Investigating the social Web

     The news is full of stories about evidence found on Web sites such as MySpace, Facebook, YouTube, and others. From Internet Crimes Against Children (ICAC) task forces gathering chat sessions and images, to street cops collecting videos related to assaults and robberies, law enforcement seems to have begun to catch on social networking.

     Yet some officers remain offline — whether due to generational differences, or no-Internet-usage policies in police departments themselves. A new course from the National Consortium for Justice Information and Statistics (also called SEARCH), however, may help convince them that social networking sites, as an investigative tool, aren't just a waste of time.

Social Web sites are different

     Social networking sites like MySpace and Facebook, and the hundreds of others like them, are not like traditional Web sites. "[They] are designed for interactive communication, whereas 'regular' Web sites seem to be designed more for the dissemination of information," says Keith Daniels, a high-tech crimes training specialist with SEARCH.

     This difference can make investigations difficult. Lauren Wagner, the high-tech crimes training specialist who is Daniels' co-presenter, says that this is because social networking Web sites are designed so users can change their own content whenever they want.

     "Also," she says, "there is very little probability that these changes are recorded anywhere, so all available information can disappear quickly with little chance for recovery." Daniels adds that users can quickly migrate from one site to another, "whether owing to popularity or police presence." Thus, he says, investigators must record "as much information as possible — as quickly as possible."

     Online investigations are no longer tied to finding child predators. In fact, says Wagner, "All types of crimes and evidence of crimes can exist on social networking Web sites. Phishing, viruses and spyware are all rampant. Drug dealers post pictures of what they are selling (for example a picture of marijuana on a scale to show the amount, and money laid out beside it to show how much that amount costs). Hate groups and terrorist groups recruit over social Web sites. Background information as well as links between suspects, victims and witnesses can be obtained. Pictures of graffiti and stolen property can be found."

     Sites like MySpace and YouTube aren't the only places where evidence is available. "Microblogging" sites like Twitter can also offer it. "The case that comes to mind is the incident in Tokyo, Japan, where a man drove his truck into a crowd of people, then got out and started stabbing people," Wagner says. "He had documented everything he was going to do on a Japanese microblogging Web site before he started his killing spree."

     In addition, while traditional sites offer e-mail and postal addresses, telephone numbers, and other more conventional means of contact, social sites allow for direct lines of communication. These include private messaging, group memberships, and forums devoted to specific subject areas or users. "All areas of social sites have the potential to be used for all kinds of crimes," says Wagner. "If the information is publicly available, then law enforcement can search for, find and document this information."

A new course offering

     SEARCH's new training began last fall, when it offered three one-day "pilot" courses. They were so popular that the course, "Social Networking Sites: Investigative Tools and Techniques," became part of the organization's regular schedule.

     A non-technical offering, the course was designed for all investigators — not just those experienced in high-tech crimes, but also those who investigate gang activity, narcotics and property crimes. Attendees learn how to set up a MySpace page, work around page "enhancements," locate and trace users via their profiles, search the site for case information, and use off-site tools such as Firefox add-ons and the SEARCH Investigative Toolbar (downloadable at

     Although the training focuses on MySpace, Wagner says the lessons learned can easily translate to investigation of other sites. "Due to the fact that all social networking sites are based on the foundations of creating social networks, there must be some standard information fields that translate across the multiple specific sites," she explains.

     Even when sites change their interfaces — the "look and feel" of the way users create and exchange information — generally this affects the users more than investigators. In other words, Wagner says "the same information just looks different."

     Most of all, the course teaches investigators how to apply what they already know to the Internet. "No technology can make up for 'good old-fashioned police work,' " Wagner explains. "Investigators still need to use all the skills they use to find good evidence in the real world to find good evidence in the digital world. There is no silver bullet to do that for you. Sometimes the evidence is obvious and sometimes it's like finding a needle in a haystack, but that's where proper training comes in."

Legal considerations

     In general, the same rules of search and seizure apply to online evidence as to physical. W.R. McKenzie, a deputy district attorney in Stanislaus County (Calif.), says that information on social network sites is essentially in "plain view." "A page open to the public is not something the officer accesses without permission," he explains. Even when an officer must sign up to view profile information, as with Facebook — even if they were not previously a member — it still has no legal difference from any other signup.

     However, private messages or off-site e-mails do require user permission or a court order. An officer cannot, for example, figure out a user's password in order to obtain evidence. Likewise, a warrant is necessary to get evidence directly from the site provider.

     Sometimes information is not publicly available, as when users trade private messages, or only allow friends to see their profile pages. "[In that case] other methods, such as undercover work, may need to be employed," Wagner says. Legally this is slightly thornier. "In at least one state, a law enforcement officer cannot lie about his or her identity online," McKenzie says. Otherwise, officers can engage in public or private discussions without a court order because criminals give implicit permission to do so, taking the chance that the person they're talking to is not a law enforcement officer.

