One of the unexpected downsides of social media is that it has transformed the dynamics of crime, offering criminals and terrorists easier access to victims. The prevalence of social networking has allowed them to identify potential victims and collect vast amounts of sensitive personal information that can be used for a number of criminal purposes, including extortion and kidnapping.
With social media, users can broadcast their whereabouts as they upload photos or post in real time or through live feeds and apps with geolocation features. What’s more, geotagging is often automatically embedded in posts and photographs without owners even realizing it. According to recent research, 35% of Americans “check-in” or tweet about their whereabouts on a regular basis, 15% announce to their social-networking “friends” when they are not home and 40% post details of an upcoming vacation on social media sites. This information can help criminals profile a victim and pinpoint their location. It is no surprise, then, that 78% of burglars have used social media to identify potential targets and 74% of criminals have used Google Maps to locate a property.
Personal information on websites or instant messaging services can also be used against an extortion victim, particularly in cases of virtual kidnapping, in which scammers deceive people into believing a loved one has been abducted and then demand a ransom. By obtaining personal information, criminals can make the event seem more credible and increase the probability of success. In a recent kidnapping case in Guatemala, for example, a response consultant was working with a family to find their son. Within 45 minutes, the consultant was able to successfully answer three proof-of-life questions after searching social media sites, rendering them useless. If consultants can find these answers on social media, so can kidnappers.
While many social media sites allow users to specify privacy settings, restricting what is publicly available, criminals can still access posted information by hacking user accounts or accessing other accounts trusted by the user. Likewise, some sites state in their terms of use that they claim ownership of the content once it has been posted. Thus, once personal information has been posted to a social media site, the owner has effectively lost control of that information and how it is used.
Another kidnapping case of a young man in Mexico, who was successfully released, proves this point. During the debrief meeting with the victim, the consultant discovered that the gang used social media to gather information on potential victims. The kidnappers used “spotters” in a casino the victim had frequented to identify potential victims and gather basic information on them. With this information in hand, the kidnappers then compiled more details on the victim through social media. The kidnappers even showed the victim information about his friends to get him to confirm it.
Information posted by third parties can also be used to target individuals. Such information is less likely to contain more personal details, but it can give criminals some general background information on a prospective target. Searching oneself online and noting the results will demonstrate what information is currently available.
Terrorist organizations also use social media to identify and gather information on potential targets. Israeli intelligence has warned of Hezbollah’s use of Facebook to monitor Israeli soldiers’ activities and to cultivate online friendships in order to gather information and arrange kidnappings and attacks. Likewise, Al Qaeda’s “terrorist handbook” instructs its users to search online and use social media to identify potential targets, noting that social media can provide a wealth of personal information relating to an individual’s residence, workplace, family and travel routines. Moreover, terrorist organizations have increasingly used social media in recent years to identify, indoctrinate and radicalize individuals.
As a result of these trends, users need to be wary about giving away too much information on social media. This includes separating their online personal presence from their online business presence. Even though publicity is essential to business, companies should consider implementing risk mitigation measures including developing safe social media usage policies and purchasing kidnap and ransom insurance to protect workers, especially those in potentially dangerous or unstable regions.
While social media can be a positive and powerful tool, individuals need to be aware of what personal information is available online to individuals or groups that intend to do harm. Just as we would not leave our front door unlocked when we are away from home, we must also take precautions with security in our virtual lives.