Social media serves up a special sort of security challenge, and one that is often still poorly recognised and understood by governments and law enforcement agencies. But social media sites are also crucial online gathering spots for the public, whose rights to privacy must be properly respected within security policy.
So says Sir David Omand, a man who is so intrigued by the complications – and the importance – of this balancing act that he has made them a career focus.
Omand is the former head of Britain’s Government Communications Headquarters (GCHQ), the UK’s signals intelligence organisation. He was also the first UK intelligence and security co-ordinator in the cabinet office from 2002 to 2005, responsible for the counter-terrorism strategy and “homeland security”. He spent seven years as a member of the joint intelligence committee, and has served as permanent secretary of the UK home office and cabinet office.
Now, having left the civil service behind, Omand is an author and visiting professor in the department of war studies at King's College London. His 2012 book, Securing the State , was published to generally excellent reviews.
He has also become a leading contributor to both public and private debate on internet security and privacy issues, with a particular interest in social media. Last year he co-authored a report for UK think tank Demos on the subject, arguing that intelligence services have not kept up with the use of services like Facebook and Twitter.
“The net is here to stay, and it can be used for good or evil,” Omand says in an interview after a recent talk on the security challenges of social media at the Institute of Irish and European Affairs in Dublin.
He says social media is a concern for governments and law enforcement, both because of its use for on-the-fly communications and co-ordination, and because some can be structured as closed communication spaces for criminals or terrorists.
But at the same time, Omand says, the general public should have the freedom to use services that are not subject to over-regulation, without fear their privacy will be casually compromised, which could have a "chilling effect" on social media use.
Steep learning curve
Social media has presented a steep learning curve for authorities. In the UK, Omand says, agencies were definitely behind in understanding their power at the time of the 2011 summer riots.
Then, rioters using social media and messaging were able to move faster than the authorities, who were relying on old-fashioned policing techniques. At the same time, Omand notes, social media was also used in positive ways and for productive policing – the public used social media to help monitor and warn of impending rioting and organise community clean-ups.
But lessons were learned, and authorities were far more adept at monitoring and using social media by the time of last summer's Olympics, when Scotland Yard set up a special centre called the All Source Hub (Ash). This kept an eye on social media conversations and was used to "gauge sentiment". If trouble seemed to be brewing, extra police could be sent quietly to an area, "all without the appearance of lots and lots of officers in riot gear".
The Olympics passed off peacefully, in part due to the more adept use of social media enabling a lower-key police presence, Omand says.
After his talk, Omand notes that context in social media conversations is extremely important. Language online can be more inflammatory without necessarily indicating real aggression or intent. In addition, a service like Twitter can draw out angry comments from a large number of users, without reflecting general anger from the majority of people in a given community or place.
He says his personal interest in internet and social media privacy and security issues comes from his own background: “It really developed out of my career in defence, security and home affairs. It’s a subject that spans those areas. I also was seeing it from the perspective of the home office – the development of social media use. It’s a fascinating area.”
Omand’s background would seem to put him staunchly on the pro-security and pro-surveillance side. But he argues for the need for balance and proportionality.
In his book, he offers a list of guiding principles for considering the use of intelligence gathering and surveillance. These include the need for integrity of motive, the use of proportionate methods, the reasonable prospect of success, the right level of authorisation, and the recourse to secretive methods only as a last resort.
Omand believes the principles would also work well for gathering what law enforcement agencies now call Socmint – social media intelligence. In the UK, the home office has been working on a policy and legal framework for Socmint, he says, noting there is “a spectrum of privacy concerns”.
Activities that might be considered acceptable without requiring specific permissions would be gathering intelligence from open Twitter feeds or other social media sites when a user has no privacy settings restricting viewing. These are like a public broadcast, Omand says.
Off-limits infiltration
A grey area is introduced with more restricted, user-applied privacy settings, Omand notes, such as a closed Facebook group. This could be infiltrated by someone joining with a false identity, but this raises questions of acceptability and whether special authorisation is required.
An example of off-limits infiltration would be accessing closed BlackBerry messaging, he says. In such a case, proper authorisation should be required for intelligence gathering. What is most important is finding balance.
“It’s important to be able to keep the ability of authorities to monitor places where they believe things of interest may be happening. But this must be balanced with keeping the confidence of the public that communities are not just being arbitrarily watched,” he says.
But these issues have much broader significance too, Omand argues.
“Beneath everything I’m saying is the thought that [the internet] is the future, and the economic growth on which the future depends, depends on us using the internet. If confidence is lost – which could affect transactions and commerce on the net – this becomes a significant problem for our economic future,” he says. “So this is not just about ethical issues or privacy.”
