How maps help juries visualize cell phone data

In May, Law Enforcement Technology published an article, “Mapping Human Behavior,” which used a high-profile California homicide case to show the pivotal role which cell phone evidence played.

Wireless expert Jim Cook, quoted in the article, will be presenting at the HTCIA International Training Conference & Expo in September. To promote his lecture via their blog*, I interviewed him for more information.

We ended up in a long discussion that wouldn’t fit there, but that I thought would fit quite well here, about things first responders and investigators both need to know about cell phone evidence — but rarely do.

Why cell data mapping?

Cook says in some cases, the cell phone can be one of the primary pieces of evidence. It usually contains content and metadata (information about content, such as a date/time stamp or geotag on an image or video).

In other cases, the data on the phone may be deleted. While cell phone forensics can recover this kind of data, it may not recover everything (depending on the tool used and the examiner’s skill level). Even if it does, carrier data can be an important corroboration of what the phone tells the investigator.

A carrier’s call detail records are a “fingerprint” of the device’s activity, which may include calls, texts, and data transmissions placed or received. The records include information about the cell sites and sectors from which this activity originated; sometimes, if requested soon enough, location information and text content can be obtained from the carrier.

“Sometimes you don’t have the weapon, or witnesses, but you do have potential suspects,” Cook explains. “The victim’s or suspects’ cell phones and carrier data together can contain critical evidence including a suspect’s movements, possible witnesses or even more suspects.”

Otherwise, with no clues, investigators may want to consider requesting a “tower dump.” The tower dump is a request which the investigator makes of the carrier to provide all call, text, and data transmissions that connect to the cell sites covering the crime’s geographic area for a specified time period.

Cell carriers are encouraged to “co-locate,” or lease space on the tower(s) they own, to other carriers wishing coverage in an area that they don’t currently cover. That means that a single tower can contain records for multiple carriers’ customers — which can run into the hundreds or even thousands, depending on the time period and the location.

“A tower dump is a ‘needle in a haystack’ piece of evidence,” Cook says, “but it can be especially useful with serial crimes such as home invasions, robberies or sexual assaults, because tower dumps for each crime location can be cross-referenced for numbers that come up in all locations.” In a case he assisted with, this type of evidence was backed up with search warrants to specific carriers, which led to the arrests of 11 suspects.

But so much evidence can be overwhelming in its raw format. Once the tower dump leads to a specific suspect via a specific carrier, as in the case example above, those call detail records can be mapped as a way to help non-technical people visualize a suspect’s or victim’s movements.

Visualizing a cell sector as a "piece of pie."

“You first explain to the jury how the phone actually works,” says Cook. “You explain antennas, sectors [he uses the analogy of a piece of pie] and so on — then the call process, and how the carrier captures the data.

“Then you show them the map and how you plotted the data, and ultimately, what it means to the case — how it solidifies or even potentially refutes other evidence, including eyewitness accounts, video or social networking updates.” He estimates the conviction rate on cases he has assisted with is 96-97 percent. “Cellular phones are really the new DNA,” he adds, paraphrasing Santa Clara County Deputy DA Vicki Gemetti.

So how do investigators do the mapping?

1. Book cell phones as evidence; don’t mark them as personal property.

“Personal property, if picked up by the suspect or a designee, can be wiped of any and all content,” says Cook. “Booking the phone as evidence allows you to write a search warrant to examine the phone, and also obtain call detail records, text and data transmissions from the carrier for the time period in question, which should be done ASAP because it’s volatile. Not every carrier holds it for a year — some expunge call records after just 90 days.”

Currently, MetroPCS is the only carrier that maintains text message content for up to 60 days. Other carriers such as AT&T and Sprint don’t maintain content at all, while some (like Verizon) maintain it for very short periods of time — six to eight days.

Call detail records can substantiate witness, suspect, or victim testimony, and can even solve a case. At that level, waiting too long can be fatal to a case.

2. Be sure to get data from the phone, too.

Don’t overrely on the carrier, even if you haven’t waited too long. “There is always more evidence,” says Cook. “Take the extra step or two you need to find what you can find from the device.

“Don’t think you can’t get data if the phone’s battery isn’t charged, or if you don’t have cell phone forensic tools. I’ve bought chargers for police from wireless retailers,” he adds. “And if you don’t have a forensic tool, or the tool you have doesn’t work on that phone, or you have only one tool, find an agency that has a tool that will work or a different tool from the one you use. There is always more data; to recover the maximum amount of data from the device, use more than one tool.”

3. Write warrants for carrier data from at least the past three months.

Cook raised this point in the LET article, what he calls “the Jim Cook Rule #1”: go far beyond the immediate period of time you’re interested in.

“We’re all creatures of habit,” he says. “We’re up in the morning, on the road by a certain time, driving through Starbucks and calling mom or dad on our way to work. We have similar routines on the way home and on the weekends.

“But then, we take our phone to New York, and there’s this big gap of no activity when normally, we’re talking to people. Only an extended sample of call detail records can show whether this is out of the ordinary, or part of a subject’s monthly routine.”

4. In your warrant, use the right verbiage.

Also discussed in the article — a sidebar goes into the specific eight items that Cook recommends — is the need to get the right amount of detail in the search warrant. “Carriers need exact requirements for certain information,” says Cook, “like cell sites and sectors, along with the phone data. If they don’t provide it up front, investigators will end up having to write multiple warrants.” That can waste precious time, and lose data along the way.

5. Make sure you’re getting the right data from the carrier.

If the defense attorney is doing his or her job, you may need to prove that the phone really belonged to the suspect at the time of the incident. “Number portability and number switching mean that the investigator needs to find out if the device was active and billable in the suspect device’s carrier’s network during the specified date range,” says Cook.

“If not, you have to find out where to serve the paper sooner rather than later, while the data is still there, instead of finding out you were wrong two or three months later when the records are gone.” Services like FoneFinder or Neustar will show carriers of record; however, they aren’t always 100% accurate, and investigators should follow up their findings with a phone call to those carriers.

6. Be specific with tower dump requests.

If you have to take that next step into the haystack, provide carriers with a physical location, longitude, latitude of crime scene or other location of interest; then, request a tower dump of all calls, text events and data transmissions from all cell sites and sectors covering that geographic area during a period of time. “Let the carrier’s engineers determine the best sites and sectors, as opposed to an investigator making an incorrect assumption that will only result in the wrong data being obtained,” says Cook.

