When a $38,000 Infinity SUV went missing in League City, Texas, in March, police discovered a post of the missing keys on 29-year-old Christoffer Andrew Lee's Facebook page — with his location tagged. Texas police saw the post and arrested him.
It's become a core activity for law enforcement and governments to use online histories and social media to track crimes — after they occur. But the issue becomes more dicey when social media is being used to catch a criminal before they act.
The recent shooting in Oregon is a prime example. The shooter and his mother had a history of online posts and social media that were discovered after the fact and that, in the least, suggested cause for concern. The shooter, Chris Harper-Mercer, had a social media profile that expressed frustration with organized religion and that he had studied mass shootings. He lived with his mother, who wrote online about her passion for firearms.
Does that qualify as evidence? Could it have led to preemptive action by law enforcement? As law enforcement uses insights from predictive data analytics and firms like Palantir Technologies — a billion-dollar-plus Silicon Valley and CIA-backed firm whose claim to fame is the role it reportedly played in catching Osama bin Laden — it is hunting along a slippery slope of privacy rights and potentially using a less-than-perfect science to indict members of society for their words alone rather than deeds.
"There's a treasure trove of information available on social media when it comes to not only criminal-based activities but also terrorist-based activities," said Jon Miller, a former hacker who now serves as vice president of strategy at Cylance, an antivirus software maker.
"The posted threats, though nonspecific, probably provided enough of a predicate to warrant law-enforcement investigations, which it sounds like were under way," said Bryan Cunningham, senior counsel at Palantir Technologies.
Law-enforcement agencies and intelligence and security services around the world have been taking note. In 2014 the International Association of Chiefs of Police conducted its fifth annual survey on law enforcement's use of social media. Surveying 600 agencies in 46 states, the research found that the most common use of social media is for criminal investigations (82.3 percent). Meanwhile, it found the most frequently used social media platforms are Facebook (95.4 percent), Twitter (66.4 percent) and YouTube (38.5 percent).
In 2011 the New York Police Department formed a unit to track criminals who brag about their crimes on Twitter, MySpace and Facebook. And in March 2013, following the fatal attack of a soldier in London, an intelligence unit within London's Metropolitan Police Service focused on tracking social media feedback and monitoring community tension.
"I think that social media gives huge insight into the mental instability of desperate people," Miller said. "As a society, we should use our advances in machine learning and big data analytics to identify these people that are in need of help before tragedies, like the latest Oregon shooting, occur."
Michael Levine, a law-enforcement consultant and retired Drug Enforcement Administration agent, said social media should be used as an investigative tool and, in the best-case scenario, to obtain probable cause for a search warrant. But he also sees major limitations on its usefulness in the legal system.
"Both the Oregon shooter and his mother had a history of social media posts, which shed light on the buildup toward the tragedy. However, before the shooting, there was no court-worthy evidence that the mere participation in social media played a causative role in any mass shooting," Levine said.
Levine added that after a crime, it's different. "Once a shooting has occurred, an investigator can find court-worthy evidence of other people playing a criminal role and aiding and abetting and/or encouraging the act; sufficient evidence to indict." But he added that as a career criminal investigator, trial consultant and expert witness, he saw no logical or causative relationship that would be acceptable as "evidence" by a court in the specific case of the Oregon shooting.
In the least, social media is creating a host of challenges for law enforcement. The sheer volume of digital evidence to wade through, for one, and the consequential "false positives" that arise as a result. Many legal experts note that social media is uncovering new ethical challenges surrounding privacy. While public posts are fair game for investigators, privacy advocates are quick to point out that just because content of a post is public, it doesn't give government the right to then listen in on phone calls and have access to more private information.
According to data from industry researcher eMarketer, there will be more than 2 billion social network users worldwide by the end of 2015. That amounts to 28.2 percent of the total worldwide population and nearly two-thirds of Internet users around the world. eMarketer expects an increase in global social media use of 9.3 percent in 2015 and 8.8 percent in 2016.
The Palantir lawyer sees the difficulty of reconciling law-enforcement aims with privacy rights. "The father in me wishes police had the resources, and we had a society, where the Internet could be monitored for those types of postings, but the civil libertarian in me says we don't want the kind of society where the government is looking everywhere, all the time, without any predicates, even if such activity could prevent some horrific acts like this one."
Too often, according to law-enforcement and security experts, the approach of using social media in fighting crime has been an afterthought, and specifically, after the fact. That approach, some security experts claim, is largely the result of poor training, insufficient software and a lacking understanding of how valuable social media actually is.
The former hacker Miller has built a career putting himself inside the minds of criminals to test the vulnerabilities of Fortune 500 companies — a career that's made him well aware that having a system of searching, mining and storing data on specific users from social media is imperative to tracking criminal activity. "One of the problems today is that the way most law-enforcement units use social media is ad hoc. There aren't a lot of forensic standards," he said.
Criminals, for example, often use social media to brag about what they did to their friends. Case in point: In 2013 in Florida, 31-year-old Derek Medina allegedly confessed on Facebook to murdering his 26-year-old wife. He also posted a photo of her body covered in bullets.
Miller predicts that in five to 10 years, "machine learning" will take a more active role in how law enforcement and governments police social media activity, "before something bad happens." This doesn't necessarily mean catching the Oregon shooter — it means using that shooter's history of posts to help build a data set that would inform the ongoing hunt for future criminals.
"Ideally, when somebody goes out and does something like a shooting, you'd be able to plug that user's social media presence into a machine to say, 'These types of posts can lead to this type of event' … and then the machine would perform large-scale psychological profiling on the public," Miller said. "It's all going to be done with the motivation of making the world a safer place, but it's all going to be incredibly invasive."
Similar to Waze, the GPS navigation app Google acquired in 2013, which collects metrics on where people are at all times, various tools are already on the market to do just that. These tools essentially plug in swaths of social media feeds into a machine capable of processing contextual history, using machine learning to look for trends and patterns and perform large-scale statistical analysis.
Start-up company Five Labs has a similar online tool that it claims can analyze Facebook posts to assess personality.
ZeroFox.com, the cybersecurity start-up that monitors social media networks, sells products that it says can help identify internal and external threats to an organization.
Palantir's Cunningham believes the likelihood of success is greater, and privacy and civil liberties less risky, with predicate-based analysis than with the bulk collection of social media data.
For example, getting warrants for and analyzing the social media and more sensitive data of a gang member posting a photo of the property he just stole on Facebook is more effective and poses little risk to the privacy of innocent people, he said. On the other hand, large-scale, bulk analysis to identify potential terrorists, according to Cunningham, while perhaps sometimes necessary, is more fraught with privacy concerns and its effectiveness is more difficult to pinpoint.
He said additional resources should be devoted to refining analytical technology to reduce the number of false positives and false negatives and provide additional privacy protections.
Based on current technology, the privacy and civil liberties concerns are significant enough with bulk social media analysis that law enforcement should only use it to combat the gravest threats, like smuggling nuclear devices into the U.S. Even then, Cunningham said, it should be done with a careful eye toward protecting privacy and civil liberties.
Experts hope that over time, the use of social media to respond to, fight and prevent crime will make law-enforcement and security protection activities more effective and, at the same time, privacy- protective.
"The hope is that that the conversation evolves from 'catching criminals' on social media to following and analyzing indicators of instability based on past behavior — before those people actually go out and perpetuate crimes," Miller said. "We're not there yet."
—By Paula Vasan, special to CNBC.com