MICC8 ISD Notebook - Real-Time Intelligence With Social Media

MASTER INSTRUCTOR
CERTIFICATION COURSE
[CLASS 8]
October,
2014
Real-time Intelligence with Social Media,

Instructional System Design
Owen Berger
[Student]
:Los Angeles Police Department:
Christopher Bouse
[Mentor]
:Los Angeles Police Department:
Kris Allshouse
[Facilitator]
:San Diego Regional Training Center:
POST Master Instructor Certification Course Class 8

Owen Berger
Los Angeles Police Department
Table of Contents
Executive Summary
Learner Characteristics
220
Biography
Course Design Worksheets
225
Training Needs Assessment
CDWS No. 1
225
Purpose
CDWS No. 2
251
Background
CDWS No. 3
270
Methodology
13
CDWS No. 4
289
Results and Analysis
47
Instructional Resources
308
Conclusion
189
Logistical Support
312
Glossary
193
In-Progress Review
320
Annotated References
194
Marketing Plan
327
Priorities
209
Post-course Evaluation Plan
335
Constraints
213
Revision Plan
354
Course Goal
217
Annotated Bibliography
357
Task List
218
Table of Contents
PG. 2

Owen Berger
Executive Summary
This course shows law enforcement students from any discipline how to process the
vast amount of information from online resources, including Social Media. Students will be
able to apply that information directly to their respective organizations decision-making
processes. The course is 24 hours in length and has multiple sections of content, or modules.
Each module focuses on different aspects of the overall course goal including cyber-monitoring,
policy development and intelligence-systems design and implementation. There is also a trainthe-trainer module that shows students how to train peers in the subject matter.
Each module is supplemented by two distinct components. The first component is legal
application, where students will analyze law enforcements use of real-time intelligence in a
legal context including a review of current case law and changing legislation. The second
component is critical thinking, which will encourage students to constantly think about their
methods, techniques, and ideas. The critical thinking component will help students to not only
perform at a higher level in the performance of their duties, but it will help them keep up with
the dynamic nature of real-time intelligence and the constantly evolving Internet.
An experiential and task-oriented approach will be used for delivering course ideas and
concepts. Students will actively monitor events, develop policy for their organization, design
intelligence systems, and develop training for cyber-monitoring. In addition to participating in
hands-on reality-based activities, students will also examine the legal repercussions of those
activities while thinking about them in a metacognitive fashion. These experiences and
behavioral outcomes will help students carry the course content from use in the classroom to
use in their real-world duties.
Table of Contents
PG. 3

Owen Berger
Biography
Owen Berger is a police officer with the Los Angeles Police Department (LAPD) with ten
years of law enforcement experience. Owens tenure with the LAPD started in a uniform patrol
assignment and then moved to a position with a divisional Narcotics Enforcement Detail where
he conducted complex narcotics investigations. After his stint in narcotics, he moved to a Crime
Suppression Detail, which involved finding and preventing crime in specific geographic areas
including narcotics-related crime, serial robberies and burglaries, shootings, and gang-related
crime.
Currently, Owen works for the Cyber Support Unit (CSU), of which he was a founding
member. This unit assists department detectives with any criminal investigations that have ties
to, or evidence on, Social Media and the Internet. The CSU is also responsible for situational
awareness and community engagement through Social Media. Owen is one of the few courtqualified experts on Social Media in the State of California, and has testified as a foundation
witness in several homicide, shooting, and robbery trials. Owen was part of the Social Media
development process for the LAPD, which included helping to craft policy, guidelines, and
training for the entire department. With his assistance, the CSU has grown to twelve officers
throughout the southern geographical bureau and almost sixty throughout the city of Los
Angeles.
Owen utilizes his unique work experience to teach computer and Social Media
investigations to various sworn and civilian personnel in California and across the country.
Owen is currently a lead instructor for a non-profit California Multi-Agency Support Services
(Cal-Mass). Cal-Mass assists local, state, and federal agencies with technical training and highly
technical investigations, both in person and online. Among the organizations for which Owen
teaches high-tech investigations are the California Peace Officers Association, the San Diego
Regional Training Center, and the Police Officers Association of Los Angeles County.
During his tenure, Owen earned certification as a California Peace Officer Standards and
Training (POST) advanced instructor. He is also a certified instructor for the Robert Presley
Institute of Criminal Investigations (ICI). Owen is currently enrolled in the POST Master
Instructor Certification course (MICC), Class No. 8.
Table of Contents
PG. 4

Owen Berger
Training Needs Assessment
Purpose
Background
Methodology
13
47
Conclusion
189
Glossary
193
194
Instructional System Design Notebook Table of Contents
Training Needs Assessment | Table of Contents

PG. 5

Owen Berger
Purpose
The purpose of this Training Needs Assessment (TNA) is to determine the breadth and
depth of the necessity for a course that will train law enforcement in the gathering and
dissemination of real-time intelligence from Social Media and the Internet. If the research
indicates a need for this course, the TNA will identify and prioritize the categories and
components of the course content. The results of the TNA will also guide the creation of
delivery methods and learning activities while helping to maintain a focused course design
process.

PG. 6

Owen Berger
Background
The use of Social Media has increased dramatically in the last five years. Today, almost
a third of the population in the United States visits Facebook.com daily.1 Both Twitter and
Instagram (text and photo sharing websites) are accessed by tens of millions of unique users
every month. YouTube (a video sharing website) receives almost a billion unique visitors each
month.2 In California, an estimated 50% of the population is active on Facebook.3 This rapid
growth in the use of Social Media has led to a large volume of open-source or public
information online.
A sizable percentage of Social Media users utilize this digital medium to announce their
activities, plans, locations, and travels. People also use Social Media to show connections and
affiliations with other people, organizations and groups. Even those involved in civil
disobedience, protests, crimes-in-progress, and those with violent intentions, including mass
shooters and murder-suicide suspects, use Social Media to publicize their actions, plans and
thoughts.
Recently, several mass-murderers posted manifestos online prior to committing
violent acts. For example, Christopher Dorner, who murdered several people in California,
posted his intentions on Facebook. In addition to criminals posting their intentions online, the
rapid flow of information through Social Media and the Internet has provided a worldwide
platform where a multitude of individuals are sharing their same thoughts and goals. This
platform makes it much easier for citizens to organize and protest.
In another recent event, there were mass protests organized through Social Media
across the country after the not-guilty verdict of George Zimmerman, who shot and killed a
teenager named Trayvon Martin in Florida. Despite the fact that the shooting and trial
occurred in Florida, public concerns that started on Social Media led to the Zimmerman
Protests in California. During these protests there were violent clashes between protesters
and police, as well as property crimes such as vandalism, arson, and theft/burglary. In many
cases, groups announced their intentions to protest or demonstrate at a certain place and time,
and criminals announced their whereabouts online, even bragging about their exploits on sites
such as Twitter, Instagram, and live streaming sites such as UStream.tv.
The gravity and serious consequences of these and similar events require an exploration
into the use of information from Social Media and the Internet by law enforcement.
1
(Saba, 2013)
(YouTube (Google, Inc.), 2014)
3
(Internet World Stats, 2010)
2

PG. 7

Owen Berger
Specifically, law enforcements ability to gather and use this information in an effective and
timely manner should be examined. Further research and analysis can show the effectiveness
of law enforcements current approach to utilizing real-time online intelligence, and what
training, if any, will improve that approach.
There are no courses offered to California law enforcement by the Commission on Peace
Officer Standards and Training (POST) in which the core subject is the gathering and
dissemination of intelligence from Social Media and the Internet. There are several courses
that have content regarding Social Media, Social Networking, or the Internet, but only in the
context of criminal investigations see Table No. 1 below. The aforementioned courses do not
cover the use of Social Media and the Internet as intelligence-gathering resources outside of
the strict purview of criminal investigations.
Examples of intelligence-gathering subjects outside of criminal investigations include
mass gatherings and natural disasters. In addition, there are no POST-approved courses on the
subject taught to California law enforcement by outside presenters. There are several
intelligence-gathering tools available to law enforcement, but there is not a current curriculum
that teaches law enforcement how to use those tools or what to do with the information
gained from them.
Note Some terms and nomenclature used in this Training Needs Assessment (TNA) do not
have a uniform definition for law enforcement, and some are difficult to understand without
introduction or proper context. Please see the Glossary section for more detail.
Current and Related POST Courses: Table No. 1. Current POST courses with content
concerning information or intelligence from Social Media, Social Networking, or the Internet. 4
Presenter and Course Information
Computer Crime Investigation
Search Group, Inc. - 9860
7311 Greenhaven Dr., Suite 270
Sacramento, ca 95831
(916) 392-2550
Plan: IV. Travel and per diem reimbursement
Course Description (per Presenter)

The Internet is alive and well, and is a
dynamic resource for millions worldwide. It is
also a place for criminals to prey on
unsuspecting victims. Many victims are
children, some are adults, while others are
corporations. This 24- hour course teaches
investigators how to investigate hightechnology theft and computer-related
(California Peace Officer Standards and Training, 2014)

PG. 8

Owen Berger
Cost: Non-Reimbursable Tuition: $0.00

Certified Hours: 24
crime. It provides participants with an

understanding of computer technology, its
application to criminal endeavors, and the
issues associated with investigating these
cases. The course will provide current realworld case studies and solutions that can be
adapted to current investigations. The course
will also discuss: identity theft, Internetbased fraud, child exploitation, hacking and
compromised systems, and phishing.
Computer Crime/Social Networking Sites
Social Networks are being utilized in the

commission of many crimes including, drug
trafficking, prostitution, child pornography
and frauds of all types. This class will provide
information on the methods of investigating
crimes utilizing this Social Media, and
utilizing the networks to assist in the
investigation of various crimes.
California Narcotic Officers Association 8790

28245 Avenue Crocker, Ste. 230
Santa Clarita, 913551201
(661) 775-6967
Cost: Non-reimbursable tuition: $35.00
Certified hours: 8
Computer Investigation of Websites
California Peace Officers' Association (CPOA)
- 9100
555 Capitol Mall, Suite 1495
Sacramento, CA 95814
(916) 263-0541
Certified hours: 8
This course is designed to educate the

student on various aspects of social
networking sites and how to utilize the
Internet as an investigative tool. The student
will develop their own undercover email
account and use that account to set up
several undercover social networking
accounts. This information will aid the
investigator to understand the mechanics of
these sites and how to navigate through
them while collecting evidence. At the
completion of the course, the investigator
will have the necessary knowledge and tools
to write an effective search warrant based on
their investigation. This course will also aid

PG. 9

Owen Berger
the student in monitoring social networking

sites for intelligence gathering.
San Diego County District Attorney - 3880
330 W. Broadway, Suite 960
San Diego, CA 92101
(619) 531-3054
Plan IV reimbursement suspended from
January 1, 2014 through June 30, 2015
Certified hours: 8
San Diego Regional Training Center - 9070
6155 Cornerstone Ct. #130
San Diego, CA 92121
(858) 550-0040
Plan: III. Travel and per diem, tuition
reimbursement
Cost: reimbursable tuition: $0.00
Certified hours: 8
Ethical Use of Technology Officers
D-Prep, LLC. - 7290
7485 Rush River Drive, Ste. 710
Sacramento, 95831
(916) 761-9130
Cost: non-reimbursable tuition: $106.00
Certified hours: 8
Students will learn the essentials of how

accounts are created, how accounts are
accessed and how to navigate around the
Myspace website; what information is
available on a website, as well as from the
website provider, how to search for it, and if
necessary, the particulars to writing a search
warrant for the relevant information;
awareness and prevention information
regarding children on the Internet and on
social networking sites, that can be
disseminated to the general public.
The course will teach students about the
most popular websites used by the generally
public for a variety of reasons; including by
not limited to; My Space, Craigslist, YouTube
and others. The purpose is to give LE officers
the tools needed to understand and
investigate crimes where any Internet usage
may have occurred and to find leads
associated with such.
The course objective is to train law
enforcement officers in the ethical and
proper use of technology. This course
explores current forms of technology being
utilized by law enforcement personnel
(Facebook, Twitter, Myspace, Nixle,
YouTube, etc.) how to have the officers
determine when an employee use of
technology is ethical or unethical, the proper
use of technology and the legal

PG. 10

Owen Berger
considerations and Department policies they

must confront and comply with.
Ethical Use of Technology for Law
Enforcement- T-T
D-Prep, LLC. - 7290
7485 Rush River Drive, Ste. 710
Sacramento, 95831
(916) 761-9130
Certified hours: 24
Ethical Use of Technology for Law

Enforcement- T-T
West Sacramento Police Department - 6260
550 Jefferson Blvd.
West Sacramento, 95605
(916) 617-4946
Certified hours: 24
Online Investigations: Tools, Tips, and

Techniques

enforcement personnel in the ethical and
YouTube, etc.), how to determine when an
employee use of technology is ethical or
unethical, development of employee training
programs to educate employees on the
proper use of technology, and the legal
considerations for employees use of
technology coupled with developing a
department policy. Participants will receive
significant information that will allow them
to return to their agency and conduct
training on this topic within their
department.
enforcement personnel in the ethical and
YouTube, etc.), how to determine when
employee use of technology is ethical or
unethical, development of employee training
programs to educate employees on the
proper use of technology, legal
considerations for employees use of
technology coupled with developing a
department policy.
The constant evolution of technology and its
use by criminals is a challenge investigators

PG. 11

Owen Berger
Search Group, Inc. - 9860

7311 Greenhaven Dr., Suite 270
Sacramento, ca 95831
(916) 392-2550
Cost: Non-Reimbursable Tuition: $0.00
Certified Hours: 16
face on a daily basis. Investigators have an

urgent need to learn how to search for,
locate, save, and replicate online information
relating to all areas of crime. Online
Investigations: Tools, Tips, and Techniques is
a two-day course designed for all
investigators, whether their work is in hightech crime, gangs, homicide, vice, property
crimes, narcotics, or other details. All
investigators regardless of their technical
backgroundwill gain the skills and
knowledge they need to enhance their online
investigations. In this course, we introduce
investigators to the SEARCH Investigative
Toolbar, advanced Google searching, and
"Portable Apps. In this course, we will also
teach investigators how to use various Social
Networking websites to locate information,
find linkages between people, and use the
sites for law enforcement purposes.
END, Background

PG. 12

Owen Berger
Methodology
The research for this training needs assessment consisted of a survey, subject matter
expert (SME) and subject matter resource (SMR) interviews, and a review of current literature
on the subject. The literature review included professional law enforcement organization
websites, peer-reviewed articles, current case law pertaining to law enforcement and Social
Media, law enforcement-published documents and reports, and books on real-time intelligence
and law enforcement.
Currently there is no course offered to California law enforcement on gathering
intelligence with Social Media and the Internet, therefore no courses were sampled for this
assessment. There are several courses through California POST that offer training on how to
navigate some Social Media sites for criminal investigations. However, the scope of those
courses is limited to the uses of Social Media intelligence-gathering in criminal investigations,
e.g. preservation requests and search warrants, and were therefore not audited or sampled.
Quick Reference Methodology.
Survey
14
Subject Matter Experts and Subject Matter Resource
36
Literature Review
42

PG. 13

Owen Berger
Survey. The survey was delivered in the form of a website link (or URL) sent via
electronic mail (e-mail) to a random sampling of 527 recipients from various law enforcement
agencies, the majority of which are located in the state of California. The recipients had
differing backgrounds with respect to experience, expertise, rank and agency affiliation
(federal, state, and local). The survey-taking mechanism was a digital survey built with
SurveyMonkey.com, an online survey-building service. The survey consisted of 18 questions,
and was broken into separate groups of questions by specific topic header. Each section
consisted of a specific topic header, and some sections contained explicit instructions and/or
qualifying information necessary for completion of the survey in general or for that specific
section.
Survey section headers, text, and individual questions. The contents of the survey
are listed below, with text for each section header and instructions. Each individual survey
question is represented by an image of how each individual question actually appeared to the
survey respondents.
Introduction. My name is Owen Berger and I am a Police Officer with the Los Angeles
Police Department. I am currently a student in the Commission on Peace Officer Standards and
Training (POST) Master Instructor Certification Course, Class-8 (MICC-8). MICC is the highest
level of POST's Instructor Development Institute (IDI), and has the overall goal of producing
instructors that have mastered the art of course design and delivery for the California law
enforcement community.
My participation in MICC includes designing a 24-hour course that will address real-time
intelligence through Social Media and the Internet. The valuable time you use to complete this
short survey will be used to design this course for maximum effectiveness and content
relevancy. No personal information is gathered with this survey, and all responses will be
anonymous when used in the Training Needs Assessment.
If you are interested in being a Subject Matter Expert on this subject, or would like the
opportunity to provide additional input on the creation of this course, simply complete the
Subject Matter Expert portion of the survey, or contact me at the below e-mail address.
Thank you very much for your participation,
Owen Berger
37319@lapd.lacity.org
PG. 14

Owen Berger
Survey Question No. 1.

PG. 15

Owen Berger
Survey Section No. 1, header and explanation. Utilizing Information from Social Media
and the Internet.
IMPORTANT Here are some important definitions/meanings to keep in mind during this
survey:
1) For the purposes of this survey, intelligence and information are interchangeable. We
understand that these two words have different meanings across the broad spectrum of law
enforcement agencies and organizations. However, for this survey, intelligence is defined as any
useable information that can aid an agency/organization in the decision-making process.
2) For the purposes of this survey, law enforcement-only databases that are accessible online
do NOT count as information gained from Social Media or the Internet.
3) Examples of "planned" vs "spontaneous" events for reference in this survey:
Planned events - Awards shows, sporting events, permitted protests, etc...
Spontaneous events - Homicides, mass shootings, unplanned protests, etc...
This page is intended to find out exactly how you and your organization utilize information
gained from Social Media and the Internet.

PG. 16

Owen Berger

PG. 17

Owen Berger

PG. 18

Owen Berger

PG. 19

Owen Berger
Survey Section No. 2, header and explanation. Personnel Training and Information.
This page is intended to gather information on you and your training with regards to gathering
information/intelligence from Social Media and the Internet.

PG. 20

Owen Berger

PG. 21

Owen Berger
Survey Question No. 6, continued.

PG. 22

Owen Berger

PG. 23

Owen Berger

PG. 24

Owen Berger

PG. 25

Owen Berger

PG. 26

Owen Berger

PG. 27

Owen Berger

PG. 28

Owen Berger

PG. 29

Owen Berger

PG. 30

Owen Berger
Survey Section No. 3, header and explanation. Planned and Spontaneous Event
Information.
This page is intended to gauge information on how your organization deals with planned or
spontaneous events.
Examples of "planned" vs "spontaneous":
Planned events - Awards shows, sporting events, permitted protests, etc...
Spontaneous events - Homicides, mass shootings, unplanned protests, etc...

PG. 31

Owen Berger
Survey Section No. 4, header and explanation. Decision-making, Intelligence Planning

and Architecture.
This page is intended to gauge how information from Social Media or the Internet affects your
organization's decision making processes, information planning and architecture.

PG. 32

Owen Berger
Survey Section No. 5, header and explanation. Social Media and Internet Specifics.
Specific agency/organization information on the utilization of Social Media and the Internet.

PG. 33

Owen Berger

PG. 34

Owen Berger
Survey Section No. 6, header and explanation. Last page, thank you!
This is the final page of the survey, and your response is not required, thank you so much for
your cooperation and help.
Survey, Conclusion. Thank you very much for participating.

Thank you again for your help, and if you know of someone who would like to fill out this
survey or who could be helpful in the design process, please forward them the e-mail
containing the link to this survey.
Please contact me with any suggestions, questions, or concerns,
Owen Berger
37319@lapd.lacity.org

PG. 35

Owen Berger
Subject Matter Experts/Resources. Subject matter experts and resources were

interviewed to gain additional information on the current scope of how intelligence from Social
Media and the Internet is used by todays law enforcement community. The questions
addressed were, specifically, how that community utilizes the intelligence in decision-making
processes, and what forms or methods are used to gather and disseminate intelligence. The
experts and resources were chosen for several reasons: their current assignments (which are
related to the subject matter), their intense interest in the subject matter, and their experience
in the subject matters application to the real-world.
The subject matter experts were interviewed either in-person or telephonically, and the
subject matter resource gave their insights through electronic mail (e-mail). All subject matter
experts and resources were asked the following questions, either directly or in a conversational
manner:
1) Currently, how does your organization use real-time intelligence from Social Media and
the Internet?
2) What do you see as your organizations biggest challenges to using real-time
intelligence?
3) What specific kinds of training do you want to see for your organization when it comes to
real-time intelligence?
4) What is your organizations current structure for gathering and disseminating
information from Social Media and the Internet?
5) What changes would you like to see, if any, to your organizations current structure for
gathering and disseminating intelligence?
6) What would you like to see implemented in training for your organizations personnel for
gathering real-time intelligence?

PG. 36

Owen Berger
SME No. 1 Detective Samuel Palmer, Phoenix Police Department.

Selection Information. Detective Palmer was chosen for his experience in a crime
analysis position at the Phoenix Police Department and the fact that he is a presenter on and
instructor in the subject matter. Detective Palmer was a survey recipient and requested to be
contacted as a possible subject matter expert. Detective Palmers expertise was assessed both
through online research and a telephonic interview.
Experience and Expertise. Detective Samuel Palmer has worked in law enforcement for
twenty years. He is currently a detective with the Phoenix Police Department, and is currently
assigned to the Crime Analysis and Research Units Robbery Investigation Section. Detective
Palmers expertise is not limited to robberies, as he has assisted with investigations for
homicides, threats at schools, gang-related crime, and terrorism investigations in conjunction
with the Arizona Counter-Terrorism Information Center.
For the past seven years, Detective Palmer has utilized the Internet and social
networking to investigate violent crime. He has given presentations and taught courses on
using Social Media in investigations as well. Some of the subjects he teaches are intelligencegathering for violent crime, and modern-day issues such as sexting, and cyber-bullying.
Detective Palmer was recently honored as a ConnectedCOPS Social Media Investigator Award
recipient during the Social Media, the Internet and Law Enforcement (SMILE) conference in
Omaha, Nebraska.

PG. 37

Owen Berger
SME No. 2 Sergeant Tom Leveque, Arcadia Police Department.

Selection Information. Sergeant Leveque was selected as a subject matter expert
because of his training, current responsibilities and accomplishments with the Arcadia Police
Department. Sergeant Leveques expertise was assessed through online research, peer
recommendations, and a telephonic interview. Sergeant Leveque was chosen for his
supervisory position in charge of Social Media at the Arcadia Police Department, and the fact
that he is a nationally-recognized presenter and instructor on/in the subject matter.
Experience and Expertise. Sergeant Tom Leveque has worked in law enforcement for
almost thirty years. He is currently a supervisor of detectives at the Arcadia Police
Departments Investigation Section. Sergeant Leveque pioneered the use of Social Media for
his department, and uses cutting-edge technology and tools to monitor Arcadia PDs Social
Media presence, as well as the Social Media coming from his community.
Sergeant Leveque is experienced in utilizing information obtained from Social Media for
community interaction, investigations and event situational awareness. Throughout the
performance of his duties, Sergeant Leveque has impacted the quality of life for the citizens of
Arcadia though Social Media. Sergeant Leveque is responsible for identifying resources for a
young girl who was threatening suicide on the popular micro-blogging site Tumblr. In addition,
Sergeant Leveque monitors the Breeders Cup horse race in Arcadia, using Social Media to both
engage the large number of visitors during the event and to monitor for information that could
be adverse to Arcadia or to the event itself.

PG. 38

Owen Berger
SME No. 3 Officer Candice Foster, Los Angeles Police Department.

Selection Information. Officer Foster was chosen for her current position as a Cyber
Support Unit officer at the Los Angeles Police Department. Officer Fosters current assignment
is the full-time duty of monitoring Social Media and the Internet for intelligence that could
affect the Los Angeles Police Department with regards to decision-making, deployment and/or
officer safety.
Experience and Expertise. Officer Candice Foster has 23 years of law enforcement
experience. She has been with the Los Angeles Police Department for 20 years and was with the
Upland Police Department for 3 years prior to that. Officer Foster has worked a variety of
assignments; undercover buying narcotics, patrol, accident investigation, vice, gang
enforcement - CRASH, as a training officer, a City Attorney investigator - legal researcher and as
a detective trainee. With such a wide variety of assignments, it has given Officer Foster the
experience and opportunity to work her current assignment at Operation Central Bureau, Cyber
Support Unit. Officer Foster not only assists the Central Bureau divisions with their Social Media
pages, she assists with training the departments employees with new trends in Social Media,
criminal investigations and monitoring unusual activities that occur in the city during protests
and other major incidents.

PG. 39

Owen Berger
SME No. 4 Lauri Stevens, Principal, LAwS Communications.

Selection Information. Mrs. Stevens was chosen for her position as the head of LAwS
Communications, a private company that teaches law enforcement how to use open-source
tools to use information from Social Media. In addition, Mrs. Stevens was chosen due to the
fact that she is a presenter on, and instructor in, the subject matter.
Experience and Expertise. Lauri Stevens is an interactive media professional with over
25 years of media experience and is the founder and principal consultant with LAwS
Communications. She founded LAwS Communications in 2005 to assist the law enforcement
profession with the implementation of interactive media technologies. LAwSComm is the
Producer of the SMILE (Social Media the Internet and Law Enforcement) Conference, the
COPPS Social Media Method and the ConnectedCOPS blog and awards program. LAwSComm
also created the "Global Police Tweet-a-thon", the first of which had over 200 agencies in over
20 countries that participated.

PG. 40

Owen Berger
SMR No. 1 Los Angeles County Sheriffs Headquarters Bureau, Electronic

Communications Triage Unit (eComm): Captain Michael Parker, Sergeant Chris Meadows,
Sergeant Robert Boese, and Deputy Anthony Moore.
Selection Information. Captain Parker, Sergeant Meadows, Sergeant Boese, and Deputy
Anthony Moore were chosen collectively as a subject matter resource due to the fact that they
founded the eComm unit and developed the majority of Social Media policies and procedures
for the Los Angeles Sheriffs Department. All three are also instructors for POST Social Media
courses, including a two-day course for Public Information Officers. The three experts were
combined into one subject matter resource because of the fact that all three experts are from
the same agency. This concentration of expertise could cause institutional bias in this research
if they were interviewed individually as subject matter experts.
Experience and Expertise. The subject matter resource members have been presenters
and instructors in the subject matter for years, including presenting at the Law Enforcement
and Private Security Conference, where Social Media was the conference theme. In addition,
the members have taught Social Media courses for Public Information Officers and other law
enforcement. All members of the SMR were part of the foundation of the Los Angeles County
Sheriffs Headquarters Bureau, Electronic Communications Triage Unit (eComm). The eComm
unit is a ground-breaking law enforcement idea-turned-reality. The eComm unit consists of
both sworn and civilian personnel, and is responsible for gathering and disseminating
information for the entire Los Angeles Sheriffs Department.