Questions about cell phone investigations or mapping, or want to get in touch with Jim Cook directly? Let us know in the comments!

*Disclosure: HTCIA is a client, but I was not compensated for this post.

People see that little of us these days, other than in a quick fleeting visit or by passing them whilst preoccupied whilst on foot – or more likely – by car. When they do see us we are generally busy thinking about what we have to do and that we have X amount of outstanding jobs that are “backing up” and need dealing with and that we have a pot of crimes that need investigating between all the calls for service….

All of this has resulted in people forming opinions of us. We are arrogant, unapproachable and uninterested [being some of the most popular ones]. In turn, we have formed opinions that the public don’t like us and that we are unappreciated and not understood. It’s a vicious circle.

We cannot control what opinions people form, but we can try to influence the reasons why they think them.

If only we had more opportunities like those I had this week. I think all of us would benefit from it. But I didn’t get a “tick” for doing it, and it’s not measurable by some kind of statistic.

Then, police leaders’ point of view on where policing is headed, from a summit in Seattle:

“The fact is, we’re in the process of constructing the next iteration of police work,” [Chief Garry McCarthy of the Newark Police Department] said. “Initially, police were very reactive,” responding to crimes after they’d been committed, he said.

“Then proactive policing came in, and we talked about preventing crime. The next step is preventing crime in concert and with the blessings of the community,” McCarthy said. “It’s where we’re going as a profession.”

[King County Sheriff Sue Rahr] said police agencies are good at teaching officers physical skills, but now they need to focus on officers’ interpersonal skills.

Instead of focusing on building trust through community forums and other macro-level efforts, Rahr said the focus is shifting to the micro level by building trust through individual contacts.

“We need to build community trust one interaction at a time,” she said.

What austerity means to community

Both in the United Kingdom and in the United States, what is called “austerity measures” in the UK and “budget cuts” in the US has impacted policing severely. Just this past week, the Sacramento Police department was the latest to announce deep cuts, layoffs too. Many specialized units are being eliminated, and officers will respond primarily to emergencies.

Yet both Good Old Bill and Sheriff Rahr are calling for more one-to-one interactions as a way to stave off the psychological impact of these measures. What’s up with that?

I’ve worried about what cuts would mean to high tech crime investigation and digital forensics. The more entrenched technology becomes, the more need to examine it for evidence of crime. Yet as police departments pull staff from these tasks and reassign them to the street (or lay them off altogether), the return to a more physical form of policing means less opportunity for officers to practice their digital — along with their interpersonal — skills.

The answer may just lie in those one-to-one interactions. Last year, a Denver Post article detailed how residents of Colorado Springs (Colo.) were taking a more active role in their own quality of life maintenance, the issues behind the “Broken Windows” theory of policing.

This reflects an article from San Diego, in which police noted that community policing was never meant to be permanent; it was meant to be transitory, enabling the community to be proactive and rely less on police. This transition may be underway already, even if we weren’t expecting it.

Legal and social complications

Still, questions remain on legal and social issues, especially with regard to high tech crime and evidence. Two other stories are troubling because of what they mean for privacy and how civilians relate to one another.

In Michigan, the ACLU has for a long time demanded to know how state troopers use cell phone forensic tools. Other law enforcement agencies are starting to put these tools in cruisers for officers to use, to save time and enable more evidence collection with less manpower.

However, and not just because of the ACLU, forensic professionals hesitate to cheer such decisions because good case law is predicated on proper forensic process. With great power comes great responsibility, after all; is it enough simply to train the officers on the use of the tool? A forensic unit is not a radar unit; it takes more than tuning forks to validate that the tool works properly.

In addition, The Independent noted that in the UK, victims of theft have engaged in some degree of vigilantism to find the high-tech equipment they’ve found stolen:

From Surrey to San Francisco, software is doing the job of the police as vigilantes use tracking programmes more commonly seen in CIA action thrillers to locate missing computers and phones. In April, the ex-England rugby captain Will Carling traced his stolen iPad to a block of flats in Woking. He knocked on all the doors – to no avail – then traced its movement through the town while detailing the chase on Twitter. The iPad was eventually handed in to local police.

Certainly this is convenient, but in some cases it may violate state laws. In California, for instance, no “safe harbor” law exists for crime victims to monitor stolen equipment in real time. That means residents who use these tools may be violating anti-wiretapping laws, and laws designed to protect private communications — yes, even on stolen equipment.

In other words, police can’t use that evidence in court, or at least can use only the data not collected in real time, and may be barred from using the information even with a search warrant.

More recently, vigilantism reared its head in Vancouver following the riots over the city’s Stanley Cup loss:

[B.C. Civil Liberties Association David] Eby said he understood the community’s anger, given the destruction and chaos, but said that bloggers run the risk of labelling bystanders as criminals.

“The concern that we have is when pictures are posted to private websites, the suggestion is made that people may have broken the law,” he said. “There were many people in the downtown area that were shocked, stunned, appalled that were not breaking any laws.”

It seems clear to me that in order to help citizens navigate these issues, police cannot simply return to the “bread and butter” of traditional policing. If they do, then that leaves only federal law enforcement — the Secret Service, the Internet Crimes Complaint Center, etc. — which is also unsustainable over the long term.

If we:

• don’t want to return to traditional reactive policing because it will undo all the hard work we’ve put in over 20 years
• don’t have time or resources to devote to proactive policing over the next 20 years
• are truly taking the next step towards empowering citizens to keep themselves safe

Then we should consider treating them almost as rookie cops, finding field training officers and attorneys who can help them navigate legal and social issues as they become proper partners in public safety. It goes without saying that social media could help pave the way.

I know of detectives and officers who already do this, making the time with their agencies’ blessing. How might yours make room among their regular duties?

Image: lancmanoffice via Flickr

What caught my eye was his mention of how high tech can be used to improve officer safety and community relations… or to damage officers’ relationships with their administrators:

Several years ago, I was approached by some of the administration in my police department about putting GPS locators in the police cars.  The idea had several layers to it.

1. They see where a car was and dispatch the closest unit to an incident
2. If an officer was in trouble they could find the car and send help to the officer.
3. If an officer was “out of zone” they could use it as a tool to make sure officers were staying where they are supposed to.

