Indian Defence Review

The use of social media has become a ubiquitous component of the ever more interconnected world in which we now live. The use of social media platforms such as Twitter, Facebook and LinkedIn can provide organisations with new and innovative ways in which to engage with their staff. However this highly dynamic and end-user focused environment also brings with it a number of security concerns. The data held within social media can provide an attacker with a wealth of information about the internal workings of an organisation, including detail on roles and responsibilities, projects, relationships and expose information about internal IT systems, including the ability to identify security vulnerabilities.

“We become what we behold. We shape our tools, and thereafter our tools shape us.” ——Herbert Marshall McLuhan1

Social computing is not a fad. Nor is it something that will pass us by. Gradually, it will impact almost every role, at every kind of organisation, in all parts of the world. The term “social media” refers to internet-based applications that enable people to communicate and share resources and information. Social media can be accessed by computer, smart and cellular phones, and mobile phone text messaging (SMS). To give an idea of the numbers, there are more than 110 million blogs being tracked by Technorati, a specialist blog search engine; an estimated 100 million videos a day being watched on video-sharing website, YouTube and more than 130 million users on the social network Facebook.

The Supreme Court of India, on March 24, 2015, struck down Section 66 A of the Information and Technology Act, which allows police to arrest people for posting “offensive content” on the internet. The bench said the public’s right to know is directly affected by Section 66 A and the Section clearly affects the Right to Freedom of Speech and Expression enshrined in the Constitution of India.

What is Social Media?

Social media is best understood as a group of new kinds of online media, which share most or all of the following characteristics:

• Participation: Social media encourages contributions and feedback from everyone who is interested. It blurs the line between media and audience.
• Openness: Most social media services are open to feedback and participation. They encourage voting, comments and the sharing of information. There are rarely any barriers to accessing and making use of content, password-protected content is frowned on.
• Conversation: Whereas traditional media is about “broadcast” (content transmitted or distributed to an audience) social media is better seen as a two-way conversation.
• Community: Social media allows communities to form quickly and communicate effectively, sharing common interests.
• Connectedness: Most kinds of social media thrive on their connectedness, making use of links to other sites, resources and people.

There are several kinds of social media:

• Social networks: These sites allow people to build personal web pages and then connect with friends to share content and communication. The biggest social networks are MySpace, Facebook2 and Bebo. Perhaps the most ‘grown-up’ of the popular networks is LinkedIn, which allows users to build their business and professional contacts into an online network. It has been criticised for not being open enough and for charging for too many of its services – but next to Facebook, it is still the most popular online social network among people aged 25 and over.

• Blogs: These are online journals, with entries appearing with the most recent first.3 At its simplest, a blog is an online journal where the entries are written in a personal, conversational style. They are usually the work of an identified author or group of authors.
• Wikis: These websites allow people to add content to or edit the information on them, acting as a community document or database. Wikis are websites that allow people to contribute or edit content on them. A wiki can be as private or as open as the people who create it want it to be. The best-known wiki is Wikipedia, the online encyclopaedia which has over two million English language articles.
• Podcasts: Audio and video files that are available by subscription, through services like Apple iTunes.
• Forums: Areas for online discussion, often around specific topics and interests. Forums are a powerful and popular element of online communities. Internet forums are the longest established form of online social media. They commonly exist around specific topics and interests. Each discussion in a forum is known as a ‘thread’, and many different threads can be active simultaneously. This makes forums good places to find and engage in a variety of detailed discussions. They are often built into websites as an added feature but some exist as stand-alone entities. The sites are moderated by an administrator, who can remove unsuitable posts or spam. However, a moderator will not lead or guide the discussion. This is a major difference between forums and blogs. Blogs have a clear owner, whereas a forum’s threads are started by its members.

• Content communities: They organise and share particular kinds of content. Content communities are social networks – you have to register, you get a home page and then make connections with friends. However, they are focussed on sharing a particular type of content. The most popular content communities tend to form around photos (Flickr),4 bookmarked links (del.icio.us) and videos (YouTube).5
• Micro-blogging: Social networking where small amounts of content (updates) are distributed online and through the mobile phone network. Twitter is the clear leader in this field.6

People can find information, inspiration, like-minded people, communities and collaborators faster than ever before through the various types of social media. New ideas, services, business models and technologies emerge and evolve at dizzying speed in social media.

