet
Lorrain de Recherche en Informatique et Ses …
16 PUBLICATIONS 8 CITATIONS

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Botnet artefacts View project

Describing and measuring cybercrime View project

All content following this page was uploaded by Jean Luc Wybo on 31 July 2015.

The user has requested enhancement of the downloaded file.

 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

Impact  of  social  media  in  security  and  crisis  management:  a  review  
 
J.L.  Wyboa1,  F.  Fogelman-­‐Souliéb,  C.  Gouttasc,  E.  Freyssinetd,  P.  Lionse  
 
a    Mines  Paristech  /  CRC;       jl.wybo@free.fr  (Corresponding  author)  
b  Université  Paris  13  /  L2TI;    
  soulie@univ-­‐paris13.fr  
c    Thales  Communications  &  Security;     catherine.gouttas@thalesgroup.com  
d    Gendarmerie  Nationale  Française;     eric.freyssinet@m4x.org  
e    CODAH  (Community  of  Le  Havre  area);  patrick.lions@agglo-­‐havraise.fr  

Abstract  
Social  media  and  more  generally  online  social  networking  technologies  have  emerged  as  powerful  tools  to  
exchange  information  among  a  large  variety  of  players,  including  the  public,  authorities,  companies,  and  
journalists.   In   this   paper,   we   review   the   present   and   potential   uses   of   social   media   and   how   to   value  
information  they  contain  to  help  manage  security  and  safety  matters.  
We  present  some  examples  of  their  use  during  emergencies  and  crises,  how  relevant  information  can  be  
extracted  to  support  fighting  against  cybercrime,  and  how  security  forces  and  emergency  managers  may  
benefit  from  integrating  social  media  into  their  organizations.  
Finally  we  propose  an  overview  of  technical  limitations  and  possible  misuse  of  social  media.  

Keywords  
Crisis  management,  cybercrime,  law  enforcement,  social  media,  big  data  

Biographical  notes  
Jean-­‐Luc  Wybo  is  senior  researcher  at  Mines-­‐Paristech  and  consultant.  He  got  a  MSC  in  Physics,  a  PhD  in  
Computer   Science   and   Professor   grade   in   Organizational   Sciences.   His   research   interests   cover   risk  
management   processes   and   crisis   prevention.   He   is   Editor   in   Chief   of   Safety   Science   (Elsevier)   and  
member  of  the  steering  committee  “safety  and  security  “  of  the  French  National  Research  Agency.  
Françoise   Fogelman-­‐Soulié   is   associate   researcher   with   L2TI   Laboratory   at   University   of   Paris   XIII  
(France)  and  scientific  advisor  for  the  TeraLab  Big  Data  platform  at  Institut  Mines  Télécom.  She  graduated  
from   École   Normale   Supérieure   and   holds   a   PhD   from   University   of   Grenoble.   She   has   written   /   co-­‐edited  
over  120  scientific  articles  and  12  books  on  machine  learning,  social  network  analysis  and  big  data.  
Catherine  Gouttas  has  a  background  in  Computational  Linguistics;  she  has  worked  as  research  engineer  in  
Computational   Linguistics   in   the   Scientific   Center   of   IBM   France   and   in   the   IBM   Sweden   Development  
Laboratory.  In  2006,  then  she  joined  Thales  to  manage  the  Thales  Communication  and  Security  Big  Data  
and  Big  Analytics  laboratory.  She  is  also  responsible  for  the  CLEAR  Laboratory  -­‐  Thales  /  LIP6-­‐UPMC  joint  
laboratory  
Eric   Freyssinet   is   a   Colonel   with   the   Gendarmerie   Nationale   in   France,   currently   heading   the   Digital  
Crimes   Centre   (C3N).   He   is   Engineer   from   Ecole   Polytechnique   and   holds   a   MSc   in   Computer   and   network  
security  from  Telecom  Paristech.  Eric  Freyssinet  has  written  several  books  and  articles  on  cybercrime  and  
digital   forensics,   teaches   at   the   University   of   Paris   II   and   is   due   to   defend   his   PhD   in   2015   on   the   fight  
against  botnets.  
Patrick  Lions  is  Manager  of  the  department  “information  about  major  hazards”  at  Le  Havre  municipality  
and  supervises  the  Office  for  major  hazards  that  gathers  local  authorities  and  companies  of  the  Le  Havre  
maritime  port  area.  After  acting  as  a  Pharmacist  for  7  years,  he  served  in  the  Fire  &  Rescue  as  top  officer  
for  15  years,  in  charge  of  NRBC  units.  Specialist  of  crisis  management,  he  trained  hundreds  of  managers  
from  public  and  private  organisms.  
 
 

                                                                                                               
1 Corresponding author: Jean-Luc WYBO; MINES Paristech; Risk and Crisis Centre (CRC); CS 10207, 06904 Sophia Antipolis Cedex (France)
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

 
Introduction  
Although  security  and  safety  concerns  may  seem  quite  different,   we  argue  that  management  of  both  kinds  
of   situations   is   based   on   the   same   principles:   detecting   weak   signals,   using   efficient   procedures   and   plans  
to   reduce   threats   and   protect   people   and   values   at   stake,   and   manage   the   crisis   and   get   back   to   control  
when  the  situation  escapes  from  known  conditions.  
‘Disaster   response   may   be   the   ideal   environment   for   ‘proving   the   worth’   of   social   media   as   a   serious  
knowledge  management  platform  (…)  Social  media  is  designed  to  create  order  from  chaos,  using  media  
as  an  artifact  around  which  knowledge  is  organized  in  clusters,  such  as  comments  on  blog  posts  or  tags  
on   images.   Decision   makers   in   disaster   response   require   knowledge   contributions   to   be   highly  
contextualized  because  environments  are  fluid  and  misunderstandings  are  common’  (Yates  and  Paquette  
2011)  
Social  media  play  today  an  important  role  in  the  daily  life  of  citizens  and  governments;  in  this  paper  we  
review  the  impact  of  the  use  of  social  media  on  the  management  of  security  and  safety  situations  and  the  
current  trends  in  processing  the  related  “big  data”  flowing  through  social  media.  
In   the   literature,   the   term   ‘social   media’   refers   to   a   wide   range   of   internet-­‐based   tools   and   uses   allowing   a  
large  number  of  users  and  communities  to  share  information,  ideas  or  opinions  in  an  interactive  manner:  
blogs,  microblogs  such  as  Twitter,  social  networking  sites  such  as  Facebook,  and  Wikis.  
The  main  feature  of  social  media  is  to  be  managed  in  a  very  decentralized  way  by  the  general  public:  
‘Unlike  traditional  media,  social  media  relies  on  user-­generated  content,  which  refers  to  any  content  that  
has  been  created  by  end  users  or  the  general  public  as  opposed  to  professionals’  (Bertot  et  al.  2012).  
Palen   (2008)   uses   the   word   ‘crisis   informatics’   to   name   this   area   of   research   examining   technical,   social  
and  information  aspects  of  disasters  and  crises.  
Cloutier  &  Radford  (2011)  identified  the  main  trends  that  will  impact  on  the  dissemination  of  emergency  
information  and  crisis  communications  practices:  
“The   expectations   for   immediate   communications   responses   by   the   public   when   a   disaster,   crisis   or  
business   disruptions   occurs;   the   growing   use   of   social   media   as   emergency   information   and   crisis  
communications   channels;   monitoring   social   media   is   now   an   integral   part   of   crisis   communications  
operations;  the  growing  reliance  on  mobile  communications  technology”  (Cloutier  &  Radford  2011,  p.  8)  
Efficiently   using   social   media   in   the   management   of   catastrophes   and   for   fighting   terrorism   or   crime  
involves   many   issues   (Rive   &   al.   2012).   Just   after   the   Haïti   earthquake   in   2010,   the   first   images   to   surface  
were   photos   posted   on   Twitter   and   Facebook   by   people   on   the   field   providing   information   before   the  
mainstream  media  (IRGC  2012).  

Social  media  and  emergency  and  crisis  management  

The   use   of   social   media   for   emergencies   and   disasters   may   be   broadly   classified   in   two   categories:   a  
‘passive’  use  to  disseminate  information  and  receive  user  feedback  via  incoming  messages,  wall  posts,  and  
polls,   and   a   more   ‘systematic’   usage   to   conduct   emergency   communications,   issue   warnings,   receive  
victims  requests,  monitor  activities  and  assess  damages  (Lindsay  2011).  
Latonero   and   Shklovski   (2011)   present   a   case   study   of   the   use   of   social   media   by   the   Los   Angeles   Fire  
Department.   They   argue   that   the   efficient   use   of   social   media   to   provide   information   to   and   get  
information  from  the  public  during  emergencies  is  closely  related  to  key  people  –  called  evangelists-­‐  for  
implementation  of  such  technological  innovations  at  the  organizational  level.  
Police   also   develops   the   use   of   social   media   during   events   that   threaten   public   order.  In   a   study   of   the   use  
of  social  media  during  August  2011  riots  in  Great  Britain,  Denef  et  al  (2013)  argue:  
“Given  that  effective  communication  is  vital  in  containing  and  controlling  crisis  situations,   twitter  with  
its  free  availability,  possibility  for  dynamic  and  faced-­paced  dissemination  and  unrestricted  reach  seems  
imminently  well  suited  for  this  task”.    
During  emergencies  and  crises,  authorities  generally  delegate  communication  with  the  public  to  a  Public  
Information  Officer  (PIO).  In  the  last  few  years,  this  role  has  been  deeply  modified  by  the  development  of  
social   media,   adding   to   their   role   of   “gate   keeper”   the   role   of   “listener”   and   reducing   the   time   to   collect  
information  and  craft  messages  to  the  public  (Hugues  and  Palen  2012).  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

Sutton   et   al   (2013)   made   a   survey   of   the   use   of   social   media   –more   precisely   Twitter-­‐   by   authorities  
during   the   Deepwater   Horizon   oil   spill.   Among   their   findings,   they   identified   that   “public   officials   are  
contributing   to   the   Twitter   atmosphere   largely   by   producing   content   rather   than   engaging   with   others  
through  directed  communication  or  content  consumption”.  
One   of   the   key   questions   that   emerge   from   such   cases   is   how   the   huge   amount   of   data   flowing   through  
these  social  media  can  be  analyzed  and  how  to  extract  relevant  information.  
Qu  et  al  (2009)  studied  how  people  in  an  online  community  respond  to  a  national-­‐wide  disaster:  the  2008  
Sichuan   earthquake.   From   the   activity   of   ‘netizens’   on   the   Tianya   web-­‐based   discussion   forum,   they  
identified  four  major  roles:  “information-­related,  opinion-­related,  action-­related  and  emotion-­related”.    