While the first two reasons were valid.  Any “big brother” style monitoring of police officers is going to be met with resistance.  And this was.  At the time, the usability of GPS tied to the computers in the cars was ridiculous at best.  Simply because of the nature of the communications protocols.  But the administration pushed for it and USB antenna’s were purchased.  Officer’s were told they “must plug them in” when in the car and on duty.

Officers who did so were met with calls from their supervisors when they left their assigned areas to go eat, or use the restroom or whatever.  So they started not plugging them in.

I recently heard that some steps had been taken to ensure they were being utilized.  There is no doubt in my mind the steps taken hinged on threats from the administration of disciplinary action if they weren’t utilized.

So the little pieces of equipment were getting “damaged” by other equipment in the car.  They plug into the USB ports on the computers in the cars and USB ports wear out.  They are held in place by FRICTION.  The flimsy little wires going to the antennas were being pinched by other pieces of equipment, severing them.

What is my point?  First, if you as a police officer are doing your job the right way, why do you care that a supervisor is watching?  Second.  If your police officers are doing their job the right way, what do you as a supervisor care if they go to a “cop friendly” restaurant or a clean facility to use the restroom?  I don’t want spit in my food anymore than the next guy.

If the officers are spending that much time and energy to render the equipment inoperable…  how much time is spent actually crime fighting?

When administrators have nothing better to do that sit around and watch police car videos, looking for something the officer is doing wrong, what job is being overlooked?  Which one of your administrative tasks is being neglected while you try to relive your glory days watching cops do their thing and to what end?

It’s hard to reconcile these words with the articles at sites like PoliceOne.com and Officer.com, which are about how police administrators can improve their relationships with officers as well as the public. But this isn’t the first time I’ve read something like this, either. In fact, this PoliceOne article backs up Scott’s observations.

How prevalent is this problem? Hard to know. I’d like to think that in an era of such severe budget cuts, admins are focusing on better things, like helping their officers to stay alive.

Then again, at least one friend in a hard-hit agency talks about what a war zone his city has become — and how political his agency. It’s as if the cops, stuck in survival mode, have adopted an “every man for himself” ethic rather than banding together. In that kind of environment, it would be easy for a budget-conscious chief to micromanage, especially if it led to being able to lay off “underperforming” officers.

There is a lot of talk in police executive circles about numbers: Compstat, problem-oriented policing, and so on. But these will only work if the administration is willing to go all the way — to refuse to allow criminals and their supporters to game the system. To use the tools the way they were intended: as a supplement to crime data; for instance, how do officer locations (based on GPS) square with the hotspots?

Policing appears to have reached something of a crossroads. On one road are the numerous tools that could stand to make the job more professional, efficient, and effective. On the other are people to whom such change is a threat. Which road is your agency walking? What will it take to change direction?

photo credit: Simon Blackley

How will you respond to criticism of the way you handle a high-profile case?

An iPhone prototype lost, found, and then sold. A police raid on the home of the blogger who broke the story. In a public relations crisis that is largely eclipsed by the much bigger issues of the Gulf of Mexico oil spill and Wall Street fraud, the Silicon Valley-based Rapid Enforcement Allied Computer Team (REACT) Task Force is facing criticism for two issues:

First, fears that it violated California’s journalist shield law. And second, that iPhone’s developer Apple, which sits on REACT’s steering committee, influenced the task force’s actions to too great an extent.

Compounding this, REACT seems as ill-prepared to respond as any law enforcement agency that is unused to widespread public criticism. That, I’m afraid, is a much bigger problem than most police might envision. But I’ll get to that in a second.

Messaging vs. communication during crisis

REACT doesn’t have a social media presence, other than an intermittently updated blog. The guestbook on their website has been taken over by criticism, however, in much the same way as Nestle’s Facebook page was by Greenpeace activists.

To REACT’s credit, they aren’t taking the criticism down (assuming they even know about it), but beyond that, haven’t said much. They’ve left communication to the public information officer at the Santa Clara County District Attorney’s Office, their “home base”:

To the extent that high-tech companies or other entities would send representatives to the meetings, they are considered members of the committee. While our records have not shown its attendance as of late, Apple is similarly situated as other companies or entities, which have open invitations to attend committee meetings at any frequency.

Meanwhile, task force leader Michael Sterner was quoted as saying that it was “not uncommon for investigators to make use of intelligence from firms’ internal security teams or to consult with companies’ security personnel as cases move forward” but that the task force does not “take directions on our investigations.” San Mateo chief deputy DA Steve Wagstaffe reminded reporters that Apple was the victim of a crime — a week after the controversy started.

In my opinion, these statements don’t go far enough. They don’t take into account the task force’s actual day-to-day work, its role in combating high-tech crime, the other cases they have worked since their inception — part of whose conditions was a private-sector steering committee. (One wonders if this in itself is the underlying basis for the criticism.) A lot more is in play here.

Crisisblogger Gerald Baron writes about the role of politics in a crisis:

“…the crisis managers [at BP and Goldman Sachs] involved in working these two humongous issues right now, will have a very significant impact on the long term decisions that elected officials will make in these two arenas.”

So, too, decisions affecting REACT and task forces like it. Recall the Heartland data breach, the Google data breach, and others. Breaches like these can lead to intellectual property theft as serious as laying hands on an iPhone prototype. They can also lead to identity theft, as when private personal and bank information in a company’s servers is sold. These affect everyone – not just the companies themselves.

Thus the need for police-private partnerships. In fact, many companies don’t involve police; they’re afraid of bad PR, and they risk that a breach dealt with quietly behind the scenes won’t evolve and go public. Police are working to change these attitudes, but they can’t do it without developing relationships with those companies.

And implications that police-private partnerships are inappropriate won’t help.

A social alternative to traditional crisis communication

Fast, clear, accurate communication is necessary during crisis

An ongoing high-profile investigation is the last thing most law enforcement administrators want to comment on, especially in the real-time social web. However, consider that numerous outlets already are doing so. Thus even if a response cannot talk about the case itself, it can work to mitigate the less wholesome coverage. Hint: that wouldn’t involve getting a subpoena to take down a news article.

So what if REACT had a social presence? It might take some lessons from a counterpart further to the northeast.