PG. 41

Owen Berger
Literature Review. The resources used in the literature review were identified using
Internet searches and interviews with subject matter experts. The literature review included a
review of the following:
Profession-dedicated websites
Peer-reviewed articles (journal, Internet, and trade publication)
Law-enforcement published documents and reports
Books anent the subject matter.
The review is expected to enrich the research by giving a current overall view of
available information on the subject matter. The review is also expected to give data and
subject matter expert opinions not available through the survey or interview portions of this
training needs assessment. The specific literature reviewed and reasoning for the literatures
inclusion in the research are outlined below.
Case Law.
Literature. Cromer v. Lexington/Fayette Urban County Government, 2008-CA000698MR5.
Reason for inclusion. In the Cromer v. Lexington/Fayette Urban County Government
decision, a law enforcement officer was terminated by the governing city council after the
officer posted inappropriate material on Social Media after self-identification as a law
enforcement officer. The original trial court ruling was upheld, and the termination was found
to be valid. This case was included in this literature review because it deals with the specific
actions of a law enforcement official on Social Media, and the repercussions of posting material
to Social Media and the Internet by the plaintiff.
Literature. Garcetti et al. v. Ceballos, 547 U.S. 410 (2006)6.
Reason for inclusion. In the Garcetti et al. v. Ceballos decision, a deputy district attorney
sued his employer based on 1st and 14th Amendment issues. The deputy district attorney,
Ceballos, claimed that he had been retaliated against for writing a memo critical of a search
warrant that was being used in an ongoing case. In this case, the retaliation was re-assignment
of duties and transfer to a different courthouse. The Supreme Court of the United States later
ruled on appeal that Ceballos right to free speech was not infringed upon as his comments
were made during the course and scope of his employment. This decision was included in the
5
6
(Cromer v. Lexington/Fayette Urban County Government, 2009)

(Garcetti et al. v. Ceballos, 2006)

PG. 42

Owen Berger
research because it furthers and clarifies the Pickering v. Board of Education decision in a law
enforcement context, meaning that it can be applied to law enforcements utilization of free
speech during the course and scope of employment.
Literature. Konop vs Hawaiian Airlines, Inc., 236 F.3d 1035 (2001)7.
Reason for inclusion. In Konop vs Hawaiian Airlines, Inc., the plaintiff (Konop) created a
website critical of his employer that was accessible only by other pilots and only by entering a
username and password and accepting the sites terms of service. A Hawaiian Airlines
management official accessed the website using a pilots login credentials (with permission)
and later disclosed website content. The 9th Circuit United States Appellate Court held, under
the Wiretap Act, that the airlines official was not authorized to view or intercept the electronic
communications. The court also held, under the Stored Communications Act, that the login
credentials used by the airlines official were not valid for third-party permission as they had
never been used by the original recipients. This case was included in the research because it
deals specifically with employer and employee relationships with regards to online accounts
and the credentials needed to access those accounts.
Literature. People of the State of New York v. Malcolm Harris, Docket No.
2011NY080152 (2012)8.
Reason for inclusion. People v. Malcolm Harris was a case that originated during the
Occupy Wall Street movement in New York during 2011 and 2012. The City of New Yorks
District Attorney subpoenaed the Twitter (a Social Media site) records for Harris, a protester
during the Occupy Wall Street movement. The District Attorney was seeking a charge of
disorderly conduct against Harris, the defendant. Harris attempted to quash the search
warrant on 1st and 4th Amendment grounds. However, the courts ruled with the District
Attorney and the defendants Twitter records were eventually provided to the District Attorney.
Due to the fact that this case deals specifically with the use of real-time intelligence, despite
being after the fact, this case and the legal ramifications will be included in this research.
Literature. United States v. Meregildo, 11 Cr. 576 (WHP) (2012)9
Reason for inclusion. In the case of United States vs Meregildo, a defendant named
Melvin Colon attempted to suppress evidence against him that was obtained via the Social
Media site Facebook. The government gained access through a Facebook friend of Colons,
7
(Konop vs Hawaiian Airlines, Inc., 2001)

(People of the State of New York v. Malcolm Harris, 2012)
9
(United States of America v. Joshua Meregildo et al., 2012)
8

PG. 43

Owen Berger
who allowed the government to view the Facebook posts made by Colon. The court ruled
against Colon, stating that although Colon has an expectation of privacy with regards to private
posts, that privacy does not extend to the Facebook friends who are free to do as they please
with the shared information. The legal effects of this case are important to this research as
they clearly delineate certain privacy expectations for private citizens and the accessibility of
private communications by law enforcement or government entities.
Articles.
Literature. Developing Policy on Using Social Media for Intelligence and
Investigations10.
Reason for inclusion. This article, as the title states, discusses policy development for
law enforcement and its use of Social Media for intelligence. The article gives examples of
current policies, how they were formed, and then discusses several key issues regarding policy
development, including: policy purpose, levels of use, reliability and validity of information and
intelligence, documentation, and off-duty conduct. The article was chosen as part of the
literature view because it provides important considerations when developing policies relating
to the subject matter of this training needs assessment.
Literature. How Police Use Social Media To Monitor, Respond to, and Prevent Mass
Gatherings11.
Reason for inclusion. Found during an online search, this article is a focused look at law
enforcements use of Social Media to monitor special events. The articles uses photographs
and real-life examples to discuss tactical and policy considerations for law enforcement with
regards to the use of Social Media and the Internet for monitoring protest or protest-like events
and those people associated with the events. This article was included in this research because
the articles subject is aligned closely with that of the research subject matter, real-time
intelligence with Social Media and the Internet. In addition the article is very specific in nature
and uses real-life events and examples to illustrate the authors main points.
Literature. Social Media Evidence in Government Investigations and Criminal
Proceedings: A Frontier of New Legal Issues12.
Reason for inclusion. This article delves into the nuances of law enforcements use of
Social Media and the subsequent impact on criminal case law and proceedings. Among the
10
(Keenan, Diedrich, & Martin, 2013)

(Lipp, 2013)
12
(Murphy & Fonticella, 2013)
11

PG. 44

Owen Berger
topics discussed are: digital evidence admissibility, the Stored Communications Act, criminal
defense and defendants rights, and the effect or impact on juries. This article was chosen
because it is an in-depth, research-intensive, and peer-reviewed article written by non-law
enforcement authors, giving a non-biased counter-balance to the other literature in this review
that was written by professional law enforcement personnel.
Literature. Police probe website targeting crime witnesses13.
Reason for inclusion. This news article covers the publication of witness information on
an anonymous Social Media account for the mobile application Instagram. The issue, as
described by Philadelphia police and prosecutors is the leaking of protected or private
information about police investigations in an attempt to intimidate witnesses in ongoing
criminal investigations. This article was included as it summarizes a real-life example of how
Social Media is being used by the criminal element, and how being aware of real-time
intelligence from Social Media can help law enforcement.
Reports and Documents.
Literature. (U//LES) Arizona Fusion Center Warning: Police Officers Targeted on
Facebook14.
Reason for inclusion. This law enforcement warning report outlines how personal
information about law enforcement personnel was found in a vehicle during a random traffic
stop. All of the information was from the Social Media site Facebook, and event revealed
undercover officer identities. This particular report was chosen for the research because it
highlights officer safety issues, particularly those that come from law enforcements use of the
same Social Media as is used by criminals.
Literature. Social Media and Tactical Considerations for Law Enforcement15.
Reason for inclusion. As a jointly published report, this literatures aim was to be a
comprehensive look at how criminals organize or facilitate criminal events, and how the law
enforcement community can, or does, use Social Media to manage large gatherings of people,
investigate crimes, or handle other events. This report is directly related to gathering
intelligence with Social Media and the Internet, and offers a good overview of how law
13
(Whelan & Newall, 2013)

(Arizona Counter-Terrorism Information Center, 2010)
15
(Police Executive Research Forum (PERF) and the United States Department of Justice, Office of Community
Oriented Police Services, 2013)
14

PG. 45

Owen Berger
enforcement organizations in the United States are using this intelligence during the decisionmaking process.
Literature. Developing a Policy on the Use of Social Media in Intelligence and
Investigative Actions, Guidance and Recommendations.16
Reason for inclusion. This report, as the title states, provides an in-depth look policy
development for law enforcement and its use of Social Media for intelligence and
investigations. The article gives full examples of current policies, and then examines the
necessary elements to any new policy on the subject matter. The report was chosen as part of
the literature view because it gives critical and elemental look at what to consider when
developing policies relating to the subject matter of this training needs assessment.
Books.
Literature. Social Media as Surveillance: Rethinking Visibility in a Converging World17,
Chapter Six Policing Social Media.
Reason for inclusion. This book is an extensive look at interpersonal communications via
Social Media and how people and organizations use these communications. It is a study on
Social Media and the intelligence gained with it from many of todays important perspectives.
The book starts with focus on the individual, then builds to institutional uses of Social Media as
surveillance, then delves into issues such as marketing and police uses. The last chapter,
entitled Policing Social Media, is what drew the attention of the researcher. This book chapter
was chosen for the research as an in-depth look at the subject matter, written with an outsideof-law enforcement viewpoint by a Postdoctoral Fellow of Social and Digital Media at
Westminster Universitys Communication and Media Research Institute.
END, Methodology
16
17
(Bureau of Justice Assistance, Office of Justice Programs, United States Department of Justice, 2013)
(Trottier, 2012)

PG. 46

Owen Berger

The analysis for this research will be included with the results section so that the reader
can digest the analysis without having to reference a separate results section. There will be an
analysis section for each individual topic, subject matter expert or resource, and piece of
literature. The overall or summary analysis will be included in the Conclusion of this Training
Needs Assessment.
Quick Reference Results and Analysis.
Survey
48
Subject Matter Experts and Subject Matter Resource
143
Literature Review
153

PG. 47

Owen Berger
Survey.
Note The results and analysis for Question No. 1 will be broken into five sections, (a) through
(f), one for each piece of requested information.
Question No. 1 (a). What state are you located in? (Or country, if outside of the United
States)
Results. Out of 142 respondents, 23 were from outside of California.
Chart Key State or Country (Number of respondents from state or country)
Alaska (2)
Arizona (2)
California (119)
Colorado (5)
Maryland (1)
Massachusetts (1)
Nevada (3)
Table 1
North Carolina (1)

Oklahoma (1)
Texas (3)
Vermont (1)
Victoria, Australia (1)
West Virginia (1)
Wiesbaden, Germany (1)
Analysis. The strong California-centered response is logical considering the fact that
most of the survey recipients were located in California. The proposed course is for California
law enforcement, so the larger percentage of California-based respondents will assist in
targeting the specific needs of those respondents and their respective agencies. The data
collected from the respondents from outside of California will assist in providing perspective to
the research by showing the concerns about the subject, and issues surrounding the subject, for
law enforcement around the world.

PG. 48

Owen Berger
Question No. 1 (b). Organization/Agency Name (No acronyms, please).

Results. Responding Agencies, Inside California
Chart Key Organization Name (Number of respondents from stated organization)
Arcadia Police Department (1)
Burbank Police Department (1)
California Department of Corrections (2)
California Highway Patrol (1)
California State Threat Assessment Center
(1)
California State University, Chico (1)
Carlsbad Police Department (1)
Chino Police Department (2)
Chula Vista Police Department (1)
City of Berkeley Police Department (4)
Compton School Police Department (1)
Concord Police Department (1)
Corona Police Department (1)
El Cajon Police Department (2)
Elk Grove Police Department (1)
Garden Grove Police Department (1)
Glendale Police Department (1)
Hemet Police Department (1)
Humboldt Sheriff's Office (1)
Imperial County Sheriff's Office (1)
Inglewood Police Department (2)
Irvine Police Department (1)
Laguna Beach Police Department (1)
Long Beach Police Department (2)
Los Angeles County District Attorney's Office
(1)
Los Angeles County Sheriff's Department (5)
Los Angeles Police Department (26)
Los Angeles Police Department - Retired (1)
Los Angeles School Police Department (1)
Los Angeles World Airports Police (1)
Modesto Police Department (1)
Orange County District Attorney's Office (1)

Orange County Sheriff's Department (1)
Oxnard Police Department (1)
Placerville Police Department (1)
Redondo Beach Police Department (1)
Riverside County District Attorney's Office (2)
Riverside County Sheriff's Department (2)
Riverside Police Department (2)
Sacramento Police Department (5)
Sacramento Sheriff's Department (1)
San Bernardino County Fire/Hazmat (1)
San Diego County Probation Department (1)
San Diego County Sheriff's Department (2)
San Jose Police Department (1)
San Mateo County Sheriff's Office (1)
San Mateo Police Department (1)
Santa Ana Police Department (1)
Santa Barbara County Probation (1)
Santa Clara County District Attorneys Office
(1)
Santa Monica Police Department (1)
Santa Rosa Police Department (1)
Simi Valley Police Department (1)
Sonoma County Sheriff's Office (2)
South Gate Police Department (1)
South Lake Tahoe Police Department (1)
Torrance Police Department (1)
Tustin Police Department (2)
University of California, Berkeley Police Dept.
(1)
University of Texas System Police (1)
Ventura County Sheriff's Department (3)
Walnut Creek Police Department (1)

PG. 49

Owen Berger
Morgan Hill Police Department (1)

Mountain View Police Department (2)
National City Police Department (1)
Oceanside Police Department (1)
Table 2
West Sacramento Police Department (1)

Westminster Police Department (1)
Westwood College (1)
Results. Responding Agencies, Outside of California

Chart Key Organization Name (Number of respondents from stated organization)
Anchorage Police Department (1)
Arizona Department of Public Safety (1)
Aurora Police Department (2)
Austin Regional Intelligence Center (1)
Bureau of Alcohol, Tobacco, and Firearms (1)
Department of Public Safety, Texas Rangers
(1)
Douglas County Sheriff's Office (1)
Federal Bureau of Investigation (1)
Federal Bureau of Prisons (1)
LAwS Communications (Private Sector) (1)
Newark Police Department (1)
Table 3
Oklahoma City Police Department (1)

Phoenix Police Department (1)
Rich Square Police Department (1)
State of Colorado, 18th Judicial District
Probation Department. (1)
U.S. Army, Europe Law Enforcement Branch
(1)
U.S. Department of Homeland Security (1)
U.S. Department of Justice (1)
U.S. Internal Revenue Service (1)
University of Texas System Police, Office of
the Director (1)
Victoria Police Department (Australia) (1)
Washoe County Sheriff's Office (1)
Bias issues. Despite the large number of respondent agencies, 26 respondents, or 18%
of the total, were from the Los Angeles Police Department. The next highest percentage of
respondents from any agency was 3.5%, from both the Los Angeles Sheriffs Department and
the Sacramento Police Department. The high proportion of respondents from the Los Angeles
Police Department could therefore introduce some organizational bias into the research.
Analysis. The fact that respondents from over 90 different agencies completed the
survey indicates diversity in the data collected. Despite the aforementioned bias issue, the fact
that 82% of the respondents were from a variety of local, state, and federal agencies only
highlights the importance of the data collected in the survey. The widely varied response gives
the research a breadth of law enforcement perspectives, meaning that the research will not be
tainted by any kind of agency specific bias be it municipal, state, or federal.

PG. 50

Owen Berger
Question No. 1 (c). Approximate No. of Personnel (Sworn & Civilian).

Note Question No. 1 (c) was in the context of the respondents own agencies.
Results. There was a large range in the approximate number of personnel at each
agency as estimated by the respondents for their own organization. The lowest end of the
range was three civilian employees, with the highest end of the range at 125,000 total
personnel. The highest number of personnel estimated was from a respondent who worked at
the United Stated Department of Justice. The average number from the respondents was
3803.79, with a median of 540 personnel.
Bias issues. Some of the estimates of personnel were incorrect, even among
respondents from the same agency. For example, among the respondents from the Los
Angeles Police Department there were several different estimates of department size, leading
the researcher to believe that more detailed research will be needed if personnel numbers are
going to be used heavily in course design.
Analysis. There is a large range of sizes of organizations, including agencies as small as
seven sworn personnel, and as large as a respondent-estimated 125,000 personnel. This large
range of employee numbers means that there should not be organization size-based bias in the
data. However, data from the Bureau of Justice Statistics shows us that, in the United States,
About half of local police departments employed fewer than 10 sworn personnel, and about
three-fourths served a population of less than 10,000.18 Subsequently, it seems that the larger
departments whose employees were respondents in this survey gave an atypical result for
median department size.
18
(United States Department of Justice, Bureau of Justice Statistics, 2008)

PG. 51

Owen Berger
Question No. 1 (d). Position/Title/Rank.

Results.
Key Position, Title, or Rank (Number of respondents in stated position, title, or rank)
Analyst (1)
Captain (4)
Chief of Police (2)
Commander (1)
Coordinator (1)
Correctional Officer (1)
Crime Analyst (3)
Deputy Probation Officer (2)
Deputy Sheriff (5)
Detective (33)
Detective Sergeant (1)
Forensic Anthropologist (1)
HazMat Specialist (1)
Intelligence Analyst (3)
Investigator (3)
Leading Senior Constable (1)
Lieutenant (7)
Manager (1)
Officer (7)
Police Officer (20)
Table 4
Police Technician (1)

Principal (1)
Probation Officer (1)
Professor of Criminal Justice (1)
Program Manager (1)
Public Information Officer (1)
Security Specialist (1)
Senior Deputy (1)
Senior Forensic Chemist (1)
Senior Inspector (1)
Senior Investigator (3)
Senior Police Officer (1)
Sergeant (19)
Sergeant - Retired (3)
Social Media Dispatcher (1)
Special Agent (4)
Task Force Officer / Deputy (1)
Utility Systems Operator (1)
Police Technician (1)
Note The results for position, title, and rank were categorized into 39 different positions, and,
for the sake of simplicity and readability, the name of the unit or specific task was trimmed
from the actual position or rank name.
Analysis. There is wide variety in ranks and assignments of respondents, which means
that the data will be representative of an overall view from law enforcement and those that
work with law enforcement. Because of this variety of ranks and positions, any course design
content based on this research will be applicable to a large audience, not a specific subset of
law enforcement.

PG. 52

Owen Berger
An even more distilled breakdown of this positional data is as follows:
Civilian Positions: 19 total

Sworn Line Personnel (Sergeant and below): 64 total
Detectives and Investigators: 45 total
Command Personnel (Lieutenant and above): 14 total
Respondent Positions
10%
13%
Civilian
Detectives/Investigators
32%
45%
Line Personnel (Sergeant and

below)
Command Personnel
(Lieutentant and above)
Figure 1
These different perspectives give breadth to the responses with regards to the possible
applications of this research on any forthcoming course design. Also, none of the positions
appear to be out of line proportionally as compared with positional ratios that would occur in a
real-world law enforcement organizational structure. Therefore, the data gained from this
survey provides a view of the current real-time intelligence-gathering landscape without
apparent rank or positional bias.

PG. 53

Owen Berger
Question No. 1 (e). How many years have you been working in (or with) Law
Enforcement?
Results.
Respondent Years of Experience

35
32
32
30
Number of Respondents
30
25
23
22
20
15
10
5
0
1 to 5
6 to 10
11 to 15
16 to 20
21 to 25
25+
Years of Experience
Figure 2
Bias issues. There appears to be a bias issue in respondent experience only three (2%)
of the respondents have between one to five years of experience. This lack of insight from
youthful or inexperienced personnel means that more research and/or testing will be
necessary to ensure that the course design takes into account the younger, less-experienced
personnel. Unfortunately, exact respondent age was not requested in this survey, so average
age was extrapolated rather than gathered.
Analysis. Despite the bias issue mentioned above, there is wide variety in the range of
experience years, which means that the data will be helpful in contemplating generational
course design. In order to further generational course design considerations, the respondents
experience years were converted into generational age ranges. The age ranges were
assembled using both the generational definitions of William Strauss and Neil Howe, and the

PG. 54

Owen Berger
Pew Research Center.19 To extrapolate possible age ranges for the respondents, a starting age
average was assumed starting at age 21 and spanning one decade to the age of 30, as charted
below.
Generation Name
Birth year, lower
bound(s)
Birth year, upper
bound(s)
Combined age range
Starting age of 21
Starting age of 22
Starting age of 23
Starting age of 24
Starting age of 25
Starting age of 26
Starting age of 27
Starting age of 28
Starting age of 29
Starting age of 30
Table 5
Greatest
1901
Silent
Boomers
Total
1925/1928 1943/1946 1961/1965 1980/1982
1924/1928 1942/1945 1960/1964 1980/1981

86 to 113
0
0
0
0
0
0
0
0
0
0
Millennials
69 to 89
0
0
0
0
0
0
0
0
0
0
50 - 71
13
16
21
22
28
31
37
40
45
53
33 - 53
101
104
113
113
119
119
118
120
114
111
2004
20 - 34
49
43
37
33
23
17
10
7
3
0
163
163
171
168
170
167
165
167
162
164
As you can see in Table Four above, the majority of respondents lie within Generation X,
regardless of assumed starting age average. The only thing that changes is the number of
respondents within the Boomers generation and the Millennial generation, respectively.
Obviously, as the assumed average starting age increases, the number of Boomers increases,
while the number of Millennial decreases, both in a linear fashion. A graphical representation
of this linear swing can be seen in the chart below (Figure Two).
19
(CNN (Cable News Network), 2011)

PG. 55

Owen Berger
Respondent Generational Breakdown

80%
70%
60%
50%
40%
30%
20%
10%
0%
21
22
23
24
25
26
27
28
29
30
Assumed Starting Age, on Average

Greatest
Silent
Boomers
Millenials
Figure 3
After reviewing Figure Two above, Respondent Generational Breakdown, it follows that
any course design based on this research must take into account the learning traits of
Generation X more than any other generation. Also, Millennial and Boomer traits must be
taken into account to a lesser degree, though in the same proportion to each other.

PG. 56

Owen Berger
Note The results and analysis for Question No. 2 will be broken into nine sections, (a) through
(i), for the sake of individual topic analysis.
Question No. 2 (a). Considering the following topics, how important or how impactful
to you is the information or intelligence found on Social Media and the Internet?
Topic. Aiding in deployment decisions [139 respondents, 3 skipped]
Results. The results are displayed by categorical percentage of total responses and by
number of responses in each category.
Aiding in deployment decisions
Aiding in deployment decisions

80
69
70
9%
5%
Very important
60
50
50
36%
Good to know
Not very
important
50%
Don't use it at all
40
30
20
13
7
10
0
Very
important
Figure 4
Good to
know
Not very Don't use it

important
at all
Figure 5
Analysis. Eighty-six percent of respondents thought that real-time intelligence was good
to know or very important when it comes to making deployment decisions. In addition to
supporting the need for a course on gathering real-time intelligence, this means that any course
generated from this research will need to emphasize how real-time intelligence can be used
when making decisions anent personnel deployment.

PG. 57

Owen Berger
Question No. 2 (b). Considering the following topics, how important or how impactful
to you is the information/intelligence found on Social Media and the Internet?
Topic. Assisting in criminal investigations [139 respondents, 3 skipped]
Assisting in criminal investigations
Assisting in criminal investigations

114
120
100
17%
1%
0%
Very important
80
Good to know
82%
60
Not very
important
40
Don't use it at all
20
24
0
Very
important
Figure 6
Good to
know

important
at all
Figure 7
Analysis. The data shows that 99% of respondents thought real-time intelligence is
good to know or very important when dealing with criminal investigations. Because of this
overwhelming emphasis on criminal investigations, any training generated from this research
should have a component that deals with criminal investigations, or at least emphasizes the
subject matters usefulness in criminal investigations.

PG. 58

Owen Berger
Question No. 2 (c). Considering the following topics, how important or how impactful to
you is the information/intelligence found on Social Media and the Internet?
Topic. Aiding in personnel decisions [138 respondents, 4 skipped]
Aiding in personnel decisions
Aiding in personnel decisions

90
81
80
8%
18%
15%
Very important
70
60
Good to know
50
40
Not very
important
Don't use it at all
59%
25
30
21
20
11
10
0
Very
important
Figure 8
Good to
know

important
at all
Figure 9
Analysis. Almost one quarter of the respondents do not believe that real-time
intelligence is important, for aiding in personnel decisions, or they dont use it at all.
Bias Issues. Review of the data elicited by this question found that the question was
somewhat misleading, and that respondents did not distinguish a difference between the topics
of aiding in deployment decisions and aiding in personnel decisions. It is quite possible that
the responses to this question are a combination of people who are answering it as mainly
deployment-oriented, a repeat of Question No. 2 (a), or are considering it as the research
intended to make decisions about hiring, promoting, or transferring personnel.
Due to this confusion it is possible that the data sets for this question and Question No.
2(a) are corrupted. However, without statistical evidence to verify the possible corruption, and
its extent, these questions will not be disregarded in the research. And, though they may not
be disregarded, they should also not be used as a statistical base on which to build findings for
either this research or any forthcoming course design in the subject matter.
PG. 59

Owen Berger
Question No. 2 (d). Considering the following topics, how important or how impactful
Topic. Preparing for and responding to planned events [138 respondents, 4 skipped]
Preparing for and responding to
planned events
3%
1%
Very important
Good to know
28%
68%
Not very
important
Don't use it at all

planned events
94
100
90
80
70
60
50
40
30
20
10
0
38
Very
important
Figure 10
Good to
know

important
at all
Figure 11
Analysis. The data shows that 96% of respondents believe preparing for and responding
to planned events requires real-time intelligence on a level of good to know or very important,
with 68% rating the topic as very important. Not only does this stress the need for a course on
real-time intelligence outside of strictly criminal investigations, but it would appear to steer the
course towards event-centered instructional design and content.
Cross-analysis. Furthermore, there are two facts to consider here:
1) Besides the hard percentages listed above, only 3% less of the respondents found
preparing for and responding to planned events good to know or very important relative
to Question No. 2(b), criminal investigations.
2) Of the courses available through Californias POST, there are several for using Social
Media and the Internet in criminal investigations, but none for monitoring events,
whether planned or spontaneous.

PG. 60

Owen Berger
These two facts lead directly to the conclusion that there is a distinct training gap with
regards to monitoring events with real-time intelligence.

PG. 61

Owen Berger
Question No. 2 (e). Considering the following topics, how important or how impactful
Topic. Preparing for and responding to spontaneous events [139 respondents, 3
skipped]
spontaneous events

spontaneous events
90
81
80
7% 3%
Very important
70
60
Good to know
32%
45
50
40
58%
Not very
important
30
Don't use it at all
10
20
0
Very
important
Figure 12
Good to
know

important
at all
Figure 13
Analysis. Ninety percent of respondents believe that preparing for and responding to
spontaneous events requires real-time intelligence on a level of good to know or very
important, with 58% rating the topic as very important. Not only does this stress the need for a
course on real-time intelligence outside of strictly criminal investigations, but it would appear
to steer the course towards event-centered instructional design and content.
The slight drop in percentage in the good to know or very important categories to
this question/topic from Question No. 2 (d), planned events, could indicate that law
enforcement doesnt believe real-time intelligence can aid in dynamic and unplanned events, or
both, or, law enforcement believes that staffing is better used elsewhere during dynamic
events. Regardless, in order to increase the use of real-time intelligence during spontaneous
events, it appears that there needs to be or should be subject matter course content that show
students how to increase speed in researching and reporting real-time intelligence.

PG. 62

Owen Berger
Question No. 2 (f). Considering the following topics, how important or how impactful to
Topic. Monitoring national news [139 respondents, 3 skipped]
Monitoring national news
Monitoring national news

70
60
7%
Very important
50
Good to know
40
59
56
10%
43%
30
Not very
important
40%
Don't use it at all
20
14
10
10
0
Very
important
Figure 14
Good to
know

important
at all
Figure 15
Analysis. Eighty-three percent of respondents noted that monitoring national news was
either good to know or very important. This could indicate that because of the rapid pace at
which information spreads in todays society, modern law enforcement must monitor news on
a national level to be aware of events that could potentially affect their localities. These
findings are supported anecdotally by recent events in the national news. Two examples of
these events were the Occupy Wall Street movement in New York and the George Zimmerman
trial in Florida. Despite occurring in one part of the country, these two events caused protest
and civil disturbances in other parts of the country.

PG. 63

Owen Berger
Question No. 2 (g). Considering the following topics, how important or how impactful
Topic. Monitoring international news [138 respondents, 4 skipped]
Monitoring international news
Monitoring international news

60
50
53
50
Very important
9%
40
17%
36%
38%
Good to know
30
Not very
important
20
Don't use it at all
10
23
12
Very
important
Figure 16
Good to
know

important
at all
Figure 17
Analysis. While 74% of respondents noted that monitoring international news was
either good to know or very important, this represents a 10% drop from the previous topic,
monitoring national news. The drop could merely be indicative of the fact that law
enforcement believes national news is more likely to affect the citizenry than international
news. Another possibility is that many of the smaller organizations do not have the same
concerns as the larger organizations that would be affected by international news, such as
federal buildings or consulates that could draw protests and other similar events.

PG. 64

Owen Berger
Question No. 2 (h). Considering the following topics, how important or how impactful
Topic. Monitoring community reactions and/or feedback [139 respondents, 3 skipped]
Monitoring community reactions
and/or feedback
Monitoring community reactions

and/or feedback
90
3%
80
2%
Very important
78
70
54
60
Good to know
50
40
39%
56%
Not very
important
30
Don't use it at all
10
20
4
Very
important
Figure 18
Good to
know

important
at all
Figure 19
Analysis. The data shows that 95% of respondents rated monitoring community
reactions and feedback as good to know or very important. This means that real-time
intelligence via Social Media and the Internet is one of law enforcements best modern tools for
being aware of, acknowledging, and paying attention to the community. Any course design
based on this research should have a strong component of monitoring the communitys
reactions and feedback with real-time intelligence.

PG. 65

Owen Berger
Question No. 2 (i). Considering the following topics, how important or how impactful to
Note The responses for Question No. 2(i) were respondent-entered comments at the end of
Question No. 2, and were meant to gain information that was not requested or was not
available for input via the question itself.
Topic. Other (please specify) [6 respondents]
Results.
1. The answers I provide are base [sic] on my section of investigations and may not be the
standard practice for the department.
2. Identifying potential subjects, witnesses, and victims - Very Important
3. This is a very vague series. Good to know vs Not Very Important is a wide berth.
4. To the extent the info/intel is attributable to an identifiable source it's more valuable
5. Often times at a crimes scene, we discover the parties involved ONLY knew about the
event, (spontaneous and planned) via Social Media
6. Most of the nodes of information have a Social Media blog attached. These blogs
provide invaluable information with regard to public sentiment.
Analysis. Each individual response was pointed, and all specified different respondent
opinions. Regarding these individual responses, it appears that there could be a need for
several different kinds of content in the course, including: identifying people online, vetting
information, blog overview, and tying information to its source.
Bias Issues. Response No. 3 above did not add information, rather it was merely a
statement on the respondents belief that there should have been another option. This could
mean that there is a bias issue in the question where some responded to Question No. 2s
topics as very important for lack of another option. This could mean that the research is
skewed in this section, and the data here may need to be discounted when it is taken into
consideration for course design. However, in context, this was only one comment amongst all
of the responses to Question No. 2, where there were eight different topics with an average of
139 responses.

PG. 66

Owen Berger
Note The results and analysis for Question No. 3 will be broken into nine sections, (a) through
(i), for the sake of individual topic analysis.
Question No. 3 (a). What are some reasons you might NOT use, or be resistant to using,
the information/intelligence found on Social Media and the Internet? Please agree or disagree
with the following:
Topic. There's too much information [135 respondents, 7 skipped]
There's too much information
There's too much information

80
69
70
19%
60
30%
Agree
Disagree
Not a factor
50
41
40
30
25
20
51%
10
0
Agree
Figure 20
Disagree
Not a factor
Figure 21
Analysis. The fact that 30% of respondents think that there is too much information to
be gained from Social Media and the Internet underscores the need for a class on gathering and
disseminating this information. This fact also indicates that perhaps real-time intelligence is not
being used, at least in part, due to sheer volume, and steps should be taken to ensure that any
forthcoming instructional design shows students how to parse the large volume of available
information for only that which can be helpful in decision-making processes.
Also, the fact 51% of respondents disagreed that there is too much information does not
necessarily mean that they are, in reality, utilizing all of the information they receive or are
using that information effectively. Furthermore, when cross-analyzed with other topics in this
same question, such as Question No. 3(b), not enough personnel, and Question No. 3(e), not
PG. 67

Owen Berger
enough training, the survey data actually indicates that respondents believe they could use all
of the information gained from Social Media and the Internet were it not for logistics-based
restrictions like personnel and training.