Social  media  and  security  management  

Social   Media   also   play   a   central   role   in   the   field   of   cybercrime,   both   regarding   infringements   on   the  
individual   properties   and   infringements   towards   physical   persons.   Crump   argues   they   constitute   an  
important  real-­‐time  source  of  information  and  intelligence  for  fighting  against  cybercrime.    
’Social   media   are   a   source   of   intelligence   for   policing   (…),   social   media   are   a   source   of   real-­time  
information.’  (Crump  2011)  
Relying   and   learning   on   experiments   realized   by   the   Police   since   2008   through   Twitter,   Crump   (2011)  
shows  that  knowledge  of  social  media  allows  law  enforcement  organizations  to  set  up  communication  and  
reaction   strategies   helping   to   counter   cybercrime.   Denef   et   al   (2013)   argue:   “Social   media   possess   two  
potential  benefits  for  police:  They  can  support  primary  functions  such  as  crime  investigations  and  prevention,  
and  they  offer  a  faster,  more  direct  path  of  communication  with  the  public”.  
Without  darkening  the  positive  impact  of  Social  Media,  it  can  be  noticed  that  they  also  contribute  to  the  
multiplication   of   security   breaches.   In   an   article   entitled   ‘What   Are   the   Police   Doing   on   Twitter’,   Crump  
(2011)  shows  that  Facebook  and  Twitter  are  widely  used  to  coordinate  criminal  activities.  
 ’Social   networking   sites   like   Facebook   and   Twitter   and   messaging   services   like   Blackberry   Messenger  
have  been  used  to  coordinate  criminality,  and  stay  one  step  ahead  of  the  Police’.  (Crump  2011)  
Nowadays,   the   fight   against   cybercrime   also   collides   with   numerous   obstacles.   The   lack   of   technologies  
adapted  to  the  necessary  needs  and  practical  means  of  the  cyberspace  investigators,  ‘to  prevent,  detect  or  
investigate  breaches’,  remains  a  major  drawback  (Freyssinet  2011).  
Globally,  the  response  of  law  enforcement  bodies  to  the  impact  of  social  media  on  their  activities  is  still  
shy   in   comparison   to   the   overall   public   enthusiasm   for   those   new   tools.   Challenges   are   numerous   and  
difficulties  not  to  be  underestimated.  But  in  the  end,  social  media  could  lead  to  a  very  interesting  evolution  
in  the  relationship  with  the  public.  
Usually,  the  first  encounter  of  law  enforcement  personnel  with  social   media  is  either  as  an  individual  user  
for  personal  or  professional  reasons  or  because  such  a  media  is  used  or  abused  in  a  crime  process  or  an  
event   occurrence   and   investigations   are   needed.   But   in   parallel,   as   time   passes,   more   and   more   police  
forces   are   using   social   media   as   a   continuity   of   their   electronic   communication   with   the   public   (web  
presence,  web  services,  email  and  now  social  media).  
In   this   paper,   we   first   present   some   trends   in   the   use   of   the   different   social   media,   and   we   address   the  
techniques  to  extract  relevant  information  from  the  “big  data”  flowing  through  social  media.  
Then   we   analyze   the   opportunities   that   arise   in   the   use   of   social   media   in   security   and   crisis   management  
and  we  discuss  the  benefits  social  media  may  provide  but  also  the  threats  they  may  generate.  

Uses  and  specificities  of  social  media  

In  January  2014,  among  more  than  3  Billion  people  using  Internet  in  the  world,  social  penetration  of  social  
networks  was  26%  over  the  world,  varying  from  56%  in  North  America  to  7%  in  South  Asia.  There  were  
1,184  Million  Facebook  users  and  232  million  Twitter  users.  (Source:  www.wearesocial.com)  
Table   1   presents   who   among   the   French   population   is   using   Facebook   and   Tweeter   (Source:  
www.ifop.com)
  Facebook   Twitter  
GLOBAL  %   63   17  
GENDER      
Male   60   20  
Female   66   14  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

AGE      
18  to  24   86   31  
25  to  34   72   20  
35  to  49   64   16  
50  to  64   52   12  
65  and  over   46   10  
Table  1:  percentage  of  Facebook  and  Twitter  users  in  France  
Depending  on  events,  impacts,  visibility  and  duration,  population  react  differently.  In  most  cases,  people  
use   social   media   to   get   information   or   to   witness   an   event   (figure   1).   The   public   wonder   about   what   is  
happening,   what   they   see,   listen   or   feel.   They   also   use   social   media   to   check   if   other   people   share   their  
feelings   on   an   event.   Three   social   media   emerge   during   emergency   and   crisis:   Facebook,   Twitter   and  
Flickr,  specialized  in  the  sharing  of  images  and  photos.  Liu,  Palen  &  al.  (2008)  identified  29  groups  Flickr  
created  by  citizens  to  allow  the  dissemination  of  photographs  documenting  for  crises.  
The   media   community   also   uses   social   media,   as   it   provides   an   enormous   quantity   of   quickly   available  
data   to   detect   what   is   happening.   Many   journalists   monitor   activity   on   Twitter   to   identify   where   they   will  
rush  to  get  a  scoop  or  report  on  an  event.  Journalists  also  use  social   media  to  publish  information  on  their  
personal  Twitter  accounts,  even  before  this  information  is  on-­‐line  on  the  journal’s  official  web  page.  

The  Twitter  social  media  

Twitter   is   the   archetype   of   instantaneousness.   As   soon   as   some   event   occurs,   images   are   posted   and  
people  start  discussing.  Figure  1  shows  the  crash  of  USAir  flight  1549  in  Hudson  River  (January  15,  2009);  
a  witness,  Janis  Krums,  posted  this  photo  on  Twitter  just  five  minutes  after  the  crash.  

Figure  1.  USAir  flight  1549  in  the  Hudson  River,  posted  on  Twitter  
What  is  specific  to  Twitter  is  the  short  lifetime  of  information.  Photos  and  videos  of  an  event  will  rapidly  
be  forgotten  when  national  media  will  provide  aerial  images  and  interviews.  
Authorities  in  charge  of  emergency  and  crisis  management  may  benefit  from  such  fast  reactivity.  On  one  
hand,   monitoring   systems   may   process   these   data   to   get   relevant   information   quite   soon,   which   give  
managers  essential  inputs  for  their  decisions.  
On  the  other  hand,  providing  advices,  guidelines  and  orders  may  also  benefit  from  using  this  fast  channel  
to  reach  a  large  number  of  people.  In  that  sense,  it  is  a  fast,  cheap  and  easy-­‐to-­‐use  communication  channel  
to   the   public,   complementing   existing   communication   channels   (sirens,   automatic   calling   systems,   Web  
sites,  etc.).  
When   local   authorities   decide   to   create   a   Twitter   account,   this   implies   that   they   commit   to   be   reactive  
when   a   new   situation   appears.   The   use   of   Twitter   imposes   a   search   for   information   to   provide   factual  
data,  comments  on  what  is  happening,  what  resources  are  engaged,  but  also  fighting  against  rumors  and  
false   information;   see   for   instance   the   use   of   the   Tweeter   hashtag   #Mythbuster   in   Australia   by   the  
Queensland  Police  Service  (Bruns  2011).  
Rumors  generally  emerge  from  fear  and  anxiety  in  the  public.  By  providing  factual  information  to  reduce  
uncertainty  and  reassure  the  population,  authorities  may  also  refute  rumors  as  soon  as  they  appear,  as  it  
was  set  up  by  FEMA  (2012)  during  the  Sandy  hurricane.  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

Facebook  uses  during  emergencies  and  crises  

Facebook  usage  is  quite  different  from  Twitter.  In  most  cases,  posted  information  is  only  available  to  the  
provider’s   community   (his/her   ‘friends’).   Posted   information   is   more   personal   and   tends   to   open   a  
discussion  among  the  people  concerned  or  interested.  
During  emergencies  and  crises,  it  may  become  an  important  communication  channel  with  the  emergence  
of   pages   related   to   some   important   or   stressful   events,   which   allows   communities   to   share   support   and  
resources  when  faced  to  dramatic  circumstances  such  as  storms  or  floods  for  instance.  
Facebook  may  also  be  used  ‘in  time  of  peace’  to  provide  training  and  information  about  prevention.  This  is  
the  role  of  ‘Community  Managers’,  who  manage  the  accounts  of  public  authorities  and  private  companies  
with  a  well-­‐defined  strategy.  