The Sacramento Valley High Tech Crimes Task Force has been, at least since 2003 when I first started working with one of its detectives, very media-friendly. This culture is driven by a desire to inform and educate the public; this desire in turn led to the task force’s social presence. Detective Dan Brown daily posts information about cyber crimes like identity theft, trying to educate his publics about threats and how to protect themselves.

In short, he talks about the same hard-to-understand issues that led to the task forces’ creation. So I asked him to speculate on how he would handle it if it was Sac Valley, not REACT, that was involved in the search. Here’s what he had to say:

I would address the question and in this way: The steering committee is made up of 52 law enforcement agencies and approximately 42 private businesses of the “high technology” industry and various financial entities.  The purpose of the steering committee (in summary) is to review task force activity and provide advice, recommendations, strategic input and direction for “task force consideration.”

With about 42 private entities involved, no one entity has more influence over the other and we have not experienced an extreme amount of pressure from any one entity.  The task force operates solely on state grant funding and requires no monetary contributions from any of the private entities.  The task force respects the advice and recommendations of the private industry committee members but we are not beholden to any private corporation.  In the end we make the decisions.

Fortunately, we have a great relationship with the private industry side and are of the same mind on most issues.  So our committee is made up of members who simply want to combat hi-tech crimes.  Political influencing and the pushing of individual agendas has never been an issue; furthermore, it would never be tolerated.

Note that Det. Brown is an investigator, not a PIO. That’s why it can be a mistake to defer to the “home” agency’s PIO, whose responsibilities are much broader than what one task force is doing. That person may have only the barest-bones idea of what a task force does and what it means to the community.

Ideally, then, it will be a task force representative managing task force social sites, and working hand-in-hand with the PIO – and, if necessary, legal teams – to communicate rather than message.

Social strategy and crisis communication

A good communication strategy can keep you from being sunk

When I first started writing this post, I thought it would boil down to strategy. A social presence set up solely to educate, I imagined, would be within its rights not to address bad PR. It would not want negative comments to dilute its educational content stream, or to drown out its longer-term message – especially if its resources were as limited as many agencies’ are.

But social culture is rooted in two-way communication. As many companies and law enforcement agencies broadcast, feedback continues to be important to their publics. Indeed, President Obama’s administration has been criticized for “[seeming] to imagine that releasing information is like a tap that can be turned on and off at their whim.”

This in contrast to his campaign, in which he and his staff tapped into social networking culture to drive a grassroots support for a variety of changes—among them, better government transparency. Thus inconsistent communication fails to generate or maintain trust just as much as no communication.

Which was behind Det. Brown’s response to my question about how he would handle social criticism:

As far as Facebook goes I think I would entertain critical comments as long as the language was appropriate for our younger fans.  I would address each comment as quickly as possible and with the utmost professional tone.  In the case where someone just can’t be satisfied or reasoned with, I would not continue in a back and forth debate, which almost always ends in a negative and unprofessional way, and consider removing the comments.

While our main purpose is to inform and educate, it would be a mistake to operate in such a manner which the public would keep us under the same ole law enforcement stereo type “not approachable, silent because we are hiding something, not truthful in our endeavors, etc.”

I want to improve communication between our task force and the community we serve.  There is no better way for a hi-tech crimes unit to communicate with the members of their community than on the computer.  I believe if you are going to reach out using social network mediums, you should be ready to converse with anyone who contacts you.  Be accessible, appear approachable and be willing to engage.

This means that above all, don’t just be on Facebook and Twitter because everyone else is on Facebook and Twitter. Know what you’re doing there, have a plan for crisis communication, and be the calm in the storm. That’s what builds trust that when you act in the interests of one segment of your community, you’re acting in everyone’s best interest.

Do you have a social crisis communication plan? Tell us about it in the comments!

Images: Ernst_Moeksis, alex-s, & Amanda_M_Hatfield via Flickr

The implications for online investigation are clear. If you can archive a website, preserving it with incriminating (or exculpatory) evidence the way you found it, you can make cases that way. Right?

Yes. Absolutely. But a third party storing evidence opens the door to reasonable doubt. How can you, the law enforcement officer, prove that no data went unchanged while the evidence was stored out of your direct control? (Chain of custody; evidence preservation.)

I debated with myself over whether to post this, because even if I disclose that I work for a maker of online evidence collection software, “conflict of interest” gives way to “selling something.” Not a comfortable position to be in.

And yet, I believe in what my client does. That’s why I signed with them. And I’d be remiss as a blogger if I didn’t draw attention to something that solves a problem for my community of readers.

Therefore:

Got WebCase?

Websites have a bad habit of changing content, especially when you least need or expect them to. They might undergo a redesign and lose the article you needed to find, or the server they’re hosted on goes down, or their owner might let the domain registration lapse.

Or they could be a social networking site, with status updates and tweets disappearing after a matter of days.

Forensic collection of evidence has always depended on the ability of the collector to preserve the evidence as it was at the time of collection. A bloodstained shirt goes into a properly sealed and marked paper bag, and is logged along the chain of custody until it gets to the analyst. A hard drive is imaged and likewise logged until a digital forensic examiner analyzes that image.

How do you do this with Internet evidence? A lot of investigators simply screenshot a website or capture its video. If that content is taken down or changed between the time it was collected and court, there’s no way to prove it ever existed as it did when you saw it. (Even the Internet Archive’s Wayback Machine is limited.) Again: reasonable doubt.

There’s a much longer story that goes into Vere Software’s making of WebCase, but in essence, it splices together legal expectation with commonly accepted digital forensic methodology by not just archiving, but also date/time stamping and hashing (“digitally fingerprinting”) the website content as evidence.

It then goes a step further by providing a way to show all this in court in a way that average jurors, attorneys, and judges can understand—visually, sometimes auditorially.

Can vs. should

Can you get away with screenshots and video captures? Sure. I can’t think of current or recent cases that made challenges to this kind of evidence… but that doesn’t mean they aren’t coming, as soon as defense attorneys and judges get savvy. I’m not sure that will take long. They’re already trying to figure out what to do about tweeting jurors and judges on Facebook.

Cops are so frequently accused of taking shortcuts, meanwhile, with investigations. Especially when it comes to evidence collection and preservation. And while digital evidence can be complicated, WebCase wasn’t designed for analysts. It was designed for average investigators, who deserve to be able to show in court how law enforcement takes case-building as seriously as we want you to.