PG. 68

Owen Berger
Question No. 3 (b). What are some reasons you might NOT use, or be resistant to using,
with the following:
Topic. We don't have enough personnel [139 respondents, 3 skipped]
We don't have enough personnel
We don't have enough personnel

85
90
80
10%
70
60
29%
61%
Agree
50
Disagree
40
Not a factor
30
40
20
14
10
0
Agree
Figure 22
Disagree
Not a factor
Figure 23
Analysis. With 61% of respondents agreeing that they dont have enough personnel to
use real-time intelligence from Social Media and the Internet, it would appear that any course
generated using this research should include information or content on how to minimize the
number of personnel needed to properly monitor and disperse real-time intelligence. In
addition, perhaps there needs to be instruction on how to gather and disseminate real-time
intelligence on an ad hoc basis, rather than as a full-time job.

PG. 69

Owen Berger
Question No. 3 (c). What are some reasons you might NOT use, or be resistant to using,
with the following:
Topic. Limited resources (Internet availability, computers, etc...) [139 respondents, 3
skipped]
Limited resources (Internet
availability, computers, etc...)
Limited resources (Internet

availability, computers, etc...)
60
57
54
50
20%
40
39%
Agree
Disagree
Not a factor
41%
28
30
20
10
0
Agree
Figure 24
Disagree
Not a factor
Figure 25
Analysis. There was a somewhat even response to whether or not the respondents
were hampered by limited resources. Approximately the same number agreed that they had
limited resources as those that disagreed. This could mean several things, including the fact
that the tools need for gathering real-time intelligence are fairly common, such as access to the
Internet and computers.
However, those resources that are commonplace might be being used for, or even
dedicated to, other law enforcement-related tasks such as report processing, filing, and
database queries. For those that responded and agreed with having limited resources, it might
be beneficial to include course content that shows personnel how to maximize the resources
that they have, such as computing power, and the use of free web tools which can be used on
any computing device connected to the Internet.

PG. 70

Owen Berger
Question No. 3 (d). What are some reasons you might NOT use, or be resistant to using,
with the following:
Topic. Steep learning curve [137 respondents, 5 skipped]
Steep learning curve
Steep learning curve

85
90
80
16%
70
22%
60
Agree
50
Disagree
40
Not a factor
30
30
22
20
62%
10
0
Agree
Figure 26
Disagree
Not a factor
Figure 27
Analysis. Sixty-two percent of respondents disagreed that monitoring for real-time

intelligence has a steep learning curve, which indicates that the majority of respondents feel
that either they or their co-workers are capable of learning how to mine intelligence from Social
Media and the Internet. This response data could indicate that there does not need to be a lot
of very basic computer-related material prior to in-depth instruction on the specific topic of
gathering and disseminating real-time intelligence. Additionally, individual classes could be
tailored to course attendees by polling their expertise and experience beforehand.

PG. 71

Owen Berger
Question No. 3 (e). What are some reasons you might NOT use, or be resistant to using,
with the following:
Topic. Not enough training [139 respondents, 3 skipped]
Not enough training
Not enough training

90
83
80
8%
70
60
32%
60%
Agree
50
Disagree
40
Not a factor
30
44
20
12
10
0
Agree
Figure 28
Disagree
Not a factor
Figure 29
Analysis. The majority of respondents (60%) agreed with the fact that there is not
enough training on the subject matter, leading to the simple conclusion that a course on the
subject is indeed necessary. This topic, and that of Question No. 3(b), not enough personnel,
are the main two restrictions respondents agreed with as to why they do not, or are resistant
to, using real-time intelligence. Combined, this data would indicate that having trained
personnel is the primary reason for limited-to-zero use of real-time intelligence from Social
Media or the Internet. This leads to several conclusions:
1) There is a definitive need for this type of training,
2) This type of training needs to reach as many personnel as possible, and
3) The previous need to reach as many personnel as possible makes the case for a
secondary training need a train-the-trainer course section whereby course
students could bring their knowledge back to their own organizations in an effective
and lasting manner.
PG. 72

Owen Berger
Question No. 3 (f). What are some reasons you might NOT use, or be resistant to using,
with the following:
Topic. It's too unreliable [139 respondents, 3 skipped]
It's too unreliable
It's too unreliable

100
93
90
12%
80
21%
70
Agree
Disagree
Not a factor
60
50
40
30
29
17
20
67%
10
0
Agree
Figure 30
Disagree
Not a factor
Figure 31
Analysis. A majority (67%) of respondents disagreed with the fact that information from
Social Media and the Internet are unreliable. This could be demonstrative of several things,
including:
1) The possibility that law enforcement personnel are used to dealing with intelligenceparsing, and just because information from Social Media is relatively new, this does not
mean that it should be treated differently than more conventional sources of
intelligence,
2) The possibility that law enforcement personnel are willing to accept any source of
information in the hopes that even a small amount of the information is useable, and
can help to negate criminal activity or save resources, and

PG. 73

Owen Berger
3) The possibility that law enforcement are in fact finding that information from Social
Media and the Internet can be more reliable than conventional means because the
information is often from the source, e.g. an event proposed on a personal Facebook
page.
Regardless of which possibilities above are true, further research would be necessary to
determine exactly why law enforcement is in majority agreement on the reliability of this
intelligence source. Despite not knowing the exact reasons as to why the majority of law
enforcement thinks of information from Social Media and the Internet as credible, this fact
speaks to a direct training need. Indeed, law enforcement is in agreement that this is a reliable
source of information, so dedicated courses that teach how to gather and disseminate this
information are warranted.

PG. 74

Owen Berger
Question No. 3 (g). What are some reasons you might NOT use, or be resistant to using,
with the following:
Topic. Liability issues [139 respondents, 3 skipped]
Liability issues
Liability issues
90
79
80
22%
70
21%
60
Agree
50
Disagree
40
Not a factor
30
30
30
20
57%
10
0
Agree
Figure 32
Disagree
Not a factor
Figure 33
Analysis. A relatively small number, 21% of respondents, found that there were liability
issues with using intelligence from Social Media and the Internet. Initially this might indicate
that course content should not include a lot of information on the liability consequences of
using real-time intelligence. However, one should also consider the fact this type of intelligence
is relatively new, and there is not a lot of case law or other precedents for what happens when
this type of information is used either incorrectly or unethically. Therefore, further
consideration should be taken before deciding on the amount of liability-related course content
in any course design using this research.

PG. 75

Owen Berger
Question No. 3 (h). What are some reasons you might NOT use, or be resistant to using,
with the following:
Topic. Legality issues (privacy laws, 1st Amendment issues, etc...) [138 respondents, 4
skipped]
Legality issues (privacy laws, 1st
Amendment issues, etc...)
Legality issues (privacy laws, 1st

Amendment issues, etc...)
80
74
70
20%
60
26%
Agree
Disagree
Not a factor
50
36
40
28
30
20
10
54%
0
Agree
Figure 34
Disagree
Not a factor
Figure 35
Analysis. Compared to other topics in this question, a relatively small number (26%) of
respondents found that there were legality issues with using intelligence from Social Media and
the Internet a similar result to the previous question topic on liability issues (see Question No.
3 (g)). Initially this might indicate that course content should not include a lot of information on
the legal repercussions of using real-time intelligence. However, one should also consider the
fact this type of intelligence is relatively new, and there is not a lot of case law or other
precedents for what happens when this type of information is used either incorrectly or
unethically. Therefore, further consideration should be taken before deciding on the amount of
legal- or law-related course content in any course design using this research.

PG. 76

Owen Berger
Question No. 3 (i). What are some reasons you might NOT use, or be resistant to using,
with the following:
Note The responses for Question No. 3(i) were respondent-entered comments at the end of
Question No. 3, and were meant to gain information that was not requested or was not
available for input via the question itself.
Topic. Other (please specify) [4 respondents]
Results.
2. Linking factors (connecting a person to a "handle/moniker" and confirming their
identity)
3. lack of written policy
4. Gives employees an excuse to waste time rather than trying to genuinely get work
done.
Analysis. The written responses to this question added some valuable insight,
specifically the need for, or training to create, written intelligence-gathering policies, as well as
ways to connect individual data points, such as online identities with confirmed identities.
Bias Issues. The fourth response to this question seems to be directed more at a
personnel issue rather than an issue relating specifically with the subject matter.

PG. 77

Owen Berger
Question No. 4. Does your organization allow you to have unrestricted Internet access,
such as access to Facebook, Twitter, YouTube, or even posting sites such as Craigslist or
Backpage.com where inappropriate vice-related photos can be seen? [138 respondents, 4
skipped]
Unrestricted Internet Access
Unrestricted Internet Access
Yes
11%
9%
22%
Yes, with
department
approval
26%
32%
Specialized units
only
No
15
Only on an ad hoc basis or

for special assignments
12
Specialized units only
36
Yes, with department

approval
44
Yes
Only on an ad
hoc basis or for
special
Figure 36
31
0
10
20
30
40
50
Figure 37
Analysis. Almost 90% of the total respondents reported that they could have
unrestricted Internet access, divided amongst 22% with unqualified access, and 67% with
conditional access. This means that most departments require some conditions to be met for
their online intelligence-gathering personnel to have access. As for the necessity of training in
the subject matter, these results could mean that with said training, more departments would
freely allow trained personnel to have unrestricted Internet access. A possible effect of these
results on course content or design would be to ensure that every student be required to bring
an Internet-enabled device to class, with no departmental restrictions that would preclude
access to course content.
Cross-analysis. One possible conclusion drawn from these results, when combined with
Question No. 3, is that there is not enough training on gathering intelligence from the Internet.
Therefore, organizations are reluctant to allow their personnel to have unrestricted Internet

PG. 78

Owen Berger
access. In addition, care should be taken during a course on the subject matter to show
students how to establish and set guidelines for organizational Internet use.

PG. 79

Owen Berger
Question No. 5. How much training in using Social Media and the Internet to find
information have you received? For the purposes of this question, please consider all kinds of
information, such as for criminal investigations, special events, etc For the purposes of this
survey, Law Enforcement-only databases that are accessible online do NOT count as
information gained from Social Media or the Internet. [128 respondents, 14 skipped]
Results.
Real-time Intelligence Training
Real-time Intelligence Training

45
41
41
40
35
22%
32%
30
None
1 to 4 Hours
4 to 8 Hours
Over 8 Hours
14%
32%
28
25
18
20
15
10
5
0
None
Figure 38
1 to 4 hours 4 to 8 Hours
Over 8
hours
Figure 39
Analysis. Over two-thirds (68%) of respondents have had less than eight hours of
training on cyber-monitoring, which demonstrates the need for a dedicated course in the
subject matter. This data reinforces the results for Question No. 3(e), where the majority of
respondents (60%) agreed with the fact that there is not enough training in the subject matter.
Cross-analysis. Seventy-eight percent of the respondents have had at least some
training (over one hour) in using Social Media and the Internet to find information, with 32% of
the total stating that they have had over eight hours of such training. When combined with the
results for Questions No. 3 and No. 6, one could extrapolate that the type information found in
the respondents training was not for real-time intelligence, and was mostly based on finding
information for criminal investigations.
Bias issues. Despite the above analysis statements, 32% of the respondents stated that
they had received over eight hours of training, which could mean a couple of things. First, the
respondents are referring to training they received in criminal investigations, about which there
PG. 80

Owen Berger
are several courses taught in California. Second, the respondents could be referring to informal
training that they received from co-workers. Regardless of the reasons, further research will be
needed to separate out how many of the respondents, or how many California law
enforcement personnel in general, have received specific real-time intelligence training, both
related and unrelated to criminal investigations.

PG. 81

Owen Berger
Question No. 6. For the training you have received, please rate each subject on the
quality of training you received by selecting the answer that best matches you and your
experience. For this question, please consider only the training that specifically deals with
gathering intelligence via Social Media and the Internet. In-depth description of headings:
1) Never trained You have never received formal training on the subject.
2) Training had little effect Either the training was uninformative, did not offer working
solutions to the challenges you face when gathering intelligence, or did not have real-world
practical applications.
3) Training had little effect due to prior knowledge Prior to the training you were fairly
knowledgeable on the subject, so even though the training might have been informative or
offered working solutions, a lot of the information was redundant for you or covered solutions
you were already implementing.
4) Training was effective without prior knowledge This means that the training was
effective and you had little to no previous knowledge on the subject.
5) Training was effective even with prior knowledge Despite prior knowledge and/or
skills, the training offered strong, working, and/or enhanced solutions to the challenges you
face gathering intelligence.
Topics:
1. Tracking major planned events (Awards shows, sporting events, permitted protests,
etc...) [126 respondents, 16 skipped]
2. Tracking major spontaneous events (Homicides, mass shootings, unplanned protests,
etc...) [126 respondents, 16 skipped]
3. Tracking groups such as Occupy or Anonymous [126 respondents, 16 skipped]
4. Tracking local parties [125 respondents, 17 skipped]
5. Monitoring community reactions and/or feedback [127 respondents, 15 skipped]
6. Creating event work-ups and/or notifications [127 respondents, 15 skipped]
7. Monitoring for criminal investigations [126 respondents, 16 skipped]
8. Investigating vice [125 respondents, 17 skipped]
9. Finding or tracking criminals [126 respondents, 16 skipped]
10. Please describe any other related training you've had and its effectiveness below [10
respondents]

PG. 82

Owen Berger
Results. The results for Question No. 6 were not broken down for individual analysis
due to the uniformity of results among question topics.
Rated Training for Specific Operations
Finding or tracking criminals
Investigating vice
Monitoring for criminal investigations
Creating event work-ups and/or notifications

Monitoring community reactions and/or
feedback
Tracking local parties
Tracking groups such as Occupy or Anonymous
Tracking major spontaneous events

(Homicides, mass shootings, unplanned
protests, etc...)
Tracking major planned events (Awards shows,
sporting events, permitted protests, etc...)
0
10
20
30
40
50
60
70
80
1-Never trained
2-Training had little or no effect
3-Training had little or no effect due to prior
knowledge/skills
4-Training was effective without prior knowledge/skills
5-Training was effective even with prior knowledge/skills
Figure 40
PG. 83

Owen Berger
Analysis. In all but two of the question topics (Finding or tracking criminals and
Monitoring for criminal investigations) the majority of respondents stated that they had never
been trained. Even in the topics Finding or tracking criminals and Monitoring for criminal
investigations, more respondents indicated that they had never been trained than indicated
any other category/level of rated training. The results of this question indicate that there is a
significant training gap with regards to gathering real-time intelligence through Social Media
and the Internet.
Cross-analysis. When the data from this question is analyzed in conjunction with data
from other questions, particularly Question No. 2, a clear need for training is established.
Consider that even among topics where respondents overwhelmingly agreed to their
importance, more personnel had never been trained than had received training, effective or
not. For example take Question No. 2(b), where 99% of respondents thought that real-time
intelligence was good to know or very important in criminal investigations. Yet, 36% had never
received training in the subject matter. The same can be said, with even greater disparity, for
planned and spontaneous events. Please see the charts below for a representation of
respondents rated importance vs training received, by topic.

PG. 84

Owen Berger
Rated importance vs Never been trained, by topic

48%
Monitoring Community Reactions and

Feedback
95%
36%
Monitoring and/or Assisting in Criminal

Investigations
99%
46%
Preparing for/Responding to/Tracking

Spontaneous Events
91%
60%
Preparing for/Responding to/Tracking

Planned Events
96%
0%
20%
40%
60%
80%
100%
Percentage of respondents who have NEVER been trained in this topic,

from Question #6
Percentage of respondents who believe this topic is good to know or very important,
from Question #2
Figure 41
The majority of personnel had never been trained in all of the other topics regarding the
use of real-time intelligence, with one exception, finding and tracking criminals. This statistic is
somewhat surprising and could be considered, amongst all of the reasons given in this analysis
section, the clearest and strongest indicator for a dedicated training course on real-time
intelligence with Social Media and the Internet.
Furthermore, when the data from this question is analyzed in conjunction with
Questions No. 5, No. 3, and No. 2, a clear picture emerges wherein respondents are stating the
need for training in multiple ways:
1) Using information from Question No. 2(d), 96% of respondents believe that preparing
for and responding to planned events requires real-time intelligence on a level of good
to know or very important, with 68% rating the topic as very important. This percentage
was only slightly less (3%) relative to Question No. 2(b), criminal investigations.
Subsequently, due to the fact that there are several courses available through California
POST for using Social Media and the Internet in criminal investigations, but none for
PG. 85

Owen Berger
monitoring events, there is a distinct training gap with regards to monitoring events
with real-time intelligence.
2) In Question No. 3(e), the majority of respondents (60%) agreed with the fact that there
is not enough training on the subject matter, leading to the simple and direct conclusion
that a course on the subject is indeed necessary.
3) In another direct point for training in the subject matter, over two-thirds (68%) of
respondents for Question No. 5 stated that they have had less than eight hours of
training on real-time intelligence a fact which stands in direct contrast to the large
majorities of respondents who stated that they find the information from Social Media
and the Internet to be important in a variety of topics (see Question No. 2).
4) Lastly, this questions data, and its graphical representation (see the figure above this
analysis), clearly demonstrate that even among topics where respondents agreed to
their importance, more personnel had never been trained than had received training,
effective or not. For example, in criminal investigations, 99% of respondents thought
that real-time intelligence was good to know or very important, yet, 36% had never
received training in the subject matter. The majority of personnel had never been
trained in all of the other topics regarding the use of real-time intelligence, with one
exception, finding and tracking criminals.

PG. 86

Owen Berger
Note The results and analysis for Question No. 7 will be broken into six sections, (a) through
(f), for the sake of individual topic analysis.
Question No. 7 (a). Please specify the number of personnel you know, including
yourself, that fit the following criteria:
Topic. Utilize cyber-monitoring (monitoring Social Media and the Internet) as a
functional part of their duties, whether formal or informal. [127 respondents, 15 skipped]
Utilize cyber-monitoring
(monitoring Social Media and the
Internet) as a functional part of
their duties, whether formal or
informal.
21%
None
7%
10%
Ad hoc basis
only
1-3
28%
34%
4-10
Figure 42
(monitoring Social Media and the
Internet) as a functional part of
their duties, whether formal or
informal.
50
43
36
40
26
30
20
10
13
0
None
Ad hoc
basis only
1-3
4-10
10+
Figure 43
Analysis. The data shows that 93% of the respondents stated they, or others that they
know, utilized cyber-monitoring as part of their duties. A large majority of respondents (83%)
stated that at least one person in their organization utilized cyber-monitoring as a functional
part of their duties. Both of these percentages are significant in that they demonstrate use of
cyber-monitoring in some degree across agencies, not just among individuals at a particular
agency or organization.

PG. 87

Owen Berger
Question No. 7 (b). Please specify the number of personnel you know, including
Topic. Have received formal training on gathering intelligence from Social Media
and the Internet. [127 respondents, 15 skipped]
Have received formal training on
gathering intelligence from Social
Media and the Internet.
Have received formal training on

60
16%
10%
50
9%
Ad hoc basis
only
1-3
40
4-10
40%
10+
32
30
20
20
25%
Figure 44
51
None
12
12
None
Ad hoc
basis only
10
0
1-3
4-10
10+
Figure 45
Analysis. Fifty-nine percent of the respondents stated that they know of three or fewer
people who have received formal real-time intelligence training, with 16% stated that ten or
more people have received such training. The 59% of three or fewer trainees reinforces the
findings of the interviews with the subject matter experts, which stated that only a few
personnel at each organization are tasked with, or allowed to, gather real-time intelligence with
Social Media and the Internet. It then follows, logically, that only those tasked personnel are
the ones to receive such training.

PG. 88

Owen Berger
Question No. 7 (c). Please specify the number of personnel you know, including
Topic. Brought the skills with them to the job to gather intelligence from Social Media
and the Internet. [125 respondents, 17 skipped]
Brought the skills with them to the
job to gather intelligence from
Social Media and the Internet.
Brought the skills with them to the

job to gather intelligence from
Social Media and the Internet.
60
55
None
15%
50
15%
3%
Ad hoc basis
only
1-3
23%
44%
10+
29
30
20
4-10
Figure 46
40
19
10
19
3
0
None
Ad hoc
basis only
1-3
4-10
10+
Figure 47
Analysis. The same number of respondents, nineteen, stated that they either knew of
no one or more than ten personnel who brought computer skills with them to the job. This
could speak to the balance of more- and less- experienced personnel in each organization.
However, the majority of respondents, 67%, stated that one to ten personnel came to the job
with the necessary skills. It would seem that with one to ten personnel per organization, there
are relatively few employees entering law enforcement with the necessary skills, which would
tend to suggest the need for more training in the subject matter.

PG. 89

Owen Berger
Question No. 7 (d). Please specify the number of personnel you know, including
Topic. Were self-taught, i.e. taught themselves the skills for the job in gathering
intelligence from Social Media and the Internet. [126 respondents, 16 skipped]
Were self-taught, i.e. taught
themselves the skills for the job in
2%
None
3%
60
48
50
24%
Ad hoc basis
only
38%
1-3
4-10
41
40
30
30
20
10
None
Ad hoc
basis only
33%
10+
Figure 48
Were self-taught, i.e. taught

themselves the skills for the job in
1-3
4-10
10+
Figure 49
Analysis. The large majority of respondents, 95% knew of at least one employee who
has self-taught the skills necessary to gather intelligence from Social Media and the Internet.
The imbalance would suggest that the respondents and their co-workers have been put in a
situation where they needed to utilize real-time intelligence, but had not received, or had
access to, the necessary training to utilize real-time intelligence. It would seem that this
particular piece of data demonstrates a real need for intelligence-gathering training, in order to
replace or supplement self-training in the subject matter.

PG. 90

Owen Berger
Question No. 7 (e). Please specify the number of personnel you know, including
Topic. Are dedicated solely to working special events planning or response. [126
respondents, 16 skipped]
Are dedicated solely to working
special events planning or
response.

special events planning or
response.
70
10%
19%
None
3%
48%
Ad hoc basis
only
50
1-3
30
4-10
20%
Figure 50
10+
61
60
40
25
24
20
12
10
0
None
Ad hoc
basis only
1-3
4-10
10+
Figure 51
Analysis. Eighty-seven percent of respondents had three or fewer personnel that they
know dedicated to special events planning or response, with 48% of total respondents having
no dedicated personnel. This response indicates that any training created for the monitoring of
special events with the Internet will have to be designed around personnel who are not
dedicated events personnel, and are doing so only as a supplemental task.
Cross-analysis. This questions results parallel those of Question No. 3(b), where
respondents stated that one of the main reasons for not using real-time intelligence from Social
Media and the Internet was lack of personnel. Here, the large majority of respondents, 87%,
stated that their organization did not have more than three personnel dedicated full-time to
special or critical events. This means that specialization is not an option at most organizations,
and therefore law enforcement personnel are having to use the gathering of real-time
intelligence as a supplementary position skill.

PG. 91

Owen Berger
The ancillary nature of intelligence-gathering duties speaks to a greater need for training
personnel who are unfamiliar with, or unaccustomed to, gathering and disseminating this
information. The reason for this training need is that organizations are less likely to provide
training for supplemental or ad hoc duties as they are to provide training in the specific realm
of an employees primary duties, as seen in the results of Question No. 3 and Question No. 6.

PG. 92

Owen Berger
Question No. 7 (f). Please specify the number of personnel you know, including
Topic. Are dedicated solely to working critical incidents (For the purposes of this
question, a critical incident can be exemplified by incidents such as officer-involved-shootings,
mass shootings, riots). [127 respondents, 15 skipped]
critical incidents (For the purposes
of this question, a critical incident
can be exemplified by incidents
such as officer-involved-shootings,
mass shootings, riots).
9%
None
4%
16%
Figure 52
80
60
47%
Ad hoc basis
only
1-3
24%

critical incidents (For the purposes
of this question, a critical incident
can be exemplified by incidents
such as officer-involved-shootings,
mass shootings, riots).
59
31
40
20
20
12
0
4-10
None
Ad hoc
basis only
1-3
4-10
10+
Figure 53
Analysis. With about the same response as the topic of special events, respondents
reported that 87% of them know three or fewer personnel that are assigned to working critical
incidents full-time. Logically, the response was more for this topic than for special events (24%
vs. 20%) when it comes to working critical incidents on an ad hoc basis. This response indicates
that any training created for the monitoring of critical incidents with the Internet will have to be
designed around personnel who are not dedicated critical incident personnel, and are doing so
as a supplemental task only.

PG. 93

Owen Berger
Question No. 8. Please rate yourself from one to ten on how you feel about your ability
to find information using a computer and Social Media and/or the Internet.
One (1) on the scale Novice - I think I checked my e-mail last month, and I heard that Myspace
is the biggest thing out there.
Five (5) on the scale Functional User I use e-mail regularly, follow my kids on Facebook and
Instagram, and am familiar with search engines like Google, Yahoo, and Bing.
Ten (10) on the scale Expert Dude, after I built my Linux box last week I used BackTrack/Kali
to find a Wi-Fi moocher and his username, then found the moochers name and address based
on his Instagram profile with the same username, and sent a full work-up of his personal
information to the local police for follow-up.
[119 respondents, 23 skipped]
Results.
Internet Search Self-ratings
10
22
24
17
27
4
0
10
15
20
25
30
Figure 54
Analysis. Of the respondents, 85.8% rated themselves as a five or higher on the Internet
search capabilities self-ratings. This could impact course design heavily in that it shows most
students feel that they are ready to handle advanced Internet searches without a lot of basic
instruction beforehand.

PG. 94

Owen Berger
Cross-analysis. The results for Question No. 8 are contradictory to the opinions of the
subject matter experts, three of whom stated that any training on real-time intelligence should
include a basic skills component. This contradiction could mean a couple of things:
1) The subject matter experts are underestimating the students who would be willing
to take a course on gathering real-time intelligence with Social Media and the
Internet,
2) The survey respondents are overestimating their online search abilities, and would
benefit from a basic skills component in real-time intelligence training.
Regardless of whether one, or a combination of, the aforementioned possibilities is true, the
only feasible solution would by dynamic course content or content flexibility built-in to any
training course on the subject matter.

PG. 95

Owen Berger
Note The results and analysis for Question No. 9 will be broken into two sections, (a) and (b),
for the sake of individual written response analysis.
Question No. 9 (a). Assume that you are attending technology-based training on
gathering intelligence with Social Media and the Internet. Please not which of the following
issues are the most, or least, challenging for you when it comes to technology training:
Topics:
1. Fundamental computer skills (turning the computer on, using the mouse, etc) [127
2. Opening basic programs (e-mail, web browsers) [127 respondents, 15 skipped]
3. Installing the right programs and/or browsers on my computer [127 respondents, 15
skipped]
4. The specifics of how to use searches and queries on the Internet [127 respondents, 15
skipped]
5. Using word- or data-processing programs such as Microsoft Office or Google Docs [127
6. Keeping up with the instructor as they go through the lesson [127 respondents, 15
skipped]
7. Understanding the vernacular or terms used when they werent explained or before
they were explained [127 respondents, 15 skipped]
8. Understanding the vernacular and terms used, even after they were explained [127
9. Remembering exactly which websites and online tools were used during the lesson [127
10. Grasping the overall concept of the course after doing a lot of very specific lessons and
tasks [127 respondents, 15 skipped]
11. Applying the knowledge, skills, and attitudes that I learned during training to the real
world after returning to work [126 respondents, 16 skipped]

PG. 96

Owen Berger
Results. The results for Question No. 9 (a) were not broken down for individual analysis
due to the uniformity of results for each question topic.
Most and Least Challenging During Training
Applying the knowledge, skills, and attitudes that
I learned during training to the real world after
returning to work
Grasping the overall concept of the course after
doing a lot of very specific lessons and tasks
Remembering exactly which websites and online
tools were used during the lesson
Understanding the vernacular and terms used,
even after they were explained
Understanding the vernacular or terms used
when they werent explained or before they were
explained
Keeping up with the instructor as they go through
the lesson
Using word- or data-processing programs such as
Microsoft Office or Google Docs
The specifics of how to use searches and queries
on the internet
Installing the right programs and/or browsers on
my computer
Opening basic programs (e-mail, web browsers)
Fundamental computer skills (turning the
computer on, using the mouse, etc)
0
20
40
60
80
100
120
Very challenging
Somewhat challenging
Not challenging
N/A (I haven't come across this before)

PG. 97
140

Owen Berger
Figure 55
Analysis. Of the 11 technical topics listed for Question No. 9, there was only one topic
where more respondents regarded the topic as challenging vs. not challenging Understanding
the vernacular of terms used when they werent explained or before they were explained. The
impact of this data on any emergent training would be twofold, (1) basic computer and
technical skills should be assumed for most students, and (2) careful time and consideration
should be taken to ensure that students have access to definitions and meanings for technical
terms prior to and during the use of those technical terms during the course.
Other minor takeaways from the data involve the following two topics: Remembering
exactly which websites and online tools were used during the lesson, and Applying the
knowledge, skills, and attitudes that I learned during training to the real world after returning to
work. These topics had more somewhat challenging responses (42 and 46, respectively) than
the other topics. This means that minor consideration should be taken to ensure that students
are able to access the online tools and websites during and after class. In addition, students
should be given (or better, create) ways to apply what they learned to their respective
positions.
Cross-analysis. This question broke down technical skills into different topics, and the
majority of respondents noted every topic dealing with technical skills as Not challenging. This
result is congruent with the responses to Question No. 8, where over 85% of personnel rated
themselves five or higher on the Internet search self-ratings. Again, this result is contradictory
to the subject matter experts opinion that a basic skills course component is necessary for
training in gathering real-time intelligence.
The redundancy of the respondents lack of need for basic computer and Internet skills
leads one to believe that they have either had a lot of this type of training already, or our
current technology-based society has given them these skills already. In other words, through
the rise of the computer and Internet in todays society (along with tablets and smartphones),
students no longer need basic computer and Internet skills training, rather they need more
content on how to apply the subject matter utilizing these technological mediums.