The  emergence  of  VOST  (Virtual  Operations  Support  Teams)  

More   and   more   local   authorities   invest   in   social   media   and   use   them   to   disseminate   information   to   the  
public   for   prevention   and   awareness,   but   also   recommendations   during   emergencies.   In   order   to   guide  
local  communities  in  the  use  of  social  media,  dedicated  teams  of  digital  volunteers  (“voluntweeters”)  have  
been  set  up  in  the  US,  New-­‐Zealand  and  Canada:  the  Virtual  Operations  Support  Teams  (VOST).  
The   role   of   such   dedicated   teams   is   on   one   hand   to   help   authorities   when   information   demands   during  
emergencies   outstrip   their   capacities   to   respond   and   on   the   other   hand   to   collect,   filter   and   relay  
information  from  the  public  to  authorities.  St  Denis  et  al  (2012)  propose  a  definition:  
“The  VOST  concept  integrates  ‘trusted  agents’  into  EM  operations  by  creating  a  virtual  team  whose  focus  
is   to   establish   and   monitor   social   media   communication,   manage   communication   channels   with   the  
public,   and   handle   matters   that   can   be   executed   remotely   through   digital   means   such   as   the  
management  of  donations  or  volunteers”.  
These  volunteers  know  quite  well  the  functioning  of  social  media  and  play  the  role  of  monitoring  agents  as  
soon   as   an   event   occurs.   During   the   Sandy   hurricane,   the   NYVOST   was   activated   to   inform   authorities  
about  what  was  circulating  on  the  social  media.  Decision  makers  also  use  VOST  to  transmit  information  
and  guidelines.  
Those   teams   are   getting   more   structured   with   time,   thanks   to   the   action   of   the   New-­‐Zealand   VOST   that  
drafted  a  practical  guide  (Milligan  and  Reuter  2012)  and  to  exchanges  between  two  major  communities  
dedicated  to  emergency:  #SMEM  (social  media  for  emergency  management)  and  #MSGU  (médias  sociaux  
et  gestion  des  urgences2,  in  French).  By  doing  so,  they  build  an  important  knowledge  base  that  may  be  used  
if   needed.   Even   if   those   communities   have   no   official   mandate,   they   emerge   as   references   in   the   field   of  
emergency  support.  

Processing  information  flowing  through  social  media:  social  network  analysis  

The  term  “social  networks”  is  used  to  describe  the  network  of  connections  made  possible  by  social  media,  
and  more  generally  the  connections  people  make  independent  of  technology.  
Social  Network  Analysis  (SNA)  is  a  technique  originated  in  graph  theory  (Erdös  et  al  1959)  and  sociology  
(Wasserman  et  al  1994),  and  then  got  developed  in  the  data  mining  scientific  community  (Aggarwal  et  al  
2010);  (Barabasi  2002);  (Kleinberg  1997);  (Newman  2003);  (Watts  2003).  More  recently,  and  especially  
since  the  9/11  terrorist  attack,  SNA  has  been  used  in  the  security  domain:  fight  against  terrorism  (Krebs  
2002);  (Memon  et  al  2008);  (Ressler  2006);  fraud  detection  and  investigation  (Pandit  et  al  2007);  (Chapus  
et   al   2011)   or   crisis   management   (Carbone   2011);   (Earle   et   al   2010);   (Gupta   et   al   2011);   (Hecker   et   al  
2012);  (Kumar  2012).  
In  this  community  of  research,  a  social  network  is  defined  as  a  graph  (Chapus  et  al  2011):  a  set  of  entities  
(the  nodes)   and   a   set   of  edges   linking   these  entities.   Entities   can  be  of  any  nature:  customers,  individuals,  
urls,   products,   merchants,   credit   card   holders,   bank   accounts,   etc.   Links   represent   interactions   between  
these   entities.   A   social   network   will   thus   be   viewed   as   a   representation   of   events   occurring   in   social  
media.  The  neighborhood  –or  circle–  of  a  node  is  the  set  of  nodes  to  which  it  is  linked  (its  neighbors,  its  
friends).  Its  degree  is  the  number  of  nodes  in  its  circle.  
A  community  is  a  set  of  nodes  such  that  there  are  many  more  links  between  nodes  within  the  community  
than  to  nodes  outside  of  the  community.  Decomposing  a  social  network  into  its  communities  provides  a  
segmentation  of  its  nodes.  Identifying  communities  in  a  network  is   hard:  exact  solutions  can  be  found  for  
                                                                                                               
2 Social Media and Emergency Management
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

social  networks  of  small  sizes  only.  For  large  media  (millions  of  nodes),  efficient  approximate  algorithms  
exist:   see   for   example   the   technique   to   optimize   modularity   in   (Blondel   et   al   2008).   Many   metrics   have  
been   defined   to   measure   social   network   characteristics;   see   for   example   (Wasserman   et   al   1994)   and  
(Watts  2003)  for  more  details.  
Centrality   metrics   aim   at   giving   an   indication   of   the   ‘social   power’   of   a   node   based   on   how   well   it   connects  
or  influences  the  network.  Influencers  or  opinion  leaders  are  important  to  detect  in  case  of  a  crisis,  since  
they  can  best  propagate  important  messages.  
In  order  to  implement  Social  Network  Analysis,  one  has  to  go  through  the  following  stages:  
• Start  from  contact  data,  which  describe  entities  and  connections  and  define  various  business  filters  to  
specify  the  semantics  of  the  interaction.  
• Explore  the  social  network  and  visualize  it.  
• Compute  on  the  social  network  various  social  variables.  
• Use  these  social  variables  to  define  influencers,  or  build  predictive  models.  
Addressing   the   governments’   concerns   about   information   flowing   in   social   media,   Kavanaugh   et   al   (2012)  
argue:  
“Data   mining   of   diverse   real-­time   feeds   of   social   streams   related   to   real-­world   events   is   needed   to   enable  
officials  to  make  sense  of  the  vast  amount  of  information  generated.  In  so  doing,  government  should  be  
able  to  act  more  effectively  on  matters  both  routine  and  critical”  
Social  Network  Analysis  (SNA)  is  a  technique  that  aims  at  bringing  very  novel  ways  to  analyze  events.  SNA  
should   be   implemented   whenever   one   wants   to   use   information   flowing   in   social   media   for   crisis  
management  or  crime  investigation.  The  technique  exploits  data  gathered  during  the  crisis,  in  real-­‐time,  
and  provides  various  levels  of  analysis:  
• Before   the   crisis,   it   helps   detecting   weak   signals   and   precursors   or   even   anticipating   trends   or  
events;  
• During   the   crisis,   it   allows   visualizing   situation’s   unfolding,   identifying   important   events   or  
individuals  (‘influencers’),  understanding  the  structure  of  ‘crowd  maps’;  
• After   the   crisis,   it   provides   ways   to   understand   what   happened   and   which   were   the   critical   stages   or  
individuals;   such   knowledge   can   then   be   incorporated   into   the   best   practice   guidelines   for   the   public  
or  the  emergency  management  bodies  (Prentice  and  Huffman  2008)  (Lindsay  2011).  
Figure  2  shows  an  example  of  these  different  stages  as  implemented  in  a  SNA  tool  (Chapus  et  al  2011).  

Figure  2.  A  methodology  for  Social  Network  Analysis  

Exploring  textual  data  from  social  media:  a  technological  challenge  

The   adaptation   of   automatic   text   analysis   technologies   for   processing   textual   contents   coming   from   social  
media   constitutes   one   of   the   technological   barriers   we   have   to   overcome   to   meet   the   real   needs   of  
cybercrime  specialists.  
Textual  contents  analysis  aims  at  identifying  in  the  discourses  of  ‘social  media  players’,  on  the  one  hand,  
the   thematic   dimension   of   texts   (what   do   people   talk   about?)   and,   on   the   other   hand,   the   evaluative  
dimension  (what  kind  of  feelings,  opinions,  tones  do  they  express?).  This  relies  on  methods  from  Natural  
Language   Processing   (NLP),   based   upon   quantitative   approaches   (statistical   and   learning   methods)  
and\or  symbolic  ones.    
Since   a   dozen   years,   the   NLP   academic   and   industrial   community   has   been   working   on   those   tasks.  
Evaluation   campaigns   are   regularly   undertaken   in   the   United   States   and   Europe   as   well.   Today,   the  
industrial   solutions   which   are   proposed   by   software   editors   and   vendors   still   remain   poorly   adapted   to  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

the   processing   of   social   data   and   this   is   particularly   true   for   the   cybercrime   domain,   which   imposes,   in  
addition  to  the  traditionally  existing  constraints,  some  new  specific  ones.  
We   try   in   the   following   to   make   an   assessment   of   the   current   situation   in   terms   of   descriptive  
characteristics  and  associated  challenges  related  to  the  language  analysis  dedicated  to  social  media.    

Massive  and  dynamic  data    

In  2012,  Twitter  has  published  the  following  statistics  (fig.  3):  
• 465  million  Twitter  accounts;  
• 175  million  Tweets  per  day;  
• Bursts  at  2500  Tweets/s;  
• 64%  of  Twitter  accesses  are  done  through  the  Internet;  
• 69%  of  users  are  following  their  own  friends;  
• About  1  million  new  accounts  per  day.    
These   figures   are   a   good   illustration   of   the   very   high-­‐speed   trends   in   terms   of   volumetric   and   dynamic  
evolutions  of  social  media.  What  is  true  for  Twitter  is  also  true  for  Facebook  as  well  as  for  blogs,  forums  
and  chats.    
Automatic   analysis   of   the   huge   textual   contents   collected   from   social   media   data   is,   from   now   on,   fully  
connected  with  the  newly  evolving  and  growing  domains  called  ‘Big  Data’  and  ‘Big  Analytics’.  
To   approach   this   new   paradigm,   it   is   mandatory   to   perform   decentralized   and   massively   parallel  
treatments   in   a   new   environment   (cloud   computing,   MapReduce),   which   is   still   currently   emerging,   in  
particular  within  the  NLP  community.    

