MICC8 TTP Notebook - Real-time Intelligence with Social Media

8/10/2019 MICC8 TTP Notebook - Real-time Intelligence with Social Media

1/242

MASTER INSTRUCTOR

CERTIFICATION COURSE

[CLASS 8]

October,

2014

Real-time Intelligence with Social Media,

Total Training Package

Owen Berger [Student] :Los Angeles Police Department:

Christopher Bouse [Mentor] :Los Angeles Police Department:

Kris Allshouse [Facilitator] :San Diego Regional Training Center:


2/242

POST Master Instructor Certification CourseClass 8

Owen Berger

Los Angeles Police Department

Table of Contents

PG. 2

Table of Contents

Executive Summary 3

Training Schedule 4

Course Modules 5

Module ILesson Plan 5

Learning Activities 26

Grading Rubric 45

Module IILesson Plan 50


Grading Rubric 78

Module IIILesson Plan 86


Grading Rubric 110

Module IVLesson Plan 114


Grading Rubric 145

Evaluation Instruments 151

POST Certification Package 165

Hourly Distribution 166

Certification Request 167

Instructor Resumes 168

Owen Berger 168

Chris Bouse 171

Budget 174

Expanded Course Outline 179

Module I 179

Module II 194

Module III 203

Module IV 213

Roster 223

Safety Plan 225

References 227


3/242


Owen Berger


Table of Contents

PG. 3

Executive Summary

This course shows law enforcement students from any discipline how to process thevast amount of information from online resources, including Social Media. Students will be

able to apply that information directly to their respective organizations decision-making

processes. The course is 24 hours in length and has separate sections of content, or modules.

Each module focuses on different aspects of the overall course goal, including cyber-

monitoring, policy development and intelligence-systems design and implementation. There is

also a train-the-trainer section that shows students how to train peers in the subject matter.

Each module is supplemented by two distinct components. The first component is legal

application, where students will analyze law enforcements use of real-time intelligence in a

legal contextincluding a review of current case law and changing legislation. The second

component is critical thinking, which will encourage students to constantly think about their

methods, techniques, and ideas. The critical thinking component will help students to not only

perform at a higher level in the performance of their duties, but it will help them keep up with

the dynamic nature of real-time intelligence and the constantly evolving Internet.

An experiential and task-oriented approach will be used for delivering course ideas and

concepts. Students will actively monitor events, develop policy for their organization, design

intelligence systems, and develop training for cyber-monitoring. In addition to participating in

hands-on reality-based activities, students will also examine the legal repercussions of those

activities while thinking about them in a metacognitive fashion. These experiences and

behavioral outcomes will help students carry the course content from use in the classroom to

use in their real-world duties.


4/242


Owen Berger


Table of Contents

PG. 4

Training Schedule

Real-time Intelligence with Social Media

Day 1 Day 2 Day 3

Module 1 Module 2 Module 4

08001030

Introductions/Safety

Search Plans

Critical Thinking and

Searches

10301130Twitter Presentations

Finding Criminals

08001000

Current Systems

Legal Analysis

System Elements

10001130

System DesignModule Evaluation

0800 - 1100

Teaching Generations

Teaching Cops

Constraints and Resources

Adult Learning

Learning Activities

Lunch, 1130 - 1230 Lunch, 1130 - 1230 Lunch, 1100 - 1200

Module 1, continued Module 3 Module 4, continued

12301430

Facebook Presentations

Finding Events

Site Presentations

Situational Awareness

14301700

Monitoring Events

Module Evaluation

12301430

Legal Research and

Arguments

Critical Thinking Applied

Policy Elements

14301700

Policy Development

Module Evaluation

12001600

Learning Activity Design

Activity Presentations

Module Evaluation

16001700

Review

Certificates

Training Location

Holiday Inn BurbankMedia Center (http://www.ihg.com/holidayinn)

150 East Angeleno Avenue, Burbank, CA 91502

(818) 841-4770

Course Coordinators and Instructors

Officer Owen Berger, Los Angeles Police Department

Officer Christopher Bouse, Los Angeles Police Department
http://www.ihg.com/holidayinnhttp://www.ihg.com/holidayinnhttp://www.ihg.com/holidayinnhttp://www.ihg.com/holidayinn


5/242


Owen Berger


Table of Contents

PG. 5

Course Modules

Module IGathering Intelligence with Social Media and the Internet

Date Revised: September, 2014

Instructors: Berger/Bouse

Course Goal: To teach students how to gather and disseminate real-time intelligence with

Social Media and the Internet

Module Goal: To teach students how to monitor events with Social Media and the Internet

Learning Objective: The students will utilize cyber-monitoring while working on an assignedevent in small groups with internet access and a time-limit of 45 minutes for preparation and 5

minutes for presentation, and must score a three (3) or higher on each category of the Cyber-

monitoring Grading Rubric.

Module Time: 8 hours (Day 1 from 0800-1700)

Resources Needed:

Computer or tablet for each student, with power cable and Wi-Fi capabilities. Wi-Fi capabilities for every student, i.e. enough bandwidth for class size.

Flip chart for every five (5) students. Flip chart stand for every five (5) students. Markers, preferably 5 different colors for each table. Round table for every five (5) students. Chair for each student. Extension power cord for each table (per five students) with at least five plug-ins. Projector system with HDMI compatibility. Instructor computer with PowerPoint installed. Flash-drive with back-up file for the learning and evaluated activities PowerPoint

presentation files, located in the online folder under Module Summarybelow.

Cable to connect computer to projector. (1) copy of the handoutCritical Thinking Standards and Elementsper student Cyber-monitoring Grading Rubrichandout per student. One notepad or several pieces of paper per student. One writing implement per student.


6/242


Owen Berger


Table of Contents

PG. 6

Module Summary:

This module will start with student-generated types of cyber-monitoring and definitions for

several key terms that will be used throughout the course. Next, there will be severalexercises on the basics of searching, includingsearch plansandcritically thinking about

searches. After basic searching, students will learn, through peer presentations and real-

world searches, howTwitter,Facebook,andother websitescan help them when searching

for criminals and events in their area. The peer presentations and real-world searches all will

build into afinal evaluated activitywhere the student groups will present to the rest of the

class on a fully researched event that the group found and agreed upon.

All of this modules instructor and student materials can be downloaded here:

https://www.dropbox.com/sh/3z1gg36kry1mex4/AACZBtUPRmVEpChbAk-zbKKua

Outline Instructor Notes

I. Gathering Intelligence with Social Media and

the Internet [1] [1a]

A. Types of cyber-monitoring [2]

1. Criminal Investigationsa. Ongoing criminal investigation

b. Aftermath

c. Fugitive tracking

2. Planned Events

a. Demonstration

b. Protest

[1]Greet students as they walk in and

gauge/assess computer expertise.

Ensure that the expertise is spread

evenly around the room by requesting

that highly-skilled students are at tables

with lesser-skilled students.

[1a]Introductions, Safety, and Rules

Introduce the instructors, talk aboutclassroom safety, and then have the

students come up with classroom rules,

including:

Cellphone use during class Being on-time after breaks Unrelated computer use Etc

[2] Facilitate Facilitate a discussion

about all of the different types of thingsthat law enforcement will monitor.

Make the class generate a list (with the

instructor as the scribe on a flip-chart)

that contains elements like those listed

on the left, Types of cyber-monitoring.