     Evidence recovery itself can present a legal challenge. A number of tools exist to help investigators capture video, photos, and even screenshots of text. McKenzie compares them to cameras used to take pictures of crime scenes. "It could be a Nikon or a Canon," he says, "but as long as the officer can testify that what's in the picture is exactly the same as what he saw, that he knows how to use a computer and the software itself, it's defensible."

     Finally, McKenzie says, officers and detectives can copy and save online evidence including conversations — but require search warrants to prove who put it on the Internet in the first place. This requires a court order. A search warrant to the social site can pinpoint the server, IP address, and other identifiers that can help police locate a suspect. Even then, police must prove a particular person inside a residence, for instance, was the one posting the messages.

     All these issues are why the available tools require instruction on how to be used for evidentiary purposes, something SEARCH provides in its class. More information can be obtained at

Prevention: 'My #1 Friend is a Cop'

     Reactive investigations are not the training's only focus. Although MySpace in February 2009 took the radical step of expelling 90,000 registered sex offenders from its membership rolls (following the 27,000 it banned in 2007), still more exist who haven't been caught. That's why SEARCH also emphasizes prevention through its "My #1 Friend is a Cop" program, which has police departments create their own MySpace profile pages. The idea is for young people to "friend" police, so that prospective predators — pedophiles, bullies, or other offenders — know the individual has a way to report suspicious behavior.

     The idea began in Miami in January 2007, where Wagner was teaching a computer crimes class. An officer asked if there was a way to prevent young people from being victimized on MySpace. Wagner's initial idea was for the agency to make a MySpace page, then encourage area parents to have their children "friend" the Miami-Dade police. The program was a huge success. "In the first day they had almost 300 youths involved. In four days they had approximately 700," Daniels says.

     Likewise successful has been the Fairfield (Calif.) Police Department's page, started by Det. James Carden after his 13-year-old son was approached, via MySpace, by an older man. "As a parent I wanted it to stop, but as a cop, I knew the local police wouldn't be able to handle it because it wasn't criminal activity," Carden explains. "I had no resource except to tell my son not to talk to him, and to use my son's page to message the man to tell him to stop." But even that solution was limited. "Kids are on MySpace all the time, and parents can't be. Unless you go on your kid's page regularly, you don't know what's going on, and there are no checks and balances to protect them."

     The concept is simple: A police department representative spends time to create a MySpace page. (Visit Fairfield PD's at This includes uploading the agency's official emblem — its patch — as its profile picture. When "friended," the patch shows up in the "friends" list (MySpace allows users to rank their friends so that specific friends appear on the front page all the time). "It's like parking a cop car in a neighborhood that's being hit by burglaries," Carden says.

     More than a deterrent, it's also a resource for the public to report suspicious activity — even if a crime has not taken place. "When we receive a complaint, we message the adult to ask them to 'cease and desist' before we take official action," says Carden, who is also attached to the Sacramento Valley Hi-Tech Crimes Task Force. "That way we don't have to use police time by taking a report, but we still have a way to deal with the problem."

     The program doesn't just address Internet crimes against children. Carden also posts department news releases on the page's blog and plans to post a slide show of criminals wanted in Fairfield, along with video of fraud suspects. He invites visitors to message him with tips about any and all illegal activity.

     Both the Fairfield and the Miami-Dade Police Departments used traditional media — newspaper and television — to publicize the page, and both saw positive responses. Next fall, Carden plans to visit Fairfield schools to help school resource officers spread the word. A former SRO himself, Carden believes meeting personally with the kids will help mitigate any "uncool" factor — although Carden says kids' bigger concern appears to be privacy.

     Because the project is driven by public feedback, he has no plans to create Fairfield police presences on sites like Facebook or Twitter; the community hasn't asked about it. Meanwhile, the MySpace page has proven effective. "Kids need to be able to point to a deterrent as society and technology change," Carden says. "Police need to be able to change with it."

     Ultimately, he hopes every police department will start a "My #1 Friend is a Cop" page — not only to connect with the community, but also to share information with each other. Daniels adds that any agency wishing to take part in the project can obtain valuable prepackaged information by contacting

     The bottom line: It may seem easy to log on and get to work, and indeed, learning how to investigate and participate in social network Web sites is a good start. But the real trick is in learning the underlying culture. "The question is, what will be next?" says Daniels. "Law enforcement's challenge is to predict what is on the horizon."

     Christa Miller is a South Carolina-based freelance writer who specializes in public safety issues. She can be contacted at