Figure  3.  Rapid  development  of  social  network  activity:  Twitter    

Noisy  and  non-­‐standard  data    

Beyond   the   figures,   if   we   are   interested   at   really   evaluating   the   textual   contents   characteristics   issued  
from   social   media,   it   appears,   at   first   glance,   that   we   are   faced   with   very   strongly   noisy   and   degraded  
contents,  which  contributes  to  the  complexity  of  the  data  analysis  processing  per  se.  
The   texts   we   have   to   take   care   of   appear   under   a   very  ‘imperfect’   form,   in   a   non-­‐standard   language   with   a  
strong   level   of   noise   and   linguistic   variability.   Texts   are   closer   to   the   oral   code   than   to   the   written   one,  
they   contain   typing   errors   as   well   as   spelling   and   grammatical   mistakes.   They   rely   on   graphic   and  
phonetic  forms  and   simplifications:    (‘nrj  ‘for  energy,  ‘oryu’  for  how  are  you?),  on  abbreviated  forms,  on  
agglutinated  forms,  typographic  rebus  (‘2mor’  for  tomorrow),  in  extending  the  length  of  the  word  spelling  
just  for  marking  the  intensity  (‘niiiice’),  etc.    
This  makes  the  tasks  of  extracting  thematic  or  evaluative  information  extremely  difficult.  The  complexity  
and   cost   of   adapting   analyzers   to   these   new   textual   forms   raise   problems   linked   to   the   obligation   of  
creating  new  resources  (annotated  corpuses,  lexical  resources)  and  new  extraction  information  rules,  by  
using   robust   techniques   for   automatic   correction   of   spelling   and   grammatical   errors   and   by   means   of  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

techniques   able   to   take   into   account   in   depth   ‘errors’   which   concern   the   style   or   the   typology   of   the  
discourses3.    
In  the  use  of  Tweeter  during  emergencies  and  crises,  the  development  of  codes  and  rituals  like  hashtags  
facilitate   the   identification   of   relevant   messages   (Starbird   &   Palen   2011).   The   UN   Office   for   the  
Coordination  of  Humanitarian  Affairs  has  recently  published  “hashtag  standards  for  emergencies”  (OCHA  
2014)  to  promote  an  efficient  use  of  Tweeter  during  emergencies  and  crises.  

Multiple  and  strongly  heterogeneous  data      

The   processing   of   analyzing   data,   gathered   from   various   social   media,   leads   to   the   much   more   complex  
task   of   dealing   with   a   strong   linguistic   heterogeneousness.   The   heterogeneousness   of   social   data   is  
present  at  all  levels.    
• Multiple  and  varied  textual  structures,  which  can  be  interpreted  only  in  context;  
• Multiple  levels  of  language,  cultural  involvements,  social  vocabularies;  
• Multi-­‐thematic  and  multi-­‐opinions  texts;      
• Varied  postures  (irony,  accumulations,  quotations,  etc.)  with  a  large  discrepancy;  
• Large  variety  of  semiotic  codes.  
The  heterogeneousness  of  social  data  is  widely  reinforced  by  the  strongly  multilingual  dimension  of  the  
social   media   themselves.     As   mentioned   by   Plasseraud   (2013)   in   her   Blog,   even   if   English   remains   the  
most   common  language   on   Twitter   (39   %   of   messages   in   October   2011,   that   is   to   say   70   million  tweets  
every  day),  it  remains  true  that  today,  more  than  60  %  of  tweets  are  drafted  in  another  language.  
Each  language  appeals  in  its  own  language  strategies.  Some  use  special  effects  to  reduce  the  size  of  their  
messages.   In   practice,   it   is   often   necessary   to   analyze   large   corpuses   of   multilingual   texts   but   also  texts,  
which  are  themselves  multilingual  and  use  various  languages.    The  development  of  language  identification  
tools   and   complex   analyzers   on   multiple   and   sometimes   rare   languages,   for   which   no   resources   are  
available,  is  a  latent  challenge.    
Social   media   are   interactive   spaces,   which   do   not   operate   as   the   traditional   ones   (like   phone  
conversation);   in   on-­‐line   exchanges   -­‐   forums,   blogs   -­‐   participants   enter   and   leave   the   space   of  
communication,   the   discussion   is   often   unstitched   and   ceases.   In   the   same   way   tweets   are   part   of   a  
conversation,   little   tweets   make   sense   in   an   isolated   way,   they   include   links   towards   other   spaces   or  
answer   other   tweets.   In   the   process   of   contents   analysis,   hashtags   help   to   enrich   lexical   vectors   of  tweets;  
they  also  help  to  enrich  topics  graphs.  The  understanding  of  the  context  requires  understanding  the  whole  
conversation.  Today,  existing  tools  do  not  take  into  account  this  interactive  component,  difficult  to  model  
and  to  analyze.  

Specific  constraints  linked  to  the  cybercrime  domain    

Cybercrime   and   cyber-­‐enabled   crimes   cover   a   variety   of   criminal   activities:   attacks   against   computer  
systems,   distribution   and   use   of   malware   as   well   as   child   sexual   abuse   images,   or   the   sale   of   illegal   or  
counterfeit  goods.  Its  specialists  are  also  helping  investigators  dealing  with  terrorism  or  different  forms  of  
financial  fraud.  
Without   claiming   to   be   exhaustive,   it   is   necessary   to   mention   the   specific   constraints   imposed   by   the  
cybercrime  domain.  The  analysts  work  on  very  varied  and  new  subjects  within  very  short  time  periods.  
This   strongly   limits   semantic   approaches,   which   rely   on   the   construction   of   semantic   lexical   resources,  
more  adapted  to  the  processing  of  narrow  domains.  
Their   needs   as   regards   extraction   of   thematic   information   are   complex   and   limit   the   purely   statistical  
approaches.   Besides   the   linked   difficulties,   the   extraction   of   always   new   terms   and   often   little   standard,   it  
is  necessary  to  be  capable  of  extracting  and  matching  named  entities  often  out  of  the  traditional  typology  
(telephone   numbers,   addresses,   names   of   computing   codes,   geo-­‐spatial   entities,   etc.).   It   is   the   same   for  
what   results   from   the   extraction   of   evaluative   information;   needs   are   linked   to   the   identification   of  
emotional   tones   or   intentions,   which   are   not   treated   by   the   tasks   of   extraction.   Following-­‐up   the  
conversations   constitutes   an   important   subject   as   well   as   profiling   of   the   authors,   which   imposes   to   work  
on  the  similarity  stylistics  of  texts.  
 
                                                                                                               
3 Since 2007, AND conference brings the researchers community together around problems related to noisy unstructured text data and its processing.
https://sites.google.com/site/and2012workshop/
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

The   languages   of   interest   of   the   domain  that   evolve   in   the   course   of   time  (Slavonic  languages  in  particular  
today)  are  still  little  or  not  processed.  
Finally,  but  this  is  true  for  all  fields  of  SNA  applications,  the  technological  evaluation  is  an  essential  task  to  
assess  the  degree  of  reliability  of  the  produced  results.  
In  addition  to  the  above,  there  exists  specific  –  or  stronger  –  constraints  in  terms  of  evidence  gathering:  
timestamps,  precise  traceability  and  accountability  of  the  sources  as  well  as  procedures  to  guarantee  the  
integrity   of   the   information   throughout   the   process   are   often   requested   by   investigators   and   subject   to  
evaluation  by  the  justice.  These  constraints  need  to  be  properly  integrated  in  all  the  appropriate  steps  of  
the  collection  and  analysis  process.  

Social  media:  a  new  player  in  security  and  crisis  management  

Recently,  during  the  Boston  bombings,  social  media  played  a  very  significant  role,  but  also  made  apparent  
the  risks  and  difficulties  of  using  them  in  such  a  crisis  (Kane  2013).    In  particular,  the  ability  to  identify  
rumors,  false  news,  and  influencers  on  the  social  media  has  appeared  as  quite  critical.  This  ability  depends  
on   various   technologies,   among   which   real-­‐time   data   collection,   content   analysis   and   Social   Network  
Analysis  are  most  prominent.  
Various   authors   have   advocated   for   the   use   of   Social   Network   Analysis   in   fighting   terrorism   (Ressler  
2006),  or  for  crisis  management  (Gupta  et  al  2011),  (Rive  &  al.  2012).  
In   all   these   cases,   real-­time   data   collection   is   critical.   At   this   stage,   collecting   many   different   sources   is  
important,   since   they   will   bring   different   sorts   of   information.   For   example,   in   the   mapping   of   the   9/11  
terrorists  network,  it  was  shown  (Krebs  2002)  that  multiple  data  sources  (family,  neighborhood,  school,  
military,  club  or  organization;  records  of  phone  calls,  electronic  mail,  chat  rooms,  instant  messages,  web  
site   visits,   travel   records;   bank   account   and   money   transfer   records,   pattern   and   location   of   credit   card  
use;  observation  of  meetings  and  attendance  at  common  events),  not  always  publicly  available,  allowed  to  
fully  reveal  the  terrorists  network.    
Providing  threatened  populations  with  early  warnings  is  a  government’s  mission  for  which  social  media  
should   provide   a   strong   support.   Chatfield   et   al   (2013)   demonstrated   that   hypothesis   in   their   study   of   the  
Indonesian  early  warning  system  during  a  tsunami  alert:  
“Despite  the  agile  response  and  alert,  government  resources  and  warnings  alone  did  not  comprehensively  
inform   potentially   affected   communities   in   April   2012;   however,   through   the   extended   civic   network  
relying   on   retweets   and   sub-­networks   that   had   formed   via   Twitter   in   an   ad-­hoc   fashion,   populations  
were   informed   that   otherwise   would   have   been   exposed   to   the   hazards   without   warning.   In   other   words,  
the   combined   collaborative   efforts   of   government   and   networked   citizens   had   a   substantial   effect   and  
potentially  saved  many  lives”.  