PG. 98

Owen Berger
Question No. 9 (b). Assume that you are attending technology-based training on
gathering intelligence with Social Media and the Internet. Please not which of the following
issues are the most, or least, challenging for you when it comes to technology training:
Topic. Are there any other you challenges you want us to know about? [10
respondents]
Results.
2. Time and resources, such as computers that are not tied to a government IP.
3. Keeping up with the boring classes and the overt use of war stories.
4. I find it challenging to decipher the rhetoric from vendors, from what they can actually
deliver.
5. we [sic] are not given the tools to apply what we learned. I use my own phone/laptop we do not have a protocol
6. We finally were granted access to monitor Facebook last week.
7. I'm currently taking an online masters [sic] degree program in education. All online, no
classroom instruction.
8. Just keeping up with the numerous sources, which come and go. Also, I hate Facebook
and hate to even use it for investigations.
9. Apparently challenging for the designer of this survey to "not" use the correct spelling
of "note" in the above question.
10. I am the "go to" most of the time for my dept [sic], so it's easy for me
Analysis. The individual written responses for Question No. 9 can be distilled into
course design direction by taking into consideration the following points:
Some students do not have access to the resources they need, even during class,
There are or will be resistant students who hate Facebook,
Class should not be boring or over-use war stories.

PG. 99

Owen Berger
Note The results and analysis for Question No. 10 will be broken into seven sections, (a)
through (g), for the sake of individual topic analysis.
Question No. 10(a). Please rate the following uses for intelligence-gathering training,
according to how you would apply the training and skills you received once you returned to
your organization:
Topic. Applying the training and skills to my specific job [125 respondents, 17 skipped]
Applying the training and skills to
my specific job Applying the
training and skills to my specific job
I would use the
training for this
A LOT
3%
42%
55%
I would use the

training for this
I would NOT use
the training for
this
Figure 56
Applying the training and skills to

my specific job Applying the
training and skills to my specific job
80
70
60
50
40
30
20
10
0
69
52
4
I would use the I would use the I would NOT use
training for this training for this the training for
A LOT
this
Figure 57
Analysis. Of the respondents, 97% stated that they would apply the skills that they
learned to their specific job, with 55% of the total stating that they would use the training for
this a lot. There is an ongoing theme in the analysis where the students would like to
incorporate this training into their full-time duties, therefore extra care should be taken in any
course design to show real-life examples of real-time intelligence use in common law
enforcement duties. In addition, students could bring or create examples for themselves of
how they could use the training in their respective duties.
Cross-analysis. Ninety-seven percent of respondents stated that they would use the
skills they learned in this course in their specific job. This percentage corresponds to a
widespread positional use of real-time intelligence because of the wide variety of respondent
PG. 100

Owen Berger
position from Question No. 1(d). Now consider Question No. 7, where 93% of respondents
know of one or more people in their organization that utilize cyber-monitoring as a functional
part of their duties.
Combined, these respondent percentages demonstrate a widespread use of real-time
intelligence from Social Media and the Internet not only across multiple types of agencies and
organizations, but across multiple positions and job types. The fact that no current POST course
exists for this kind of training when its use is so widespread speaks to a definitive need for
training in the subject matter.

PG. 101

Owen Berger
Question No. 10(b). Please rate the following uses for intelligence-gathering training,
your organization:
Topic. Teaching my unit how to use the skills I learned [125 respondents, 17 skipped]
Teaching my unit how to use the
skills I learned
Teaching my unit how to use the

skills I learned
70
59
60
I would use the
training for this
A LOT
8%
47%
Figure 58
50
40
I would use the

training for this
30
I would NOT use

the training for
this
10
45%
56
20
10

A LOT
this
Figure 59
Analysis. The vast majority, 92%, of respondents stated that they would use this
training to teach others in their unit how to utilize real-time intelligence. This large percentage
clearly demonstrates the need for a train-the-trainer portion of the class, where students
could learn how to teach the skills they gained during the other parts of the course.

PG. 102

Owen Berger
Question No. 10(c). Please rate the following uses for intelligence-gathering training,
your organization:
Topic. Develop or assist in developing unit policies and guidelines using the skills that I
learned [124 respondents, 18 skipped]
Develop or assist in developing unit
policies and guidelines using the
skills that I learned
Develop or assist in developing unit

policies and guidelines using the
55
60
24%
32%
I would use the

training for this
A LOT
I would use the
training for this
50
39
40
30
30
20
10
44%
Figure 60
I would NOT use

the training for
this
0
A LOT
this
Figure 61
Analysis. Seventy-six percent of the respondents stated that they would use the
training to help develop unit polices and guidelines, which is a strong indicator that there
should be policy and guideline creation content in any course based on this research.

PG. 103

Owen Berger
Question No. 10(d). Please rate the following uses for intelligence-gathering training,
your organization:
Topic. Teaching anyone else who wanted to learn how to use the skills I learned [124
Teaching anyone else who wanted
to learn how to use the skills I
learned
Teaching anyone else who wanted

to learn how to use the skills I
learned
65
70
I would use the
training for this
A LOT
6%
42%
52%
Figure 62
I would use the

training for this
I would NOT use
the training for
this
60
52
50
40
30
20
7
10
0

A LOT
this
Figure 63
Analysis. The data shows that 94% of respondents would use this training to teach
anyone else who wanted to know how to utilize real-time intelligence. Both this large
percentage, and the results from Question No. 10(b) Teaching my unit how to use the skills I
learned, clearly indicate the need for a train-the-trainer portion of the class, where students
could learn how to teach the skills they gained during the other parts of the course.

PG. 104

Owen Berger
Question No. 10(e). Please rate the following uses for intelligence-gathering training,
your organization:
Topic. Develop or assist in developing training for my department in using the skills that
I learned [123 respondents, 19 skipped]
Develop or assist in developing
training for my department in
using the skills that I learned

training for my department in
using the skills that I learned
70
21%
29%
I would use the

training for this
A LOT
I would use the
training for this
50%
Figure 64
I would NOT use

the training for
this
62
60
50
35
40
26
30
20
10
0

A LOT
this
Figure 65
Analysis. Seventy-nine percent of the respondents stated that they would use the
training to help develop department training, which, combined with the responses for Question
No. 10(b) Teaching my unit how to use the skills I learned, and Question No. 10(d) Teaching
anyone else who wanted to learn how to use the skills I learned, is a clear indicator that there
should be train-the-trainer portion of the class, where students could learn how to teach the
skills they gained during the other parts of the course.

PG. 105

Owen Berger
Question No. 10(f). Please rate the following uses for intelligence-gathering training,
your organization:
Topic. Develop or assist in developing department or organization policies or guidelines
using the skills that I learned [124 respondents, 18 skipped]
department or organization
policies or guidelines using the

department or organization
policies or guidelines using the
60
29%
30%
I would use the

training for this
A LOT
I would use the
training for this
51
50
36
40
37
30
20
10
41%
Figure 66
I would NOT use

the training for
this
0
A LOT
this
Figure 67
Analysis. Seventy percent of the respondents stated that they would use the training to
help develop department polices and guidelines, which is a strong indicator that there should
be policy and guideline creation content in any course based on this research.

PG. 106

Owen Berger
Question No. 10(g). Please rate the following uses for intelligence-gathering training,
your organization:
Topic. Are there any other ways you would use the training (please specify) [5
respondents]
Results.
2. Way too much "red tape" in my department in order for this training to help develop
policy. The workers would get this type of training through peer teaching rather than
through the department
3. Monitoring the activities of sex offenders for potential violations.
4. Move this training out to other agencies in Colorado
5. I find [non-techies] resistant to learning anything about tech. I tried to show a select
few how to use a simple Cellebrite UFED, but they never returned to use it...
Analysis. The individual responses for Question No. 10 can be broken down into a
couple of points:
Training should include discussion of organizational red-tape and perhaps how to get
past the existing barriers to policy-creation.
Train-the-trainer content should include methods on overcoming resistant students.

PG. 107

Owen Berger
Note The results and analysis for Question No. 11 will be broken into nine sections, (a)
through (i), for the sake of individual topic analysis.
Question No. 11 (a). Assume you and/or your organization have been offered to attend
training on gathering real-time intelligence with Social Media and the Internet, how many
people in your organization from the following positions do you think would be interested in
learning how to gather this intelligence?
Topic. Patrol personnel [120 respondents, 22 skipped]
Patrol personnel
Patrol personnel
10+
14%
None
39%
20%
47
4-10
32
1-3
4-10
1-3
24
10+
None
17
27%
0
Figure 68
10
20
30
40
50
Figure 69
Analysis. According to 86% of the respondents, at least one member of an

organizations patrol section would attend the training on real-time intelligence, with under half
of that percentage (39% of the total) stating that more than ten members would attend the
training. This data shows that a large component of the trainings students would be patrolbased, and therefore would need to take into consideration the effects of real-time intelligence
on patrol or uniformed operations. In addition course design would need to reflect learner
characteristics specific to patrol officers and personnel.

PG. 108

Owen Berger
Question No. 11 (b). Assume you and/or your organization have been offered to attend
Topic. Specialized personnel (vice, narcotics, gangs, etc) [122 respondents, 20
skipped]
Specialized personnel (vice,

narcotics, gangs, etc)
2%
Specialized personnel (vice,

narcotics, gangs, etc)
10+
11%
None
57
4-10
49
1-3
47%
4-10
40%
1-3
13
10+
None
3
0
Figure 70
20
40
60
Figure 71
Analysis. Of the respondents, 98% stated that at least one person at their organization
from specialized units (vice, narcotics, gangs, etc) would attend the training, with just under
half of that percentage (47% of the whole) stating that more than 10 course attendees would
be from specialized operations. This large percentage means that any course designed from
this research should emphasize the relationship between specialized operations and real-time
intelligence gathering and dissemination.

PG. 109

Owen Berger
Question No. 11 (c). Assume you and/or your organization have been offered to attend
Topic. Special event personnel (assigned or ad hoc) [119 respondents, 23 skipped]
Special event personnel (assigned
or ad hoc)
Special event personnel (assigned

or ad hoc)
10+
16%
32
27%
None
4-10
24
1-3
4-10
1-3
44
10+
20%
37%
None
19
0
Figure 72
10
20
30
40
50
Figure 73
Analysis. According to 84% of the respondents, at least one special events person would
attend the training on real-time intelligence, with 27% of the total (32) stating that more than
ten members would attend the training. This data shows that a component of the trainings
students would be working in special events, and therefore would need to take into
consideration the effects of real-time intelligence with regards to special events.
Bias issues. Some organizations do not have dedicated or even ad hoc special event
personnel, therefore, this question could include bias because it counts those organizations
that have no such personnel.

PG. 110

Owen Berger
Question No. 11 (d). Assume you and/or your organization have been offered to attend
Topic. Detectives/Investigators [124 respondents, 18 skipped]
1%
10+
14%
None
58
4-10
47
1-3
47%
4-10
1-3
18
10+
38%
None
1
0
Figure 74
20
40
60
80
Figure 75
Analysis. Ninety-nine percent of respondents stated that at least one investigator or

detective from their department would attend the training. Almost half of that percentage,
47% (58 respondents) stated that more than 10 investigators from their organization would
attend the training. This will impact course design heavily and means that course designers will
have to ensure training that highlights investigations with regards to real-time intelligence, and
that investigators learner characteristics must be considered as well.

PG. 111

Owen Berger
Question No. 11 (e). Assume you and/or your organization have been offered to attend
Topic. Administrative personnel [119 respondents, 23 skipped]
Administrative personnel
Administrative personnel
10+
12%
33%
18%
None
15
4-10
21
1-3
4-10
1-3
44
10+
None
39
37%
0
Figure 76
10
20
30
40
50
Figure 77
Analysis. Seventy percent of respondents stated that three or fewer administrative

personnel from their organization would attend the training, which indicates that special
considerations for these personnel would not need to be used in course design.

PG. 112

Owen Berger
Question No. 11 (f). Assume you and/or your organization have been offered to attend
Topic. Command staff [120 respondents, 22 skipped]
Command staff
Command staff
10+
10%
12%
None
43%
12
4-10
14
1-3
4-10
1-3
42
10+
35%
None
52
0
Figure 78
20
40
60
Figure 79
Analysis. Seventy-eight percent of respondents stated that three or fewer command

personnel from their organization would attend the training, with 43% of the total stating
none), which indicates that special considerations for these personnel would not need to be
used in course design.

PG. 113

Owen Berger
Question No. 11 (g). Assume you and/or your organization have been offered to attend
Topic. Civilian personnel (service representatives, dispatchers, records personnel, etc)
[120 respondents, 22 skipped]
Civilian personnel (service

representatives, dispatchers,
records personnel, etc)
Civilian personnel (service

representatives, dispatchers,
records personnel, etc)
10+
16%
29%
None
19
4-10
27
1-3
23%
4-10
1-3
39
10+
None
35
32%
0
Figure 80
10
20
30
40
50
Figure 81
Analysis. Sixty-two percent of the respondents stated that three or fewer of their
civilian personnel would attend the training, however, the 38% that stated that four or more
personnel would attend is still a significant percentage and cannot be ignored. Course design
based on this research must include appropriate considerations for civilian personnel.
Bias issues. It is quite possible that many organization do not use civilian personnel for
duties concerning gathering real-time intelligence, therefore this question topics data might
not be representative of the average organization.

PG. 114

Owen Berger
Question No. 11 (h). Assume you and/or your organization have been offered to attend
Topic. Specialized civilian personnel (JRIC or task force employees, analysts, etc) [122
Specialized civilian personnel (JRIC

or task force employees, analysts,
etc...)
Specialized civilian personnel (JRIC

or task force employees, analysts,
etc)
10+
25%
31
23%
None
4-10
21
1-3
4-10
1-3
42
10+
17%
35%
None
28
0
Figure 82
10
20
30
40
50
Figure 83
Analysis. Although slightly lower than Question No. 11 (g) Civilian personnel, 58% of
respondents stated that three or fewer specialized civilian personnel would attend the training.
However, 25% of the total respondents would send more than ten personnel to the training.
This means that specialized civilian personnel are more likely to attend than non-specialized
civilian personnel, and also means that course design based on this research must include
appropriate considerations for civilian personnel.
Bias issues. It is quite possible that many organization do not use civilian personnel for
duties concerning gathering real-time intelligence, therefore this question topics data might
not be representative of the average organization.

PG. 115

Owen Berger
Question No. 11 (i). Assume you and/or your organization have been offered to attend
Topic. Are there other groups not listed above? Please specify [6 respondents]
Results.
2. I u [sic] this response to my agency which is Probation, not Police.
3. We are all Investigators
4. Court Services Deputy's [sic] who deal with major criminals who frequent Court during
various phases of their case.
5. Sex offender registration and enforcement personnel
6. Probation Officers in Intensive Supervision, Sex Offender Supervision, Pre Sentence
Investigators, and Economic Crime Unit Officers
Analysis. A common theme emerged in the written answers to Question No. 11 the
fact that several organizations would send personnel whose duties include probation, sex
offender registration, and court services. These types of personnel should be considered when
designing a course on the subject matter, but more data will need to be collected to accurately
gauge the specific numbers of these types of personnel that would attend the training.
Of the respondents who knew of at least one member of their organization that would
attend from a given job position, the top three choices were (with percentages for over four
personnel as well):
1) Detectives/Investigators 99%, over four 85%,
2) Specialized personnel (vice, narcotics, gangs, etc) 98%, over four 87%,
3) Patrol personnel 86%, over four 66%.
These results could be indicative of several things. First, they could reflect the majority
makeup of the average law enforcement organization, meaning that there are simply more of
these positions at the respondents organization than any other. Subsequently, respondents
could know more people that would attend this training based on the simple fact that there are
more of them.
Cross-analysis. These results seem to be somewhat contradictory with the analysis for
Question No. 10, where there appeared to be a widespread use of real-time intelligence across
PG. 116

Owen Berger
agencies and positions. However, the three previously listed positions from this question (No.
11) cover a broad swath of actual job descriptions, and could be too general to draw a strong
conclusion from. In fact, one could conclude that these positions account for the majority of
positions at a law enforcement organization and therefore strengthen the case made in
Question No. 10, which demonstrated a widespread use of real-time intelligence from Social
Media and the Internet not only across multiple types of agencies and organizations, but across
multiple positions and job types.

PG. 117

Owen Berger
Note The results and analysis for Question No. 12 will be broken into eight sections, (a)
through (h), for the sake of individual topic analysis.
Question No. 12 (a). Assume you and/or your unit have been assigned to training on
gathering real-time intelligence with Social Media or the Internet. Please rank the below
subjects from 1 to 5, based on how important they are for you to learn at this training (choose
the number). One (1) is the LEAST important and five (5) is the MOST important. Note: When
we refer to intelligence or information below, please assume that it is information from Social
Media or the Internet.
Topic. Skills and tools for gathering intelligence on spontaneous events [124
Skills and tools for gathering
intelligence on spontaneous events
3%
2%

intelligence on spontaneous events
5 (Most)
15%
1 (Least)
58
41
47%
3
4
33%
18
1 (Least)
5 (Most)
Figure 84
20
40
60
80
Figure 85
Analysis. The large majority of respondents, 80%, thought that the skills for gathering
intelligence on spontaneous events would be more important (four or five on a scale of one to
five). This indicates that a strong component of course content should be on building those
skills.

PG. 118

Owen Berger
Question No. 12 (b). Assume you and/or your unit have been assigned to training on
Topic. Skills and tools for gathering intelligence on planned events [124 respondents, 18
skipped]
intelligence on planned events
3%

intelligence on planned events
70
60
6%
60
14%
48%
1 (Least)
50
40
30
29%
36
17
20
5 (Most)
10
0
1 (Least)
Figure 86
5 (Most)
Figure 87
Analysis. Though slightly less than with spontaneous events, the majority of
respondents, 77%, thought that the skills for gathering intelligence on planned events would be
more important (four or five on a scale of one to five). This indicates that a strong component
of course content should be on building the skills to monitor planned events.

PG. 119

Owen Berger
Question No. 12 (c). Assume you and/or your unit have been assigned to training on
Topic. Skills and tools for gathering intelligence on people or organizations [125
intelligence on people or
organizations
1%

intelligence on people or
organizations
1%
6%
18%
1 (Least)
2
3
4
74%
Figure 88
5 (Most)
100
90
80
70
60
50
40
30
20
10
0
93
22
8
1
1 (Least)
5 (Most)
Figure 89
Analysis. Ninety-two percent of respondents thought that the skills for gathering
intelligence on people or organizations would be more important (four or five on a scale of one
to five). In addition, 74% (93) of the total respondents thought that these skills were the most
important to learn. With regards to course design and content, the skills for gathering
intelligence on people or organizations should be emphasized more than any other skill listed
as a topic in Question No. 12. Delving further into the topic, this data could indicate that law
enforcement is more interested in the people and organizations behind current events than the
events themselves. Deeper analysis and further research will be needed to fully form this
concept and apply it to the subject matter.
PG. 120

Owen Berger
Question No. 12 (d). Assume you and/or your unit have been assigned to training on
Topic. Basic computer skills [124 respondents, 18 skipped]
Basic computer skills
Basic computer skills

45
41
40
35
22%
33%
13%
13%
19%
1 (Least)
30
25
20
15
5 (Most)
10
27
24
16
16
5
0
1 (Least)
Figure 90
5 (Most)
Figure 91
Analysis. The majority of respondents, 52%, found that basic computer skills were less
important (one or two on a scale of one to five). This means that less emphasis should be
placed on these skills in any subsequent course. However, 35% or respondents did state that
basic computer skills are more important (four or five on a scale of one to five), which indicates
that some special considerations should be taken for students who need improvement in basic
computer skills.

PG. 121

Owen Berger
Question No. 12 (e). Assume you and/or your unit have been assigned to training on
Topic. Notification/dissemination system design and implementation [125 respondents,
17 skipped]
Notification/dissemination system
design and implementation
Notification/dissemination system
design and implementation
50
43
45
6%
39
40
12%
31%
17%
1 (Least)
35
30
3
4
5 (Most)
25
21
20
15
15
10
34%
0
1 (Least)
Figure 92
5 (Most)
Figure 93
Analysis. The majority of respondents, 65%, thought that notification/dissemination

system design and implementation would be more important (four or five on a scale of one to
five). This indicates that there should be some component of course content should on
notification/dissemination system design and implementation.

PG. 122

Owen Berger
Question No. 12 (f). Assume you and/or your unit have been assigned to training on
Topic. Intelligence vetting process design and implementation [125 respondents, 17
skipped]
Intelligence vetting process design
and implementation
Intelligence vetting process design

and implementation
50
3%
45
7%
22%
1 (Least)
35
30
3
4
5 (Most)
5 (Most)
28
25
20
15
10
5
8
4
0
1 (Least)
Figure 94
43
40
34%
34%
42
Figure 95
Analysis. The majority of respondents, 68%, thought that intelligence vetting process
design and implementation would be more important (four or five on a scale of one to five).
This indicates that there should be some component of course content should on intelligence
vetting process design and implementation.

PG. 123

Owen Berger
Question No. 12 (g). Assume you and/or your unit have been assigned to training on
Topic. Basic online searching skills [125 respondents, 17 skipped]
Basic online searching skills
Basic online searching skills

45
11%
31%
35
12%
21%
25%
39
40
1 (Least)
30
25
20
15
5 (Most)
10
31
26
14
15
1 (Least)
5
0
Figure 96
5 (Most)
Figure 97
Analysis. The slight majority, 55% of respondents stated that basic online search skills
would be more important (four or five on a scale of one to five), which could indicate that those
respondents feel that basic searching skills should be part of course content, at least on a minor
level.
Bias issues. In Question No. 8, 85.8% of respondents rated themselves as a five or
higher on the Internet search capabilities self-ratings, which is incongruous with the results to
this question and topic. Therefore, two possibilities emerge: (1) respondents over-estimate
their own search skills, or (2) respondents under-estimate the search skills of their co-workers.
More research will be needed to find out which possibility is more accurate.

PG. 124

Owen Berger
Cross-analysis. Once again, respondents stated that they did not need basic computer
skills, with 52% stating that this was only a one or a two in importance on the scale of one to
five. However, over half (56%) of respondents noted that basic online searching skills were four
or five in importance on the scale of one to five, which is somewhat contradictory to the results
for Question No. 8. Repeating the bias analysis from Question No. 8s individual analysis, two
possibilities are possible: (1) respondents over-estimate their own search skills, or (2)
respondents under-estimate the search skills of their co-workers.
When combined with the analysis for Question No. 9, it seems that option (2) above is
more likely, and begs the question, if the respondents are confident in their own skills, why are
they not confident in the search skills of their colleagues as well? One possible answer is that
the respondents for this survey were a self-selecting group of personnel who were interested in
real-time intelligence and therefore are the personnel from their agency most likely to be
competent in online searches and search techniques.

PG. 125

Owen Berger
Question No. 12 (h). Assume you and/or your unit have been assigned to training on
Topic. What else would be important for you to learn relating to gathering real-time
intelligence? [7 respondents]
Results.
standard practice for the department. This would be a great tool for my section/unit.
2. Planned events approach a touchy subject for my unit as some have no criminal
element and are not applicable to our mission. While we are to be cognizant of any
potential threats they may pose, planned events run the risk of crossing a threshold
where 1st Amendment rights might be violated so gather information to the point
where we are certain there is no criminal element/potential threat.
3. I think a portion of the course should be on legal sufficiency and sound law
enforcement practices. Preservation requests and warrants might be useful...
4. IP Address source/origination info
5. A process. Step A, B, C, etc. Non-techies often need a step-by-step process to ensure
they got it right (it also helps for us techies).
6. I think someone coming to a class like this should have some computer skills.
7. Data mining technologies
Analysis. The written responses to Question No. 12 were varied, and analysis of these
responses is outlined below:
A couple of concerns were raised about legal issues in these responses, which, coupled
with information from the subject matter experts and resources indicates that there
should be a strong component or course content dealing with legal issues.
Two responses asked for investigative aspects of real-time intelligence to be covered,
including preservation requests, search warrants, and tracing of Internet Protocol (IP)
addresses. This content should at least be covered in brief during the course.
Lastly, a simple response was Data mining technologies, which would be covered as
part of the real-time intelligence gathering process for courses based on this research.

PG. 126

Owen Berger
Question No. 13. How often do you utilize Social Media or the Internet to gather
information/intelligence on events? [125 respondents, 17 skipped]
Results.
How often do you utilize Social Media or the Internet to gather
information/intelligence on events?
21%
14%
Never
Sometimes (For some major events)
Often (For most or all major events)
Constantly (Even for minor events)
27%
38%
Figure 98
Analysis. Eighty-five percent of respondents utilize Social Media or the Internet to
gather intelligence, with almost half (47%) of respondents stating that they gather intelligence
in this method often or constantly. This widespread and consistent use of real-time intelligence
to monitor events is remarkable, especially considering the lack of training in the subject
matter.

PG. 127

Owen Berger
Question No. 14. At what point do you monitor a typical planned/spontaneous event?
(Check all that apply) [111 respondents]
Results.
Monitoring timeline basics
We continue to monitor after the event.
(Post-event)
50 (45%)
We monitor during the event. (During)
59 (53%)
We start monitoring before the event takes

place (Pre-event)
97 (87%)
20
40
60
80
100
120
Figure 99
Analysis. The percentage of respondents who acknowledged monitoring events
decreased from pre-event (87%) to post-event (45%). This indicates that the large majority of
respondents utilize information from Social Media and the Internet prior to events, yet do not
use this information as frequently during or after an event. Further research is needed to
determine the possible reasons why event monitoring drops of during the basic event timeline
of pre-, during, and post- event.
Cross-analysis. It is possible when considering the results from Question No. 3 that
organizations can monitor for information prior to an event but must use their personnel for
other functions during and after the event due to a lack of personnel. Therefore, it would
appear that any course on real-time intelligence that includes event-monitoring should show
students how to monitor effectively during and post-event with limited resources.

PG. 128

Owen Berger
Note The results and analysis for Question No. 15 will be broken into five sections, (a) through
(e), for the sake of individual topic analysis.
Question No. 15 (a). Please identify whether the following applies to you or your
organization with regards to decision-making based on information from Social Media and the
Internet.
Topic. We make personnel decisions based on information from Social Media or the
Internet [123 respondents, 19 skipped]
We make personnel decisions
based on information from Social
Media or the Internet
We make personnel decisions

60
50
50
44
40
36%
41%
Yes
No
I don't know
29
30
20
10
23%
0
Yes
Figure 100
No
I don't know
Figure 101
Analysis. The results for Question No. 15 (a) were more evenly distributed than answers
to other topics in this same question. 41% of respondents stated their organization makes
personnel decisions based on information from Social Media or the Internet, 36% did not know,
and 23% stated no, they did not use said information for making personnel decisions.
Bias Issues. Similar to Question No. 2 (a) and Question No. 2 (c), Question No. 15 (a),
this question and topic, and Question No. 15 (b) can be somewhat misleading in that
respondents might not have been able to tell the difference between the topics using the terms
personnel decisions and deployment decisions. It is quite possible that the responses to
this question are a combination of people who are answering it as mainly deployment-oriented,
PG. 129

Owen Berger
the same as Question No. 15 (b), or are considering it as the research intended to make
decisions about hiring, promoting, or transferring personnel.

PG. 130

Owen Berger
Question No. 15 (b). Please identify whether the following applies to you or your
Internet.
Topic. We make deployment decisions based on information from Social Media or the
We make deployment decisions
We make deployment decisions

80
73
70
20%
60
Yes
No
20%
60%
I don't know
50
40
30
25
24
No
I don't know
20
10
0
Yes
Figure 102
Figure 103
Analysis. Sixty percent of respondents stating that they use information from Social
Media or the Internet to make deployment decisions. This indicates that a majority of
respondent organizations trust this information enough to deploy personnel based upon it,
which makes a case for training that shows law enforcement how to utilize Social Media and
the Internet to gather and use information when making deployment decisions.
Bias Issues. As stated in Question No. 15 (a), and similar to Question No. 2 (a) and
Question No. 2 (c), Question No. 15 (b) (this question and topic) can be somewhat misleading in
that respondents might not have been able to tell the difference between the topics using the
terms personnel decisions and deployment decisions. Despite the difference in respondent
answers, it is possible that the responses to this question are a combination of people who are
answering it as mainly deployment-oriented, or answering it as the same topic as in Question

PG. 131

Owen Berger
No. 15 (a). Because the data elicited by these questions may be compromised, no conclusions
can be drawn from them, and further research is indicated.

PG. 132

Owen Berger
Question No. 15 (c). Please identify whether the following applies to you or your
Internet.
Topic. We make tactical decisions based on information from Social Media or the
We make tactical decisions based
on information from Social Media
or the Internet
We make tactical decisions based

on information from Social Media
or the Internet
I don't know
22%
27
Yes
No
18%
60%
No
22
I don't know
Yes
73
Figure 104
20
40
60
80
Figure 105
Analysis. The majority of respondents, 60%, stated that they make tactical decisions
based upon information from Social Media and the Internet. This demonstrates a strong need
for training that will show law enforcement how to gather and disseminate real-time
intelligence rapidly during and ongoing tactical situation where personnel safety is on the line.