So please head on over to the Vere Software website and download the 30-day free demo of WebCase, along with the various free tools offered. Subscribe to the blog, check out the free e-learning. No, I’m not getting paid for this post, nor based on sales that come from this post. Yes, I understand that budgets are strapped. Believe me.

At the same time, though, a good friend of mine secured two copies of WebCase not long before the union in his department voted to forego pay raises just to keep its gang unit rather than see it disbanded. That town is facing serious gang problems, and given that gangs are using social networking sites to do their business, the fact that this agency found the money for WebCase is significant.

What kinds of online evidence is your agency seeing?

Image: NIOSH via Flickr

When transparency makes you want to hide

Those of us who applaud organizational use of social media talk a lot about “transparency.” A company or government agency that allows its employees to blog or tweet, under their own names, about their lives and jobs is said to make us trust them more. It’s humans caring about what other humans experience. What could be simpler?

Too much transparency?

In August I blogged, also with regard to transparency, about a police chief friend who “went dark” on Twitter because a citizen had complained about some tweets he’d made off hours, with regard to his life outside of law enforcement.

The other day another friend said something similar. His story went like this:

I had some citizens that were giving me info via Twitter [referring to] what they saw as a problem. I took the info and told them we were following up on it. We already were and it was drug related. When these folks didn’t see immediate reaction from LE they sort of took it out on me personally and my agency via Twitter posts. I replied with a professional, but possibly a bit stern reply….

That officer, Lt. Chris Mouser, is about as transparent as you can reasonably expect from a 17-year veteran of law enforcement. He tweets about his faith, his family, sometimes about his job as a patrol division commander. From what I can tell, he’s a good guy. Yet his human-ness was not enough for his critics.

Or was it too much?

Some people need authorities, not other people

I have wondered whether transparency is as valuable as progressive police chiefs, journalists, watchdog groups, and others tell us it is. While I think organizational transparency is absolutely valuable, personal transparency is a little more of a gray area.

Look at any log of 911 calls and you quickly see that many callers are looking for, in essence, stand-in parents. They want police to help them control their kids, take their medications, make sense of their lives.

And just as you don’t want to know about your parents’ sex life, many citizens don’t want to know that their police are anything but police. Personal details make them feel insecure, as if finding out that a cop has the same family problems they do makes him or her less able to handle their problems.

Says Mouser,

I find it much easier to speak with people on Twitter and [Facebook] when they are not from my town. When they live here they tend to turn it all into a work issue that I feel responsible for acting upon. They also expect me to talk/act a certain way…

Anticipating the haters

Social media can be a force multiplier. Cops can get the word out quickly and efficiently about problems in their communities. But when community members themselves are critical of those efforts, it’s all too easy for officers to develop “bunker mentality.” As Mouser puts it,

I just wanted to interact with people and see what was going on, and it got turned into me being on duty while on Twitter. I understand after nearly 20 years in Law Enforcement I am on duty all the time, but social media seemed to be a good outlet to interact with others without being in public. I literally avoid going out in public when I’m off as to avoid work when I’m off….

He’s not alone there. I’ve heard that said more than once by now. So rather than take up the old saw about “Take nothing personally,” law enforcement agencies should instead support their officers with policy and best practices.

Indeed, arguably Mouser’s agency needs a presence on Twitter, at the very least a policy in place for individual officers who identify themselves and their locations. How much should go into the policy? Start with questions like:

• How do we handle tips via social sites?
• Who will maintain the official presence?
• What about when they’re off duty?
• On or off duty, how much should they personally be responsible for, and how should they be responsible for it?
• How should they handle unhappy citizens—especially if their personal and professional lives are blended in one account? (Should their lives be blended?) Can they block or unfriend abusive citizens?

Some citizens will never be satisfied, either because they didn’t like police to begin with, or because they’re just disagreeable people. But just as training officers prepare recruits to deal with them on the street, all officers need preparation to deal with them in the far less cut-and-dried online world too.

What else would you add to the list of policy questions?

Image: D.C.Atty via Flickr

A "higher standard" requires police officers to think about what they are doing.

My commenters on the last post got me thinking: police departments (and other professions) demand officers hold themselves to a “higher standard” of conduct. So what’s that standard? What does it mean? How are officers expected to know where the lines are?

The “higher standard” is subjective

These are not easy questions to answer. Young people have, as in previous generations, different standards from those that came before. As commenter H. Carvey pointed out in a follow-up e-mail exchange, he has seen teenagers share Facebook passwords with each other so they can update each other’s statuses, share photos of each other without obtaining permission (sometimes with rude comments attached). And we all know the debate about sexting.

In a police context, officers are now surrounded online by people calling other people stupid. A young recruit may believe that saying “people are stupid,” for instance, is “not as bad” as calling them “stupid redneck bimbos.” And there’s the old freedom-of-speech issue.

But as Carvey, a former Marine, says, “Obtaining a position of authority does not remove your freedom of speech… it simply places you in a position of greater responsibility of the use of that freedom.”

Social networking is a new take on old human interaction. And if communication is, at least in part, about pushing the boundaries with each other, then social networking magnifies this tendency. The trick for police managers is in learning how to help cops push the right boundaries.

Training officers to think first

Good ethics training teaches what and why and how: as Carvey says, the purpose behind the standard, the need for it to exist. Good ethics training starts at the police academy and continues on through field and in-service training. It’s not just left to a policy or set of policies, but is incorporated into every piece of training an officer attends.

That covers the department’s butt in the event of misconduct. But it doesn’t necessarily solve the problem of teaching officers to think about what they are doing and saying.

Case in point. Last year, one of my sources (Lt. David Hubbard of the Eustis FL Police Department) conducted an internal investigation of one of his officers for Tasing a 14-year-old at a birthday party. Not because the teen was out of control or attacking anyone—but because he asked the officer, a personal friend, to Tase him.

Several things stand out about this incident, which ended up on YouTube:

• EPD had conducted a thorough background check of the officer, who before he was hired had been a nonsworn bailiff at a nearby sheriff’s department.
• His Taser training had included rules of conduct, including “don’t Tase your friends.”
• Just off probation, he had never had any other disciplinary problems, and was considered a good officer.
• The video shows him essentially “training” the teen on what to expect.
• He took full responsibility for the incident, not even trying to blame it on drinking too much.