Make sure this list is posted in a place
https://www.dropbox.com/sh/3z1gg36kry1mex4/AACZBtUPRmVEpChbAk-zbKKuahttps://www.dropbox.com/sh/3z1gg36kry1mex4/AACZBtUPRmVEpChbAk-zbKKua


7/242


Owen Berger


Table of Contents

PG. 7

c. Rally

d. Celebration

e. Sit-in3. Critical Events

a. Sniper Attack

b. Public shooting

c. Terrorist attack

4. Natural Disasters

a. Earthquakes

b. Fires

c. Floods

d. Snow

e. Rainf. Tsunami

g. Tornado

h. Hurricane

5. Monitoring for Intelligence vs

Information [3]

B. Searching the Internet

1. Internet Search Plans [4] [4a] [4b]a. Identify key points

1) Identify what information we

are looking for

a) Purpose, purpose, purpose

b) Specific information

c) General information or

survey

2) Distilling

a) Distill the information we

want into words or searchterms

(1) Different ways of saying

the same thing

(2) Varying specificity

(3) Skewing results with

our own words

visible to all students for the rest of the

course.

[3] FacilitateWrite down the word

Intelligence on one side of a flip-chart,

and then Information on the otherside of the flip-chart. Facilitate a

discussion amongst the class and come

up with an agreed-upon definition for

each word. Write down the

collaborative definition underneath the

word on the flip-chart, and ensure the

definitions are visible by the class.

[4] ActivityLearning Activity #1,Creating Search Plans.Have students

write a search plan for a criminal in their

jurisdiction. Then students will search

using someone elses search plan.

[4a] FacilitateAfter Learning Activity

#1, facilitate a discussion about the

importance of search plans, and about

how even a small amount of thought

before conducting a search can helpincrease the effectiveness of any search.

[4b] Ask

Why is it important to plan a searchfor intelligence/information?


8/242


Owen Berger


Table of Contents

PG. 8

b) Too much information after

distillation

(1) Need for runningmultiple searches

(2) The need for multiple

plans

(3) More research to

determine other

keywords

b. Implementation methods

1) Write plan down

2) Remember plan

3) E-mail plan

2. Safe searches with law enforcement

[5] [5a]

a. Protection

1) Anonymizers

a) HideMyAss

b) Firefox Plugins

c) Tor browser

2) Cold computers

a) Ease of use

b) IP Identifiers(1) White supremacist

example

(2) Arin.net

(3) Dawhois

(4) Others

c) Associated costs

3) Fake accounts

a) Legality of fake accounts

b) Photos for profile use

c) Face vs no faced) Other persons photos

e) False impersonation

f) Situations for fake accounts

b. Purpose will define protection

1) Again, purpose, purpose,

purpose

What are the potentialconsequences of not planning a

search? How can search planning be

implemented in your current

position?

[5] FacilitateFacilitate a discussion

about being safe while searching for law

enforcement.

[5a] Ask

What should law enforcement do tostay safe while working online, and

what should our primary online

safety concerns be? How can we best separate personal

Social Media access from work Social

Media access?

How can your work set-up orenvironment affect your health?

a. How can we help ourselves andour health?

Can you please describe a scenariowhere you would uncomfortable

reporting your online researchfindings to your superiors?

a. Why are you uncomfortable,what are some possible solutions

or outcomes to your scenario.


9/242


Owen Berger


Table of Contents

PG. 9

2) Necessary protection v

paranoia

3) Use casesa) Apparent/overt

b) Discreet

c) Covert

c. Health

1) Environment

a) Chairs

b) Monitors

c) Desk

2) Take care of yourself

a) Stretchb) 20 20 20 rule

c) Exercise

3. General Internet Searches [6] [6a]

a. Search Engines

1) Google

a) Largest of the search

engines

b) Tie results to logged in

Google account

c) Ads will immediatelyresult/respond

2) Bing

a) Microsoft-run

b) Tie results to Microsoft and

Facebook accounts

c) Bing Social

3) Yahoo

4) Ask

b. Types of searches

1) Contenta) Informational

(1) Broad information

request, usually for

things

(2) Find out

b) Navigational

[6] ActivityLearning Activity #2,

Critically Thinking about Searches.

Students will fill out the Critical Thinking

Standards and Elements while thinking

about an Internet search for subversive

or anarchist elements. The content from

this section should be created by the

students, or brought out during thefacilitated discussions at the end.

[6a] Ask-

What are some of the different kindsof search operators and how can

they help you?

If you arent finding the results thatyou need, what are some things to

consider in order to achieve better

results? What are some of the ways in which

searches are different for different

websites?

a. Why is it important to be awareof these differences?


10/242


Owen Berger


Table of Contents

PG. 10

(1) A search to get

somewhere on the

Internet(2) Finding a specific site, or

persons page

c) Transactional

(1) Means youre looking to

buy or sell or exchange

something

(2) Brands product names

2) Geographical

a) Geo-tagging

b) Quantity of informationactually geo-tagged

c) Use scenarios

(1) Protest areas

(2) Parties

(3) High-crime locations

c. Search Terms

1) Keywords

2) Names

3) Titles

4) Special Characters

a) Are they allowed, are theyincluded

b) Cross-site Scripting (XSS)

d. Common search operators

1) Quotes

2) Minus sign -

3) Plus sign +

4) OR

5) AND

6) Attitude

a) Reliabilityb) Narrowing search results

7) Other operators

e. Utilize the elements of Critical

Thinking

1) Intellectual Standards

a) Clarity

b. Please give a specific example ofhow such differences could

affect a search? How specifically can you use Internet

searches in your assignment? Why?

What information do you need tosuccessfully perform an Internet

search? Please rank that information

from most important to least

important.

How can different kinds of searchesaffect the search results we see?

What kinds of searches are there,and which are the most powerful? How can the search terms and

design affect the results?


11/242


Owen Berger


Table of Contents

PG. 11

b) Accuracy

c) Precision

d) Relevancee) Depth

f) Breadth

g) Logic

h) Fairness

2) Elements of reasoning

a) Purpose/Goal/End

b) Question at issue/Problem

to be solved

c) Assumptions

d) Point of View/Frame ofreference

e) Facts/Data/Evidence

f) Theories/Concepts/Ideas

g) Inferences/Conclusions

h) Implications/Consequences

C. Cyber-monitoring and the law [7] [7a]

1. Current case law

a. Konop v Hawaiian

b. Cromer v Lexington

1) What you do off-duty canaffect your employment

2) Dont identify yourself off-duty

c. Garcetti v Ceballos

1) Make sure you know if you are

acting as employee or citizen

2) Same goes for Social Media

d. New York v Harris

1) Good search warrants are key

2) Read the terms of service

e. U.S. v Meregildo1) Expectation of privacy does not

equal privacy

2) Confidential Social Media

informants?

2. Other legal questions

a. Reactive case law

[7] FacilitateFacilitate a discussion

about why it is important to stay current

on case law when gathering real-time

intelligence.

[7a] Ask

What are some of the legal issuessurrounding cyber-monitoring?

a. Have those issues affected yourdaily duties in the past?

b. How could those issues affectyour daily duties in the future?

What is some of the current case lawregarding cyber-monitoring?

a. Do you agree with the courtsdecisions? Why?

b. How will these legal decisionsimpact your job?

c. Which one impacts your specificassignment the most? Why?