PG. 133

Owen Berger
Question No. 15 (d). Please identify whether the following applies to you or your
Internet.
Topic. We have a vetting process in place for intelligence/information that comes from
Social Media or the Internet [123 respondents, 19 skipped]
We have a vetting process in place
for intelligence/information that
comes from Social Media or the
Internet
We have a vetting process in place

for intelligence/information that
comes from Social Media or the
Internet
I don't know
35%
37%
45
Yes
No
No
35
I don't know
Yes
28%
Figure 106
43
0
10
20
30
40
50
Figure 107
Analysis. The results for this topic were mixed, with the most respondents, 37%, stating
that they did not know if their organization has a vetting processing in place for information
from Social Media and the Internet. It would seem that all law enforcement agencies should
have a vetting process for this type of information. Therefore, a training gap could exist when
you consider that the respondents that did not know and those that stated they do not have a
vetting process constitute the majority of respondents at 65%. This data also shows that there
is no uniform best-practice for vetting information, which means that course content can be
delivered to fill this information-processing gap.

PG. 134

Owen Berger
Question No. 15 (e). Please identify whether the following applies to you or your
Internet.
Topic. We have a notification system in place for disseminating intelligence from Social
Media or the Internet [123 respondents, 19 skipped]
We have a notification system in
place for disseminating intelligence
from Social Media or the Internet
We have a notification system in

place for disseminating intelligence
from Social Media or the Internet
I don't know
23%
45%
28
Yes
No
No
40
I don't know
32%
Yes
55
Figure 108
20
40
60
Figure 109
Analysis. The results for this question were somewhat evenly distributed, although of
the individual topics the most respondents, 45% (55), stated that they do have a notification
system in place for disseminating intelligence from Social Media and the Internet. Further
research will be needed to find out whether the notification system for this kind of information
differs significantly from that of for other types or sources of information and to understand
why some organizations do not disseminate the information. The fact that 45% do not have a
notification system and 23% do not know if they have a notification system suggests that the
information being collected is not being used effectively, and that training in notification
systems design is needed.

PG. 135

Owen Berger
for the sake of individual topic analysis.
Question No. 16 (a). Please note the websites you or others at your organization use
for gathering real-time intelligence (you can list others below):
Twitter (or sites that use Twitter feeds) [124 respondents, 18 skipped]
Facebook [123 respondents, 19 skipped]
Instagram [123 respondents, 19 skipped]
YouTube [124 respondents, 18 skipped]
Search Engines (Google, Bing, Yahoo) [124 respondents, 18 skipped]
Craigslist and/or Backpages.com [123 respondents, 19 skipped]
Results.
Websites used
Craigslist and/or Backpages.com
Search Engines (Google, Bing, Yahoo)
YouTube
Instagram
Facebook
Twitter (or sites that use Twitter feeds)
0
Haven't heard of it
20
40
We don't use it
60
80
100
120
140
We use it
Figure 110
Analysis. It appears that, based on the responses, most agencies use the free tools and
websites available to them to gather information from Social Media and the Internet. This
indicates that any forthcoming course content should show how to use these tools effectively.
Cross-analysis. With contrary results to Question No. 17, this question reinforces the
results of the subject matter expert and resource interviews, where budgetary restraints were
PG. 136

Owen Berger
noted several times. Even the free tools listed in Question No. 17 were not widely used, which
means that the information-gathering tools presented by the major websites are either doing a
good enough job for law enforcement, or, are effective compared to the informationassembling tools noted in Question No. 17. The combined analysis can only lead to a consensus
that free and publicly available tools are the most relied upon and most used tools by todays
law enforcement. Therefore, these tools should be the foundation for, or most-used medium
for, course content in the subject matter.

PG. 137

Owen Berger
Question No. 16 (b). Please note the websites you or others at your organization use
for gathering real-time intelligence (you can list others below)
Topic. What other websites do you use that aren't listed above? [14 respondents]
Results.
1. Redbook
3. LinkedIn, Intelius, Whitepages.com
4. snapchat
5. Racr has several lists that are checked every watch and info is disseminated [sic] as
needed
6. ip locator
7. Socialmention, Twitterfall
8. Statigram, bluestacks
9. IndyBay.org, Redbook
10. pipl.com, archive.org/web (the wayback machine)
11. To [sic] many more to list.
12. Pinterest, next door, four square, media sonar
13. Monitoring websites of know organizations such as LACAN, Answer LA etc.
14. Snap Chat is the new thing
Analysis. The individual responses to Question No. 16 had several different themes,
including the use of the websites Redbook and SnapChat, the monitoring of individual
organization websites, and some free online information-gathering tools such as Statigram,
Bluestack, Pipl, and Intelius. These responses show that law enforcement uses a variety of tools
to complete the given task, and any emerging course content should include the same variety
of tools without limiting the students. It would also be important, if offering a variety of tools,
to also give students the knowledge of which tools are best used for different applications.

PG. 138

Owen Berger
for the sake of individual topic analysis.
Question No. 17 (a). Please note the online tools you or your organization use to gather
real-time intelligence from Social Media and the Internet (you can list others below):
Radian 6 [119 respondents, 23 skipped]

HootSuite [119 respondents, 23 skipped]
Accurint Social Media [119 respondents, 23 skipped]
GeoFeedia [119 respondents, 23 skipped]
Torch/Palantir [119 respondents, 23 skipped]
TweetDeck [119 respondents, 23 skipped]
Results.
Online tools
TweetDeck
Torch/Palantir
GeoFeedia
Accurint Social Media

HootSuite
Radian 6
0
20
Haven't heard of it
40
We don't use it
60
80
100
We use it
Figure 111
Analysis. The majority of respondents for this question had not heard of the most
common commercial and free tools available to law enforcement for gathering real-time
intelligence. Accurint Social Media had the highest number of respondent users, but that
number was still only 37.5% of the total respondents. This data shows a common problem with
budgetary constraints that was also referenced by the subject matter experts and resources.
The effect of this response on course design would be to limit the use or exposure of these
tools to students, as they are not commonly used. Its possible that students could be made
aware of these tools, but course content should not rely upon their use in class, or their use by
PG. 139

Owen Berger
students once they return to their normal duties. However, less-used tools could provide value
in specific situations, and those options should be passed on to students.

PG. 140

Owen Berger
Question No. 17 (b). Please note the online tools you or your organization use to gather
real-time intelligence from Social Media and the Internet (you can list others below)
Topic. What other online tools do you use that aren't listed above? [12 respondents]
Results.
2. Camtasia and SnagIt or simple screen shots
3. We use Accruint; we have to add the Social Media access to our account.
4. Monitter
5. We tested Torch, but they withdrew service before they got it to our specs.
6. I am not sure about this
7. I use Google Alerts to automatically keep me updated. This will not help with sites not
accessible to Google, such as Facebook, but it is still helpful.
8. TLO
9. used to use geofeedia but our trial ran out and we didnt purchase. accurint Social
Media isnt very helpful, we have it but dont really use it.
10. Budget keeps us from using the paid ones. SM information is not a priority.
11. "MediaSonar, Cosain, RepKnight, CESPrism, Haystax
Important to use LE only tools, R6, HootSuite, Tweetdeck do not fit that bill.
12. Getting Accurent [sic] next week
Analysis. The individual responses to Question No. 17 (b) indicate why the online tools
that were asked about are not widely used. Some of the respondents stated that they did use
Accurint Social Media Monitor, which was reflected in the initial question data. Additionally,
several of the tools were being noted as having been tested, but are no longer used. These
individual responses are congruent with the initial data in Question No. 17 (a), and show that
there is no unified or widely used commercial tool for law enforcement. The implications for
this on course design are twofold: (1) course design should not assume that students have
knowledge of these tools, (2) course content might not be applicable to the students collective
duties if the use of one of these tools is mandatory.

PG. 141

Owen Berger
Note The full results for Question No. 18 will not be shown due to the fact that the factual
information entered by the responses contains personal contact information that would be
improper to publish.
Question No. 18. Would you like to be a Subject Matter Expert, or do you have any
information that could help me during the instructional design process? Please enter the
following: First Name, Last Name, E-mail, Phone Number (optional) [36 respondents]
Results.
Subject Matter Expert or Informational Resource,

Responses
Phone Number (optional):
24
E-mail:
36
Last name:
36
First name:
36
10
15
20
25
30
35
40
Figure 112
Analysis. There were 36 total respondents who wanted to be either subject matter
experts or who wanted to share information regarding real-time intelligence and any emerging
course design. This 25% response shows a lot of interest in the subject matter. Further
research could be necessary to find out what the respondents wanted to share with regards to
this research and its outcomes, if any.

PG. 142

Owen Berger
Subject Matter Experts/Resources.

SME No. 1 Detective Samuel Palmer, Phoenix Police Department.
Summary. Detective Palmers primary focus is the use of Social Media and the Internet
for assisting in and conducting criminal investigations. With regards to gathering and
dissemination of real-time intelligence, Palmer stated that his department is mostly reactive,
not pro-active. Palmers department is in the process of looking for paid intelligence-gathering
tools, and has tested tools including: GeoFeedia, GeoSuites, SnapTrends LexisNexis Social
Media Monitor, HootSuite, Mention.net, Twitonomy, GeoSocialFootprint, and Tweetpath.
However, the use of his current open-source tool, HootSuite, is limited to reactive monitoring.
Detective Palmer reasoned that the main reason for his departments lack of pro-active
online intelligence gathering is man-power allocation. After the problem of putting dedicated
personnel to the task, Palmer stated that budget is the second largest obstruction to gathering
and disseminating online intelligence. As will be examined in the analysis section below, budget
and man-power constraints extend to Detective Palmers following training ideas, where both
the amount and type of training could be limited by those constraints.
When it comes to training in the utilization of real-time intelligence, Palmer stated that
he would like to see a basic training course, perhaps starting with patrol officers. The point of
this training would be threefold. First, the training would show the officers what information is
relevant in todays society. Second, the training would highlight or emphasize the liability
concerns for fake profiles or undercover personas. And, third, the training would demonstrate
what the reporting process should be for intelligence and how that process could impact the
departments deployment or investigations. Palmer stressed the need for legal and liability
training, particularly when it came to entrapment issues, privacy issues, and first and fourth
amendment violations.
In addition to the basic course outlined above, Detective Palmer would like to see an
advanced course in certain specialized topics. Among those topics would be common cyberinvestigation techniques such as the storage of evidence and court testimony. Detective
Palmer suggested that a district attorney could be contacted for advice on some of these
particular subjects.
In the eyes of Detective Palmer, the current structure at his agency for gathering and
disseminating real-time intelligence from Social Media and the Internet is non-existent. For
investigations, he uses an Internet Investigation Form that he created to track the digital path
through his investigation. Detective Palmer notifies his chain of command with any pertinent
information, then continues his investigation. Although these homemade techniques might
PG. 143

Owen Berger
seem to be a non-sequitur, they reflect Detective Palmers concerns about liability and are a
reaction to his agencys current processes see the analysis section below for further. When
prompted further for his process of creating and making notifications, Detective Palmer stated
that he utilizes phone calls and does not believe electronic mail (e-mail) to be a good method of
information dissemination.
In a perfect world, Detective Palmer would like to see a dedicated unit with both sworn
personnel and civilian analysts that would gather and monitor intelligence on critical
infrastructure, ongoing incidents, threats, crimes, etc He would also like to see a budget for
dedicated software that would assist in gathering and disseminating information.
Analysis. The primary points gleaned from the interview with Detective Palmer include
his desire for:
1) The need for enough man-power to properly gather and disseminate online
information, possibly even enough personnel to staff a dedicated sworn and civilian
unit.
2) The need for basic training, starting at the patrol personnel level, then includes a
component covering the legal and liability issues that come with utilizing intelligence
from Social Media and the Internet.
3) A more pro-active approach to gathering and disseminating online intelligence. Often,
reactive intelligence gathering can be too little, too late in todays rapidly paced and
technology driven society.
Detective Palmer identified the strong need for a training component on how to gather
and disseminate real-time intelligence with limited personnel and a limited budget. Therefore,
any proposed course should include a section on using open-source websites and tools. The
proposed course should also include a section on how to find and utilize real-time intelligence
on a part-time basis, or with only a few dedicated personnel.
In addition, Detective Palmer stressed that any proposed training should include a
section on liability and legal issues that stem from law enforcements use of Social Media and
the Internet. As mentioned in the summary section above, Detective Palmer has created an
Internet Investigation Form to track his progress and actions throughout an investigation.
This type of organically created liability protection mechanism could be an important part of
forthcoming course curriculum, where students could share their own ideas for liability
protection.
The constraints of budget and personnel mentioned in the interview summary above
would come into play for both of Detective Palmers training ideas. Personnel could be a factor
PG. 144

Owen Berger
in the patrol or basic course due to the simple fact that in most municipal and state law
enforcement departments, patrol and basic uniform personnel make up the largest percentage
of the workforce. Subsequently, any training involving these personnel would require more
training hours or more training personnel. However, if the given training employed a trainthe-trainer section, the trained personnel could bring back the skills necessary to share their
knowledge, thus reducing the need for direct training to every single patrol or uniformed
personnel member.
As for the effects of these constraints on the advanced course mentioned above, topics
such as court testimony and evidentiary techniques would involve additional research and
constantly updated course material. Both the research and updates could incur extra costs
(and staff usage) for a municipal police department. Therefore, any course in gathering realtime intelligence should have a built-in yet dynamic section on advanced techniques that can be
changed with the evolution of technology.

PG. 145

Owen Berger
SME No. 2 Sergeant (Sgt.) Tom Leveque, Arcadia Police Department.

Summary. The interview started with Sgt. Leveque showing how he uses the web tool
GeoFeedia to monitor Social Media in Arcadia. He continued to tell about a success story
where, about a year earlier, his department assisted a young girl who posted pictures of herself
cutting her wrists online. The Arcadia Police Department personnel were able to find out
where the young girl was and they were able to get her help. Sgt. Leveque continued to tell me
how they use GeoFeedia to monitor and receive alerts for anything in Arcadia. Leveque also
showed his use of a web tool called TweetDeck which he uses to monitor real-time during the
largest annual event in Arcadia, the Breeders Cup.
Sgt. Leveque stated that the majority of what he does on a daily basis is community
engagement and reputation management. He stated that a lesser part of his duties include
using Social Media for investigations or gathering real-time intelligence. Despite his admissions,
monitoring the pulse of his community (by gathering real-time intelligence) appears to be a
large part of Sgt. Leveques duties see analysis section below for further.
Sgt. Leveque believes that law enforcement is their own worst enemy when it comes to
using Social Media to gather real-time intelligence. He stated that law enforcement needs to
work together and accept that Social Media and the Internet are here to stay and need to be
understood by everyone in law enforcement. In addition to commonplace resistance, staffingpower was given as a reason why real-time intelligence isnt used more. Leveque continued on
to state that at a less-busy department such as his, the personnel are able to use some of their
time for the utilization of Social Media. The key, for Sgt. Leveque, is that everyone understands
Social Media and is able use it rather than ignoring it.
When it comes to training in Social Media and law enforcement, Sgt. Leveque would like
to see basic training starting as early as the police academy. After that, he believes that
specialized training would be important. One caveat that Sgt. Leveque mentioned was that
people have to be willing to participate in the training, and to do that you need to be able to
show success using Social Media in law enforcement operation.
At this point, the Arcadia Police Department only has an informal structure for gathering
and disseminating information from Social Media. Anyone using Social Media on behalf of the
department must have written authorization from the Office of the Chief of Police. In
emergencies, Sgt. Leveque would make phone notifications and prefers not to use e-mail as a
primary communication method. Sgt. Leveque ended the interview by stating that in a perfect
world, his department would have someone monitoring Social Media 24 hours a day, seven
days a week.
PG. 146

Owen Berger
Analysis. Sgt. Leveque stated that he does not utilize Social Media as much for
gathering real-time intelligence as he does for community engagement. However, his
anecdotes, office set-up, and demonstrated use of intelligence-gathering tools belie his own
admissions. Therefore, his opinions on training are especially valuable to this research because
as a supervisor at a small municipal department (the most common type), Sgt. Leveque has a
front-line view of what personnel at this type of department need with regards to real-time
intelligence training.
Several points stood out in the interview with Sgt. Leveque, including his insistence that
everyone in law enforcement become aware of using Social Media, that basic training be
universal, and that it is important to get a buy-in from any participants in the training. These
points will affect any forthcoming course design in that the course should include success
stories, and training that will allow students to take their knowledge back to their own
organizations and make other personnel proficient.
Furthermore, the aspect of basic training for all personnel brought up by Sgt. Leveque
cannot be ignored, and has several implications for the course design. First, any such course
should include a basics section before delving into deeper topics. Second, if early, blanketed
training is a must, then any forthcoming course design should employ a train-the-trainer
section, where the trained personnel could bring back the skills necessary to share their
newfound knowledge, thus reducing the need for direct training to every single agency or
organization member.

PG. 147

Owen Berger
SME No. 3 Officer Candice Foster, Los Angeles Police Department.

Summary. Officer Foster started the interview by describing how she and her
department currently use real-time intelligence from Social Media and the Internet. Officer
Foster monitors ongoing events as well as any incident that could affect an officers deployment
or safety. Officer Foster also monitors community activity, information pertaining to criminal
investigations, and preserves or captures digital evidence when necessary.
Officer Foster sees the primary impediment to gathering and disseminating real-time
intelligence as not having access to the necessary technology and software, in even the most
basic terms, such as continuous Internet access. The next biggest impediment, according to
Foster, is training for officers on basic searches and how to identify what they are looking for.
In addition to basic Internet searches, Foster would like to see officers receive training in siteto-site navigation flow, how to find critical information such as live feeds, and how to gather
any type of information into a format that can be stored on the computer and subsequently
shared.
The current system for gathering and disseminating real-time intelligence, according to
Foster, is a modular division-by-division approach. Foster stated that they work small to big,
sending notifications up the chain of command, especially with sensitive information. Foster
currently uses e-mail as a primary notification method, and mentioned that she prefers e-mail
because it is a traceable method of communication where the sender, receiver, and timestamp
information is recorded.
As far as changes that Foster would like to see in the current real-time intelligence
gathering and notification systems, she would like to have a written plan or direction from
supervision. She believes that the current system is not uniform throughout the department,
and she wishes that there was a defined structure.
The contents of training on real-time intelligence should start slowly, stated Foster. She
believes that basic computer skills should be the foundation, and then Internet searches,
followed by creation and dissemination of intelligence when the student is ready. In addition,
Foster would like to see officers training in how to best share access to intelligence.
Analysis. There were several recurring themes during the interview with Officer Foster,
mainly the need to start out with basic training in Internet searches, and the subsequent need
to ensure that officers who find valid intelligence know how to share information, or provide
shared access, and lastly that the officers have a mandated structure for information
dissemination.

PG. 148

Owen Berger
Officer Fosters interview gave clear guidance on the content of the proposed course.
The effect on instructional design starts with the need to ensure basic computer skills, followed
by ensuring a solid student understanding of Internet searches. Next, the course should
contain sections on the storage and sharing of saved intelligence, with a big picture follow-up
on notification design and structure.
Officer Foster is the only subject matter expert to mention the topic of providing shared
access to information. Perhaps this stems from Fosters employment at a large organization
(the Los Angeles Police Department) where making the information available to others could be
just as important as having the information in the first place. Sharing information at a smaller
organization could be easiest by pushing out information (e.g. via e-mail or telephonically),
whereas at a larger organization, information needs to simply be available for other personnel
to retrieve whenever they choose to do so. This possibility could have an important impact on
course design in that students, and their organizations, could benefit differently from various
types of information structures.

PG. 149

Owen Berger
SME No. 4 Lauri Stevens, Principal, LAwS Communications.

Summary. Mrs. Stevens current position includes using and evaluating Social Media
tools so that she can teach law enforcement how to best utilize those tools. She continued to
state that some of the challenges for law enforcements comprehension and use of Social
Media tools include what she describes as a steep learning curve. This learning curve
difficulty stems from the fact that the differences between Social Media tools are vast, and
some do specific tasks very well, while others do a lot of things, just not quite as well as the
specialized tools.
Mrs. Stevens believes that any training needs to include a strong legal and privacy
component. She believes that officers need to learn to set their own boundaries and
parameters in order to ward off harmful or overly-zealous legal rulings that come from law
enforcements possible abuse of power. Mrs. Stevens hypothesized a scenario where a suspect
was tracked using Social Media and the Internet, and then was either arrested or released.
Mrs. Stevens then wondered what happens to the information gained from the Internet or
Social Media that was used to track, to find evidence on, or to prosecute the suspect, or a
combination thereof.
Mrs. Stevens also believes that any training should also contain an evaluation portion of
current Social Media tools, but she was adamant that this section contain only open-source
tools. In addition to the tool evaluation, it is important for law enforcement to communicate
with each other and communicate within any respective organization. Mrs. Steven shared an
example where a department she knew of used a centralized information hub. Each individual
station or division within that organization believed that the information hub was gathering and
disseminating all of the information from Social Media and the Internet. However, the
information center was only using one web tool to monitor Social Media, and that it would be
impossible for the information center to monitor for the entire department using just that tool.
Mrs. Stevens concluded by saying gathering real-time intelligence could easily be a full-time job,
and should not be left up to an agencys Public Information Officer.
Analysis. There were several key points that were stressed during Mrs. Stevens
interview, including law enforcements legal and privacy obligations, and the use and evaluation
of open-source tools. In terms of course design, this means that any training on gathering and
disseminating real-time intelligence with Social Media and the Internet should contain a
sizeable section on the legal, liability, and privacy issues involved. In addition, there should be a
section of the course dedicated to obtaining, installing, using, understanding, and evaluating
open-source tools that gather raw Social Media data.

PG. 150

Owen Berger
SMR No. 1 Los Angeles County Sheriffs Headquarters Bureau, Electronic

Communications Triage Unit (eComm): Captain Michael Parker, Sergeant Chris Meadows,
Sergeant Robert Boese, and Deputy Anthony Moore.
Summary. The eComm unit utilizes the Internet and Social Media to actively listen to
open-source information regarding any type of conduct or behavior that might illicit a police
response, or might affect the image of the department. Some of the situations that the eComm
unit monitors are: rapid-onset events (riots, etc), planned events (protests, illegal parties,
etc), criminal activity (e.g. flash-robs, conspiracy crimes, etc), and possible suicide
intervention.
A major challenge for the eComm unit is finding personnel that are capable of being
trained for the job of gathering real-time intelligence. This challenge was never fully explained
by the subject matter resource, and could be linked to the other subject matter experts opinions
on training, see analysis below for further. Another challenging part of the eComm units
mission is finding platforms that can be used department-wide to minimize guesswork and
necessary user expertise. The eComm unit tries to overcome these challenges by adjusting
training to match dynamic technologies.
The eComm units members agree that any training on gathering real-time intelligence
should teach the students how to continuously think about what they are looking for. There is
no algorithm for finding and identifying relevant search terms, and students must use
metacognition with regards to terms and language while finding real-time intelligence. The
eComm unit believes that there needs to be more open-source investigative training. One
member of the eComm unit added that he would like to see a centralized platform for
information management, and there arent any all-inclusive tools available, either open-source
or commercially.
The eComm unit is a major component of their departments current structure for
gathering and disseminating information from Social Media and the Internet. The unit has full
daily coverage and disseminates the information via department e-mail to all concerned
parties. The eComm unit at Sheriff's Headquarters Bureau is the central location for the
"triage" of open-source information. That being said, individual units can search too.
Investigative units already have crime analysts who are trained (by eComm) and conduct
searches for detectives and investigators. The eComm unit would like to have more personnel,
and they would also like to see some separation of concerns, i.e. real-time intelligence in
criminal investigations versus public relations.
Analysis. The subject matter resource interview had some common themes throughout,
including the collective desire for training that includes thinking about how to search and
PG. 151

Owen Berger
what to search for. It seems that the current dissemination and notification system at the
eComm units organization is somewhat segmented, and that the unit members would like to
see a more organized approach, even if it involves paying for a commercial tool or application.
The subject matter resource members indicated that they had trouble finding
personnel that are capable of being trained for the job of gathering real-time intelligence. This
could indicate, just as was opined by the other subject matter experts, that training needs to
start at a basic level for all personnel, which could alleviate some of the recruitment difficulties
faced by the eComm unit. The manner in which the recruitment difficulties would be alleviated
is simple of the basic course students, some would show an aptitude for, and willingness to,
work in gathering real-time intelligence from Social Media and the Internet. This fact was
echoed by the experience of the Toronto Police Department in their Social Media endeavors, as
seen in the literature review results and analysis for the article entitled Social Media and
Tactical Considerations for Law Enforcement.
Those students that did not show the same aptitude or willingness would not be
considered for full-time positions in a unit such as the eComm unit. This filtering, or weedingout, process speaks to a definitive need for this course in that in a time of dynamic
communication technologies, training in the subject matter would not only assist in assuring a
basic level of skill for all personnel in law enforcement, but it would also help to identify those
who could, and would want to, specialize in the necessary skill of gathering real-time
intelligence with Social Media and the Internet.
One effect on course design stemming from the subject matter resources interview is
that any course needs to ensure that students learn how to search through a process of
dynamic or metacognitive thought. Another impact on course design is the need for the
students to be able to recognize flaws in their own information dissemination systems and to
create possible solutions to the challenges of dynamic intelligence dissemination. Lastly, the
eComm unit mentioned the need for separation of concerns. Perhaps this separation can be
accomplished by encouraging students to categorize real-time intelligence prior to designing
systems for the gathering and dissemination of this information. This method could allow
students to compartmentalize both the information and the system through which that
information flows.

PG. 152

Owen Berger
Literature Review.
Case Law.
Title. Cromer v. Lexington/Fayette Urban County Government.
Summary. In March of 2006, Officer Joshua Cromer arrested country singer John
Michael Montgomery for the crime of Driving Under the Influence (DUI). At the time, Cromer
was working for the Lexington Fayette Urban County Government (LFUCG) - Division of Police.
After the arrest, due to the country singers popularity, Cromer was found to have an online
account with the Social Media site Myspace. Friends and fellow officers posted and
commented with Cromer on his personal Myspace page, which also identified Cromer as a law
enforcement officer for LFUCG police.
The LFUCG found out about and investigated Cromers Myspace page and the posts
regarding Montgomery, and deemed the posts to be inappropriate. Cromer was relieved of
sworn duty with pay. Within one year, the police chief recommended that Cromer be
terminated from his position, and the county council subsequently dismissed Cromer for
misconduct. Cromer appealed this councils decision to the Fayette Circuit Court, which upheld
the councils actions. Cromer then appealed to the Commonwealth of Kentucky Court of
Appeals. Cromers appeal was based on technicalities concerning the paperwork and hearings
he received during the dismissal process. The Court of Appeals affirmed the trial courts opinion
and sided with the dismissal of Cromer by the LFUCG.
Analysis. The proposed course subject matter is real-time intelligence with Social Media
and the Internet with a target-audience of primarily law enforcement students. Therefore, it is
important to draw legal distinctions for these personnel separating their personal and
professional lives. This case law defines a situation wherein an employee can be fired if the
following conditions are met:
1. The employee posts to a personal Social Media page or site,
2. The employee identifies themselves as part of their organization or agency,
3. The employer can prove or substantiate that comments made by the employee
could potentially affect the employees or the organizations future duties, or
could be considered misconduct contrary to current organizational regulations
or rules.
The three conditions mentioned above constitute, or could constitute, a fairly broad range of
employee conduct, and must be taken into consideration in the proposed courses design for
two reasons.
PG. 153

Owen Berger
First, the proposed course will teach personnel how to create and use online Social
Media sites and accounts. Combine that with todays society, where many employees already
have personal Social Media accounts, and the first condition mentioned above would be met
solely through the work flow of normal course material. This means that any course based on
this research must emphasize the difference between, and separation of, personal and workrelated Social Media accounts.
Second, the proposed course should emphasize the importance of not identifying ones
self as an agency or organization employee along or in conjunction with any content that could
be considered misconduct or detrimental to either the organization or individual. Course
students should be encouraged to specify how their behavior on both work and personal Social
Media could affect their duties, or how that behavior could be seen by their respective
organizations in the context of misconduct or professionalism.

PG. 154

Owen Berger
Title. Garcetti et al. v. Ceballos.