Ultimately, the officer quit before being fired; because he’d not only Tased a juvenile, but also failed to do enough to stop underage drinking, termination was the only possible outcome. As Hubbard told me, “The ethics were there—he just exercised poor judgment.” And therein lies the rub.

So the challenge to police administrators is not just to teach according to policy about unofficial use of government property, or liability, or the other usual suspects. It’s also how to teach people to empathize with those who feel wronged by an action, when 1) they themselves would not feel wronged if the same action were done to them, 2) they “got consent,” or 3) when the sense of feeling wronged is a normal part of life for them.

It’s not, in other words, enough to ask officers to “maintain the professionalism of the department, and to nothing to bring shame or disgrace upon yourself, your fellow officers, your department, or your profession” because when people don’t even get that certain conduct (like sexting) is shameful—because they don’t see it that way for themselves—they’re not going to think about professionalism in the same way their supervisors are.

Constant, continuous ethics training

To get officers out of their own heads and into what civilians think (and why they should care) will take commitment: “…more training and education, more mentoring and working more closely with some folks, and a lot more oversight,” says Carvey.

Best way to accomplish this, when training budgets (as in Eustis PD) are being slashed? There, ethics are being worked into the high-liability training the agency must focus on. Hubbard is also a proponent of career mentoring for young officers, helping them move toward careers in law enforcement rather than just a job at an agency.

As Carvey notes, instilling professionalism in young officers is no different than instilling anything else they don’t bring to the job. To use a street example, you can’t assume that just because an officer can run five miles means he can chase and tackle a suspect safely; he needs training to put his physical abilities in context of his job.

Carvey rightly points out: “Why does a standard have to be objectively defined? Doing so basically says that we as individuals and adults simply aren’t capable and mature enough to make our own decisions…. A lot of folks want to be cops, so they are willing to learn… if they aren’t, then they need to go.”

Taking responsibility for mistakes

One last point, something that ties directly to social media usage: as Hubbard noted, his officer took responsibility for his mistake, as did the Bozeman officer, both resigning their positions.

While an agency may bear no responsibility for its officer’s bad decisions, it does have responsibility to regain public trust. Social media cannot “save the day,” but properly applied, it can show an agency willing to take a look at itself—hiring, training, and related practices—and either to make changes when needed, or to show the public how it fulfilled its responsibility.

Eustis, incidentally, is using social media. You can find them on Twitter and Facebook. While Hubbard acknowledges that the agency is still working out how to use it, his view of how to handle bad PR fits with the “be honest” strategy:

When the news breaks, post a message from the chief. Link to all news accounts—good and bad—about the incident. Let people talk about it on the department Facebook page and other venues.

The old saw about “an ounce of prevention” still holds, however, and standard-setting should be based on Carvey’s take: “Set the standard, then reinforce and mentor. Don’t just address those who come close or fall short, but address those that do well, those that encounter a situation and choose correctly. Create a sense of ownership and build confidence in the standard.”

Image: cambodia4kidsorg via Flickr

Because I’ve heard comments along the same lines from dozens of other cops. Civilians, too. Take this one from one of my own Facebook friends:

“….I suffer fools not at all. Stupidity makes me so sad. Moreover, I simply cannot believe the number of people moving through life who are totally clueless.”

Or the comments on this news article.

I see this kind of thing every time the news posts something about people who shouldn’t be allowed to drive, breed, or leave the house. In fact, I’d wager, it’s a rare person who doesn’t at least think this way (or cross the line into what many would consider racist, classist, or other offensive territory).

So why do we expect different from cops?

It’s worth thinking about if you are contemplating officer participation in social media. Valeria Maltoni writes, “Many companies have written solid policies and guides to social media participation… [but as] more employees participate, there will be a need for more conversations about what staying in character means.”

Some agencies have forbidden officers from identifying themselves as police officers altogether. Not only does this protect the agency, it also protects the officer who may end up doing online undercover work.

And that’s a start, but I can’t help thinking it’s not fair to the good, responsible officers, for whom police work is an integral part of who they are. Not to mention, at least in a place like Facebook, there will always be some “friends” who know what s/he does for a living.

So why isn’t it OK for police to be as honest as the rest of us in their opinions of humanity? Quick and easy answer, straight from the Bozeman lawsuit itself: because of their authority. Anyone who carries around weapons in the course of their daily work automatically has “one up” on us. If they view us as stupid, what’s to stop them from using those weapons to “put us in our place”?

The same thing, in most cases, that stops us from using whatever weapons are at hand—kitchen knives, baseball bats, words—to put others in place whom we feel are being “stupid.” Conscience, experience. In fact, cops are even less likely to use weapons than we are, when they’re well trained. It’s when emotion and stress overwhelm training that they start to act more like—well, us, at our worst.

Yet we continue to demand better, even after things like the Stanford Prison Experiment and Stanley Milgram’s electric shock experiments prove that very few humans—fewer than we’d like to think—are capable of taking the moral high ground, that not only are some of us not better than others; frequently, we’re worse than our beliefs about ourselves.

Ego, not authority

So I think the main concern with police being allowed to voice their personal opinions is less about their authority and more about our ego. As humans, we go along in life mainly wanting to be liked. Deep down, we want to think we’re doing the right thing, that we’re smart for making the choices we made, and that we’ll be forgiven for making the wrong choices.

So when someone openly calls us stupid? What nerve. And how much worse when it’s someone we want to respect. Most of us want respect back from those we look up to. Knowing we don’t have it threatens our sense of who we are.

Pop psychology, right? But zoom back. I’m not just talking about a one-to-one reaction of citizen to police officer. It works the other way, too—when police departments join social networking sites, hoping to establish relationships with their publics.

Just as individuals tend to prefer to remain ignorant about what others really think of us, organizations find themselves rudely awakened by customers tweeting or blogging about a bad customer-service experience.

True—police departments are used to this, have been for decades. But because social media demands we listen before engaging, the new territory for police is 1) opening themselves to more criticism than usual and 2) facing the need to do something about it.

And really, that’s what causes us as individuals the ego-discomfort with criticism, too. We all want to think we’re getting it right. Seeing that we might not be scares us—because it means we will need to change our ways. Who wants to do that? When you’ve been doing something the same way for years, where would you even start to change?

To protect ourselves, we lash out. It can’t be us, we think; it must be the person doing the judging. There’s no way I could have been speeding; I’m a careful driver. That cop didn’t calibrate his radar this morning.