Social  media  as  sensors  and  monitoring  tools  in  dynamic  environments  
Collecting   these   data   in   real   time,   for   example   on   Twitter   and   Facebook,   as   the   event   takes   place,   will  
require   substantial   resources   and   skills.   Data   volume   and   velocity   will   have   to   be   handled,   possibly  
through  a  specific  Big  Data  architecture.  
In   many   cases,   collected   data   can   be   analyzed   and   filtered   to   provide   interesting   visualizations.   For  
instance,  Twitter  has  a  geolocation  feature,  which  allows,  if  turned  on  by  the  user,  to  attach  the  location  
information  to  each  tweet  made  by  this  user.  Tracking  these  locations  can  then  be  used  to  build  maps  of  
events.  As  figure  4  shows,  such  maps,  tracked  in  time,  can  provide  very  useful  information  for  the  crisis  
management  teams.  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

 
       Figure  4.  Maps  produced  from  the  geocoded  tweet  counts  for  the  March  2009  Morgan  Hill  earthquake  
(left  from  (Earle  et  al  2010))  and  the  July  2011  Mumbai  blast  (right  from  (Gupta  et  al  2011))  
The  social  network  itself  can  also  be  visualized  to  show  interesting  groups  (the  communities)  which  can  
be   characterized   by   the   attributes   of   their   nodes,   for   example   by   tag   cloud   of   the   most   frequent   words  
used  by  the  users  in  a  Twitter  users  network.    
Police   forces   need   to   be   able   to   collect   information   from   social   media   that   will   help   detect   and   prevent  
infractions,  or  breaches  in  public  order.  Taking  into  account  the  necessary  safeguards  in  terms  of  privacy  
and  personal  data  protection,  they  need  to  be  able  to  exploit  the  information  that  is  available  and  maybe  
initiate  by  their  online  contact  with  the  public  new  sources  of  information.    
That   should   include   the   online   presence   of   police   personnel,   which   can   be   a   good   channel   for   accessing  
interesting   information;   but   this   needs   to   be   organized,   as   well   as   an   official   online   presence   of   the  
agencies  themselves.  It  also  requires  being  able  to  monitor  those  channels,  which  means  dealing  with  a  lot  
of  information  (including  personal  information  that  needs  to  be  treated  appropriately)  over  a  reasonable  
period   of   time   (hours,   days   or   months   depending   on   the   legal   specificities   or   the   necessity   of   the  
situation),  to  detect  and  manage  weak  signals  (Brizon  and  Wybo  2009),  follow  the  community  reactions  to  
an   event   and   adapt   the   response   of   law   enforcement   or   forward   that   information   to   investigators,  
reconstruct   a   timeline   of   events   and   how   they   are   reported   by   the   public,   drawing   links   between  
information  flows,  etc.  
When  a  disaster  strikes  somewhere,  the  first  witnesses’  reaction  is  nowadays  to  take  photos  or  videos  and  
to  post  them  on  social  media  (fig.  5).  By  accessing  them,  authorities  can  complete  their  perception  of  the  
situation  and  take  appropriate  and  fast  decisions  to  address  the  more  urgent  needs  to  rescue  and  protect  
lives  (Winerman  2009).  

 
Figure  5.  Mobile-­‐phone  photos  of  the  April  2013  Sichuan  earthquake  aided  the  rescue  efforts.  
Another  concern  is  the  potential  malicious  use  of  social  media  during  disasters,  from  mischievous  pranks  
to  acts  of  terrorism.  (Lindsay  2011).  

Social  media  as  support  to  investigations  

More  specific  to  law  enforcement,  investigating  on  social  media  opens  a  whole  lot  of  new  questions.  Like  
many   other   Internet   services,   social   media   are   encountered   both   as   the   main   location   or   object   of   an  
offence  (where  infractions  take  place),  but  are  also  used  as  an  additional  source  of  information  in  many  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

other  types  of  investigations  (to  identify  the  person  behind  a  pseudonym,  get  more  information  about  a  
suspect  or  a  victim's  contacts).  
The  various  privacy  configurations  put  the  investigator  in  front  of  a  very  complex  set  of  scenarios  where  
information  that  is  accessible  to  him  varies  a  lot  whether  the  data  is  accessible  to  the  public,  friends  and  
contacts,  friends  of  friends,  and  whether  the  legal  system  in  their  country  recognizes  the  collection  of  such  
evidence   in   the   different   situations.   In   some   countries,   for   specific   types   of   crimes   or   police   units,   it   is  
possible  for  the  investigator  to  investigate  covertly,  using  a  pseudonym  and  thus  when  in  contact  with  a  
suspect  profile,  gathering  more  information.  
But   more   generally,   when   faced   with   social   media,   not   only   will   the   investigator   try   and   identify   who   is  
doing  what,  but  he  can  try  and  address  the  origin  of  an  information  (who  was  the  first  to  publish,  does  it  
exist   elsewhere   on   the   Internet?),   and   what   kind   of   metadata   can   be   extracted   from   the   information  
published  (such  as  geolocation  information),  etc.    
Information  flowing  in  social  media  may  also  help  police  authorities  to  get  a  precise  assessment  of  victims  
and   damage.   About   the   2007   Virginia   Tech   shootings,   Starbird   and   Palen   (2010)   studied   how   students  
collected  and  exchanged  information  and  identified  that:  
“The   resulting   interactions   became   the   basis   of   a   highly   distributed   problem   solving   activity   that  
‘discovered’   in   parallel   and   with   redundancy   and   apparent   accuracy,   the   names   of   the   32   fatalities   in  
advance  of  official  release  of  that  information”.  

Detection  of  influencers    

In   the   terrorists   network   described   in   (Krebs   2002),   the   analysis   of   centrality   metrics   (degree,  
betweenness  and  closeness)  identified  Mohamed  Atta  as  the  ringleader  of  the  9/11  conspiracy.  Would  this  
have   been   known   in   advance,   the   whole   plot   could   have   been   blocked.   Present   intelligence   teams  
nowadays   routinely   collect   information   to   build   graphs   and   try   to   identify   significant   individuals   or  
groups.   The   size   of   these   data   is   extremely   large.   A   similar   analysis   was   performed   for   the   train   bombings  
of  March  11th,  2004  in  Madrid  and  allowed  to  obtain  similar  results  (Rodriguez  2005).  
In  a  similar  analysis  performed  on  the  users  network  in  the  Mumbai  blasts  (Gupta  et  al  2011),  the  authors  
showed   that   the   various   centrality   metrics   identify   different   types   of   influencers:   nodes   with   highest  
degree   were   celebrities   and   media   accounts,   while   nodes   with   highest   betweenness   and   closeness   were  
relatively  unknown.  Yet,  identifying  these  various  nodes  allows  the  crisis  management  team  to  focus  on  
users  who  play  the  most  central  role.  
Emergencies   and   crises   are   dynamic   situations   in   which   events   occur   asynchronously,   while   the   many  
stakeholders   located   at   different   places   make   decisions   to   cope   with   unfolding   situations.   When  
addressing   emergency   and   crisis   information   matters,   it   is   important   to   know   at   any   time   who   is   a   source  
of   information,   who   receives   information,   who   is   related   to   who   and   who   is   located   where,   to   identify   the  
current   social   network   available.   These   questions   relate   to   the   percolation   dynamics   of   information  
through  the  network  (Wybo  2013).  
A   good   knowledge   of   the   existing   social   network   in   a   community   and   its   percolation   properties   allows  
authorities   and   other   stakeholders  to  predict  difficulties  in  the  flow  of  information  during   ‘time  of  war’:  
individuals   and   groups   not   reachable   or   receiving   information   after   a   too   long   delay.   This   kind   of   analysis  
may  give  efficient  guidance  to  solve  these  difficulties  ‘in  time  of  peace’.  

Social  media  as  a  support  to  security  and  safety  organizations  

In   2010,   the   consulting   company   Booz-­‐Allen-­‐Hamilton   analyzed   the   best   practices   in   risk   and   crisis  
communications   (Booz-­‐Allen   and   Hamilton   2010).   Among   the   advices   provided   in   this   guide,   social   media  
play  a  central  role:  
‘Scholars,  risk  communicators,  homeland  security  officials,  emergency  management  personnel,  and  other  
observers  recognize  the  prominent,  multiple  roles  of  social  media  in  a  variety  of  recent  crisis  and  disaster  
situations.’  (Booz-­Allen  and  Hamilton  2010)  
Using  social  media,  the  police  can  develop  a  new  relationship  with  the  public.  People  get  their  information  
–  or  most  of  their  information  –  through  social  media,  and  they  make  comments  about  it.  
‘City   police   departments   in   large   US   cities   primarily   use   Twitter   to   disseminate   crime   and   incident  
related  information’  (Heverin  and  Zach  2010)  
Trottier  &  Schneider  (2012)  present  the  use  of  Facebook  by  police  following  the  2011  riot  in  Vancouver.  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

