Social Media and Security

I want to spend a few minutes talking about social media. That includes blogging, tweeting, forum posting, and friending. Many humanitarian security practitioners don't give social media much thought. But let me give you some real world examples I've encountered where social media went wrong and security issues arose (names, locations, and organizations aren't revealed for obvious reasons):

• Blog posts about upcoming program site visits (including dates, destinations, and routes) in an area noted for banditry
• Blog posts that revealed the location of an ex-pat humanitarian worker's residence (the staff member later left the conflict zone country when a Western intelligence agency warned an abduction was being planned)
• Photos posted on a personal Web site that showed the inside of a field office (including the location of the safe)
• An interview that appeared in an online magazine where a staff member discussed the details of refugee camp security measures
  
• A Facebook page belonging to an ex-pat staff member working in a Muslim country that contained culturally insensitive photos and comments

Good security practice is all about reducing risk. Yet in each of the above cases, not enough thought was given to the security implications of online activities and the potential impact to individuals and the employing organization. (I personally believe there's a tendency for many people to treat the Internet as a separate reality that seldom, if ever, intersects with real life.)

To reduce exposure to possible consequences, a good social media policy that spells out what is acceptable online behavior is a must. In tandem, educating staff about some of the risks to themselves and their colleagues from unmindful use of social media is also essential

This falls more into a human resources versus a security responsibility within most organizations (but shouldn't stop a good security practitioner from making others aware of the risk). If your organization doesn't have a social media policy (or wants to see how others are dealing with potential issues), check out this great, free resource that provides a database of over 170 social media policies from business, non-profit, and government.

Postscript: While on the subject of social media. The Mexican drug cartels are increasing their attacks on bloggers. Listen to a recent NPR story and see this news account about a female blogger being decapitated. I wonder if this type of activity will become more widespread (in varying degrees of violence) outside of Mexico and outside of a drug cartel context. It bears watching, especially in developing country conflict zones where actors' Internet savvy is often significantly underestimated. 9/27/11 - It's not just cartels putting the squeeze on bloggers. The State of Veracruz just passed a law that makes social media illegal if it undermines public order.

New Somali pirate threats to NGOs?

Only humanitarian organizations that use cargo ships in the Indian Ocean have had to worry about the threat of Somali pirates. That may be changing with the recent hijacking of a commercial aircraft in the Puntland region. According to a Voice of America news article, members of a pirate gang commandeered the plane, in hopes of holding it and two German journalists for ransom. The incident was peacefully resolved by security forces, but it begs the question of whether increased naval pressure in the Gulf of Aden is forcing pirates to look elsewhere for revenue - such as kidnapping Westerners. (Despite stepped up patrols, it's instructive to point out that according to Lloyds List the pirate's success rate in taking ships and smaller vessels has surged to over 50%.) Readers interested in piracy are encouraged to check out a recently released book by Peter Leeson called "The Invisible Hook: The Hidden Economics of Pirates." Leeson takes an economist's look at 18th century piracy and provides fresh perspectives on why pirates behaved and operated as they did. His historical account is fascinating and entertaining and provides insights into what is happening off the Somali coast today.

Identity Theft Study

Identity theft receives a fair amount of media coverage, and organizations (especially at the headquarters level) will often turn to their security officers for guidance. A new study on identity theft in the U.S. has just been released that dispels a number of popular beliefs. For example, less than 1/5 of the cases involved information obtained from the Internet while low-tech methods such as dumpster diving and stealing mail accounted for the majority of stolen personal information. There's an AP news story with a good summary here and the complete report in PDF format here.