Summary. Richard Ceballos was employed as a District Attorney for the Los Angeles
County District Attorneys Office. In February, 2000, Ceballos was working as a calendar deputy
in the Pomona branch. Ceballos was made aware of a defense motion to traverse and quash a
search warrant due to perceived inaccuracies by a defense attorney. Ceballos visited the
warrant location, then spoke telephonically with the warrant affiant, a deputy sheriff who also
worked for Los Angeles County.
Ceballos, concerned with misrepresentations in the affidavit, wrote a memo to his
supervisors regarding the situation. Ceballos also made a recommendation to dismiss the case
and prepared paperwork to do so. A meeting was set up with deputy sheriffs, Ceballos, and his
supervisors. The meeting ended in disagreement, and the prosecution based upon the search
warrant continued.
Ceballos testified during the hearing of the motion to traverse and quash the warrant,
which the criminal court rejected. After the hearing, Ceballos claimed that he was subject to
various retaliations by his employer, including reassignments, transfers, and promotional
denials. Ceballos subsequently sued for infringement of his First and Fourteenth amendment.
The case went to the following courts:
1) United States District Court for the District of California (claim rejected)
2) United Stated Court of Appeals, Ninth District (reversal, claim upheld)
3) United States Supreme Court (reversal, claim rejected)
The Supreme Court relied primarily on two cases for its decision: Pickering v. Board of
Ed. of Township High School Dist. 205, Will Cty., 391 U. S. 563 (1968), and Connick v. Myers, 461
U. S. 138, 142 (1983). Both of these decisions consist of a two-prong test, the balances of which
formed the decision for Ceballos case. First, the balance of whether or not a public employee
is speaking under the guise of their employment or as a free citizen. Second, the extent to
which the speech in question is of public concern or interest weighed against the need for
governmental organizations to make disciplinary or employment decisions.
In Garcetti v. Ceballos, the Supreme Court noted that there were several other laws and
regulations protecting Ceballos from retaliation (such as whistleblower protections), but that
the First Amendment does not protect against expressions employees make pursuant to their
professional duties. In this case, because the memo was created by Ceballos as an employee
and was sent to his supervisors, the entire chain of communication was as an employee not as
a private citizen expressing a matter of public concern or interest.
PG. 155

Owen Berger
Analysis. Students who take any course on communications or governmental

monitoring of communications should be aware of this legal decision. They should be
encouraged to think about how their respective positions or duties could possibly put them in
the same position in which Richard Ceballos found himself. They should be able to apply the
following two-prong tests to any expression of speech that they are making that could in any
way be related to their professional lives:
1) Is the expression or speech being made as a public employee or as a private citizen?
2) Is the expression or speech of such public concern or interest that it overrides the
need for governmental organizations to make disciplinary or employment decisions?
Course students should develop an understanding of how their speech differs as an
employee versus their speech as a private citizen. They should be encouraged to think about
how this differentiation applies to their respective positions, and how they could be at risk of
employer discipline if they violate their departments policies or rules while communicating as
an organizational employee. They should also hypothesize on how they would, or how they
already, report things that the public should know about without being subject to discipline by
their organization.

PG. 156

Owen Berger
Title. Konop vs Hawaiian Airlines, Inc.

Summary. In 1995, Robert Konop was working as a pilot for Hawaiian Airlines, Inc.,
hereafter referred to as Hawaiian. He was unhappy with the outcome of recent negotiations
between his union, the Air Line Pilots Association (ALPA) and Hawaiian. Konop created a
website for pilots wherein the pilot needed to sign in using their name and an assigned
password. The pilot then needed to agree to the website terms of service prior to using the
site. Konops website had blog postings that were critical of Hawaiian, the ALPA, and their
negotiations.
After hearing about the website, James Davis, then the vice-president of Hawaiian,
asked several pilots for their permission to access the website using their name and password.
Davis logged into the site multiple times and agreed to the sites terms of service. The head of
the ALPA, Reno Morella, contacted Konop and relayed his distress about the comments on
Konops website, including a possible threat of defamation against Konop. Konop checked the
access logs to his website and believed that Davis had logged in under the names of two pilots,
Gene Wong and James Gardner, and had used the information from the website in
conversations with Morella.
Konop sued Hawaiian on the basis of what he believed to be a retaliatory medical
coverage suspension based on information gained from violations of the Railway Labor Act, the
Wiretap Act, and the Stored Communications Act. The initial court, the United States District
Court for the Central District of California, granted summary judgment against Konop, who
appealed to the United States Court of Appeals for the Ninth Circuit. In 2001, the Ninth Circuit
reversed the lower courts decision on the suits claims dealing with the Stored
Communications Act and the Railway Labor Act. The court ruled on the following bases:
Wiretap Act At specific issue in this case is the issue as to whether or not the
communications by Konop on his website were intercepted by the Hawaiian. The
Electronic Communications Privacy Act, enacted in 1986, amended the Wiretap Act to
include prohibition of intercepting electronic communications. For the purposes of this
ruling, the Ninth Circuit concluded that the communications by Konop were not
intercepted per the definition of interception by the Wiretap Act.
Stored Communications Act (SCA) The Ninth Circuit regarded the main issue in this
case dealing with the SCA as the definition of the term user. Specifically, whether or
not the pilots Wong and Gardner were site users under the definition, and therefore
legally allowed to disseminate the information from Konops website to a third-party.
Due to the fact that no evidence existed that Wong or Gardner had ever actually used
the website, the Ninth Circuit determined that they could not authorize Davis site
PG. 157

Owen Berger
access. Therefore, summary judgment was granted to Konop for unauthorized or illegal
access of his websites stored electronic content.
Railway Labor Act (RLA) From the Ninth Circuits case summary:
Konop argues that Hawaiian managers: (1) interfered with Konop's organizing
efforts by viewing the website under false pretenses, (2) wrongfully supported
one labor group in favor of another by informing the opposing labor faction of
the website's contents, and (3) engaged in coercion and intimidation by
threatening to sue Konop for defamation, all in violation of the RLA. Hawaiian
argues, and the district court agreed, that Konop failed to present sufficient
evidence to withstand summary judgment on these claims. We disagree.20
The court gave summary judgment to Konop for his RLA claims due to the fact that the
intercepted communications assisted Hawaiian in favoring one union faction over
another, could give rise to limitation of a union organizing activity, and possibly gave rise
to coercion and intimidation by threatening to sue Konop for defamation.
Analysis. Although this case deals specifically with a private employer and a unionized
employee, its definitions and judgments based on electronic communications could impact law
enforcements use of such communications to monitor public activity or to conduct criminal
investigations. First, any course that deals with real-time intelligence should define the
different types of communications, and whether or not those communications can be
intercepted, stored, etc Second, the course should address the different roles that students
can or could have with regards to a websites information, such as user, administrator, or even
as law enforcement officially requesting said information.
Students studying real-time intelligence should consider their conduct during the
performance of their duties in the light of two specific questions:
1) Are they intercepting communications according to the lawful definition, and, if so,
do they have the legal right to do so?
2) Are they accessing information as a lawful user, according to the legal definition?
With regards to number (1) above, the most common example of law enforcements
legal interception of communications is accomplished via court order, subpoena or search
warrant. As for number (2) above, current law enforcement normally accesses websites via
public interface, and do not often need to ask themselves about their role as a legal user.
20
(Konop vs Hawaiian Airlines, Inc., 2001)

PG. 158

Owen Berger
However, with the growing number of undercover accounts or false personas by todays
law enforcement, there should be deeper thinking on how the use of accounts and websites in
gathering real-time intelligence can push the boundaries of case law such as Konop v. Hawaiian
Airlines.

PG. 159

Owen Berger
Title. People v. Harris.

Summary. During the Occupy Wall Street movement of 2011, Malcolm Harris was a
protester who utilized the Social Media site Twitter to communicate about the movements
protests and events. Harris tweeted under the account name @destructuremal, the records
for which were the central focus of this case.
In October, 2011, Harris and other protesters were charged with disorderly conduct by
the New York County District Attorneys Office. The District Attorney subsequently issued a
subpoena to Twitter, Inc. for the @destructuremal account records in order to use them as
evidence of organizational activity on the part of Harris and the other protesters. Twitter
informed Harris of the subpoena, who then filed a motion to quash the subpoena. Meanwhile,
Twitter refused to honor the subpoena, telling the District Attorney that the company would
wait on a ruling of the motion to quash prior to complying with the subpoenas orders.
The claim to quash the subpoena went to the Criminal Court of the City of New York,
New York County. The criminal court rejected the quashing of the subpoena for two different
reasons:
1) Harris had no legal standing to contest the subpoena, as the records being
requested belonged to Twitter and were being requested from Twitter directly by
the District Attorney. Additionally, the records belonged to Twitter, a fact which was
reinforced multiple times by Twitters Terms of Service (TOS). The TOS explicitly
note the public availability of information posted to Twitter and the fact that Twitter
owns the information once posted.
2) The subpoena was lawfully written, served, and was otherwise proper in the context
of the ongoing criminal case against Harris, et al., i.e. the court order did not violate
any other laws, whether state or federal.
On a minor not, the court affirmed the motion to quash with regards to information less
than 180 days old, meaning that the District Attorney was granted the information they
requested, just on a more limited scope. The judge noted that the limitation of records could
be overcome with a separate search warrant. They New York Court of Appeals denied an
attempted appeal of this decision, which was made by Twitter.
Analysis. Though a seemingly simple case, Harris motion raises important points about
the publics use of Social Media. First, there is the question of how a websites terms of service
can dictate where or how a sites information can be accessed by private users or law
enforcement. Course design should impress upon the students the importance of
understanding how a sites terms of service detail how information can be used, transferred, or
PG. 160

Owen Berger
relayed by the controlling company. Tangentially, students should also seek understanding of
exactly how private (or not) information really is when posted on Social Media. This
understanding should extend not only to information posted by the public, but information
posted by law enforcement as well.
Second, this case could impact law enforcement in that it shows the power of a lawful
subpoena, which appeared to be the backbone of the judges second argument siding with the
plaintiff. However, one fact cannot be stressed enough to law enforcement students and
should be stressed in course material a subpoena can and will be reviewed critically for
several factors, most notable among them are the relevancy and scope of the content or
information being requested.
One can see how easily overreach, whether intentional or not, could creep into
subpoenas or other court orders for Social Media information based on the sheer amount of
account information and posted content available. Students should be encouraged to carefully
consider the scope of their court orders with regards to content or information, as well as the
relevancy of the same in the context of the investigated or monitored activity. Furthermore, at
the point where the paths of real-time intelligence and criminal investigations cross, students
need to be mindful of the legal repercussions of their actions. They should consider not only
current case law, but possible reactive case law that could limit or impair future intelligencegathering or investigation by law enforcement.

PG. 161

Owen Berger
Title. United States v. Meregildo.

Summary. During the period from 2011 to 2012, the United States Attorneys Office of
the Southern District of New York was investigating and building a criminal case against a
violent Bronx street gang called the "Courtlandt Avenue Crew. In the course of the
racketeering, murder, and narcotics trafficking investigation, the government found evidence
that one of the defendants, Melvin Colon, had posted messages regarding prior acts of
violence, threatened new violence to rival gang members, and sought to maintain the loyalties
of other alleged members of Colon's gang.21
The government had viewed the incriminating posts by accessing the Facebook account,
or page, of a cooperating witness, who was a Facebook friend of Colon. The friend was able
to see posts, messages, and photos created by Colon that were not visible to the public due to
Facebooks built-in and customizable privacy settings.
Colon challenged the viewing of his Facebook content on Fourth Amendment grounds,
believing that because his posts, images, and messages were sent privately to another account,
they could not be seized by the government or used as evidence. The United States District
Court, Southern District of New York, disagreed with Colons claim. The court asserted that
indeed, the messages were sent privately to Colons Facebook friend. However, the
Facebook content, once sent to a friend, was outside the realm of any expectation of privacy.
While Colon undoubtedly believed that his Facebook profile would not be shared with
law enforcement, he had no justifiable expectation that his "friends" would keep his
profile private. Cf. Barone, 913 F.2d at 49. And the wider his circle of "friends," the more
likely Colon's posts would be viewed by someone he never expected to see them.
Colon's legitimate expectation of privacy ended when he disseminated posts to his
"friends" because those "friends" were free to use the information however they
wanted-including sharing it with the Government.22
Meaning, Colons content was private, but when sent to another person, that person was free
to do with that information what they pleased.
Analysis. This ruling demonstrates how supposedly private information from Social
Media can become privy to the public. Even with strict privacy controls, the incredible reach of
Social Media can take a users content and broadcast it on different mediums and to a large
21
22


PG. 162

Owen Berger
number of other users without the originators knowledge or intent. This has a two-fold impact
on law enforcement students engaged in or learning about intelligence-gathering.
First, law enforcement must realize that information from Social Media can be obtained
in many different ways. Even though a target account has strict privacy settings, that accounts
content could have leaked out of the privacy net, unbeknownst to the target account. The
automation of Social Media broadcasting and the linking of accounts between mediums and
Social Media sites makes this information leak ever more likely.
Second, students should understand exactly how accounts can be linked through
detailed study. This could take the form of a review of a students newly created account, or
research online to find out different methods of broadcasting the same information. One
example can be found in the link between Instagram, Facebook, and Twitter, all of which allow
you to post simultaneously to each other. An Instagram photo on a private account can be
made public by posting to a public Twitter or Facebook page.
In summary, the Meregildo decision highlights the blurred lines between private and
public content from Social Media. In the context of this researchs proposed course on realtime intelligence, students should be able to discover the means by which supposedly private
yet important information can be uncovered for the benefit of public safety. Furthermore,
students should be able to articulate the different avenues by which they can legally access
information or intelligence that may or may not have been intended as private.

PG. 163

Owen Berger
Articles.
Title. Developing Policy on Using Social Media for Intelligence and Investigations.
Summary. This article, written by several members of the Georgia Bureau of
Investigation (GBI) begins by laying out the need for a comprehensive Social Media policy for
law enforcement. Well-crafted policies can ensure that command staff know what their
employees are doing as well as protect citizens privacy and civil liberties.
One important point raised during the beginning of the article is how one defines the
purpose behind the use of Social Media by law enforcement. The purpose, according to the
authors, is defined by the answers to a two-level questions:
1) Why is Social Media being used to investigate criminal activity or gather
intelligence?
2) Is the answer to number (1) above consistent with the agencys mandate and
authority?
Next, the duties of law enforcement are broken down into three categories:
apparent/overt, discreet, and covert. These duties are denoted as levels of use, and should
provide the context in which law enforcement is using Social Media or the Internet. The
categories are defined as:
Apparent/overt No concealing of identity is desired or needed, information is only

being monitored that is privy to the public.
Discreet Knowledge of law enforcements activity could hamper an ongoing
investigations, so law enforcement should cover their tracks or use differing
techniques to avoid broadcasting or giving away their identity.
Covert An identity which cannot be revealed, and oftentimes involves contact
between law enforcement and the suspect.
As the level of use increases in secrecy from overt to covert, more supervisory oversight
is necessary, according to the authors. In fact, once identities are formed on the covert level,
there should be deconfliction efforts used on local, state or federal levels to reduce
interference and duplication of efforts.
After determining the purpose and level of use, the authors ponder the content gained
from Social Media monitoring or investigations. There is a corollary between the vetting of
information gained from Social Media and that of information gained from traditional sources,
such as informants. That is, if verification and authentication of intelligence from Social Media
is indeed necessary, then the same methods used for traditional intelligence should be used for
PG. 164

Owen Berger
Social Media-based intelligence. These methods include people-centric vetting such as

confessions and statements, as well as technical methods such as Internet Protocol (IP) address
tracing.
When it comes to acquiring intelligence from Social Media, the GBI uses different
monitoring tools, but a written request is required to use such a tool. Such requests must
include the purpose, time frame, tool details, and a list of websites monitored through said
tool. The authors draw a specific distinction regarding the use of intelligence-gathering tools,
and warn that such automated intelligence-gathering operation must be careful to stay within
the parameters of the stated purpose.
In addition to warning about the overreach of automated Social Media monitoring tools,
the authors also believe policies should limit the storage and retention of data gained from
monitoring and investigations. The authors recognize that it is important to save necessary
information through printing or digital archives. Any stored information, however, must be
kept according to agency policy only when it has a nexus to a criminal offense, and, if not,
should be discarded as quickly as possible. This minimal storage of data is necessary to avoid
basic civil rights protections that could arise out of a perceived targeting of a specific individual
or entity.
Lastly, the authors discuss how any policy on Social Media should contain adherence
guidelines and should be dynamic. The authors suggest periodic written reviews or supervisory
inspections to ensure compliance with the policy. In addition, policies should be as flexible and
able to grow or change as the technologies whose use they attempt to regulate.
Analysis. This article presents an interesting two-prong test of purpose at the
beginning: Why is Social Media being used to investigate criminal activity or gather intelligence
in this case? And, is the answer to the previous question consistent with the agencys mandate
and authority? If students of a course on real-time intelligence-gathering were able to ask
themselves these questions prior to the every use of Social Media or the Internet, there
probably would not be as much of a need for a policy as the authors suggest.
Consequently, a cognitive process asking the basic question, Why?, should be part of
any course on Social Media. This particularly affects course design with law enforcement
members as students because they are taught and trained to react quickly to dynamic
situations. Yet, in this case, they will be asked to define a purpose prior to intelligencegathering. This will encourage deeper thought in other aspects of the process, including
applicable case law, technical or procedural issues, and the levels of use concept mentioned
by the authors.
PG. 165

Owen Berger
The authors put an emphasis on validating information from Social Media by stating that
a combination of conventional and technological methods should be used to authenticate or
verify that information. This could be a simplification, and perhaps a prior step should be
implemented in course design where the students determine, on a case-by-case basis, whether
or not the information actually needs to be verified or vetted.
Two subjects in the article, Monitoring Tools and Storage or Retention Requirements,
are organization-specific. Monitoring tool usage depends on and individual organizations
budget and personnel constraints. In the design of a course on real-time intelligence with
Social Media and the Internet, it is important to remember that monitoring tools are not
ubiquitous. Spending any significant amount of time on the usage of these tools outside of a
theoretical discussion would exclude some or most students. Therefore, the authors
recommendations on the inclusion of these tools in a Social Media policy should be used, at
most, in a hypothetical or theoretical manner.
Retention and storage requirements, like monitoring tools, are organization-specific.
However, unlike monitoring tools, the authors suggest to keep the information for the
minimum amount of time possible. This suggestion, although intentionally vague, would be
more appropriate for a course on gathering and dissemination of intelligence than the
aforementioned suggestions about monitoring tools. Perhaps course students could think
about past or current cases where they had to make a decision about whether or not to keep
information, and then explain the reasoning behind that decision.
Next, the authors discuss the consequences of the increase in personal Social Media use
by law enforcement. The effect of this phenomenon coincides with growing tracking
technologies, such as Internet Protocol (IP) address tracing, Global Position System (GPS) usage,
and account-connection programs. These technologies, while making it easier for law
enforcement to track criminals, also make the reverse easier. Students should, emphatically,
speak with their respective organizations about obtaining the proper equipment to conduct
online work that cannot be traced back to an individual.
At the end of the article, the authors reinforce the need for any monitoring or work
done with Social Media be constitutional, and for consistent assessment and review of Social
Media policy. These suggestions speak to the last two impacts of this literature on a real-time
intelligence course:
1) A strong legal component.
2) An emphasis on consistent and thorough critical thinking by students about their duties.

PG. 166

Owen Berger
Title. How Police Use Social Media To Monitor, Respond to, and Prevent Mass
Gatherings.
Summary. In an apparent update, the article begins by dispelling a rumor that Chicago
police had recently worked with Facebook to block particular users from posting content during
a protest. Facebook denied the claims and subsequently noted in their Law Enforcement
Guidelines that reports made by law enforcement are the same as every other type of report.
The author then argues that police, contrary to the rumor, want to have protesters organizing
their protest activity in a public forum.
The author begins the main article by explaining how much Social Media has expanded
law enforcement activities. Specifically highlighted are both the presence of law enforcement
on Social Media and its use of the medium for intelligence and digital surveillance operations.
The need for this presence stems from two conditions. First, the necessity to meet the publics
hunger for and ability to consume large amounts of updated information from an official
source. The author cites an example from Philadelphia where the police used Social Media to
push Occupy Wall Street protesters out of a plaza with impending construction through an
embedded reporter. Second, the necessity to take advantage of the fact that mass gatherings
or large events can be easily monitored via Social Media or the Internet.
Next, the author summarizes some of the agencies that are working on Social Media
tools, policies, and initiatives for law enforcement. These agencies include:
Department of Justice, Community Oriented Policing Services (COPS),

Department of Justice, Bureau of Justice Assistance,
International Association of Chiefs of Police (IACP), Center for Social Media.
Police Executive Research Forum (PERF)
After discussing these agencies, the author breaks down how pervasive the subjects of social
networking, cybercrime, and their intersection in intelligence-led policing were at the 2013
IACP Conference. The author gives some examples and a commentary on what occurred at the
conference that was related to law enforcement, mass gatherings, and Social Media.
Among the discussions at the conference was a concern for officer-safety amidst
frequent targeting by hacker groups such as Anonymous. Specifically, the use of DOXing to
release officers or officials private and personal information. DOXing is a shortened version
of the term document tracing and refers to the research and release of a persons private
identity information.

PG. 167

Owen Berger
Several speakers talked about a technique known as geo-fencing. Geo-fencing assists

monitoring employees by using geo-location data, or Global Positioning System (GPS) data, to
contain processed information to a specified location or area. This technique can help
substantially reduce the amount of information surrounding a mass gathering, particularly
when it is of interest outside the events locale, i.e. nationally or internationally.
Analysis. The article concentrated on anecdotal evidence from a narrow variety of
sources, and mainly from one law enforcement conference. This means that any information or
points gained from the article will need to be taken strictly in the context of anecdotal evidence
from a small amount of sources, and not as industry-standard practices or theories.
Though at first appearing to be a non-sequitur, the anecdote about the Chicago police
working with Facebook to block users highlights an important public perception. Many citizens
believe that the government can force Social Media companies to block users, hand over data,
or manipulate accounts at will. This perception is of course false, but it bears repeating to law
enforcement students who may share the same perception. Any course on real-time
intelligence should start by setting realistic expectations of the advantages of Social Media
without giving the impression that law enforcement can or should manipulate Social Media in
an unethical, immoral, or unlawful way.
The author raised interesting points about the necessity of law enforcements use of
Social Media, which the research summarized as:
1) The necessity to meet the publics hunger for and ability to consume large amounts of
updated information from an official source.
2) The necessity to take advantage of the fact that mass gatherings or large events can be
easily monitored via Social Media or the Internet.
These two necessities can be further distilled into a simple axiom it is far easier to
both push and pull information with the advent of Social Medias popularity. However, this
push and pull can lead law enforcement into unchartered waters, legally and ethically. This
could impact any forthcoming course design by encouraging students to think about or consider
these legal and ethical situations prior to encountering them during the course of their duties.
Several other points raised in the article require inclusion or mention in the design or
any course on real-time intelligence through Social Media and the Internet. First, the issue of
officer safety was touched on through the discussion of DOXing. This issue, amongst others,
is important for law enforcement on a conceptual level. Law enforcement is extremely
interested in the benefits of utilizing Social Media for interaction and surveillance so
interested that the common pitfalls are often ignored. Law enforcement should use a tactical
PG. 168

Owen Berger
approach to using Social Media intelligence, i.e. carefully considering the consequences and
safety issues before rushing in.
The rest of the article consists of a recounting of the 2013 IACP Conference and the
anecdotes of several of the speakers. This part of the article could best be funneled into course
design consideration by using anecdotes and real-life situations to get resistant students to
buy-in or to realize the importance of Social Media in modern police work.

PG. 169

Owen Berger
Title. Social Media Evidence in Government Investigations and Criminal Proceedings: A

Frontier of New Legal Issues.
Summary. This article begins by discussing the importance of Social Media in todays
society. One natural extension of Social Medias rising importance is its impact on two areas,
which are the focus of this article, government investigations and criminal litigation. Evidence
used in these two processes include, among other things, photographs, status updates, a
persons location at a certain time, and direct communications to or from a defendants Social
Media account.
The initial assertion of the importance of Social Media is then bolstered by several facts
and figures about the subject. Social Media is the number one activity on the Internet, and has
increased in usage an estimated fourfold since 2006. The article continues with a myriad of
statistics about the proliferation of Social Media use in the United States and across
generations. This proliferation has led to a digital goldmine of potential evidence, the
entirety of which is available via government subpoena.
All of the information available from Social Media is also, subsequently, available to law
enforcement. In many cases, the government does not need to complete a legal request
because this information is publicly available. This public information has led to many cases in
which defendants were arrested for the photos or media they posted online. Although there
are privacy tools offered by most of the popular Social Media sites, many users do not make
use of such tools.
The authors then suggest that there are several means other than legal request
available to law enforcement to gain a defendants Social Media information. Specifically,
United States v. Meregildo, the government obtained the needed information by accessing the
Facebook page of the defendant through a cooperating witness who was Facebook friends
with the defendant. The governmental action was upheld, and the court found that although
the defendant had the expectation of privacy for personal information, that privacy was no
longer valid when sent to a friend, who ostensibly was free to do what they wanted with the
information (see also Case Law, above).
Alongside the growth of Social Media and its evidentiary value, there has been, logically,
a significant growth in government requests for this information. The authors also mention,
coincidentally, that formal training for law enforcement with regards to Social Media will
account for even more growth in such requests. As such, the evidence gained from these
requests will continue to accelerate in quantity and form of associated complications:

PG. 170

Owen Berger
Social Media evidence is the new frontier of criminal proceedings and it raises unique
legal challenges, including issues of admissibility and a defendants constitutional rights
in material that Social Media companies maintain.23
When dealing with the actual acquisition of Social Media evidence from electronic
service providers, the article states that case law is not settled. Courts will have great impact
on this legal process as the Stored Communications Act (SCA), which would normally govern
this aspect of the legal system, has not been updated to cover current technologies and media.
In a specific case, United States v. Warshak, the Sixth Circuit Court of Appeals ruled for the
defendant on Fourth Amendment grounds.
The thrust of the case had to do with electronic mail (e-mail) communications, which
the court stated were similar to traditional communication methods in the context of Fourth
Amendment protections. An important impact of this case was the insistence by most major
Social Media providers that law enforcement submit a subpoena or warrant with any electronic
records request.
The constitutionality of Social Media evidence is an ongoing struggle, exemplified by the
recent case of People v. Harris. In this case a trial court denied the request by a third-party
(Harris) to quash a search warrant for Twitter records relating to Harris Twitter account. The
court denied the motion on the grounds that the information was requested through a valid
search warrant and that once made public, the information belonged to Twitter, not to Harris
(see also Case Law, above).
The next section of the article lays out the difficulties faced by criminal defense
attorneys when they attempt to obtain or request the same Social Media evidence available to
law enforcement. The obstacles for defense counsel include the inability to access Social Media
evidence via third-party, which has been found to be unethical by that community. An
important consideration also mentioned is the ability for defense to subpoena or retrieve law
enforcements personal Social Media. A plethora of other courtroom considerations must be
taken into account, because courts may order jurors, witnesses, or third parties to produce or
manipulate their Social Media information in unique and unprecedented ways.24
The next topic in the article is the admissibility of Social Media evidence. The article
uses several examples, but settles on the simple conclusion that admissibility is being granted
quite freely, while the evidences weight and legitimacy are being left up to juries on a case-bycase basis. In a nutshell, given the huge amount of Social Media evidence and the wide variety
23
24


PG. 171

Owen Berger
of ways in which it can be gathered, published or disseminated, there is, and will continue to
be, vigorous disputes between parties that may mean the difference between ultimate guilt
and innocence.
The article concludes with a discussion about Social Media during trial and jury
considerations. Some basic rules have already been set by defense attorneys and their bar
associations. Among those rules is the allowance to conduct research via Social Media as long
as the juror in question does not receive communication, and that deception cannot be used to
gain information.
In the opposite realm as Social Media inquiries into juries, is the use of Social Media by
jurors to research defendants, victims, and witnesses. The Supreme Court of Kentucky found
that being a Facebook friend was not enough to prove bias for disqualification because those
friendships are often superficial in nature. This use of Social Media by jurors has led to
specific (and dynamic) juror instructions for the non-use of Social Media. This set of juror
instructions leads to a whole new set of considerations for judges, and can lead to penalties for
the inappropriate use of Social Media.
Analysis. This article provides valuable insight because the authors are both private
defense attorneys who work in the field of electronic discovery. Their opinions and research
help balance the majority of literature on the subject, which is focused on the use of real-time
intelligence from the law enforcement perspective.
There is no differentiation between the views of this article and other literature
regarding the importance and proliferation of Social Media in todays criminal justice
landscape. Rather, the difference between this article and other literature is that this article
concentrates on Social Media evidence gathering, use, and consequences at trial. This focused
view clarifies some of the legal considerations that police must consider when obtaining and
using Social Media evidence.
First, law enforcement should use properly-scoped legal requests (e.g. subpoenas and
search warrants) whenever possible to avoid ambiguities in case law. One such ambiguous area
surrounds the Stored Communications Act, which has not been updated with evolving
technology. Communication through Social Media is fast becoming ubiquitous, and should be
treated by law enforcement as if it were a more traditional form of communication. This
emphasis on legal requests should be impressed upon students in any course on real-time
intelligence with Social Media and the Internet. Although there are often alternate ways to
acquire identical information, students should always consider which method is least
susceptible to defense motions and most affords the target entity their constitutional rights.
PG. 172

Owen Berger
Second, law enforcement needs to be careful with Social Media evidence throughout
the process of criminal investigations and court proceedings. Current case law seems to treat
this evidence on a case-by-case basis where the jury is left to determine its credibility or
evidentiary value. Therefore, law enforcement, and real-time intelligence students, need to do
the same. Each piece of evidence should be examined throughout the justice process to ensure
that it meets current legal standards for retrieval and utilization at trial.
Lastly, apart from evidence in a jury trial, the article states Social Media can impact law
enforcement and criminal proceedings in a several ways:
Law enforcement employees personal Social Media could become discoverable if they
arent careful with their public content.
Witnesses and victims who work with law enforcement could damage a criminal case
with careless or thoughtless content on Social Media.
Jurors can be punished or harm criminal proceedings if their use of Social Media violates
jury instructions.
Therefore, students whose duties include participation in active or ongoing cases and
trials must be aware of Social Medias ability to undermine officer safety and prosecutorial
efforts. When designing a course on the subject matter, students should be encouraged to
develop a plan not only for evidence procedures, but for Social Medias possible consequences
in the courtroom.

PG. 173

Owen Berger
Title. Police probe website targeting crime witnesses.