12/242


Owen Berger


Table of Contents

PG. 12

b. False personas

c. Purpose, purpose, purpose

3. 28 CFR Part 23 -https://it.ojp.gov/documents/28cfr_pa

rt_23.pdf

D. Useful sites and tools [8]

1. Understanding Twitter

a. Twitter Accounts

1) Signing up for Twitter

a) Full Name

(1) Resistance to sign up(2) Fake Name

(3) Work Name

b) E-mail Address

(1) Use your work e-mail

(2) Use a throw-away e-

mail

c) Password

(1) Password security

(a) Never write down

passwords

(b) Ensure password isdifferent for each

account

(2) Consequences of poor

password security

(a) Public

embarrassment

(b) Loss of trust

d) Username

(1) Be descriptive

(2) Or not(3) This is your Twitter

handle

e) Keep me signed-in

checkbox

(1) Stores a cookie in

your browser

[8] Individual workGive students

however long they need to ensure that

every student has an active Twitter

account that they can access during the

course. Students that already have an

account should assist those without anaccount.
https://it.ojp.gov/documents/28cfr_part_23.pdfhttps://it.ojp.gov/documents/28cfr_part_23.pdfhttps://it.ojp.gov/documents/28cfr_part_23.pdfhttps://it.ojp.gov/documents/28cfr_part_23.pdfhttps://it.ojp.gov/documents/28cfr_part_23.pdf


13/242


Owen Berger


Table of Contents

PG. 13

(2) Inherently safe, if only

you are using the device

f) Tailor Twitter to my mostrecent websites checkbox

(1) They are storing your

information for

advertisements

(2) Dont check these boxes

(3) Its unclear how much

information they store,

and for how long

g) Terms of Service

b. Post sign-up operations1) Follow five people

a) Not necessary to complete

for this course

b) Only follow people you are

actually interested in

c) As soon as you follow

someone, that information

is public

2) Complete profile

a) Uploading a photo

b) Entering backgroundinformation

c) Entering a website

3) Find your friends

4) Confirm your e-mail address

a) Not necessary for this

course

b) Common practice that

ensures you own your e-

mail address

c. Twitter terms and nomenclature

[8a] [8b]

1) Users

a) Username

(1) The same thing as a

Twitter handle

[8a] ActivityLearning Activity #3,

Twitter Mini-presentations and Criminal

Searches. Group members will prepare

mini-presentations on different aspects


14/242


Owen Berger


Table of Contents

PG. 14

(2) Be descriptive

(3) Or not

b) Profilec) Profile picture

d) Profile background

e) Followers

(1) These are the people

following you

(2) They can see all of your

tweets, and re-tweet

them

(3) You can restrict who is

following youf) Following

(1) These are the people

you are following

(2) They can view your

information

(3) They can disallow you

to follow them

2) Tweets

a) Tweet

(1) 140 Character-limit

(2) Goes to all followers(3) Is publicly searchable

(4) NEVER GOES AWAY

b) Re-tweet (RT)

(1) Twitter for lazy people

(2) This is how information

goes viral

c) Modified Tweet (MT)

d) Link

(1) To picture/photo

(2) To website(3) URL Shorteners

(a) Purpose

(b) Dangers of overuse

3) Hashtag

a) Groups content

of twitter, including (groups with more

than five can double up):

Signing up Terms and nomenclature Searching Twitter Events and Twitter Preservation of digital evidence for

Twitter

ALL presentations should have a strong

tie-in to exactly how that subject

translates into gathering real-time

intelligence for events or #SMEM.

After the mini-presentations, each

student will be tasked with finding a

criminal or gang-member in their area

using only Twitter.

[8b] Ask

What are common Twitterterms/nomenclature, and what do

they mean? Which of these termshave you heard in the news lately?

What makes Twitter such a powerfultool? Which parts of Twitter are the

most useful for law enforcement?

What considerations do we need tomake when using Twitter for event

monitoring/awareness? Facebook?

Instagram?

Why is Twitter different than other

means of communication? What are the best ways you use the

information from Twitter in your

current assignment?

When have you used Twitter beforeas law enforcement personnel?

a. Was it successful?


15/242


Owen Berger


Table of Contents

PG. 15

b) Organic way to organize

tweets

c) Large range from specific togeneral

d) No special characters

4) @-Mention

a) Tied to a username

b) Can be used to reply

c) Can draw attention to a

Twitter profile.

5) Photos

a) Are attached to the Tweet

b) Can be linked to(1) Instagram

(2) Other websites

c) EXIF and META data

(1) Information stored with

the photograph

(2) Included geo-location

data

(3) Camera information

(4) Shutter speed, etc

(5) Sometimes its scrubbed

(6) Can be obtained viasearch warrant

(7) Command staff love

pictures

6) Other

a) Direct Messages (DM)

(1) Only between your

followers or people you

are following

(2) Used the same as text

messages(3) Can be obtained via

search warrant

b) Reach

(1) How does something go

viral

b. If not, what would you change orhow would you do it differently?

How does law enforcements view ofTwitter differ from that of the

general public? Or criminals?

What do you need to work on tobetter understand how to monitor

events with Twitter?

What real-life scenarios can youthink of where Twitter would be a

helpful tool?

How can successful preparation help

us with remote event monitoring? How can the tools you learned todaybe applied to other websites, such as

Backpage or Craigslist?

How does the type of event we arepreparing for affect our search

terms?

Can you please describe a scenario inwhich information from Twitter

would require further investigation

or vetting before being relied upon?

What is the best way to findmeanings of terms we dont

understand?

How could we teach our peers tofind the same information?

How would you convince yourcommand staff to allow you to

access Twitter on the job?

What kind of resistance do youexpect when you go back to work

and are using Twitter to gatherinformation?

a. How can you mitigate/preparefor/overcome this resistance?

Can you describe why theinformation flow that Twitter uses is

good for event monitoring? Try to do


16/242


Owen Berger


Table of Contents

PG. 16

(2) Multiple layers of re-

tweets makes for a

huge audiencec) Trending

d) Geo-location

(1) Uncommon

(2) Used in Twitter

mapping software and

applications.

2. Searching Twitter

a. Types of searches

1) Keywordsa) Autocomplete

b) Multiple types of returned

information

(1) Hashtags

(2) Profiles

(3) General search terms

2) Hashtags

3) Profiles or @-mentions

4) Search operators

(https://www.twitter.com/sear

ch-homefor full list)a) Quotes

b) Minus sign

c) OR

d) AND

e) Attitude

(1) Reliability

(2) Narrowing search

results

f) Other operators

5) Twitter search enginesa) Native Twitter search

b) Other Twitter search

engines

(1) Bing Social

(2) Google (Twitter: )

(3) IceRocket

so without using any of our Twitter-

specific terms or nomenclature.

Is the amount of information in atweet limited to 140 characters?

Why?

Can we track peoples location usingTwitter? How?