In  some  cases,  directly  collecting  information  from  the  public  could  allow  faster  reaction  to  events,  as  well  
as   a   better   quality   of   their   relation   with   the   police:   being   able   to   provide   more   information   (pictures,  
videos,   instantly   collected   details   that   they   will   never   remember)   as   well   as   having   the   impression   to  
actually   participate   in   the   protection   of   the   community   –   but   this   means   that   the   police   also   need   to  
provide  their  public  with  feedback  in  terms  of  prevention  and  results.  
In  order  to  be  efficient  when  facing  an  emergency,  a  threat  or  a  crisis,  the  social  network  should  already  
exist.  IRGC  (2012)  argues  that  this  contributes  to  minimizing  damages  and  loss  of  life:  
‘Social  media  tools  can  and  should  be  used  to  create  a  wide  network  of  subscribers  or  followers  before  the  
event  of  a  crisis’.  
Social   media   constitute   a   key   channel   to   defend   one’s   organization   reputation   and   limit   the   dissemination  
of  rumors,  by  making  available  factual  data  on  the  current  situation.  
 ‘Applying   social   media   tactics   to   corporate   and   government   crisis   communication   has   several  
advantages.  First,  it  brings  credibility  to  your  organization  at  a  time  when  it  is  likely  to  be  most  needed.  
And   at   the   same   time,   it   prompts   discussion,   debate   and   feedback   from   the   very   people   who   most   care  
about  the  crises.  (Prentice  and  Huffman  2008)  
Most  large  companies  have  set  up  a   ‘social  media  team’  whose  role  is  to  monitor  what  is  said  about  the  
company  on  the  different  media,  in  order  to  provide  immediately  information  and  data  when  faced  with  
attacks,  rumors  and  false  information.  See  for  instance  the  blog  that  the  TOTAL  Company  set  up  to  provide  
timely  information  about  the  gas  leak  in  the  North  Sea  at  Elgin  platform,  which  occurred  on  March  25th,  
2012.  (Total  2012)  
In   a   testimony   before   the   US   Senate   Committee   on   Homeland   Security,   Craig   Fugate   (2011),   a   FEMA4  
administrator,   discussed   about   the   power   of   Social   Media   as   a   communication   tool   in   the   aftermath   of  
disasters.  He  said:  
‘Communication   in   and   around   a   disaster   is   a   critical,   life-­saving   part   of   FEMA's   mission.   Social   media  
provides   the   tools   needed   to   minimize   the   communication   gap   and   participate   effectively   in   an   active,  
ongoing  dialogue.  Social  media  is  an  important  part  of  the  ‘Whole  Community’  approach  because  it  helps  
to  facilitate  the  vital  two-­way  communication  between  emergency  management  agencies  and  the  public’.  
Fugate  insists  on  the  fact  that  social  media  tools  are  well  known  by  the  public,  so  FEMA  has  to  adapt  to  the  
way  the  public  communicates  rather  than  convince  the  public  to  adjust  to  the  way  FEMA  communicates.  
In   2009,   the   London   Fire   Brigade   set   up   a   Twitter   account   and   a   Facebook   page.   Nowadays,   there   are  
more  than  60.000  followers  of  both  accounts.  
‘The   London   Fire   Brigade   has   the   largest   social   media   presence   of   any   UK   local   or   regional   public   sector  
authority  in  the  country  and  has  delivered  significant  and  demonstrable  results  in  cutting  fires’  (London  
Fire  Brigade  2013).  
By  targeting  people  at  risk  from  fires  and  not  taking  notice  of  traditional  public  safety  messages  (young  
professionals  well  connected  to  social  media),  The  London  Fire  Brigade  achieved  a  significant  reduction  in  
the  weekly  number  of  fires.  This  category  is  responsible  of  around  25%  of  accidental  house  fires.  
In   the   security   domain,   the   professional   presence   of   individual   law   enforcement   personnel   is   more   and  
more   common   to   connect   with   each   other   and   with   the   people   they   are   in   contact   with   (industry,  
academia,  local  authorities...).  There  are  some  associated  risks,  similar  to  those  any  organization  is  facing:  
• There  are  more  chances  to  get  targeted  by  fake  profiles  fishing  for  information5;  
• The  organization  itself  can  also  be  a  target:  people  claiming  to  be  part  of  an  agency  when  no  checks  
are   being   made,   fake   organization   profiles   being   created   to   attract   the   members   of   a   community,   etc.  
This  is  even  more  sensitive  an  issue  for  a  law  enforcement  agency.  

An  application  in  a  local  community  

With   the   rapid   development   of   electronic   data   exchange   and   the   availability   of   many   open   platforms   to  
exchange   data   and   information,   the   attitude   of   local   authorities   has   changed   regarding   communication  
and   information   management   about   emergencies   and   crises.   For   Jaeger   et   al   (2007),   web-­‐based  
emergency   systems   would   facilitate   social   networks   in   helping   communities   respond   to   emergencies   to  
provide  assistance  to  one  another.  
                                                                                                               
4 FEMA: Federal Emergency Management Agency
5 To demonstrate this risk, Thomas Ryan conducted an experiment in 2009, involving the creation of a fake profile named Robin Sage, claiming to be a cyber threat analyst
and who managed to get in contact with 300 other profiles from the security environment. This experiment was presented at the BlackHat conference in 2010.
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

In  that  context,  a  city  ‘urban  area  community’,  associating  the  town  and  a  number  of  smaller  cities  around,  
has   set   up   a   monitoring   system   to   follow   information   related   to   major   events   occurring   in   its   area   of  
concern   (Blay   et   al   2012).   For   these   local   authorities,   the   most   important   aspect   of   social   media   use   is  
about   the   human   character   of   exchanges.   More   attention   is   given   to   the   messages’   contents   than   to   the  
way  they  are  transmitted.  
What  is  essential  for  a  community  decision  maker  is  to  detect  relevant  events  as  soon  as  possible  and  to  
anticipate  emerging  crisis  situations.  Monitoring  must  be  fast  and  find  information  where  it  is  first  posted.  
To   achieve   this   objective,   community   managers   focused   on   social   media   monitoring   and   designed   a  
methodology   to   extract   relevant   information   from   all   information   available   on   social   media.   This  
methodology  to  search  for  relevant  data  associates  a  filter  on  major  hazards  (natural  and  technological)  
and  a  filter  on  the  area  of  concern.  
From   this   first   experience,   it   was   clear   that   this   monitoring   tool   has   a   potential   interest   for   crisis  
management.  During  the  first  weeks  following  the  system  launch,   this  community  faced  a  strong  fire  in  an  
electric   power   plant.   The   system   allowed   local   authorities   to   monitor   media   reactions   but   also   citizens’  
reactions   on   social   media.   From   lessons   learnt   during   this   event   and   other   external   crises   (Sandy  
hurricane,   Boston   terrorist   bombing,   smelly   gas   leak   in   another   urban   area)   the   monitoring   system   and  
the  crisis  management  procedures  set  up  by  this  community’s  authorities  were  improved.  
The   local   office   for   major   hazards   is   currently   setting   up   a   VOST   to   support   the   development   of   that  
initiative.  

Discussion:  limitations  and  perspectives  

Social  networking  technologies  are  used  in  a  complex  social  environment  -­‐with  its  institutional,  cultural,  
and   technological   dimensions-­‐   that   need   to   be   addressed   properly.   In   a   study   about   the   difficulties   to  
implement   a   SMS-­‐based   emergency   alert   system   on   a   university   campus,   Wu   et   al   (2008)   offer  
suggestions   for   the   design   of   information   and   communication   systems   that   target   college   student   users:  
“make  the  purpose  clear,  give  the  user  control,  make  it  visible,  and  socialize  it”.  
One   of   the   difficulties   that   emerge   with   the   development   of   the   use   of   social   media   is   the   lack   or  
incompleteness  of  adequate  policies:  
‘Though   the   current   policy   environment   addresses   many   issues   of   privacy,   security,   accuracy,   and  
archiving   in   some   detail,   much   of   the   policy   related   to   the   use   of   social   media   predates   the   creation   of  
social   media   technologies.   As   a   result,   many   of   the   existing   policies   do   not   adequately   address   the  
technological  capacities,  operations,  or  functions  of  social  media’  (Bertot  et  al  2012).  
Social   Network   Analysis   brings   powerful   tools   to   monitor   social   media   events.   All   stages   in   the   SNA  
process,   as   shown   in   figure   2   (real-­‐time   data   collection,   network   building,   network   visualization,   social  
variables  extraction)  must  be  fully  integrated  in  a  user-­‐friendly  interface.  Integration  of  content  analysis  
(through   text   mining,   sentiment   analysis,   and   natural   language   processing)   will   bring   more   information  
about  what  happens  in  the  social  media,  allowing  the  users  to  better  control  and  monitor  them.  Additional  
research   is   still   needed   to   make   available   these   techniques   to   crisis   management   and   crime/terrorism  
detection  field  teams.  

Technological  limitations  
Considering  the  complexity  of  the  language  used  on  the  social  media,  it  seems  clear  that  today  suppliers  of  
solutions   of   Social   Media   Analysis   cannot   yet   claim   to   propose   solutions   fully   adapted   to   the   automatic  
processing   of   social   textual   contents.   Today   Natural   Language   Processing   tools  (NLP)   are   very   efficient   on  
limited   semantic   domain   of   analysis   with   very   homogeneous   and   well-­‐formed   structures   and   contents.  
Current   technologies,   available   for   English   and   sometimes   for   French,   only   allow   identifying   the   main  
subjects   of   conversation   and   the   polarity   of   the   feelings   expressed   by   authors,   without   being   capable   of  
characterizing  them  more  precisely.  
The  NLP  community  is  very  active  on  all  the  SNA  challenges.  There  are   many  conferences  and  campaigns  
today   which   address   all   the   challenges   related   to   these   massive,   dynamic,   complex   and   strongly  
heterogeneous   data.   The   combination   of   the   statistical   and   symbolic   approaches   is   a   promising   track   as  
well  as  the  consideration  of  Big  Data  technologies.  
Coupling   textual   information   and   relational   information   analysis   is   also   a   very   promising   track   as   far   as  
the  consideration  of  semantics  of  the  relations  between  texts;  actors  and  sources  help  in  the  analysis  and  
the  interpretation  of  the  textual  contents.    
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

Figure   6   illustrates   the   dynamic   coupling   of   topics,   sources,   actors   and   texts   graphs,   which   helps   to  
investigate   large   sets   of   social   data.   The   HMI   is   used   for   detection   and   investigation,   by   putting   in   relation  
in  a  dynamic  way  a  set  of  connected  graphs:  topics,  sources,  actors,  and  texts  graphs;  it  allows  to  operate  
personalized   user’s  paths,  based  on  filtering,  navigation   and   iterations.   This   capacity   enables   to   propose  
several  analytical  viewpoints  to  analysts:  
• They  can  quickly  draw  statistics  to  unveil  macroscopic  or  microscopic  trends  on  specific  topics;  
• They  can  visualize  all  the  relations  found  in  the  collected  texts  and  map  these  relations  on  the  main  
semantic  topics  extracted  from  a  combined  semantic/statistical  analysis  of  the  textual  contents.  
Such  a  visualization  capability  enables  the  analysts  to  browse  a  huge  graph  in  order  to  identify:  
• Frequent  and  rare  topics;  
• Communities  of  actors  discussing  these  topics;  
• Social  sources  which  publish  information  on  these  topics;  
• Posts,  comments  which  deal  with  these  topics;  
• Evolution  in  time  of  all  the  results.  