Summary. This article, which first appeared in The Philadelphia Inquirer, discusses a
Social Media account from the photo-sharing application (app) called Instagram. The account,
entitled rats215 had thousands of followers. The account posted photos of and information
about court testimony and statements from witnesses of violent crimes in the Philadelphia
area.
Followers commented on or liked the hundreds of photos displayed on account.
Many of the statements in the photos were not matter of public record, and authorities
believed the page to be an act of mass witness intimidation. Law enforcement was puzzled at
how the statements were obtained, because they were not redacted, and in grand jury
indictments, defense attorneys are instructed not to give their clients copies of such
statements.
The District Attorneys office and Philadelphia were working to find the account owner,
and Instagram was looking into the account as well. The article concludes by discussing the
rising number witness intimidation cases that involve Social Media. Despite stricter rules on the
subject in some states, the Department of Justice called for courts to make it harder for the
public to access court documents on the Internet.
Analysis. This article demonstrates a logical progression of information and criminal
behavior. That is,
1) Prior to the Internet and Social Media, there were cases of witness intimidation.
2) Social Media and the Internet are being used to supplement or even replace
traditional methods of communication.
3) Communication between criminals and witnesses is a necessary factor for there to
be witness intimidation.
4) Therefore, Social Media and the Internet are being used to facilitate witness
intimidation.
This simplistic and obvious logical progression serves to show that Social Media can be
part of almost any crime or tactical situation. In fact, Social Media and the Internet are used
frequently during criminal activity or ongoing events because they make people feel
(sometimes correctly) that communicating online: offers anonymity, shields criminals from
being identified, and minimizes consequences.
The importance of this logical progression on real-time intelligence is to offer a different
perspective to law enforcement when considering the criminals or citizens they come across
PG. 174

Owen Berger
during the performance of their duties. Meaning, they should analyze how Social Media and
the Internet could be used by their target element to affect tactical situations or ongoing
events, or further criminal behavior. It should be impressed upon students that criminals view
Social Media as a way to put out information or communicate invisibly, even though the
information, communicator, or both, are often unhidden. This metacognitive approach to
evaluating searches and profiling behavior was mentioned by the subject matter resource in
this training needs assessment. Accordingly, this idea should be woven through the various
topics covered in the course.

PG. 175

Owen Berger
Reports and documents.

Title. (U//LES) Arizona Fusion Center Warning: Police Officers Targeted on Facebook.
Summary. This one-page report outlines findings during a traffic stop in Maricopa
County, Arizona. During the traffic stop, law enforcement recovered a compact disc (CD), which
later was found to contain photographs and other digital information. The photographs
information showed or identified over 30 Phoenix Police Department law enforcement
personnel, both sworn and non-sworn. The information was obtained from the Social Media
site, Facebook, and contained names of both uniformed and undercover personnel. The report
ends with several suggestions about how law enforcement should conduct themselves online,
including: ensure privacy settings are appropriate, dont put personal or identifying
photographs on public sites or site areas, never identify yourself as law enforcement, and
ensure your sites and settings are up-to-date.
Analysis. This article speaks directly to safety concerns for law enforcement. The same
methods used by law enforcement can find criminals online can be used in reverse. Students of
a course in real-time intelligence should be shown how to be careful online while they perform
their duties. In addition, and perhaps more importantly, students should be shown how to
manage their personal Social Media so that their professional lives and personal lives to not
become mixed.

PG. 176

Owen Berger
Title. Social Media and Tactical Considerations for Law Enforcement.

Summary. This report is organized by chapters, and the following literature review will
follow the same structure during summary. A joint effort of several organizations, this report
was created as a reaction to the ability of citizens to communicate rapidly through Social Media
for the purposes of organizing, protesting, and demonstrating. This rapid communication
reality has consequences for most things law enforcement, including public perception, crimerelated information, and data-mining pre- and post-event.
Chapter One, Developing a Strategy on Social Media, begins with a case study of the
Toronto Police Service (TPS) and their operational use of Social Media. TPS began using Social
Media in 2007 when a constable introduced a public message for the TPS Crime Stoppers
program on the popular video sharing site YouTube. Others at TPS saw the success of this
message and started to use Social Media as well, which soon turned into a consistent usage of
most of the major Social Media sites available today.
In 2010, TPS developed an overall strategy for using Social Media as a two-way
communications stream for normal duties and during adverse events. The strategy developed
into a full policy with a Corporate Communications unit that oversees departmental use of
Social Media to ensure quality control. TPS also analyzes how Social Media is used during
major events, during the event and afterwards.
One major part of TPSs strategy was identifying the right people to manage Social
Media for the department through a three-day training course. The strategy and training
experience has led the TPS to learn to not be over-sensitive in risk assessment, have simple and
clear policies, and to have the right personnel doing the job.
Chapter Two, Investigative and Intelligence Considerations, begins with a note on how
criminals are using Social Media. Agencies who wish to utilize online intelligence from criminalcreated content must consider several issues. Despite the fact that there is widespread use of
Social Media in criminal investigations, there arent a lot of legal precedents on the subject.
Social Media is used in investigations for evidence collections, location of suspects, and criminal
network identification.
For a case study in investigations, the report cites the New York Police Department
(NYPD), specifically its Intelligence and Juvenile Justice Divisions. Both monitor Social Media for
their respective domains of responsibility. Although they investigate or monitor different
things, they both primarily use the same sites: Facebook, Twitter, and YouTube. In 2012, the
NYPD, like the TPS, created a special operations order governing the use of Social Networks in

PG. 177

Owen Berger
investigations. The order included rules on the use of aliases, public domain data, and
suspected terrorist activity.
The Intelligence Division monitors Social Media networks for adverse events that could
require police and for criminal investigations. They handle requests from NYPDs precincts, and
engage constantly in crime prevention by monitoring activities like parties and other large-scale
events where criminal activity or violence could occur. For demonstrations or protests, the
Intelligence Division attempts to get factual information about locations, dates, etc and then
provides timely crowd estimates and crowd movement updates.
The Juvenile Justice Division monitors youthful offenders who belong to neighborhood
gangs (crews). They strive to provide useable information to patrol and detectives while also
looking out for beefs, or negative interactions, between these crews to prevent violence
before it starts. The majority of the activity they see is on Facebook and YouTube, with Twitter
being used by these gangs on a much smaller scale.
Unlike the TPS, the NYPD has no formal training for the personnel who use Social Media
in investigations, rather they use on-the-job training in specialized units. The NYPD does not
see Social Media use for patrol officers as a positive, and simply want patrol to have access to
the information in a simple, useable format, according to Assistant Commissioner Kevin
OConnor. This is primarily due to the belief that specialized training is need to provide the
technical skills and legal knowledge to ethically and constitutionally monitor Social Media.
Chapter Three, Flash Mob Violence and Robberies, starts with the definition of a flash
mob a group of individuals brought to one location for the purpose of performing the same
act. This same act can, and has, included criminal activity such as store robberies, fighting,
and other chaotic activities. The tie-in for this chapter to the reports subject is the fact that
oftentimes, these flash mobs are organized through Social Media. These mob participants feel
that being part of a larger crowd offers them anonymity. Conversely, Social Medias
pervasiveness also means that there are photographs, videos, and other information available
that was not available before, helping law enforcement to identify these anonymity-seeking
criminals.
There are three separate case studies for these flash mobs and related activities. The
first examines the Philadelphia Police Department and their issues with violent flash mobs. In
2010, a large flash mob at a Macys store, where almost 100 juveniles ran through, causing
damage and assaulting customers. A short time later, the same thing happened at a different
mall near Philadelphias Center City. The Philadelphia police responded with stronger curfew

PG. 178

Owen Berger
laws in conjunction with Social Media information dissemination to business organization in the
city.
The second case study deals with dance parties in downtown Minneapolis. The parties
started at downtown hotels and were advertised to young people. In September of 2011, one
of the parties got out of hand and almost 800 youths became involved in a flash mob at the
Nicollet Mall. The parties turned to worse behavior in 2012 with click mobs that would form
and assault innocent bystanders. Police in Minneapolis responded by monitoring Social Media,
sharing radio frequencies with downtown businesses, and studying or debriefing major
incidents to cull intelligence and create additional preventative measures.
Third, in Milwaukee on July 3, 2007, a group of violent people wreaked havoc after a
large fireworks celebration. During the same summer, at the State Fair, another mob caused 11
injuries and led to 30 arrests. Post-analysis showed that much of the action had been talked
about on Social Media prior to the violence. Milwaukee police now regularly monitor Social
Media, especially during summer months. Last, the report offers advice on dealing with flash
mobs, as follows:
Analyze Social Media,

Identify groups with histories of criminal activity,
Use Social Media for outreach,
Get the community involved,
Curfews,
Business district initiatives,
Prevent events,
Use other intelligence resources,
Transit enforcement in urban areas.
Chapter Four, Using Social Media to Prevent, Respond to, and Investigate Riots,
evaluates the responses to riots in the United Kingdom and Canada. This report section is
broken into three parts use of Social Media, during the riots, after the riots, and for community
outreach. The synopsis for this literature review will analyze each riot separately.
First, they examine the Vancouver Canucks riot in 2011. The hockey team lost in a final
game, and an estimated 155,000 fans converged on downtown Vancouver. Vancouver police
utilized Social Media during the riots to attempt to gather evidence. They were, however,
without an organized system for collecting or disseminating information in this context. Later
analysis showed that most of the protesters or riot participants were not organized through
Social Media, rather they were downtown already to watch the hockey game and participated
PG. 179

Owen Berger
as part of the crowd. Post-riot, the Vancouver police formed the Vancouver Integrated Riot
Investigation Team. They researched hundreds of hours of video and thousands of tips, then
combined the information into one website to process and to find violators.
On August 4, 2011, a Metropolitan Police Service (MPS) officer shot and killed a man by
the name of Mark Duggan. The incident occurred in the Tottenham area of North London, and
organized protests led to a violent riot and demonstration on August 6 th. The riot was very
large, and over 4,500 people were arrested for actions relating to the riot. MPS personnel had
not been formally trained in gathering information from Social Media, and was overwhelmed
by the amount of available information. MPS, like the Vancouver police, utilized Social Media
extensively after the riots to gather evidence of criminal behavior and to identify suspects.
The report offers a lessons learned section at the end of each individual chronological
breakdown. Here is a list overview of those lessons:
Have pre-established channels of communication,

Use experienced intelligence officers to vet information,
Ensure that the public has accurate information,
Be innovative when collecting evidence, information, and tips,
Have working relationships with Social Media providers,
Publicly appeal for information,
Create a process for handling large amounts of incoming information,
Fully vet and investigate all tips (i.e. do not take them at face-value),
Use traditional techniques for enhancing Social Medias value,
Watch out for vigilantism after mass demonstrations, protests, and riots,
Tell the public exactly how they can help with Social Media.
Chapter Five, Mass Demonstrations: The Law Sometimes Lags behind Advances in
Technology, begins with a message about being careful to balance demonstrators First
Amendment rights while responding to mass demonstrations. The protection of constitutional
rights has become even more difficult with the growth of Social Media.
The case study for this chapter involves the actions of the Bay Area Rapid Transit Police
(BART) after the shooting death of a homeless man, Charles Hill. Protests sprang up after the
shooting, and were seen as a response not only to Hills shooting, but to that of Oscar Grant
two years before and to the release on parole of former Officer Johannes Mehserle (Mehserle
shot Grant). During the subsequent demonstrations, BART police shut down cell phone service
at targeted locations in their transit system to prevent a violent outbreak. The American Civil

PG. 180

Owen Berger
Liberties Union vehemently spoke out against the actions, claiming that it violated the
protesters right to free speech.
In response to critics, BART created a formal cellular phone policy to be used in similar
situations. The California State Legislature attempted to legislate against such impediment of
cellular service, but the bill was vetoed by Governor Jerry Brown, who cited public safety
concerns.
The reports conclusion is a summation of the most important points listed above, which
include ensuring development of a sound strategy for disseminating information to the public.
Agencies should also take care when investigating with Social Media, as there are many
unresolved legal issues such as the use of aliases. Regarding flash mobs, agencies need to
anticipate activities through the analysis of Social Media, identification of criminal groups, and
use of traditional methods such as curfews. Lastly, riots necessitate established two-way routes
of communication so that police can properly anticipate, then investigate, these widespread
violent or damaging gatherings.
Analysis. This report offers a synthesis of lessons learned from a variety of case
studies. These lessons should be reviewed and incorporated into any course design on realtime intelligence for law enforcement. The following pieces of advice from the report have
been extracted because they are applicable to course design or are important pieces of
content:
Having experienced, trained intelligence personnel is important for viable gathering

and dissemination of real-time intelligence during mass demonstrations, protests, or
riots. This lesson speaks to not only the need for training in the subject matter, but
also to the need for a train-the-trainer section that teaches personnel how teach
their knowledge to others in their unit or agency.
Setting up communication lines during an emergency or mass demonstration is too
late. Those lines of communication, whether they be from the public to the agency
or vice versus, need to be established prior to the time they are needed. This speaks
to a course design that incorporates established information systems design and
vetting processes.
Similarly, there should also be an established legal policy for law enforcement
personnel. Due to the lack of governing case law and possible constitutional
violations that can occur with over-zealous intelligence efforts, there needs to be a
strong legal component in any course on the subject matter.
Engaging the community appears to be an important part of the intelligence
process. Whether prior to, during, or after a major public event, the public can
PG. 181

Owen Berger
assist with evidence, identification, and can even act as an early warning system.
Additionally, monitoring public channels and known disruptive groups can lead to
information sources that were not intended by those groups to be public.

PG. 182

Owen Berger
Title. Developing a Policy on the Use of Social Media in Intelligence and Investigative
Actions, Guidance and Recommendations.
Summary. This report, published by the Bureau of Justice Assistance (BJA), begins by
recommending that all law enforcement agencies develop a Social Media policy. The reasons
for developing a policy include protecting the agency and the public by documenting purpose
for, and limitations of, Social Media use. The constitutional rights of individuals and groups
must be protected, and a documented Social Media policy can ensure that civil liberties are not
compromised.
After citing major uses of Social Media by law enforcement, the report gives six major
elements that should be part of any policy regarding Social Media for law enforcement. The
first element of Social Media policy is to Articulate that the use of Social Media resources will be
consistent with applicable laws, regulations, and other agency policies. Rather than treating
Social Media as its own special tool, it should be treated like any other intelligence or
investigative tool. Therefore, its purpose should be clearly articulable, and its use should be
limited or authorized depending on that purpose.
The second element is to Define if and when the use of Social Media sites or tools is
authorized (as well as use of information on these sites pursuant to the agencys legal
authorities and mission requirements). Policies should include protections against unlawful
search and seizure. One example of this in action is the application of the Katz test, wherein
an agency applies a two-prong test from Katz v. United States, 389 U.S. 347 (1967). In the case
of Social Media policy, if a user has shown a desire for, or expectation of, privacy with Social
Media, then the agency should consider those communications as private. Agencies also need
to be aware of 28 Code of Federal Regulations Part 23 (28 CFR Part 23), which outlines policies
for federally funded information and intelligence systems. The code states that agencies shall
not obtain information about a specific group or individual without a nexus to criminal activity,
or the belief that ones conduct may be criminal.
The third element is to Articulate and define the authorization levels needed to use
information from Social Media sites. Law enforcement can use Social Media on three levels:
1. Apparent/Overt Use In this level, law enforcements identity or activity does no need
to be concealed. There is no two-way communication on this level between law
enforcement and intelligence subjects.
2. Discrete Use This level also does not contain two-way communication, but differs from
the level above in that law enforcement is actively seeking information in a way or
method that seeks to conceal their identity.
PG. 183

Owen Berger
3. Covert Use The covert level of use occurs when law enforcement is explicitly
concealing their identity, usually through the use of a false persona or fake profile.
As personnel engage in activities that rise in the levels of use, so should appropriate oversight,
documentation, and legal consideration.
The fourth element is to Specify that information obtained from Social Media resources
will undergo evaluation to determine confidence levels (source reliability and content validity).
Element four describes information validation and the necessity of following evaluation
procedures with information from Social Media. There is a difference between the vetting
necessary depending on whether it is for intelligence or investigations. Some Social Media
information may be difficult to validate, yet could still be valuable from an intelligence
standpoint. Law enforcement should strive to validate information from Social Media to the
fullest extent possible, especially if the information could become evidence in criminal
proceedings.
The fifth element is to Specify the documentation, storage, and retention requirements
related to information obtained from Social Media resources. Again citing 28 CFR Part 23,
Element Five states that any policy on Social Media should include regulations on information
retention. Agencies should document the basics about stored information, including use, type,
times, and specification on how the information as collected. After assessing the information
and whether or not it has a valid law enforcement purpose, the determination can be made as
to how long, if at all, such information will be stored. The report cites the requirements of 28
CFR Part 23 as a national standard and those standards should be followed when storing
information from Social Media that could be classified as intelligence.
The sixth element is to Identify the reasons and purpose, if any, for off-duty personnel to
use Social Media information in connection with their law enforcement responsibilities, as well
as how and when personal equipment may be utilized for an authorized law enforcement
purpose. This element defines the need for policy to cover off-duty conduct for personnel on
Social Media. This specifically includes a scenario where law enforcement personnel are using
their personal Social Media within the context of their law enforcement mission. Policy should
dictate if, and how, off-duty personnel can use personal Social Media for work purposes. If
they are allowed to, then that Social Media use would fall under the same guidelines as
information gathered on-duty.
The seventh and final element is to Identify dissemination procedures for criminal
intelligence and investigative products that contain information obtained from Social Media
sites, including appropriate limitations on the dissemination of personally identifiable
PG. 184

Owen Berger
information. Lastly, agencies should carefully consider how information from Social Media is
disseminated. Social Media offers a wide variety of easy ways to share information, which
means that law enforcement needs to be event more careful with how intelligence is reported,
share, or distributed. Specific protocols should be set up for this type of information, and
should take into account considerations such as confidentiality and sensitivity of the
information.
Analysis. The primary point gleaned from this report is the necessity for written policy
and guidelines that govern all aspects of Social Media use by law enforcement. The report does
a good job in breaking down the most vital elements of such a policy. Course design in the
subject matter will be impacted by this report in several ways. First, policies should not be seen
by students as optional, but mandatory, both for their protection and that of their agency.
Second, students should generate their own elements of good Social Media policy, and
compare against the elements in this report. Third, students should review current regulations,
including 28 CFR Part 23 to see the base guidelines for intelligence structures. Last, students
should recognize that policy guidelines are there to ensure that Social Media use by their
respective agencies falls into the domain of existing guidelines and law. A legal review or strong
legal component would assist with incorporating this into course design.

PG. 185

Owen Berger
Books.
Title. Social Media as Surveillance: Rethinking Visibility in a Converging World, Chapter
Six Policing Social Media.
Summary. The chapter starts with mention of Craig Lynch, the Facebook Fugitive.
Lynch escaped from a Suffolk prison, Hollesley Bay, just before Christmas in 2009. Lynch posted
on Facebook several times during the holidays, uploading photos and reiterating that he was
free. Lynch gained both followers on Facebook as well as detractors, but managed to maintain
a sort of dual life publicly online yet private offline.
Next, the book briefly examines the differences between communication and
information. In short, communication refers to actual social networking, while information is
the actual flow and collection of data. Social Media, as a distributed form of communication,
is becoming an increasingly large part of daily life. Combining the ideas of dual privacy and
publicity with the pervasiveness of Social Media leads the author to state that police can know
or retrieve a lot of information on an individual without them knowing it.
In 2011, after the Vancouver Canucks lost in the Stanley Cup Playoffs, there were mass
riots which were broadly covered in the media. Users posted massive amounts of content
(sometimes as a public shaming), and investigators were able to use this content in their
investigations. The author extrapolates that behaviors and places that used to be private, such
as the home, have become public due to the use of Social Media in these private places. We, as
a society are somewhat unprepared for the policing of Social Media, which amounts to
increasingly a feature of the regulation of everyday life.
The evolution of policing in its current state started with the modern policing ideas of
Robert Peel in 1829. The idea of a separate and distinct police force to scrutinize possible
criminal groups or individual has changed to an embedded approach, where police and the
community work together. The author sees this as an attempt to both control public opinion
and gain information.
As police surveillance technologies grow, some of them hinder the community policing
approach, such as closed-circuit television cameras (CCTV). Alternatively, Facebook and other
Social Media sites were designed to be a social tool, and police presence on those types of sites
is not a concern to most of the public. This acceptance of police on Facebook stems from a
growing belief that anything put online is public. Therefore it is the users responsibility to
determine what they do or do not post online, including information they do not want law
enforcement to view.

PG. 186

Owen Berger
Next the author discusses an interesting concept called Investigating Through

Interfaces. This concept references the complete connectivity of Social Media information. The
primary point of this concept is that information, no matter where it starts, is usually
searchable by law enforcement due to the vast amount of interpersonal communications or ties
which constitute interfaces.
The author theorizes that investigators are taking advantage of Social Media users
insecurities, which draw the users to the site in the first place. This search for security or social
acceptance extends beyond the mere narcissism of wanting to share your life online.
Investigators can use this broad information surface to conduct investigations in a way that
they were never able to before. Police use Social Media for investigations by scrutinizing
information and media that was originally shared by the user with a sense of intimacy,
whether real or perceived.
Police can gain information from a users accounts through legal request to technology
companies such as Facebook, Twitter, and Myspace. These requests, which are becoming more
frequent, and easier to author, are changing the way people view their enclosed online lives.
Essentially, what once was private or expected to be private is no longer because of the
relentless mining of Social Media for evidence by law enforcement.
In addition to investigating online, police are also building a presence on Social Media,
using it as a platform to disseminate or request information. The author surmises that police
use of Social Media, regardless of the purpose, enhances their ability to institutionally scrutinize
the populations they serve, or oversee. The author views this development as creating a
larger gap of inequality between police and the public, A domestic network of technologies,
once thought to empower citizens, now amplifies existing inequalities.
Next, the chapter delves into the realms of traditional police work that have extended
into the realm of Social Media. Wiretapping, community policing, undercover policing, and
criminal informants have all found a place on Social Media and the Internet. Just as in real life,
Social Media users now have consider their online communications the same way do they do in
real life. Meaning, a criminals natural paranoia now extends into the online world.
Not only does traditional policing extend into Social Media, but now the reverse is also
true. New technologies, such as facial recognition by Facebook, have given police options that
they did not have before, that arent merely supplementing new practices but creating them.
Real-time tracking and mapping of locations through the use of new technologies has given
police an entirely different avenue, providing consistent visibility and a constant flow of
information.
PG. 187

Owen Berger
The chapter ends with a summary of how Social Medias online enclosures, once
thought to be private, have become open for police investigations and surveillance. The author
ponders how far this visibility shift will go, and wonders if the heightened surveillance of
everyday life will lead to more profiling or more crime anticipation tactics. Lastly, policing
Social Media to a degree where evidence is paramount, even over social relationships, will lead
to users policing their own networks, especially the criminal element.
Analysis. The author is clearly worried about the policing of Social Media. He is
concerned, from a sociological standpoint, that this possibly overzealous mining of Social Media
for evidence will have unintentional consequences for both Social Media and law enforcement.
Criminals, and even citizens in general, could start to censor each other to an extent that
negates the utility of Social Media for law enforcement. Meaning, if law enforcement is
overzealous in their quest for information from Social Media and the Internet, they could push
unknown or unintended barriers into their own way. The impact of this on course design is the
need to impress simple restraint upon students. Law enforcement has been given a new
intelligence-gathering tool in Social Media, overuse of which could lead its non-viability as an
information source.
Another effect on course design is the need for students to be metacognitive in their
use of Social Media as an investigative tool. As Social Media changes or presents new avenues
of communication, law enforcement must adapt to use these changes, or to use existing tools
with these dynamic communications.
Lastly, the author views, pessimistically, the use of Social Media for community
engagement and other non-investigative actions by law enforcement as simply an extension of
police surveillance or oversight. However, the author is not a member of the law enforcement
community and the concerns in the book chapter must be taken at face value and should be
noted or covered in the course design. Law enforcement should be careful to maintain the
public trust while engaging in activities on Social Media or the Internet. As mentioned
previously in this literature review, law enforcement should define a set purpose for any
activities on Social Media. They should remind themselves of their stated purpose while
engaging in those activities so as to not blur the lines of constitutionality and ethical behavior.
A strong course section on legality and ethics could help law enforcement with this purposedriven goal setting.
END, Results and Analysis

PG. 188

Owen Berger
Conclusion
The proposed course on real-time intelligence with Social Media and the Internet has a
proven need for law enforcement in California. Societys use of Social Media has risen
dramatically, and creates a global information flow for every single citizen with Internet access.
The pervasiveness of Social Media in the United States has extended to modern societys
criminal, disruptive, and chaotic elements. Law enforcement needs to employ unified
measures and a constitutionally sound response to responsibly and ethically monitor these
individuals and groups online activities. A course in the subject matter will assist greatly in
that response, and, by showing students how to teach others, this courses content will reach a
large audience faster than conventional courses.
The research from this Training Needs Assessment (TNA) shows multiple reasons why a
course is needed on gathering and disseminating real-time intelligence from Social Media and
the Internet. First, there is no existing course dedicated to the subject matter despite the fact
that there is a strong need for one a fact which is reinforced by the research conducted in this
TNA. Second, in addition to the general subject training gap, the research shows a need for
course content that modifies or supplements existing intelligence systems or approaches to
intelligence within California law enforcement.
To review, this training needs assessment consisted of three data sources: interviews
with subject matter experts (SME) and subject matter resource (SMR), an online law
enforcement survey, and a literature review on the subject. The data provided by these
sources contained important aspects of both course design and course content, distilled and
listed below.
Course Content Considerations
Legal or case law knowledge The subject matter experts and resource interviews
touched on the need for legal knowledge when gathering real-time intelligence. One
example of the need for this knowledge is concern that overzealous informationgathering that could lead to reactive case law that would impede law enforcement (see
SME No. 4). The literature review drove this point home even further, particularly with
regards to policy design and implementation, which should follow agency, local, state,
and federal guidelines and laws.
Internet search skills The subject matter expert and resource interviews stressed the
need for basic Internet training for all personnel. Though the survey respondents
rated themselves highly on their Internet skills (see Question No. 8), the majority also

PG. 189

Owen Berger
believed that it would be important to include course content regarding online search
skills (see Question No. 12-g).
Monitoring Social Media and the Internet for intelligence or information This subject is
perhaps the most necessary element of proposed course content. The data sources in
this TNA called for specific monitoring of (in order of importance and need): planned
and spontaneous events, criminal investigations, community reactions or feedback, and
people or organizations. This assessment is supported by the survey (Questions No. 2,
No. 6, No. 12, No. 13, and No. 15), as well as the subject matter experts and the
literature review. Criminal investigations were marked as significant, but course content
in this regard could overlap with existing training, and should be careful not to duplicate
existing course content.
Training on how to train others A train-the-trainer section of course content could
have an exponential effect for the impact of this course on California law enforcement.
The survey (Questions No. 3 and No. 10) showed the respondents desire to teach
others the knowledge learned in this course. In addition to the survey, the subject
matter expert interviews demonstrated a clear need for training that produced trainers,
due to the commonly voiced necessity for basic training for all law enforcement in
California. Not only would this train-the-trainer section assist with the spread
(breadth) of training, but it would ensure that those who are using real-time intelligence
are prepared for the common legal and systematic challenges facing this type of
intelligence-gathering (depth).
Developing policy on Social Media and the Internet A key component of real-time
intelligence for the subject matter experts and the collective authors in the literature
review was the constitutional protection of both law enforcement and citizens. The
literature indicated that this protection could be obtained through well thought out
policies with a targeted purpose (or pre-defined reason) for gathering real-time
intelligence. This course content might be presented side-by-side with the legal section
mentioned above. In a sense, this content is how legal, privacy, and liability issues
should apply to the actual act of gathering, storing, and sharing real-time intelligence by
law enforcement.
Designing and implementing information systems All three data sources informed of a
need for more effective information and dissemination practices. The survey (Questions
No. 10 and No. 11) reported that most respondents thought notification and vetting
systems would be important to learn at this type of training. The subject matter experts
were a mixed bag of current structures, with systems based on phone, e-mail, or no
system at all. One report in the literature review gave case studies of major events, and
one of the key lessons learned was to have intelligence systems in place prior to a
PG. 190

Owen Berger
major event. Students in this course should be able to help their organizations put such
a system in place.
Course Design Considerations
Generational In Question No. 1(e), average respondent ages and experience were
calculated based on assumed starting age in law enforcement. The numbers showed
that a majority were in Generation X. A smaller percentage of respondents were
Millennials and Boomers, though they were proportional to each other. This indicates
that course design should be geared towards Generation X, along with somewhat less
design consideration given to Boomers and Millennials. However, course design
considerations should not be static, and the number of Millennials will be increasing
annually, which means that learning characteristics of the Millennials should have an
increasing prominence in course design and course updates.
Positional The number of personnel from certain positions was estimated in Question
No. 11. They were projected to attend a course in the subject matter in the following
order, from most to least: Detectives, Specialized Personnel, and Patrol. However, given
the desire for universal training by the subject matter experts and subject matter
resource, it would not be surprising to see more patrol personnel than was indicated in
the survey. The literature review also indicated that training was essential to successful
deployment of intelligence resources and units, so more dedicated intelligence
personnel could also be expected.
Search skill level As stated in the course content section above, Internet search skills
should be part of the curriculum. However, the survey respondents stated that they
were already proficient, while simultaneously stating that their colleagues were not.
Respondents and subject matter experts agreed that Internet search skills should be
included in course content. Furthermore, search skills will most likely vary from student
to student each class. Therefore, perhaps this dichotomy of estimated search skill
strength should be incorporated into course design by created lessons or activities that
can be utilized by both proficient and novice searchers. Another possible way to handle
search skill level would be to use a search skill course pre-requisite where students
show that they are capable of handling basic search skills prior to attending the course.
Personnel and budget constraints All data sources indicated that personnel and budget
constraints were major barriers to law enforcements use of intelligence from Social
Media and the Internet. Therefore, course design should assist students in dealing with
not enough personnel and a limited budget. This could impact the time spent on free
online tools vs. paid or commercial applications.