Likewise, regardless of how accustomed police are to criticism, we hear: These people have no idea what goes into what we do. We work hard trying to keep them safe. Can’t please everyone.

We are them, they are us

Folks, these are the reasons WHY we are on social media. Those of us who have jumped aboard have experienced first-hand how it can bridge gaps. Most of us understand that social media is about bringing together people with widely divergent experiences, communicating differences with an eye toward fixing the problems they pose.

Yes, reducing human interaction to words on a screen enables criminals to hide more easily, but the criminal mind will always take advantage of well-purposed tools. For the rest of us, social media equalizes. Reducing interaction to words on a screen also reduces the likelihood of our making unfair assumptions about each other—and enables us to correct those assumptions made more easily.

So while guidelines should indeed determine whether and how much officers participate in social media, self-identifying as officers, administrators should bear in mind that if you worry too much about controlling the message, you risk turning the public away altogether.

Set guidelines. Reprimand officers who blog or tweet or whatever outside them. Apologize to the public for the problem. Remind them that we’re all just learning this space and how to coexist in it. Promise that you’ll do better next time—and, because the medium is the equalizer, ask the same of them. Agree to forgive each other when you fall short of that, as we all do.

Isn’t that what we all want?

Image: Kevin Marks via Flickr

Does transparency sacrifice honesty in blogs?

An interesting debate has cropped up over on ConnectedCops.net about whether police officers should be allowed to blog anonymously.

It started with Lauri’s point in her post on elements of a social media policy (cross posted here and on her blog):

3. Identity. Some bloggers work anonymously, using pseudonyms or false screen names. Law enforcement agencies should absolutely insist that in blogs, wikis or other forms of online participation that relate to the department or the city, or activities or issues with which the department is engaged; department employees use their accurate identity.

Which stuck with me because of the number of excellent cop bloggers who are anonymous. You can read mine and the other comments there. At the debate’s heart: whether anonymity allows more honesty (yes, honesty, not bravado or bigotry or any other negative connotation) than they perhaps otherwise would use.

Positive perceptions

I emailed one of the anonymous bloggers to get his opinion. He doesn’t hide his workplace from his readers, and I wondered whether he was working with his administrators’ blessing. If so, I asked, how was anonymity decided upon?

I just started blogging on my own. I decided that the ‘net was full of the cop sites complaining about bureaucratic and political incompetence so I thought I’d do something upbeat. I figured if it was positive it would be harder for the big shots to complain about it.

A few weeks after starting I was contacted by one of our command staff through the site asking who I was. I was honest about it and didn’t hear anything else…. I was told that they see it as my right and they aren’t intervening….

My anonymity is an open secret at work. It’s a small enough agency that it wouldn’t be hard to figure out from my stories. I’m more concerned about Internet privacy and not being stalked over it. I’ve had some interesting hate mail through the site and I don’t want to give anyone a target.

Again with the officer safety

He continued:

I do think that the Internet opens you up to a whole world of cop haters hiding behind their computer screen. The problem is you don’t know which ones are willing, or capable, of carrying out the threats. I know these people don’t like me, and I don’t care. If I wanted to be liked, I would have been a fireman.

However, I don’t want them having my real name to attach to my blog so they can figure out where I live or otherwise target me. My administrative policies can’t override the first amendment if one of these wack jobs decide to target me because of my blog and post my home address on some cop hating site.

Especially if the hater is clear across the country. At least if some local crazy starts stalking me through work I have a chance of filing charges or otherwise working it out. Imagine if an Internet stalker on the other side of the country does it online, my department would be powerless to stop it or protect me. I’m definitely not putting my name on my blog.

Department-sanctioned tools

Lauri rightly points out that this is the reason why social media policies should cover the tools that are and are not sanctioned by the department. Although I am concerned that this might remove an otherwise important “coping” mechanism for officers, sites like the Experience Project may cover this issue.

Perhaps the real problem lies not in whether law enforcement must sacrifice honesty for transparency, but in whether citizens are comfortable with their police officers having a voice. One chief, who does not blog anonymously, wrote me a few months ago that he was going dark for a time:

One of my illustrious citizens came across my accounts and made a complaint to the Mayor and Council. Of all the things I’ve posted on Twitter, he or she was hung up on a post I made about people acting stupid—alluding to the fact I was either speaking about my officers or my citizens. That particular comment was directed at a vendor I had been dealing with….

City administrators were supportive, but the chief chose to avoid conflict—a shame, because I haven’t heard much from him since.

Honesty vs. liability

Ideally officers can be honest about what they see daily. It might encourage citizens to change their behavior: not calling 911 when their children refuse to go to bed, or to help them take their pills. It might even go as far as citizen journalism. In prior generations, officers with serious concerns about department corruption went to the media. Now, they can be the media. As my contact notes:

If you want to publicly criticize your agency or city management, anonymity is the only thing [allowing you to keep] your job. Look at bloggers like Inspector Gadget–I have no questions he would be fired, or drummed out of his rank, or transferred to some terrible assignment if they found him out. Same thing with Second City Cop. The Chicago Political Machine would probably make them disappear like Jimmy Hoffa.

Indeed, many administrators fear the liability bugaboo. However remote the possibility of a successful lawsuit over “emotional distress stemming from embarrassment” might be from an unnamed citizen who nonetheless recognizes him- or herself, nothing would stop a lawyer from trying—and causing considerable expense, not to mention stress, in the meantime.

Should cop bloggers be allowed their anonymity, or should they be required to be up front about their identities—even if it sacrifices some honesty?

Image: thelastminute via Flickr

Networks of "friends" on a social site

In response to my question, “Do you think more LE don’t get on board w/ social media b/c they fear the inability to size ppl up as they would in person?” I got another response besides those from the previous entry:

@cmouser:
There are folks telling officers it not safe for them to do it…false claims posted about them or for them
I have 2 SRO’s that just got back from training and they were told that Twitter [Facebook] etc. are the worst things an officer can do
one of them deleted his accts due to this training.

This surprised me. What better way to connect with students than to reach them in their own social spaces away from school? So I found out the trainer’s name: Lt. Joe Laramie, commander of the Internet Crimes Against Children Task Force for the state of Missouri. Someone with a lot of experience online, in other words, who was not simply reacting to technological changes.

