Social Media Warfare Analysts Qualifications, Training, and Functions

One of the most important functions in social media warfare is data collection and analysis that can help determine the defensive and offensive social media warfare tactics necessary to achieve a specific goal. Whether an organization is chasing criminals or combating terrorists, to succeed in the use of social media warfare tactics an understanding of the enemy, or the target, is required.

Open source data gathering and analytical skills are a must for the social media warfare analyst. These tools collect data from multiple sources, including websites, social media, broadcast media, gray literature sources, the dark web, and traditional press sources, and combine that information with that of geospatial analysts, cyber specialists, librarians, data scientists, and other subject matter experts to identify trends, patterns, and relationships that provide unique insights into specific issues or areas of activity.

A social media warfare analyst usually comes equipped with skills and knowledge in one or more fields, such as military operations, law enforcement, terrorism, cyber security, science, and so on. Social media warfare analysts also need strong writing and analytic skills; foreign language proficiency; well-developed Internet research skills; excellent communication and English-language skills, excellent analytical ability, solid interpersonal skills; the capacity to think clearly and creatively; and the ability to work under tight deadlines.

Social media warfare analysts that specialize in counterterrorism, for example, assess the leadership, motivations, capabilities, plans, and intentions of foreign terrorist groups and their state and non-state sponsors. Their key mission is to identify specific threats, warn of and preempt attacks, disrupt their networks, and eventually defeat terrorist organizations. Counterterrorism analysts analyze a variety of information to gain a comprehensive understanding of a complex analytic issue and produce a range of written intelligence products. Counterterrorism analysts may also be responsible for briefing policy makers and foreign partners, military officials, and intelligence and law enforcement agencies. They highlight targeting opportunities to support intelligence operations designed to counter terrorism. Analysts generally maintain and broaden their professional ties through academic study, contacts, and attendance at professional meetings. They may also choose to pursue additional studies in fields relevant to their areas of responsibility.

Intelligence collection analysts apply their expertise on intelligence collection systems, capabilities, processes, and policies to inform intelligence consumers about collection developments and their effect on analysis through a range of written products and briefings. They collaborate with other analysts and collectors across the intelligence community (IC) to identify intelligence gaps and develop strategies to overcome collection challenges. Collection analysts provide insight that informs decisions on the acquisition and development of current and future collection systems [17].

Investigating the Internet criminal can be one of the most complex tasks facing law enforcement professionals and requires a multi-disciplinary approach supported by technical expertise that was not needed with traditional crime. Internet investigations can focus on the examination of historical Internet data such as e-mails, social media consumer-generated content, and website postings to identify the author or originator of the Internet activity by looking at system artifacts and attributes. Online investigations focus on the live and active interrogation of online data, such as investigating websites and attempting to determine their physical location. Investigators must be able to successfully seize and acquire digital evidence whether online or from seized computers, which requires comprehensive digital forensics techniques [18].

Criminal investigators as well as counterterrorism agents need the training necessary to complete a forensically sound, logical acquisition of digital evidence from mobile devices. This requires an understanding of cell technologies (GSM, CDMA, and iDEN), practical application of historical tracking, and the skills to frame an investigation from evidence obtained through call detail records from cellular service providers to map and track the mobile device’s movement by using standard mapping programs such as Google Earth™. Evidence must also be correctly extracted from mobile devices.

Criminal investigators may also be confronted with network-related crimes that might include network intrusions and hacking attacks. To be successful, investigators must be familiar with hacking methodologies and popular hacking tools, but they must also utilize proper evidence handling in the investigative processes to assist with network forensic investigations. These investigations can become very technical when trying to determine what security measures were in place at the time of the incident and the types of logs that were maintained. This can help determine if unauthorized user accounts were added; files were added, modified, copied, or deleted; security settings were reconfigured or a backdoor added; intrusion and sniffer tools were copied to the network; and services were stopped or started [19].