Why would Twitter users need to useDirect Messages?
https://www.twitter.com/search-homehttps://www.twitter.com/search-homehttps://www.twitter.com/search-homehttps://www.twitter.com/search-homehttps://www.twitter.com/search-homehttps://www.twitter.com/search-home


17/242


Owen Berger


Table of Contents

PG. 17

6) Twitter feeds (continuous

searches) or Aggregators

a) Current Twitter feed/APIissues

(1) Twitter has begun to

disallow access to their

data

(2) Several smaller twitter

services have closed

(Monitter)

b) Twitter feeds

(1) Most require a Twitter

account(2) Some have different

refresh rates

(a) Refresh rates are

how often the

information is

updated

(b) Important to know

depending on how

critical updated

information is to the

task at hand(3) Feed providers

(a) Tweetdeck

(b) Twitterfall

c) Multiple feed windows

(1) Advantages

(a) Helpful during most

major events

(b) Can use multiple

screens

(2) Disadvantages(a) Bandwidth issues

(b) Eye-problems

(c) Practice the 20-20-

20 rule

3. Events and Twitter


18/242


Owen Berger


Table of Contents

PG. 18

a. What Twitter provides

(Advantages)

1) Real-time intelligence fromanywhere people are

2) Location-centric data

a) Limitations of geo-tagging

information

b) Small amount of people

with geo-tagging turned on

3) Used the same as other

intelligence

a) Multiple (difference)

sources lend credibilityb) Intel must be

independently verified for

action to be taken

c) Twitter is a good starting

point

4) Photographs can be a gold

mine

a) Crowd estimates

b) Weather

c) Evidence

d) Piecing events togethere) Disaster breadth

b. What Twitter does not provide

(Pitfalls)

1) 100% credible information

a) Believe it or not, people lie

on Twitter

b) Invalid information can be

as viral as true information

2) Not a replacement for

deployed resourcesa) Typically, the more

resources, the less helpful

Twitter is

b) Should not be used for

major decisions

c. Using Twitter specifically for Events


19/242


Owen Berger


Table of Contents

PG. 19

1) Generating search terms

a) Preparation is key

(a) Every event isdifferent

(b) Examples

i. Baseball game

ii. Awards show

iii. Gang funeral

iv. Slang

v. Emergencies

vi. Natural disasters

vii. #SMEM

(c) Research can help alot

(d) Gang experts

(e) Fans

(f) Other news sites

(g) Slang

i. Helpful sites

ii. Transl8it

iii. UrbanDictionary

iv. Pay attention

b) Terms and hashtags are

DYNAMIC(a) Dynamic

terminology

(b) Terms can change

i. Always be

watchful for new

hashtags &

keywords

ii. Variations

iii. #occupy

iv. #occupylav. #occupymay1

vi. #occupylamayda

y

vii. #buildingcollaps

e

(c) Hashtag hijacking


20/242


Owen Berger


Table of Contents

PG. 20

i. Context is

important

ii. Theperson/entity

tweeting can

change the

meaning

(d) Hashtags can pop up

anywhere

(e) #ShuttleEndeavour5

HoursLate

(f) #CrashGate7

(g) #TailgateNow(h) #FlashMob711

4. Understanding Facebook

a. Facebook Accounts

1) Signing up for Facebook [9]

a) Initial Page

(1) First Name

(2) Last Name

(3) E-mail address

(4) Password

(5) Birthday(6) Male/Female

(7) Phone number

b) Find Friends

c) Fill out Info

d) Profile Pic

2) Facebook terms and

nomenclature [10] [10a]

a) Page

b) Postc) Profile

d) User

e) Username

f) Vanity URL

g) Banner

h) Profile ID

[9] Individual workGive students

however long they need to ensure that

every student has an active Facebook

account that they can access during the

course. Students that already have an

account should assist those without an

account.

[10]ActivityLearning Activity #4,

Facebook Presentations. Groups will

prepare presentations on differentaspects of Facebook, including (in order

of importance):

Terms and nomenclature Searching/Monitoring Facebook Events and Facebook


21/242


Owen Berger


Table of Contents

PG. 21

(1) Never changes

(2) JSON pathway

(a) Change www tograph

i) Status

j) Update

k) Timeline

l) Groups

m) Apps

n) Friends

(1) Friend Request

(2) How many friends

should you haveo) Followers

p) Likes

q) Comments

r) Messages

s) Privacy

5. Searching Facebook

a. Types of searches

1) Keywords

a) Autocomplete

b) Multiple types of returnedinformation

(1) Profiles

(2) Pages

(3) Events

(4) Photos

(5) Apps

(6) Games

(7) Groups

2) Profiles (People)

3) My Friends4) Photos, movies, music, games

I might like

5) Nearby Restaurants

6) Photos I have liked

b. Facebook Search Engines

1) Native Facebook Search

Preservation of digital evidence forFacebook

Positives and negatives of Facebookfor cyber-monitoring

Facebook feeds / APIs / aggregators.ALL presentations should have a strong





student will be tasked with finding an

event in their area using only Facebook.

[10a] Ask

In Geek-speak, what do I mean whenI say a picture is worth a thousand

words?

a. What is EXIF/META data? Howdoes it affect law enforcement?

How do we know if we have foundenough information?

a. How do you define enough

information?b. Why?

In what ways can intelligence fromSocial Media and the Internet be

used during an emergency or natural

disaster?

Can you map those wayschronologically for a given

emergency or natural disaster, e.g.

earthquake, fire, building collapse?

What actions would need to betaken if you found a specific threat

to the public or to law enforcement

online?

a. In what order should theseactions be taken?

b. Why?


22/242


Owen Berger


Table of Contents

PG. 22

2) Other Facebook search engines

a) Bing Social

b) Google (Facebook: )c) IceRocket

3) Graph search

a) Can replace www. With

graph.

(1) JSON

(2) Plain text

representation of

information

(3) What

b) Results different foreveryone

c) What information is or is

not shown

6. Events and Facebook

a. What Facebook provides

(Advantages)

1) Real-time intelligence from

anywhere people are

2) Some Location-centric data

a) Limitations of geo-tagginginformation

b) Small amount of people

with geo-tagging turned on

c) Locations can be entered

incorrectly or faked

3) Used the same as other

intelligence

a) Multiple (different) sources

lend credibility, links to

other Facebookb) Intel must be

independently verified for

action to be taken

c) Facebook is a good starting

point, and has less fake

pages than Twitter


23/242


Owen Berger


Table of Contents

PG. 23

4) Photographs and videos linked

to accounts

a) Location can be deducedfrom photo OR

account/page

b) Valuable information

(1) Crowd estimates

(2) Weather

(3) Evidence

(4) Piecing events together

b. What Facebook does not provide

(Pitfalls)

1) Easy searches/Automationa) Facebooks Graph API isnt

great for law enforcement

b) Advertising drives results,

not relevant information

2) Not as real-time as Twitter

a) Twitter offers more for

ongoing events

b) Twitter offers less for

upcoming events

c. Using Facebook specifically for

Events1) Generating search terms

a) Preparation is key

(1) Uniform page layout

means most events

have same setup

(2) Examples

(a) Parties

(b) Protests

(3) Slang

(a) Helpful sites(b) Transl8it

(c) UrbanDictionary

(d) Pay attention

b) Different searches, think in

person terms, not keywords

(1) Names


24/242


Owen Berger


Table of Contents

PG. 24

(2) Phone Numbers

(3) Locations

(4) Groups2) Respondents Who is coming?

a) Yes

b) No

c) Maybe

7. Preserving Digital Evidence [11]

a. Preservation Requests

b. Preservation Letter

c. Search.org for contact information

d. Arin.net for IP Address Informatione. Facebook.com/records

f. InstagramFacebook.com/records

g. Otherwise look for e-mail or fax

8. Understanding Instagram [12]

a. Instagram basics

1) Instagram is phone-only

2) Signing up requires your phone

3) Must download app

b. Instagram accounts

1) Profile/Username2) Chosen at signup

3) No publicly available id

4) http://jelled.com/instagram/lo

okup-user-id

c. Instagram terms

1) Profile

2) Caption/Description

3) Title

4) Message

5) Like heart6) Follow

7) Comment

8) Direct Send

d. Searching Instagram

1) IconoSquare (used to be

Statigram)

[11] FacilitateRe-cap how to preserve

digital evidence when necessary (should

have been covered in the mini-

presentations, twice), and ensure that all

students understand the basic steps topreserving online evidence

[12] ActivityLearning Activity #5, Site

Mini-presentations and Awareness

Searches. Group members will prepare

mini-presentations on different websites

, including (everyone chooses a site, no

repeats):

Instagram

Craigslist/Backpage Etc

ALL presentations should have a strong





student will be tasked with finding

something current in their area usingonly the sites presented by their group.