Figure  6.  Dynamic  graphs  visualization  

Without  doubt,  new  methods  for  putting  man  in  the  analysis  loop  are  still   to  invent  as  a  complement  to  
progress   of   NLP   technologies.   Works   in   the   field   of   visual   analytics   based   on   dynamic   and   interactive  
visualization  are  also  promising  there.  

Creating  new  threats  by  mixing  private  and  professional  worlds  

Social   media   tend   to   push   people   into   mixing   their   personal   and   professional   lives   online:   asking   for   your  
work   position   on   leisurely   media   or   linking   you   with   your   former   student   friends   on   work-­‐oriented  
media,   may   create   risk.   Another   technique   that   enhances   that   risk   is   asking   you   to   give   the   key   to   your  
online  email  where  professional  and  personal  contacts  are  mixed  and  will  be  contacted  to  be  your  friend.  
Some  online  tools  are  specialized  in  pulling  all  network  accounts  together.  Since  most  people  have  actual  
friends  at  work,  why  exclude  them  from  their  online  friends?  
Thus,   it   is   not   always   easy   to   keep   strong   barriers   between   professional   and   personal   online   presence.  
This   means   that   one   needs   to   be   careful   in   all   situations,   and   at   least   try   to   stick   to   the   context   when  
acting:   being   professional   in   online   professional   media   and   keeping   personal   stuff   for   more   personal  
oriented  media.  
The  presence  of  law  enforcement  people  online  nowadays  is  mostly  of  personal  nature:  social  media  are  
more   and   more   used   to   stay   in   touch   with   their   families   and   friends.   It   is   a   challenge   for   police  
organizations,   similar   to   the   one   every   organization   is   facing:   one   has   no   real   control   on   how   their   staff   is  
going  to  behave  online.  There  are  specific  risks  related  to  law  enforcement  personnel:    
• Revealing   confidential   information   –   unwillingly   for   instance   when   talking   with   friends   about  
insignificant  details  of  their  work  activities,  such  as  a  planned  activity  early  in  the  morning  that  could  
give  a  tip  about  a  programmed  house  search,    
• Endangering  their  families  –  some  people  could  want  to  locate  the  families  of  police  men  and  harass  
them,  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

• Expressing   inappropriate   views   in   public,   or   being   seen   in   contact   with   people   that   are   expressing  
those  views,  or  have  bad  police  records  –  social  media  are  about  connecting  and  making  friends  and  
most  don't  always  check  who  is  trying  to  connect  with  them.  
Law  enforcement   staff  as  many  others,  tend  to  connect  to  social  media  from  work,  which  involves  the  risk  
of   clicking   on   unwanted   links,   such   as   those   distributing   malware.   If   access   to   social   media   –   or   any  
Internet  content  where  no  control  is  made   –   is   permitted   or  necessary,   all  precautions  should  be   taken   to  
protect  from  those  particular  threats.  
What  these  few  examples  show  is  that  law  enforcement   organizations  need  to  inform  and  advise  properly  
their   personnel   about   risks   related   to   social   media;   some   institutions   are   already   doing   it,   such   as   the  
French   Ministry   of   Defense6.   It   also   means   that   those   organizations   need   to   acknowledge   that   some  
situations   are   unavoidable   and   not   always   blame   their   personnel   for   their   bad   connections,   but   rather  
better  educate  them  about  the  risks.  

Conclusion  
Social  media  are  nowadays  part  of  the  organizational  systems  managing  security  concerns,  emergencies  
and   crises.   More   and   more   authorities   at   the   local,   regional   and   national   levels   include   them   in   their  
processes,   to   provide   public   with   the   information   they   request   and   to   collect   timely   information   about  
what  is  going  on.  
But  the  intrusion  of  social  media  in  existing  organizations  raises  a  number  of  concerns:  how  to  cope  with  
new  and  time-­‐consuming  duties,  how  to  avoid  malicious  use,  and  how  to  extract  relevant  information  in  
the  huge  amount  of  data  flowing  through  social  media,  knowing  that  most  of  them  are  just  ‘noise’.  
The   scientific   community   as   a   whole   is   working   on   these   matters,   through   the   work   of   different  
disciplines:   social   scientists   study   the   uses   and   behaviors   of   different   communities,   computer   scientists  
study  the  methods  and  tools  to  process  big  data  flows,  and  the  political  sciences  community  work  on  the  
definition  of  new  organizational  patterns  that  integrate  social  media.  
We  argue  that  these  different  researches  should  be  integrated  to  provide  policy  makers,  authorities  and  
practitioners   with   a   strong   background   and   help   them   understanding   why   and   how   integrating   social  
media  in  their  practices  for  the  improvement  of  security  and  safety.  
As  a  general  conclusion,  we  quote  an  argument  raised  by  (IRGC  2012):  
‘The   lack   of   control   over   information   posted   on   social   media   platforms,   and   the   related   fear   that   it   is  
much  more  difficult  for  government  agencies  to  ‘control  the  message’  may  have  to  be  accepted  as  part  of  
the  new  communication  reality:  an  unavoidable  challenge  that  comes  alongside  the  many  opportunities’.  

Acknowledgements  
Authors  thank  Dr.  Julie-­‐Maude  Normandin  for  her  valuable  comments  and  suggestions.  

References  
Aggarwal  C.C.,  Wang  H.,  2010.  Managing  and  Mining  Graph  Data.  Springer  
Barabasi  A.L.,  2002.  Linked.  Plume,  Penguin  Group  
Bertot  J.C.,  Jaeger  P.T.,  Hansen  D.,  2012.  The  impact  of  polices  on  government  social  media  usage:  Issues,  
challenges,  and  recommendations,  Government  Information  Quarterly  29,  30–40  
Blay  L.,  Laclemence  P.,  Wybo  J.L.,  Lions  P.,  2012.  L’apport  d’une  veille  territorialisée  pour  anticiper  les  
évènements  majeurs  dans  les  collectivités  locales,  WISG’12,  Troyes  
Blondel  V.D.,  Guillaume  J.L.,  Lambiotte  R.,  Lefebvre  E.,  2008.  Fast  unfolding  of  communities  in  large  media.  
J.  Stat.  Mech.,  arXiv:0803.0476v2  [physics.soc-­‐ph]  
Booz  Allen  and  Hamilton,  2010.  Risk  and  crisis  communications:  best  practices  for  Government  Agencies  
and  Non-­‐Profit  Organizations.  http://www.boozallen.com/media/file/Risk-­‐and-­‐Crisis-­‐  Communications-­‐
Guide.pdf  
Brizon  A.,  Wybo  J.L.,  2009.  The  life  cycle  of  weak  signals  related  to  safety,  International  Journal  of  
Emergency  Management,  6-­2,  117-­‐135  

                                                                                                               
6 http://www.defense.gouv.fr/actualites/articles/reseaux-sociaux (in French)
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