People joining a social network usually create a profile and then build a network by connecting to friends and contacts in the network, or by inviting real-world contacts and friends to join the social network. Among the defining characteristics of social media are the blurring of definitions, rapid innovation, reinvention and mash-ups.7 Some marketers have cottoned on to the power of this and encourage people to reinterpret their content. MySpace, for instance, allows members to create vivid, home pages to which they can upload images, videos and music.

The unique way that the internet continually improves in response to user experience is driving innovation on an unprecedented scale. Social media is developing in response to the appetite for new ways to communicate and to the increasingly flexible ways to go online. Its future direction is impossible to predict. What is beyond doubt is that social media – however it may be referred to in the future – is a genie that will not be disappearing back into its bottle.

A Security Challenge And Opportunity

New entrants to the global workforce are posing increasing security challenges to their employers as they mix personal and private lives. Nowhere is this more evident than in the use of social media, often accompanied by a low regard or even total disregard for privacy concerns. Most people believe the age of privacy is now over and are, apparently, unconcerned about the data that is captured about them.8

This attitude is at odds with organisational concerns about the disclosure of sensitive information through social media to potentially millions of Twitter and Facebook users. This has led to concerns about privacy linked to security and is driving proposals for cyber security directives that link privacy and security, especially where data breaches are concerned. According to the Cisco 2013 Annual Security Report, the highest concentration of online security threats is on mass audience sites, including social media. The report revealed that online advertisements are 182 times more likely to deliver malicious content than pornography sites, for example.

The ability of individuals to share information with an audience of millions is at the heart of the particular challenge that social media presents. In addition to giving anyone the power to disseminate sensitive information, social media also gives the same power to spread false information, which can be just as damaging. The rapid spread of false information through social media is among the emerging risks identified by the World Economic Forum in its Global Risks 2013 report. The report’s authors draw the analogy of shouting “Fire!” in a crowded cinema. Within minutes, people can be trampled to death before a correction can be made to the message. There have been several incidents over the past year where false information transmitted on the internet has had serious consequences. For example, a fake tweet by a someone impersonating the Russian Interior Minister, claiming that the Syrian President had been killed or injured, caused crude prices to rise by over $1 before traders realised the news was false.

Social media is used by terrorist organisations as a tool for ideological radicalisation, recruitment, communication and training. In addition, terrorist groups take advantage of it to communicate with cyber crime organisations and to coordinate along with them fundraising activities (from illicit activities) carried out in part (drug smuggling, gunrunning) or completely (e.g. phishing9) on the Internet. The link between organised crime and terrorist organisations is increasing considerably in the cyber world, and this coalition will be able to produce new offensive technologies. To date, the terrorist groups which make the most substantial use of social media for their own purposes are the Islamic-jihadist ones.10 Facebook and YouTube channels are often used by them for recruiting and increasing the number of sympathisers and jihad-supporters, especially in the West (e.g. spreading photos and videos of successful terrorist attacks, publishing lists and biographies of martyrs, preaching or ideological texts).

Future conflicts will occur in more and more connected environments, which will be characterised by the use of new communication and information technologies, social media included. Social media is now ready to be employed more and more frequently to accompany traditional offensive means. In particular, the use of social media during a conflict adds to the employment of other mass media (newspapers, TV and radio) for propaganda, influence and deception activities.

Since open-source material is sparse, it is not possible to investigate cases of military campaigns conducted with an actual employment of social media in support of military operations. Nevertheless, it is useful to briefly mention the two latest conflicts between Israel and Lebanon. During the second Israeli-Lebanese war in 2006, Hezbollah carried out several Information Warfare (IW) activities thanks to the use of social media. During the conflict, they published several videos and photos on blogs, social networking sites and YouTube to foster their own image and decry Israel and their security services. Further, Hezbollah managed to instil a “perception of failure” in the Israeli political-military establishment which conditioned the course of the conflict.11 Iranian Signal Intelligence (SIGINT) professionals tracked signals coming from personal cell phones of Israeli soldiers to identify assembly points of Israeli troops that may have telegraphed the points of offensive thrusts into Lebanon. This is just one example of low-end cyber warfare that can be as deadly as expensive software worms designed to infiltrate an enemy’s most heavily defended networks. During the following war (2008-2009), Israel showed a much effective management of social media, employing them in information and counter-information campaigns.12