25/242


Owen Berger


Table of Contents

PG. 25

2) Hashtags from Twitter and

Facebook work also

9. Other sites [13]a. Trending

b. New Technologies

c. Online Buy/Sell

1) Craigslist

2) Backpage

d. General searches

e. Fly-by-night aggregators

10.Commercial tools

a. Geofeedia

1) Geo-fencing2) Stateful monitoring

b. LexisNexis/Accurint

c. Torch (Palantir)

d. Radian 6

e. SAS Social Media

[13] FacilitateFacilitate a discussionabout different websites (other than

Facebook and Twitter):

Instagram Craigslist Search Engines Commercial Tools Backpage Etc

The discussion should include exactly

how those other sites can be used forgathering real-time intelligence for

events or #SMEM.

[14] Evaluated ActivityThe last activity

will involve full group work and an

evaluated presentation covering the

main points of the modules,Evaluated

Activity #1, Event Research and

Presentations.

[14a] Ask What is your biggest takeaway from

today, and why did you choose that

over other takeaways?

Why were you allowed to work ingroups for your final presentation?

a. Why were you given a time limit?


26/242


Owen Berger


Table of Contents

PG. 26

Learning Activity #1Create a Search Plan

Purpose:

To have students develop effective search plans.

Description:

Preview

The students will create a search plan, and then trade with a partner. The students will

then look for a criminal in their city, but only looking according to the plan written by their

fellow students. Then the instructor will facilitate a discussion about things that were perhapsleft out of the search plans, or what types of things could have made the search plan better.

Prior to the activity

Ensure that all students have some sort of writing implement (pencil or pen) and at leasttwo blank sheets of paper.

Bring up the first slide of thePowerPoint presentation entitled

Creating Search Plans->

During the activity

Pull of the second slide of thePowerPoint presentation, Create a

Search Plan ->

Allow the students to read the slide, ask if there are any questions, and then give thestudents time to work, approximately 10 to 15 minutes.


27/242


Owen Berger


Table of Contents

PG. 27

Pull up the third slide of thePowerPoint presentation, Trade and

Find ->


Pull up the fourth slide of thePowerPoint presentation, Discussion

->

Facilitate a discussion about how the students searches went, and whether or not theirsearch plans hindered them, and why.

While the students talk about the search plans and their effectiveness, write down

primary elements of a good search plan on a flip-chart at the front of the room (asecond instructor should do this if possible).

Key Learning Points:

Students will understand why search plans are important.

Students will understand how to think about search plan development from a userspoint of view.

Students will understand the elements of an effective search plan.

Students will be able to apply search plans to actual searches.

Resources Needed:

- (1) Computer or tablet for each student, with power cable and Wi-Fi capabilities.- Wi-Fi capabilities for every student, i.e. enough bandwidth for class size.- (1) Flip chart- Markers, for instructor use


28/242


Owen Berger


Table of Contents

PG. 28

- (1) Round table for every five (5) students- (1) Chair for each student.

- (1) Extension power cord for each table (per five students) with at least five plug-ins- (1) Projector system with HDMI compatibility- Instructor computer with PowerPoint installed- Flash-drive with back-up file for the PowerPoint presentation file Creating Search Plans.- Cable to connect computer to projector- (1) notepad (or two pieces of notebook paper) per student- (1) writing implement per student (pen or pencil)

Time Required:

30 to 45 minutes


29/242


Owen Berger


Table of Contents

PG. 29

Learning Activity #2Critically Thinking about Searches

Purpose:

To have students analyze the thought process behind searching for information.

Description:

Preview

In this multi-layered activity, students will be analyzing an upcoming search for

subversive or anarchist organizations or individuals in their geographic jurisdiction. Students

will fill out the Critical Thinking Standards and Elements worksheet while thinking about finding

such organizations or individuals in their respective areas. Students will then choose their most

interesting choices and write them on their flip-chart. The groups/tables will present the topthree (after discussion) choices from the worksheets. The last part of the activity will be a

facilitated discussion seeking deeper meaning behind the groups choices.

Before the activity

Ensure that every student has a copy of the handout entitled Critical Thinking Standardsand Elements as well as a writing implement (pen or pencil).

Pull up the first slide of thePowerPoint presentation entitled

Critical Thinking and Online Searches

->

During the activity

Pull up the second slide of thePowerPoint presentation,

Definitions->

Facilitate a discussion amongst the students, asking what the definition of a subversiveand/or anarchist organization would be.

Tell the students that they are going to be searching for a subversive or anarchistelement in their geographical jurisdiction, but first


30/242


Owen Berger


Table of Contents

PG. 30

Pull up the third slide of thePowerPoint presentation, Critical

Thinking Worksheet->

Explain to the students that they are to fill out the entire Critical Thinking Standards andElements worksheet, putting one to three words in each box, applying that specific

intersection of the elements and standards to the idea of searching for a subversive or

anarchist organization or individual in their area.

Answer any questions, and then let the students work for about 30-45 minutes,

depending on the level of students still working and paying attention to unrelatedconversations. Try to steer non-working students back to the worksheet by engaging

them in individual conversations if necessary.

After the 30 minute worksheetperiod, pull up the fourth slide of

the PowerPoint presentation,

Cherry-picking->

Ask every student to write their two most interesting boxes on their groups flip-chart,including three things, (1) the element of thought, (2) the intellectual standard, and (3)

the words the student wrote for that box on their worksheet. This should take about

five to ten minutes. Try to keep the students moving and writing on their flip-chart as

quickly as possible.

Pull up the fifth slide of thePowerPoint presentation,

Distillation->

Ask every group to discuss their other group members selections and what they mean,and then to choose the two or three most interesting of that groups selections. The

groups should be prepared to explain their selections, with a different group member

talking about each selection and the reason behind choosing it for class discussion.


31/242


Owen Berger


Table of Contents

PG. 31

Pull up the last slide of thePowerPoint presentation,Discussion

->

Have each group present their chosen items, and explain the reasoning behind themand what they mean.

Facilitate a discussion amongst the class after each presentation, asking for deepermeaning and or thought on each selected box.


Students will better understand the process of Critical ThinkingApplying theElements of Thought with sensitivity to the Intellectual Standards.

Students will be able to apply critical thinking to their own searching thought processes.

Students will understand why critical thought about searching is important for real-timeintelligence-gathering with Social Media and the Internet.

Resources Needed:

- (1) Flip chart and stand for every five (5) students.- (1) Flip chart stand for every five (5) students.- Markers, preferably 5 different colors for each table.- (1) Round table for every five (5) students- (1) Chair for each student.- (1) Extension power cord for each table (per five students) with at least five plug-ins- (1) Projector system with HDMI compatibility- Instructor computer with PowerPoint installed- Flash-drive with back-up file for the PowerPoint presentation file Critically Thinking

about Searches.