Bruns,  A.,  (2011).  Towards  Distributed  Citizen  Participation:  lessons  from  WikiLeaks  and  the  Queensland  
Floods.   In   Parycek,   Peter,   Kripp,   Manuel   J.,   &   Edelmann,   Noella   (Eds.)   CeDEM11:   Proceedings   of   the   In-­  
ternational   Conference   for   E-­Democracy   and   Open   Government,   Edition   Donau-­‐Universität   Krems,   Danube-­‐
University  Krems,  Austria,  pp.  35-­‐52  
Carbone  N,  2011.  Charting  the  Catastrophe:  Map  Matches  Earthquake  Videos  to  Location.  Time  NewsFeed.  
March  12,  2011.  http://newsfeed.time.com/2011/03/12/charting-­‐the-­‐catastrophe-­‐map-­‐matches-­‐
earthquake-­‐videos-­‐to-­‐location/#ixzz2SuCwSlY4    
Chapus  B.,  Fogelman  Soulié  F.,  Marcadé  E.,  Sauvage  J.,  2011.  Mining  on  Social  Networks.  In  Statistical  
Learning  and  Data  Science,  edited  by  Mireille  Gettler  Summa,  Leon  Bottou,  Bernard  Goldfarb  and  Fionn  
Murtagh.  Computer  Science  and  Data  Analysis  Series,  CRC  Press,  Chapman  &  Hall.  2011  
Chatfield  A.T.,  Scholl  H.J.,  Brajawidagda  U.,  2013.  Tsunami  early  warnings  via  Twitter  in  government:  Net-­‐
savvy  citizens'  co-­‐production  of  time-­‐critical  public  information  services,  Government  Information  
Quarterly  30,  377-­‐386  
Cloutier  P.,  Radford  B.,  2011.  PTSC-­‐Online  Project  to  advance  crisis  and  emergency  communications,  
http://www.ptsc-­‐online.ca  
Crump  J,  2011,  What  Are  the  Police  Doing  on  Twitter?  Social  Media,  the  Police  and  the  Public,  Policy  @  
Internet  3,  Issue  4,  article  7  
Denef,  S.,  P.S.  Bayerl,  Kaptein  N.  2013.  Social  Media  and  the  Police-­‐Tweeting  Practices  of  British  Police  
Forces  during  the  August  2011  Riots.  In  Proceedings  of  the  2013  Conference  on  Human  Factors  in  
Computing  Systems,  3471–3480.  New  York,  NY:  ACM  Press.  
Earle  P,  Guy  M,  Buckmaster  R,  Ostrum  C,  Horvath  S,  Vaughan  A.,  2010.  OMG  Earthquake!  Can  Twitter  
Improve  Earthquake  Response?  Electronic  Seismologist  of  America.  
http://www.seismosoc.org/publications/srl/SRL_81/srl_81-­‐2_es/    
Erdös  P.,  Rényi  A.,  1959.  On  random  graphs.  Publicationes  Mathematicae,  6,  290-­‐297  
FEMA,  2012.  FEMA  Rumor  control,  http://www.fema.gov/hurricane-­‐sandy-­‐rumor-­‐control  
Freyssinet  E.,  2011.  L’Europe  en  lutte  contre  la  cybercriminalité  in  La  criminalité  en  France,  CNRS  éditions  
Fugate,  C,  2011.  Testimony  before  the  Senate  Committee  on  Homeland  Security  and  Governmental  Affairs,  
Subcommittee  on  Disaster  Recovery  and  Intergovernmental  Affairs:  ‘Understanding  the  Power  of  Social  
Media  as  a  Communication  Tool  in  the  Aftermath  of  Disasters’,  May  5  2011,  
http://www.dhs.gov/ynews/testimony/testimony_1304533264361.shtm  
Gupta  A.,  Kumaraguru  P.,  2011.  Twitter  Explodes  with  Activity  in  Mumbai  Blasts!  A  Lifeline  or  an  
Unmonitored  Daemon  in  the  Lurking?  IIIT,  Delhi,  Technical  report,  IIITD-­‐TR-­‐2011-­‐005,  2011.  
http://14.139.56.164/Publications_files/AG_PK_TR_2011.pdf    
Hecker  M.,  Vanbremeersch  N.,  De  Durand  M.,  Souchet  T.,  2012.  Nature  et  conséquence  des  réseaux  sociaux  
pour  les  forces  armées.  http://www.defense.gouv.fr/content/download/204906/2271215/file/EPS2012-­‐
Reseaux  sociaux.pdf  
Heverin  T.,  Zach  L.,  2010.  Twitter  for  city  police  department  information  sharing,  proceedings  of  ASIST  
2010  conference,  Pittsburgh  
Hughes,  A.L.,  Palen  L.  2012.  The  Evolving  Role  of  the  Public  Information  Officer:  An  Examination  of  Social  
Media  in  Emergency  Management.  Journal  of  Homeland  Security  and  Emergency  Management  9  (1),  article  
22.  
IRGC,  2012.  Social  Media  for  Crisis  Communication,  Concept  note,  International  Risk  Governance  Council,  
Geneva  
Jaeger  P.T.,  Shneiderman  B.,  Fleischmann  K.R.,  Preece  J.,  Qu  Y.,  Fei  Wu,  P.,  2007.  Community  response  
grids:  E-­‐government,  social  media,  and  effective  emergency  management.  Telecommunications  Policy,  31-­
10,  592-­‐604.  
Kane  G.C.,  2013.  What  Can  Managers  Learn  about  Social  Media  from  the  Boston  Marathon  Bombing?  MIT  
Sloan  Management  Review.  April  25,  2013.  http://sloanreview.mit.edu/article/what-­‐can-­‐managers-­‐learn-­‐
about-­‐social-­‐media-­‐from-­‐the-­‐boston-­‐marathon-­‐bombing/    
Kavanaugh  A.L.,  Fox  E.A.,  Sheetz  S.D.,  Yang  S.,  Li  L.T.,  Shoemaker  D.J.,  Natsev  A.,  Xie  L.,  2012.  Social  media  
use  by  government:  From  the  routine  to  the  critical,  Government  Information  Quarterly  29,  480–491  
Kleinberg  M,  1997.  Authoritative  sources  in  a  hyperlinked  environment.  IBM  Research  Report  RJ  10076,  
May  1997.  
Krebs  V.E.,  2002.  Mapping  Media  of  Terrorist  Cells.  Connections  24(3),  43-­‐52  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

Kumar  A.,  2012.  Role  of  Social  Media  in  Crisis  Response:  Mumbai  Blasts  2011.  Lessons  Learned.  ISCRAM  
2012  Summer  School.  Sep  23,  2012.  http://www.slideshare.net/ajuonline/role-­‐of-­‐social-­‐media-­‐in-­‐crisis-­‐
response-­‐mumbai-­‐blasts-­‐2011-­‐lessons-­‐learned-­‐iscram-­‐2012-­‐summer-­‐school    
Latonero,  M.,  I.  Shklovski,  2011.  Emergency  Management,  Twitter,  and  Social  Media  Evangelism.  
International  Journal  of  Information  Systems  for  Crisis  Response  and  Management  3-­4  1–16  
Lindsay  B.R.,  2011.  Social  media  and  disasters:  current  uses,  future  options  and  policy  considerations,  
Congressional  Research  Service,  6  September  2011,  www.fas.org/sgp/crs/homesec/R41987.pdf  
Liu   S.B.,   Palen   L.,   Sutton   J.,   Hugues   A.,   Vieweg   S.   (2008).   In   Search   of   the   Bigger   Picture:  
th  
The   Emergent   Role   of   On-­‐Line   Photo   Sharing   in   Times   of   Disaster,   Proceedings   of   the   5 International  
ISCRAM  Conference,  Washington  
London  Fire  Brigade,  2013.  http://www.london-­‐
fire.gov.uk/news/LatestNewsReleases_Socialmediareducesfires.asp#.UaSop0AvmSp  
Memon  N.,  Hicks  D.L.,  2008.  Detecting  Core  Members  in  Terrorist  Media:  a  Case  Study.  In  Mining  Massive  
Data  Sets  for  Security,  NATO  ASI  Workshop,  IOS  Press,  pp  345-­‐356  
Milligan  C.,  Reuter  S,  2012.  NZ  VOST  Training  guide,  Wellington  Region  Emergency  Management  Office,  
Wellington  
Newman  M.E.J.,  2003.  The  Structure  and  Function  of  Complex  Media.  SIAM  Review,  45,  167-­‐256  
OCHA,  2014.  Hashtag  standards  for  emergencies,  OCHA  Policy  and    Studies,  October  2014    
Palen  L.,  2008.  Online  Social  Media  in  Crisis  Events,  Educause  Quarterly,  3,  76-­‐78,  
Pandit  S.,  Chau  D.H.,  Wang  S.,  Faloutsos  C.,  2007.  NetProbe:  A  Fast  and  Scalable  System  for  Fraud  Detection  
in  Online  Auction  Media.  WWW  2007,  Session:  Mining  in  Social  Media.  May  8–12,  2007,  Banff,  Alberta,  
Canada.  pp  201-­‐210  
Plasseraud  S.,  2013.  Blog  wearesocial.fr  
Prentice  S.,  Huffman  E.,  2008.  Social  Media’s  New  Role  in  Emergency  Management,  Idaho  National  
Laboratory,  INL/CON-­‐07-­‐13552  
Qu  Y.,  Wu  P.F.,  Wang  X.,  2009.  Online  Community  Response  to  Major  Disaster:  A  Study  of  Tianya  Forum  in  
the  2008  Sichuan  Earthquake,  Proceedings  of  the  42nd  Hawaii  International  Conference  on  System  
Sciences  
Ressler  S.,  2006.  Social  Network  Analysis  as  an  Approach  to  Combat  Terrorism:  Past,  Present,  and  Future  
Research.  Homeland  Security  Affairs,  Vol  II,  N°  2.    
Rodríguez  J.A.,  2005.  The  March  11th  Terrorist  Network.  Working  papers  EPP-­‐LEA  03.  December  2005.  
http://www.ub.edu/epp/wp/11m.pdf    
St.  Denis,  L.A.,  Hughes  A.L.,  Palen  L.,  2012.  Trial  by  Fire:  The  Deployment  of  Trusted  Digital  Volunteers  in  
the  2011  Shadow  Lake  Fire.  In  proceedings  of  9th  International  ISCRAM  Conference,  Vancouver  
Starbird  K.,  Palen  L.,  2010.  Pass  it  on?:  retweeting  in  Mass  Emergency,  in  proceedings  of  the  7th  
international  ISCRAM  conference,  Seattle  
Sutton,  J.N.,  Spiro  E.,  Butts  C.,  Fitzhugh  S.,  Johnson  B.,    Greczek  M.,  2013.  Tweeting  the  Spill:  Online  
Informal  Communications,  Social  Media,  and  Conversational  Microstructures  during  the  Deepwater  
Horizon  Oilspill.  International  Journal  of  Information  Systems  for  Crisis  Response  and  Management  5-­1:  58–
76.  
Total,  2012.  http://www.elgin.total.com/elgin/  
Trottier,  D.,  Schneider,  C.,  2012.  The  2011  Vancouver  riot  and  the  role  of  Facebook  in  crowd-­sourced  
policing.  BC  Studies:  The  British  Columbian  Quarterly,  175  .  pp.  57-­‐72  
Wasserman  S.,  Faust  K.,  1994.  Social  network  analysis:  methods  and  applications.  Cambridge  University  
Press.    
Watts  D.,  2003.  Six  Degrees,  the  science  of  a  connected  age.  W.W.  Norton  &  Company  Publisher  
Rive  G.,  Hare  J.,  Thomas  J.,  Nankivell  K.  (2012).  Social  Media  in  an  Emergency:  A  Best  Practice  Guide.  
Wellington  Region  CDEM  Group:  Wellington  
Winerman  L.,  2009.  Crisis  Communication,  Nature  457,  376-­‐378  
Wu  P.F.,  Qu  Y.,  Preece  J.J.,  2008.  Why  an  emergency  alert  system  isn’t  adopted:  the  impact  of  socio-­‐
technical  context.  In  BCS  HCI  (2),  pp.  101-­‐104.  
 Published  in  :  Int.  J.  Emergency  Management,  Vol.  11,  No.  2,  2015,  105-­128  
 

Wybo  J.L.,  2013.  Percolation,  temporal  coherence  of  information,  and  crisis  prevention,  Safety  Science  57,  
60–68  
Yates  D.,  Paquette  S.,  2011.  Emergency  knowledge  management  and  social  media  technologies:  A  case  
study  of  the  2010  Haitian  earthquake,  International  Journal  of  Information  Management  31,  6–13  
 

View publication stats