Parts of Lt. Laramie’s interview are also included in my article “Social Networking Officer Safety,” due out in Police & Security News in September. For the purposes of this blog, though, I want to focus on his input regarding school resource officers. Whether you agree with him or not, the points he raises are good ones, and should be discussed among administrators and officers alike.

Who’s reading your profile?

It is possible to get too caught up in social networking’s positive aspects. Naivete can lead to situations like the one NYPD Officer Vaughan Ettienne found himself in. This is, in part, because most people focus on the “social” aspect of social networking.

But Laramie, a 30-year law enforcement veteran who teaches school resource officers and vocational counselors a class on social networking, says law enforcement should focus more on the “networking” aspect. “You may be able to control the people you friend, but not the people they friend,” he explains, calling this a “pyramid” effect.

Even if you can control the people you friend—by “ignoring” requests from people with questionable content—you can’t control what existing friends post on their own pages. “Photos and blogs they post can reflect badly on you,” says Laramie. “And these materials are constantly being changed, so it’s impossible to enforce a ‘friend policy’”—following or unfollowing based on appropriateness.

This is true of everyone, but even more so for school resource officers. Laramie says SROs are susceptible to more problems than a regular patrol officer or detective would be, because of their closeness to middle and high school students. Such problems can include emotionally needy students with few boundaries; students who take for granted online interactions; and even students who intentionally target law enforcement officers or agencies.

In fact, Laramie likens an officer “friending” students online to a teacher leaving a cell phone on or in a desk. “The student can easily take the phone to the bathroom, send a suggestive text message or picture to another student, then put the teacher’s phone back. You can’t defend against that,” he explains, “but you can control it—by keeping the phone with you, not giving them access.”

This is the reason why Laramie’s Missouri ICAC Task Force Facebook page has an emblem rather than his photo on it. “It’s easy to take an officer’s official department photo and superimpose his or her face over that of someone wearing fewer clothes,” he says. He himself is featured in two YouTube videos—neither of which he posted. “They’re of a speech I gave, so I’m not embarrassed about them,” he says. “But I had no control over their posting. That’s why it’s important to search on your own name, see what’s being posted about you in the different environments.”

No privacy, no control

When Laramie teaches teens about social networks, he has them “write” just one way to reach them online on an imaginary business card. “Then I ask them if they would hand that to a stranger driving by their school,” he says. “They haven’t thought about that. There is a disconnect between their online world and the real world.”

Both teens and police officers mistakenly believe that making pages “private” will protect their information. However, says Laramie, “When teens argue this, I ask them if they’ve ever seen a site they didn’t have permission to be on,” says Laramie. “They often have—if they were with a friend who had permission.”

This can be a problem when that friend is someone unknown to, or even an enemy of, the user. “The two most misused words when it comes to social networks are ‘private’ and ‘friend,’” says Laramie, adding that he doesn’t know most of the “friends” on his task force page. So, while it’s possible to limit access to a site, nothing is ever truly private.

This problem is exacerbated by inadequate privacy protections on the social network sites themselves. A Cambridge University study published in July showed that 90 percent of sites required unnecessary information, such as birth date, for membership. Eighty percent did not protect sensitive data using standard encryption protocols, while 71 percent reserved the right to share user data with third parties.

Officers may also believe that anonymity will protect them, but can leave enough details that administrators, other officers, and even the public can figure out who they are. This has been the case for several well-known law enforcement blogs, deleted in recent years on pain of their authors’ termination.

The need for cyber ethics training

Police officers who are unaware of these pitfalls could be disastrous for a law enforcement agency. “Defense attorneys who do their homework will come after them,” Laramie says. “They’ll start out by asking whether a posting on a social site was the truth, or made up. And who wants to defend their bragging in court? But if they say they made something up, they’re subject to being impeached as a witness. And if they say it’s the truth, that opens the door to every inappropriate thing the attorney found.”

Laramie believes that training in cyber ethics must begin at the academy level. “Personal ethics is already taught, but there needs to be a cyber component to it,” Laramie says. “This generation is so used to the technology that they don’t think twice about what they are doing.”

For instance, says Laramie, “Teens don’t see what the big deal is about sending nude photos to each other or saying inappropriate things. They don’t understand that when adults do it at work, we get fired.”

Thus a student’s “harmless flirting” with her school resource officer could land him in hot water, as could her risque photo in her Facebook profile when they are connected as friends. “If a parent finds those things, it’s guilt by association,” says Laramie. “Even if the officer hasn’t been online in three days and had no idea the photos were posted.”

Balancing safety with usage

Professionally, Laramie says school resource officers and other investigators do need to know how social networking sites work. “I’m not sure all SROs understand it as well as they should,” he says. “Many are still struggling with how to deal with it. Some have very sophisticated knowledge, but others have no idea how to use it or communicate with it, or even how to use it as a search mechanism. They have to be able to get online and see what’s going on in the school, among that community.”

The challenge is in doing so without jeopardizing the relationship-building that community policing demands. Whether undercover (which most social networking sites discourage) or using their real names, Laramie says any communication on the officer’s part should be one-way only—no friend requests.

This flies in the face of social networking culture as well, which demands two-way communication. “Students can feel the officer is only there to spy on them,” says Laramie. “They already stay away from social networking sites their parents are on, and they’ll stay away from those the officer is on.”

Yet savvy SROs may take the opportunity to lead by example, encouraging prudence in posting content. As Larry Magid of SafeKids.com pointed out in a June blog entry:

Internet safety is more than just the absence of danger. It also includes finding ways to use technology for learning, collaboration, community building, political activism, self-help and reaching out to others…. [L]ike fences around swimming pools, the use of filters at home and school can’t protect them forever. That’s why we teach kids to swim. Not only does knowing how to swim help prevent drowning, it empowers them to thrive in the water instead of fearing it.

Likewise in police departments, where gripes among officers may offer administrators the chance to consider whether employee point of view is accurate. In the social web, companies monitor what customers are saying, whether good or bad, and use the feedback to build on the good and improve on the bad. Comcast, for instance, uses Twitter to great effect to connect with its customers, as does the Ford Motor Company and others.

“You have to protect your name, your identity, and your reputation because you own those for the rest of your life,” says Laramie. “But it isn’t possible to control your reputation totally, because it’s what other people think.”

Image: matmorrison via Flickr