- Cable to connect computer to projector- (1) copy of the handoutCritical Thinking Standards and Elementsper student- (1) writing implement per student (pen or pencil)

Time Required:

60-70 minutes.


32/242

Clarity Accuracy Precision Relevance Depth Breadth Logic Significance Fairness

Purpose

(goal, objective)

Question at issue

(problem, issue)

Information

(data, facts,

observations,

experiences)

Interpretation and

Inference

(conclusions,

solutions)

Concepts

(theories,definitions, axioms,

laws, principles,

models)

Assumptions

(presupposition,

taking for granted)

Implications and

Consequences

Point of View

(frame of reference,

perspective,

orientation)

Ele

en

tsofThought

Intellectual Standards

Everyone thinks; it is our nature to do so. But much of our thinking, left to itself, is biased, distorted,

partial, uninformed, or downright prejudiced. If we want to think well, we must understand at least

rudiments of thought, the most basic structures out of which all thinking is made. We must learn how

take thinking apart. CriticalThinking.org

Critical Thinking Standards and Elements

Selected thought process -

[ ]


33/242


Owen Berger


Table of Contents

PG. 33

Learning Activity #3Twitter Mini-presentations and Criminal Searches

Purpose:

To have students understand Twitter through presentations and searches.

Description:

Preview

The students will create a small presentation on a specific aspect of Twitter, and then

present to their respective group. After the presentations, students will be asked to find a gang

member or criminal in their jurisdiction using only (or mainly) Twitter.



Twitter Presentations and Searches-

>

During the activity

Pull up the second slide of thePowerPoint presentation, Twitter

Mini-presentations ->

Allow the students to read the slide. Pull of the third slide of the

PowerPoint presentation, Topics ->


34/242


Owen Berger


Table of Contents

PG. 34

Ask if there are any questions and then give the students time to work, approximately15 minutes.

Pull up the fourth slide of thePowerPoint presentation, Present ->

Allow the students to read the slide, ask if there are any questions, and then give thestudents time to work, approximately 15 minutes (3 minutes per student).

Every three minutes, ensure that the student presenter is changing and that every

student has a chance to conduct their presentation. If a group has less than fivestudents, ask the students to discuss the most important aspects of the others

presentations.

Pull up the fifth slide of thePowerPoint presentation, Searching

Twitter, Criminals and Gangsters->

Allow the students to read the slide, ask if there are any questions, and then give thestudents time to work, approximately 5-10 minutes.

After 5-10 minutes ask all of the students who have NOT found a criminal in their areato raise their hands. Next, tell all of the students who dont have their hands up to help

the closest person to them that hasnt found a criminal/gang member.

Allow the students to work for another 5 minutes or so. Facilitate a discussion, asking any unasked in-depth questions from the lesson plan, and

asking specifically what is different about finding people through Twitter than finding

them through other online resources.


Students will understand the basics of Twitter.

Students will understand how to find specific targets in a geographical area.

Students will practice presenting ideas and concepts about Social Media.

Students will practice helping others with searches (search collaboration).


35/242


Owen Berger


Table of Contents

PG. 35

Resources Needed:

- (1) Computer or tablet for each student, with power cable and Wi-Fi capabilities.- Wi-Fi capabilities for every student, i.e. enough bandwidth for class size.- (1) Flip chart- Markers, for instructor use- (1) Round table for every five (5) students- (1) Chair for each student.- (1) Extension power cord for each table (per five students) with at least five plug-ins- (1) Projector system with HDMI compatibility- Instructor computer with PowerPoint installed

- Flash-drive with back-up file for the PowerPoint presentation file Twitter Presentationsand Searches.- Cable to connect computer to projector- (1) notepad (or two pieces of notebook paper) per student- (1) writing implement per student (pen or pencil)

Time Required:

50 minutes


36/242


Owen Berger


Table of Contents

PG. 36

Learning Activity #4Facebook Presentations and Event Searches

Purpose:

To have students understand Facebook through presentations and searches.

Description:

Preview

The students will create a small presentation on a specific aspect of Facebook, and then

present to their respective group. After the presentations, students will be asked to find an

upcoming or ongoing event in their jurisdiction using only (or mainly) Facebook.



Facebook Presentations and

Searches->

During the activity

Pull up the second slide of thePowerPoint presentation, Facebook

Mini-presentations ->


PowerPoint presentation, Topics ->


37/242


Owen Berger


Table of Contents

PG. 37






presentations.


Facebook, Events->


After 5-10 minutes ask all of the students who have NOT found an event in their area toraise their hands. Next, tell all of the students who dont have their hands up to help

the closest person to them that hasnt found a criminal/gang member.


asking specifically what is different about finding events through Facebook than finding



Students will understand the basics of Facebook.

Students will understand how to find specific targets in a geographical area.

Students will practice presenting ideas and concepts about Social Media.



38/242


Owen Berger


Table of Contents

PG. 38

Resources Needed:

- (1) Computer or tablet for each student, with power cable and Wi-Fi capabilities.- Wi-Fi capabilities for every student, i.e. enough bandwidth for class size.- (1) Flip chart- Markers, for instructor use- (1) Round table for every five (5) students- (1) Chair for each student.- (1) Extension power cord for each table (per five students) with at least five plug-ins- (1) Projector system with HDMI compatibility- Instructor computer with PowerPoint installed- Flash-drive with back-up file for the PowerPoint presentation file Facebook Mini-

presentations and Event Searches.- Cable to connect computer to projector- (1) notepad (or two pieces of notebook paper) per student- (1) writing implement per student (pen or pencil)

Time Required:

50 minutes


39/242


Owen Berger


Table of Contents

PG. 39

Learning Activity #5Site Mini-presentations and Awareness Searches

Purpose:

To have students understand various websites through presentations and searches.

Description:

Preview

The students will create a small presentation on a website that isnt Facebook or

Twitter, and then present to their respective group. After the presentations, students will be

asked to find a current situation or something going on right now in their jurisdiction using only

the websites presented at their table.



Site Mini-presentations and

Awareness Searches->

During the activity

Pull up the second slide of thePowerPoint presentation, Site Mini-

presentations ->


PowerPoint presentation, Sites ->


40/242


Owen Berger


Table of Contents

PG. 40






presentations.


Websites, Situational Awareness->


After 5-10 minutes ask all of the students who have NOT found something current intheir area to raise their hands. Next, tell all of the students who dont have their hands

up to help the closest person to them that hasnt found a current situation.


asking specifically what is different about finding events through Facebook than finding



Students will understand the basics of various websites that can be used for searches.

Students will understand how to conduct situational awareness searches for theirjurisdiction.


41/242


Owen Berger


Table of Contents

PG. 41

Students will practice presenting ideas and concepts about Social Media and InternetSearches.


Resources Needed:

- (1) Computer or tablet for each student, with power cable and Wi-Fi capabilities.- Wi-Fi capabilities for every student, i.e. enough bandwidth for class size.- (1) Flip chart- Markers, for instructor use- (1) Round table for every five (5) students- (1) Chair for each student.

- (1) Extension power cord for each table (per five students) with at least five plug-ins- (1) Projector system with HDMI compatibility- Instructor computer with PowerPoint installed- Flash-drive with back-up file for the PowerPoint presentation file Site Mini-presentations

and Awareness Searches.

- Cable to connect computer to projector- (1) notepad (or two pieces of notebook paper) per student, for notes- (1) writing implement per student (pen or pencil)

Time Required:

50 minutes


42/242


Owen Berger


Table of Contents

PG. 42

Evaluated Activity #1Event Research and Presentations

Purpose:

To have students fully research an event and then present their findings.

Description:

Preview

The students will individually search for an event in their area, different from the event

they found during the earlier Facebook exercise. Students will then talk about their events with

their respective groups, and choose one event to fully research. Students will then find out all

of the information they can about their group project, and present this information along withtheir actions as law enforcement.


Ensure that all students have some sort of writing implement (pencil or pen) and at leasttwo blank sheets of paper.

IMPORTANT - Ensure that all students have their own copy of the Cyber-monitoringGrading Rubric.


Evaluated Activity 1 Event

Research and Presentations->

During the activity

Pull of the second slide of thePowerPoint presentation, Find an

Event ->



43/242


Owen Berger


Table of Contents

PG. 43

Pull up the third slide of thePowerPoint presentation, Choose an

Event ->


Pull up the fourth slide of thePowerPoint presentation, Research

and Prepare->

Ask if there are any questions, and then give the students 45-50 minutes to work, lettingthem know that they can break as needed.

Pull up the fifth slide of thePowerPoint presentation, When in

Doubt->

At some point before the end of theresearch period, pull up the last

slide, Presentations:

After each group presentation, facilitate a good discussion (5 minutes or so) on thatpresentation, its positives and negatives, and anything about the presentation that

reinforced or used lessons from the course content.


44/242


Owen Berger


Table of Contents

PG. 44

Learning Objective:

The students will utilize cyber-monitoring while working on an assigned event in small groupswith internet access and a time-limit of 45 minutes for preparation and 5 minutes for

presentation, and must score a three (3) or higher on each category of the Cyber-monitoring

Grading Rubric.

Resources Needed:

- (1) Computer or tablet for each student, with power cable and Wi-Fi capabilities.- Wi-Fi capabilities for every student, i.e. enough bandwidth for class size.- (1) Flip chart

- Markers, for instructor use- (1) Round table for every five (5) students- (1) Chair for each student.- (1) Extension power cord for each table (per five students) with at least five plug-ins- (1) Projector system with HDMI compatibility- Instructor computer with PowerPoint installed- Flash-drive with back-up file for the PowerPoint presentation file Evaluated Activity

Event Research and Presentations.

- Cable to connect computer to projector- (1) notepad (or two pieces of notebook paper) per student- (1) writing implement per student (pen or pencil)

Time Required:

Two hours


45/242


Owen Berger


Table of Contents

PG. 45

NoteThe pages below consist of a modified view of the Cyber-monitoring Grading Rubric.

The full version (better for printing) can be downloaded from the link below (in Word format or

PDF format):

https://www.dropbox.com/sh/cak9000jwkjvbrl/AACdOSS15-gTalvgaqrMg3M3a

Cyber-monitoring Grading Rubric

This rubric is designed to give guidelines on how to rate the student groups during the

evaluated activity section of Module IGathering Intelligence with Social Media and the

Internet. The final score is a pass/fail rating, where each group must score a 3 or higher on

ALL categories to pass. A 1 in any category is an automatic fail and requires remediation.Student: Evaluator: Date:

CategorySearch Plan

1-Not

acceptable

2-Not acceptable

3-Competent

4-Outstanding Score

Students did

not create a

search plan

for their

event.

One or two in the group

actively cooperated in the

creation of a search plan

for their assigned event

by verbally giving input or

writing the plan down.

Students explicitly

referenced the search

plan zero or one time

verbally or by reading it

during the research of

their event.

Most students in the

group actively cooperated

in the creation of a search

plan for their assigned

event by verbally giving

input or writing the plan

down. Students explicitly

referenced the search

plan at least twice


during the research of

their event.

All students in the group

actively cooperated in the

creation of a search plan

for their assigned event by

verbally giving input or

writing the plan down.

Students explicitly

referenced the search plan

at least three times


during the research of their

event.

Comments:
https://www.dropbox.com/sh/cak9000jwkjvbrl/AACdOSS15-gTalvgaqrMg3M3ahttps://www.dropbox.com/sh/cak9000jwkjvbrl/AACdOSS15-gTalvgaqrMg3M3ahttps://www.dropbox.com/sh/cak9000jwkjvbrl/AACdOSS15-gTalvgaqrMg3M3a


46/242


Owen Berger


Table of Contents

PG. 46

CategoryVocabulary / Nomenclature

1-Not

acceptable

2-Not acceptable

3-Competent

4-Outstanding Score

Students did

not use the

Social Media

and Internet

terms and

nomenclature

that were

taught or

found during

the course.

Student showed little

understanding of the

technical Social Media

and Internet

terms/nomenclature

that were taught, by:

discussing them at

most one time during

their group evaluated

activity,whilemonitoring their

assigned event, or

during the group

presentation of their

finding.

Student showed


technical Social Media and

Internet

terms/nomenclature that

were taught, by: discussing

them during their group

evaluated activity at least

once, using them correctly

while monitoring theirassigned event at least

once, and using them

correctly during the group


findings at least once.

Students showed


technical Social Media and

Internet

terms/nomenclature that

were taught, by: discussing

them during their group

evaluated activity at least

twice, using them correctly

while monitoring theirassigned event at least

twice, and using them

correctly during the group


findings a minimum of

twice.

Comments:

CategorySite / Tool Knowledge

1-Not

acceptable

2-Not acceptable

3-Competent

4-Outstanding Score

Students were

not observed

utilizing the

websites and

tools that were

introduced or

used during

training.

Students utilized the

websites and tools that

were introduced or used

during training for the

majority of their

research. Students were

observed using the

demonstrated sites andtools at least oncewhile

researching and

monitoring their event.





majority of their

research. Students were

observed using the

demonstrated sites andtools at least twicewhile

researching and






majority of their research.

Students were observed

using the demonstrated

sites and tools at leastthree timeswhile

researching and


Comments:


47/242


Owen Berger


Table of Contents

PG. 47

CategoryLegal Application

1-Not acceptable 2-Not acceptable 3-Competent 4-Outstanding ScoreStudents did not

demonstrate


legal ramifications of

using Social Media

and Internet to

monitor events.

Students did not

openly discuss the

constitutionality orlawful consequences

of the performed

cyber-monitoring.

Students demonstrated



using Social Media and

Internet to monitor

events. Students

openly discussed, more

than once, the

constitutionality or

lawful consequences ofthe performed cyber-

monitoring. Their

discussions did not

include law that was

introduced or

mentioned during the

course.





Internet to monitor

events. Students

openly discussed, at

least once, the



monitoring. Their

discussions included,

but werent limited to,

false personas, current

case law, data storage

and retention, and

constitutional

amendment issues.





Internet to monitor

events. Students

openly discussed, more

than once, the



monitoring. Their

discussions included,

but werent limited to,

false personas, current

case law, data storage

and retention, and

constitutional

amendment issues.

Comments:


48/242


Owen Berger


Table of Contents

PG. 48

CategoryEvent Results

1-Not acceptable 2-Not acceptable 3-Competent 4-Outstanding Score

Students were able toproduce results from

their cyber-

monitoring. They

found less than five

separate pieces of

information on their

event. In addition,

students were not able

to extrapolate

necessary actions ortactics from their

found information.


their cyber-monitoring.

They found at least

five separate pieces of


event. In addition,

students were able to

extrapolate at least

onenecessary actions

or tactics from theirfound information.



They found at least

sevenseparate pieces

of information on their

event. In addition,



twonecessary actions




They found at least ten

separate pieces of


event. In addition,



threenecessary actions


Comments:

Category - Presentation


Students were not

able to clearly

communicate their

findings to the rest of

the class. Students

did not convey how

they obtained their

information, and did

not present any

actions were

implemented due to

the foundinformation.

Students were able to

communicate their

findings to the rest of

the class. Students

conveyed how they

obtained their

information by giving

at least onesites/tools

that were used, and at

least oneactions were

implemented due to

the found information.


clearly communicate

their findings to the

rest of the class.

Students conveyed how

they obtained their

information by

detailing at least two

sites/tools that were

used, and at least two

actions were

implemented due tothe found information.


clearly communicate

their findings to the

rest of the class.

Students conveyed how

they obtained their

information by

detailing at least three

sites/tools that were

used, and at least three

actions were

implemented due tothe found information.

Comments:


49/242


Owen Berger


Table of Contents

PG. 49

Category - Participation


Only one or twogroup members

presented over

ninety percent of

the material.

Most of the group membersparticipated in the

presentation, but one or

two members presented

more than seventy-five

percent of the material.

Every group memberparticipated in the

presentation, though one

or two members presented

more than fifty percent of

the material.

Every groupmember

participated in the

presentation

equally.

Comments:

CategoryTime Management


The presentation was more

than 45 seconds less than

or more than 5 minutesin

length, and one or two

group students

participated in presenting.

The presentation was

within 45 seconds of 5

minutesin length, and

most of the group

participated in

presenting.

The presentation was

within 30 seconds of 5

minutesin length, and

the entire group

participated in

presenting.

The presentation

was within 15

seconds of 5

minutesin length

Comments:

Please total the scores for all categories and type the number in the box to the right.

Twenty-one (21) is the minimum passing score. Twenty-eight (28) is the maximum

score.

Overall Presentation Comments:

Please enter a selection of pass or fail in the box to the right.


50/242


Owen Berger


Table of Contents

PG. 50

Module II - Real-time Intelligence Systems: Design and Implementation

Date Revised: September, 2014

Instructors: Berger / Bouse

Course Goal: To teach students how to gather and disseminate real-time intelligence with

Social Media and the Internet

Module Goal: To teach students how to design and implement systems for gathering and

disseminating intelligence from Social Media and the Internet

Learning Objective: The students will create an intelligence system while working in smallgroups with Internet access and a time-limit of 60 minutes for preparation and 6 minutes for

presentation, and must score a three (3) or higher on each category of the Systems Design

Component of the Intelligence SystemsRubric.

Module Time: 4 hours (Day 2 from 0800-1200)

Resources Needed:

(1) Computer or tablet for each student, with power cable and Wi-Fi capabilities. Wi-Fi capabilities for every student, i.e. enough bandwidth for class size. (1) Flip chart for every five (5) students.

(1) Flip chart stand for every five (5) students. Markers, preferably 5 different colors for each table. (1) Round table for every five (5) students. (1) Chair for each student. (1) Extension power cord for each table (per five students) with at least five plug-ins. (1) Projector system with HDMI compatibility. Instructor computer with PowerPoint installed. Flash-drive with back-up file for the learning and evaluated activities PowerPoint

presentation files, located in the online folder under Module Summarybelow.

Cable to connect computer to projector.

(1)Intelligence SystemsRubric Systems Design Componenthandout per student. One printed version of the two-page document entitledElement-driven Systems

Design Notecards (for instructor use only).

One printed version of theIntelligence Systems Elements Checklistfor each student. One notepad or several pieces of paper and a writing implement per student.


51/242


Owen Berger


Table of Contents

PG. 51

Module Summary:

This module will utilize two learning activities and one evaluated activity, building toward the

creation of a customized intelligence system. Students will firstreview their ownorganizations intelligence systems and review case law. Students will then do an hour long

element-driven design activity,where they will build three separate systems for specific

messages. Last, students will choose a non-existing intelligence system that will benefit their

workplace,design it, and then presentthat system and be graded according to themodule

grading rubric.

All of this modules instructor and student materials can be downloaded here:

https://www.dropbox.com/sh/3z1gg36kry1mex4/AACZBtUPRmVEpChbAk-zbKKua

Outline Instructor NotesII. Designing Intelligence Systems [1] [1a]

A. Definitions

1. Intelligence

a. Universal definition

b. Defining the term

1) Command staff

2) Multi-jurisdictional

3) Policy

c. Intelligence vs information

2. System

a. Systems Definition1) System vs Policy

2) System vs Guideline

3) System vs Law

b. Breadth

1) Organization-wide

2) Division/Bureau wide

3) Unit-wide

[1] FacilitateStart a group discussion

about the meaning of an intelligence

system or information system. Then,

lead a prolonged discussion about how a

system differs from other law

enforcement terms and how intelligence

systems are used by law enforcement

today.

NOTEFor the above facilitated

discussion, please write down importantpoints on a flip chart that the class can

view.

[1a] Ask -

What is an intelligence system? Howdid you come up with your

definition? Would all of us define it

the same way? Why or why not?

How do you define intelligence? How

does it differ from information?Does your organization see it the

same way? Why or why not?
https://www.dropbox.com/sh/3z1gg36kry1mex4/AACZBtUPRmVEpChbAk-zbKKuahttps://www.dropbox.com/sh/3z1gg36kry1mex4/AACZBtUPRmVEpChbAk-zbKKua


52/242


53/242


Owen Berger


Table of Contents

PG. 53

(1) Importance

(2) Invitation vs pre-

subscribed(3) Intentional recipient vs

open subscription

3) Methods of communication

a) Interception vs Reception

vs Storage/Retrieval

b) Direct sending

c) Post and retrieve

d) Actively transmitting vs

retrieval from storage

b. Garcetti v Ceballos1) Employee vs Citizen

2) Two-prong tests

a) Determine who you are

speaking as

(1) Employee

(a) Statements for work

purposes

(b) Whistleblower laws

(c) During work hours

(d) At work location

(e) Using workresources

(f) Work Equipment

(g) Work supplies

(h) Work Technology

(2) Citizen

(a) On off-time (off-

duty)

(b) Using

private/personal

equipmentb) Matter of public interest

(1) Raising public concerns

(2) Normal situation arising

out of work

(3) Right to know / Need to

know


54/242


Owen Berger


Table of Contents

PG. 54

c. Cromer v Lexington

1) Separation of concerns

a) On-duty(1) Acting as representative

of your organization

(2) Must abide by all

policies/procedures

(3) Can identify as law

enforcement

(4) Can hide identity for

certain operations

b) Off-duty

(1) Should not identify aslaw enforcement

(2) Behavior that can

(a) Affect your ability to

work

(b) Affect your

employers ability to

function

(c) Affect reputation of

you or your

employer

2) Termination for off-dutybehavior

a) It is possible

b) It is legal

c) Never identify yourself as

law enforcement

d) Complaints about employer

(1) Use whistleblower

protections if needed

(2) Use the proper channels

for reportingmisconduct

d. New York v Harris

1) NY District Attor

Documents

MICC8 TTP Notebook - Real-time Intelligence with Social Media