PG. 191

Owen Berger
Nomenclature Surprisingly, the only subject that survey respondents found challenging
during technology training was the understanding of terms and nomenclature when
they were used without being defined first. Hand-outs for, digital materials with, and
consistent strong review of unfamiliar terms and nomenclature would help alleviate this
student-centered difficulty.
Critical Thinking Information from the subject matter experts, subject matter resource,
and the current literature suggested that an important component to dealing with
dynamic technology and legal decisions is the ability to critically examine the methods
and techniques used by modern law enforcement. Therefore, course design should
incorporate at least a supplemental component of critical thinking as applied to
gathering and disseminating real-time intelligence.
The proposed course will be a major part of building a strong movement in law
enforcement to keep up with dynamic information and communication methods. As stated
previously, the survey, subject matter experts, and literature review all showed an absolute
need for this kind of training which does not currently exist for California law enforcement.
At the end of this course, students will be able to monitor ongoing events to ensure quick and
safe action by their agencies. In addition, students will be able to show their individual
organizations how to develop policies and information systems that comply with existing laws
and guidelines. The courses impact will go beyond the proposed content, and will start an era
of thoughtful, dynamic Social Media and Internet use by law enforcement in California.
END, Conclusion

PG. 192

Owen Berger
Glossary
Some of the terms and nomenclature used in technology can be difficult to understand
especially without context or introduction. The following terms are used throughout this
Training Needs Assessment (TNA). They are not meant as strict definitions, but rather as a
starting point for defining complex subjects.
Information. Knowledge that you get about someone or something, facts or details
about a subject.25 For the purposes of this TNA, it is not assumed that the knowledge, facts or
details are accurate or correct.
Intelligence. Any information that can be used in an organizations decision-making
processes.
Real-time Intelligence. Intelligence that is processed as soon as practicable after its
broadcast, regardless of the medium.
Cyber-monitoring. Gathering information with Social Media or the Internet.
25
(Merriam-Webster, 2014)

PG. 193

Owen Berger
Arizona Counter-Terrorism Information Center. (2010, October 29). (U//LES) Arizona Fusion
Center Warning: Police Officers Targeted on Facebook. Retrieved March 7, 2014, from
https://publicintelligence.net: https://publicintelligence.net/ules-arizona-fusion-centerwarning-police-officers-targeted-on-facebook/
This document was published as a warning to law enforcement in the United States.
The warning outlines a traffic stop wherein digital evidence was found that contained
photographs of law enforcement personnel. All of the photographs were retrieved from
the Social Media site Facebook.com. The warning serves as a reminder of the dualnature of Social Media visibility for law enforcement. That is, just as law enforcement
can view criminal activity and profiles online, the criminal element can conduct the
same type of research on law enforcement. This report was used by this research to
demonstrate the real-world necessity for thinking on officer safety when using Social
Media.
Bureau of Justice Assistance, Office of Justice Programs, United States Department of Justice.
(2013). Developing a Policy on the Use of Social Media in Intelligence and Investigative
Actions, Guidance and Recommendations. United States Department of Justice, Bureau

PG. 194

Owen Berger
of Justice Assistance, Office of Justice Programs. Global Information Sharing Initiative.

Retrieved April 21, 2014, from https://it.ojp.gov/docdownloader.aspx?ddid=1826
This jointly-produced report is aimed at guiding organizational policy regarding Social

Media use for intelligence and investigative actions. The report provides an overview of
how Social Media has become useful for law enforcement. The report then delves into
the reasons for proactive Social Media policy, including privacy, civil rights, and civil
liberties. The delivery strategy for this reports content is a list of seven necessary policy
elements, in paragraph format. The report concludes with an appendix that contains
several versions of current policies that 1) were referenced during the article, or 2) are
for the readers continued reference. This report was used as a basis for the formation
of course content, specifically policy elements for the third course task, Develop Social
Media Policy.
California Peace Officer Standards and Training. (2014, June 18). California POST Course
Catalog. Retrieved March 24, 2014, from Commission on Peace Officer Standards and
Training: http://catalog.post.ca.gov/
This website contains a full listing of available California Peace Officer Standards and
Training (POST) courses. The list was used to find courses with Social Media content, so
that the course created with this ISD was not redundant. The list of courses with

PG. 195

Owen Berger
content on Social Media are listed in the background section of the Training Needs
Assessment, Table No. 1.
CNN (Cable News Network). (2011, May 5). American generations through the years. Retrieved
April 13, 2014, from www.cnn.com:
http://www.cnn.com/interactive/2011/05/living/infographic.boomer/
This website contains an infographic that shows, as the title states, a graph of
American generations across several decades. This infographic was used to correlate
the two primary yet different definitions of generational starting and ending years
introduced by the Pew Research Center, and Strauss and Howe. This information was
used to create the data for the Respondent Generational Breakdown.
Cromer v. Lexington/Fayette Urban County Government, 2008-CA-000698-MR (Commonwealth

of Kentucky Court of Appeals April 10, 2009).
In the Cromer v. Lexington/Fayette Urban County Government decision, a law

enforcement officer was terminated by the governing city council after the officer
posted inappropriate material on Social Media after self-identification as a law
enforcement officer. The original trial court ruling was upheld, and the termination was

PG. 196

Owen Berger
found to be valid. This case was used in this ISD to show the blurred lines between
personal and professional Social Media for law enforcement. This case also shows the
possible employment repercussions of violating an employers misconduct rules,
whether intentional or not.
Garcetti et al. v. Ceballos, 547 U.S. 410 (2006) (Supreme Court of the United States May 30,
2006).
In the Garcetti et al. v. Ceballos decision, a deputy district attorney sued his employer
based on 1st and 14th Amendment issues. The deputy district attorney, Ceballos,
claimed that he had been retaliated against for writing a memo critical of a search
warrant that was being used in an ongoing case. In this case, the retaliation was reassignment of duties and transfer to a different courthouse. The Supreme Court of the
United States later ruled on appeal that Ceballos right to free speech was not infringed
upon as his comments were made during the course and scope of his employment.
Garcetti v. Ceballos was used in this ISD to clarify the role of free speech in the course of
law enforcement employment. This case expands upon Pickering v. Board of Education,
and will assist course attendees in determining their specific role (citizen versus
employee), and the possible consequences, when using Social Media to disseminate
information.

PG. 197

Owen Berger
Internet World Stats. (2010, June 31). United States of America Internet and Facebook Users
Stats. Retrieved March 5, 2014, from www.Internetworldstats.com:
http://www.Internetworldstats.com/stats26.htm
This website was used to gain base statistics on usage of the Internet and
Facebook.com. These statistics were used to show the widespread use of Social Media
in modern society, and how that use translates into an information source for law
enforcement.
Keenan, V. M., Diedrich, D., & Martin, B. (2013, June). Developing Policy on Using Social Media
for Intelligence and Investigations. PoliceChief Magazine (80), 28-30. Retrieved March 7,
2014, from
http://www.policechiefmagazine.org/magazine/index.cfm?fuseaction=display_arch&art
icle_id=2951&issue_id=62013
This article was written by several employees from the Georgia Bureau of Investigation,
and discusses policy development for law enforcement and its use of Social Media for
intelligence. The article gives examples of current policies, how they were formed, and
then discusses several key issues regarding policy development, including: policy

PG. 198

Owen Berger
purpose, levels of use, reliability and validity of information and intelligence,

documentation, and off-duty conduct. The article was used as a basis for the formation
Media Policy.
Konop vs Hawaiian Airlines, Inc., 236 F.3d 1035 (2001) (United States Ninth District Court of
Appeals January 8, 2001).
In Konop vs Hawaiian Airlines, Inc., the plaintiff (Konop) created a website critical of his
employer that was accessible only by other pilots and only by entering a username and
password and accepting the sites terms of service. A Hawaiian Airlines management
official accessed the website using a pilots login credentials (with permission) and later
disclosed website content. The 9th Circuit United States Appellate Court held, under
the Wiretap Act, that the airlines official was not authorized to view or intercept the
electronic communications. The court also held, under the Stored Communications Act,
that the login credentials used by the airlines official were not valid for third-party
permission as they had never been used by the original recipients.
This case, much like Garcetti v. Ceballos, helps to clarify what actions can and cannot be
undertaken by employees. Although this case deals with a private employers, it deals
specifically with an Internet site. The interesting part about this case is that it deals with

PG. 199

Owen Berger
relatively old legislation to attempt to settle case law for newer technology and
employment issues arising out of that technology.
Lipp, K. (2013, October 28). How Police Use Social Media To Monitor, Respond to, and Prevent
Mass Gatherings. Retrieved March 7, 2014, from https://kennethlipp.wordpress.com:
http://kennethlipp.wordpress.com/2013/10/28/how-police-use-social-media-tomonitor-respond-to-and-prevent-mass-gatherings/
Found during an online search, this article is a focused look at law enforcements use of
Social Media to monitor special events. The articles uses photographs and real-life
examples to discuss tactical and policy considerations for law enforcement with regards
to the use of Social Media and the Internet for monitoring protest or protest-like events
and those people associated with the events. The article mainly follows the proceedings
at the 2013 International Association of Chiefs of Police conference, and was used to
gather anecdotal evidence of current trends in intelligence use by modern law
enforcement.
Merriam-Webster. (2014, June 18). Information - Definition and More from the Free MerriamWebster Dictionary. Retrieved June 18, 2014, from Dictionary and Thesaurus - MerriamWebster Online: http://www.merriam-webster.com/dictionary/information

PG. 200

Owen Berger
This Internet page is from the online dictionary from Merriam-Webster. The definition
for the word information was copied from this page for use in the glossary section of
this ISD.
Murphy, J. P., & Fonticella, A. (2013, April 3). Social Media Evidence in Government
Investigations and Criminal Proceedings: A Frontier of New Legal Issues. Richmond
Journal of Law & Technology, 19(3), 1-30. Retrieved March 7, 2014, from
http://jolt.richmond.edu/v19i3/article11.pdf
This article delves into the nuances of law enforcements use of Social Media and the
subsequent impact on criminal case law and proceedings. Among the topics discussed
are: digital evidence admissibility, the Stored Communications Act, criminal defense and
defendants rights, and the effect or impact on juries. The article gives many current
examples of case law, including several that were included in the TNAs literature
review. This articles provided valuable insight from private sector attorneys who
practice in defense law. This point-of-view gives breadth to not only the literature
review, but to the course content by acknowledging concerns of those in the criminal
justice system who are not in law enforcement.

PG. 201

Owen Berger
People of the State of New York v. Malcolm Harris, 2011NY080152 (New York Criminal Court
June 30, 2012).
People v. Malcolm Harris was a case that originated during the Occupy Wall Street
movement in New York during 2011 and 2012. The City of New Yorks District Attorney
subpoenaed the Twitter (a Social Media site) records for Harris, a protester during the
Occupy Wall Street movement. The District Attorney was seeking a charge of disorderly
conduct against Harris, the defendant. Harris attempted to quash the search warrant on
1st and 4th Amendment grounds. However, the courts ruled with the District Attorney
and the defendants Twitter records were eventually provided to the District Attorney.
This case is important to this course because it is settled case law on an aspect of exactly
what this course will be teaching students. That is, if students are to gather intelligence
and attempt to retrieve evidence, this case demonstrates how to verify who owns that
evidence or information. As far as course content, this case shows (1) the power of a
legal subpoena, and (2) the need for law enforcement to read and understand private
companies legal publications, such as Terms of Service or End User License Agreements.
Police Executive Research Forum (PERF) and the United States Department of Justice, Office of
Community Oriented Police Services. (2013). Social Media and Tactical Considerations
for Law Enforcement. Washington, DC: Office of Community Oriented Policing Services,

PG. 202

Owen Berger
United States Department of Justice. Retrieved March 6, 2014, from

http://www.policeforum.org/assets/docs/Free_Online_Documents/Technology/social%
20media%20and%20tactical%20considerations%20for%20law%20enforcement%202013
.pdf
A joint effort of several organizations, this report was created as a reaction to the ability
of citizens to communicate rapidly through Social Media for the purposes of organizing,
protesting, and demonstrating. This rapid communication reality has consequences for
most things law enforcement, including public perception, crime-related information,
and data-mining pre- and post-event. The report focuses on several case studies that
come in the form of either a law enforcement organization that uses Social Media or a
tactical situation that necessitated the use of Social Media. These case studies (and this
report) were used in this ISD to draw several conclusions that were necessary for a
course in real-time intelligence. Perhaps the most important of the conclusions drawn
from this report was the need for an intelligence system to be established prior to an
event occurring.
Saba, J. (2013, August 13). Facebook reveals daily users for U.S. and UK, data aimed at
advertisers. (T. Reinhold, Ed.) Retrieved December 4, 2013, from www.reuters.com:

PG. 203

Owen Berger
http://www.reuters.com/article/2013/08/13/us-facebook-usersidUSBRE97C0WY20130813
This site was a news article that showed Facebook user statistics, which were important
for this ISD in establishing the ubiquity of Social Media in todays society. Although the
article has a financial focus, the statistics and user habit information were important to
this ISD as a (relatively) current resource for information on the most popular Social
Media sites.
Trottier, D. (2012). Social Media as Surveillance: Rethinking Visibility in a Converging World.

Farnham, Surrey, England: Ashgate Publishing Limited. Retrieved March 7, 2014, from
http://books.google.com/books?id=DOYjUNHs6yEC&pg=PT2&source=gbs_selected_pag
es&cad=3#v=onepage&q&f=false
This book is an extensive look at interpersonal communications via Social Media and
how people and organizations use these communications. It is a study on Social Media
and the intelligence gained with it from many of todays important perspectives. The
book starts with focus on the individual, then builds to institutional uses of Social Media
as surveillance, then delves into issues such as marketing and police uses. The last
chapter, entitled Policing Social Media, is what drew the attention of the researcher.

PG. 204

Owen Berger
This book chapter was chosen for the research as an in-depth look at the subject matter,
written with an outside-of-law enforcement viewpoint by a Postdoctoral Fellow of
Social and Digital Media at Westminster Universitys Communication and Media
Research Institute. The key takeaway from this article for this ISD was the limited-scope
approach that must be taken by law enforcement with regards to monitoring the public,
leading to purpose-driven course content.
United States Department of Justice, Bureau of Justice Statistics. (2008). Home | Law
Enforcement | Local Police. Retrieved April 13, 2014, from http://www.ojp.usdoj.gov:
http://www.bjs.gov/index.cfm?ty=tp&tid=71
This site was found during an online search for size statistics and data on law
enforcement in the United States. The data retrieved was used exclusively when
analyzing the response to the TNA survey question about estimated organization size.
Neither the survey data nor this article were used as a basis for course content or
design.
United States of America v. Anthony Douglas Elonis, 12-3798 (United States Court of Appeals
for the Third Circuit June 14, 2013). Retrieved June 17, 2014, from
http://www2.ca3.uscourts.gov/opinarch/123798p.pdf

PG. 205

Owen Berger
U.S. v. Elonis deals with the First Amendment and threats made online. Anthony Elonis
made specific sexual and threatening remarks against is estranged, then ex-, wife.
Elonis made the threats on Social Media, on Facebook.com. Elonis and his ex-wife were
not friends on Facebook, and this case seeks to determine when a threat online
becomes criminal. The case was used in this research because it is ongoing and shows
the importance of law enforcement being aware of changes in laws and legislation when
monitoring Social Media and the Internet for intelligence.
United States of America v. Joshua Meregildo et al., 11 Cr. 576 (WHP) (United States District
Court - Southern District of New York August 10, 2012).
In the case of United States vs Meregildo, a defendant named Melvin Colon attempted
to suppress evidence against him that was obtained via the Social Media site Facebook.
The government gained access through a Facebook friend of Colons, who allowed the
government to view the Facebook posts made by Colon. The court ruled against Colon,
stating that although Colon has an expectation of privacy with regards to private posts,
that privacy does not extend to the Facebook friends who are free to do as they
please with the shared information.

PG. 206

Owen Berger
U.S. v. Meregildo demonstrates, for the purposes of this ISD, how information flow can
determine the privacy of information. The case also demonstrates how information can
become part of the public domain despite the intentions of the content originator. Law
enforcement should be weary of where information comes from and its original privacy
attentions in order to avoid complications during criminal investigations or proceedings.
Whelan, A., & Newall, M. (2013, November 9). Police probe website targeting crime witnesses.
Retrieved March 7, 2014, from http://www.philly.com: http://articles.philly.com/201311-09/news/43827173_1_witness-north-philadelphia-instagram
This news article covers the publication of witness information on an anonymous Social
Media account for the mobile application Instagram. The issue, as described by
Philadelphia police and prosecutors is the leaking of protected or private information
about police investigations in an attempt to intimidate witnesses in ongoing criminal
investigations. This article was used in the research to show how Social Media has
become so pervasive in modern society that it is even being used to facilitate criminal
activities such as witness intimidation.
YouTube (Google, Inc.). (2014, March 5). Statistics. Retrieved March 5, 2014, from
www.youtube.com: http://www.youtube.com/yt/press/statistics.html

PG. 207

Owen Berger
YouTube.com is the largest video-sharing website in the world. Content ranges from
comical sketches to real video of dangerous situations and events, including videos with
subjects pertinent to law enforcement, such as protests and criminal event. This specific
site gives YouTube usage statistics, and was used to show the proliferation of Social
Media in todays society.
END, Training Needs Assessment

PG. 208

Owen Berger
Priorities
The data from the Training Needs Assessment (TNA) clearly indicated several existing
training deficiencies related to gathering and disseminating real-time intelligence associated
with Social Media and the Internet. The TNA employed several different methodologies,
including a wide-ranging peer survey, interviews with subject matter experts and subject
matter resources, and a literature review of articles, case law, books and reports related to the
subject matter. The data from those methodologies revealed the following needs for law
enforcement training in real-time intelligence: monitoring for intelligence, legal application,
train-the-trainer content, intelligence system policy and design, and critical thinking. These
priorities are listed in order or importance and explained in detail below.
Monitoring for Intelligence and Information
The primary focus for a course on real-time intelligence will be for students to learn the
mechanics of how to actually gather and disseminate the information from Social Media and
the Internet. This priority is applicable to special events, criminal investigations, specific
groups, department awareness, gang feuds, or otherwise harnessing the power of Social Media
for law enforcement need. In addition, this priority has been identified as the key course
component for this training.
The research also identified several additional priorities (listed below) which are
supplemental to this primary course goal. Students must understand how to monitor
developing situations using little more than a computer or mobile device and an Internet
connection. Therefore, students will not only receive training on gathering real-time
intelligence, but they will also receive hands-on training with real-world scenarios to help them
practice their skills throughout the entirety of the course.
Legal Knowledge and Application
The dynamic online technologies used by law enforcement are so new and evolve so
frequently that existing legislation and case law have not caught up to the many ways in which
they are being used. Students must learn how to apply legal knowledge during their
intelligence-related duties for several reasons. The first reason is simple protection against
liability for the individual and the organization. Second, students must use Social Media for
intelligence-gathering in a constitutional manner that does not invite reactive or limiting new
law. Lastly, knowledge of the law will help students to construct sound policies and intelligence
systems that reduce the likelihood of unwitting or malicious abuse by law enforcement
personnel.
Table of Contents
PG. 209

Owen Berger
Rather than creating one section of course content on the legal and liability issues
surrounding real-time intelligence, this particular priority should be spread out and taught
beside related course content. Meaning, each section or course content will have its own
subsection pertaining to law specific to that section. This method will decrease student fatigue
on case law and liability issues, while offering a more targeted approach to applying current
case law and legal issues to different aspects of real-time intelligence for law enforcement.
Training on How to Train Others
As of this writing, there is no course dedicated to gathering or disseminating real-time
intelligence with Social Media and the Internet available through Californias Peace Officers
Standards and Training (POST). Because of the rapid pace in which technology is advancing,
training for law enforcement is continually struggling to keep up with the new ways in which
the Internet is utilized. Therefore, any training on this subject should include a module on
training others to monitor and use Social Media and the Internet.
This train-the-trainer course section will enable any personnel who take the course to
not only bring their knowledge back to their home agency, but it will also give them the skills
and tools necessary to effectively share their knowledge with others in their organization or
partner organizations. This type of training will have an exponential effect on the reach of realtime intelligence training thereby putting law enforcement knowledge on par with that of
societys subversive and criminal elements. In order to achieve this content goal, students will
create several lessons while critically thinking about their future students specific learning
needs and characteristics.
Designing Intelligence Systems
Recent major events, including the Vancouver hockey riot in 2011, the post-Zimmerman
trial protests and the Christopher Dorner manhunt have taught law enforcement that having an
intelligence system in place before major events occur is paramount to effective resolution of
these large-scale situations. It is critical for law enforcement to learn how to consume or take
in the massive amount of information found by the community and their own personnel then
prioritize those tips or leads and vet them if possible. Therefore, any course on real-time
intelligence should give students the tools to design and implement intelligence systems at
their own agency. In this course, students will receive hands-on practice by designing a system
for their own agency. This practice system will give each student a ready-to-use exemplar that
can be taken back to their respective agencies for immediate use.
Table of Contents
PG. 210

Owen Berger
Developing Social Media Policy

In todays litigious society, law enforcement must take extra precautions when
designing or implementing any type of information system. This is particularly true when the
system is rife with legal consequences and constitutional issues as it is when using real-time
intelligence from Social Media and the Internet. This course component is a supplemental
section that serves as glue between applying legal knowledge, designing systems, and
monitoring Social Media. Well-written policies can protect officers from liability and insulate
organizations from undue scrutiny or unscrupulous employees. Therefore, students will be
given the chance to create several policies, taking into account different perspectives from both
inside and outside law enforcement.
Critical Thinking
Just as a train-the-trainer section will amplify the reach of this training, critical thinking
will amplify the effectiveness of such training in assisting law enforcement. A constant
metacognitive state while completing the above-listed priorities will help law enforcement
navigate the dynamic world of communications technology. Both changing laws and changing
technologies for gathering and disseminating real-time intelligence necessitate a law
enforcement work-force that is capable of analyzing the way they fulfill their duties and
modifying their methods accordingly.
This need translates into a course-wide use of critical thinking during the performance
of additional tasks. Just as with the legal component, this component will not be an individual
section, but rather a smaller component of each module. Students can practice analyzing and
assessing not just what behaviors they are being asked to demonstrate, but how they are
performing those behaviors and how they could change their actions or thought process
depending on the situation.
For example, the application of this type of thinking can lead to more performant
searches in the face of protest groups who are constantly attempting to hide their intentions or
use misdirection. Rather than just searching for the name of a protest or demonstration group,
one could review the organizations online history and look for unique posting patterns that
could help to predict how that organization is going to broadcast information for their next
demonstration.
Table of Contents
PG. 211

Owen Berger
Note - The instructional design will address the aforementioned priorities by breaking them
down into individual course sections with specific student behaviors, or tasks, as the central
focus of each section. The students will be evaluated on how they perform each task, usually
during an evaluated activity at the end of each course module. Two of the priorities, applying
legal knowledge and critical thinking, will be utilized during the other tasks rather than being
their own section of content.
Table of Contents
PG. 212

Owen Berger
Constraints
A course in real-time intelligence spawns several obvious constraints centered on
Internet availability, Internet speed, and Internet-capable devices. Additional considerations
for such a course include location, qualified instructors, and preparation requirements for
proper evaluation or testing. The following items have been identified, in order of importance,
as real-world constraints for a course on gathering and disseminating intelligence from Social
Internet or Wireless Fidelity (Wi-Fi) Connection Speed
The primary limiting factor for this course will be Internet connectivity and speed.
Students will be expected to rapidly find and share information from Social Media and the
Internet, which cannot happen with slow Internet. There are several reasons why Internet
speed is a critical factor for a technology course:
Students rapidly become frustrated and lose interest in the course if they are not
able to follow along during student activities or with the instructor during live
demonstrations.
Students will learn far less if they simply watch the instructor monitor real-time
intelligence as opposed to experiencing, for themselves, the methods and
techniques used during the course.
Activities that take a certain amount of time with relatively fast Internet speed take
longer with poor Internet speed, which increases student boredom and fatigue while
decreasing the amount of time that could be spent on other subjects or tasks.
Due to the above-listed reasons, it is critical that any presenter and instructor for this
course understand the absolute necessity of requesting, receiving, and testing the Internet at
any course location or classroom. Presenters should be advised that the course will not
function without functioning Internet connectivity, and that, if necessary, funds should be
diverted to that aim rather than other amenities. Presenters and instructors should look and
test for a minimum average speed of forty mega-bits-per-second download speed (40 mbps).
The upload speed is not as important for this course as the majority of activities and material
will consist of finding and searching for (downloading) information rather than disseminating it
to the outside world (uploading). Accordingly, the minimum upload speed should be ten megabits-per-second (10 mbps).
Table of Contents
PG. 213

Owen Berger
Instructor Competency and Availability

A course in real-time intelligence needs instructors who are capable of navigating the
Internet and Social Media sites with ease on multiple different devices and operation systems.
The reason for this is that in addition to demonstrating Internet or Social Media navigation on a
projector system, the instructors will need to show the less technically savvy students how to
navigate on their own devices and operating systems. Some of the requirements for instructors
would be the ability to use multiple operating systems such as Windows 2000/NT/Vista/7/8,
Chrome OS, and Macintosh (Mac) OS/OSX/OSX Lion. The instructors should also be familiar
with the capabilities and limitations of the different Internet browsers available, including
Google Chrome, Mozilla Firefox, Microsoft Internet Explorer, and Apple Safari.
Due to the specific technical requirements for an instructor, and considering the backlog of training (no current course exists) in gathering real-time intelligence, the ratio of
instructor availability to need will be relatively small. Therefore, every effort should be made to
find multiple sets of instructors who can teach during varying days and times of the week. The
fact that students will need more assistance during the monitoring portion of the class means
that there should be at least two instructors for Module One, which focuses on the monitoring
of Social Media and the Internet for intelligence and information.
Existing Organizational Policy
Many organizations, in an attempt to curb abuse and non-work related activity, have
limited or denied Internet access to their employees. For the purposes of a course on real-time
intelligence, it is imperative that students come with the ability and allowance to freely access
Internet websites of all kinds. For example, one website called TheHoodUp.com, uses
pornography as advertisements while hosting a message board for gang members and gang
topics. Despite the advertising, the site can provide valuable gang-related information to law
enforcement. Therefore, any organizational restrictions on Internet usage, whether policymandated or hardware-enforced, should be lifted, removed, or excused for the duration of the
real-time intelligence course.
One problem with unlimited Internet access should be addressed during the course.
Students with free time to work on activities might opt to access unrelated sites during the
course. Therefore, students should set their own rules and be their own enforcers when it
comes to staying on task. This could be accomplished with an initial rules-setting session
facilitated by instructors but led by the students. Additionally, instructors should be prepared
to guide off-track students back to the activity or course material in a non-confrontational
manner.
Table of Contents
PG. 214

Owen Berger
Social Media or Internet Viewing Equipment

The primary worry with a technical class used to be whether or not every student was
going to have a computer. Currently, there are several different technologies available to
students such as traditional laptops, tablets, mini-tablets, and combination devices with
detachable or rotational keyboards. The fact that all of these devices exist and are capable of
Internet connectivity would seem to make this subject not an actual constraint. However,
instructor experiences have shown that although ubiquitous in their private lives, students
often come to a technology course without any such device. There could be several reasons for
this:
Agency policy could prohibit personal devices being used for work purposes.
Students are unable to obtain a portable device from their work, either because they
simply do not have them in their workplace or budget shortages have limited device
usage for training purposes.
Students are unwilling to blend their personal devices with their professional duties.
Students were told to go to a training yet were not told to bring a device capable of
connecting to the Internet.
Unlike Internet connectivity, the actual devices or equipment used to connect to the
Internet should be provided by the student or their organization. Training coordinators should
be reminded several times that their employees have to bring an Internet-capable device or
they would not be able to participate in training. In case of an accident or exigent scenario
where a student was unable to bring their own device, the presenter should have a couple of
back-up devices ready. However, the availability of these back-up devices should not be known
by the training coordinators or students and should not be relied upon.
Location and Classroom
Though still a constraint, this problem is a lesser one than for previous technology
courses. The advent of wireless Internet and personal devices means that, if properly handled,
the course does not require a full computer lab with hard-wired Internet access. However, as
mentioned in the first constraint above, Internet or Wireless Fidelity (Wi-Fi) Connection Speed,
extra care should be taken to ensure that the Internet connection is solid and scalable to the
number of students.
Therefore, the most attention should be given to finding a location or room where
students are able to work together in groups and safely plug in to use their devices without
tripping on power plugs or fighting glare from too many windows. While these might seem like
Table of Contents
PG. 215

Owen Berger
insignificant problems in the light of law enforcements daily challenges, they will harm the
effectiveness of this course if not dealt with.
Dynamic Constraint Handling
This last section covers the constant difficulties of technology training. Instructors of
any real-time intelligence course must be prepared to change activities or to move content in
order to meet the real-world conditions they are presented with. For example, if a students
device suddenly stops working and they cant get it working, they should be able to share with a
group-mate. Activities that require Internet access should have a backup option for power
outages or other situations that shut down Internet traffic. Simply put, there is no end to the
challenges faced by technology instructors. However, preparation and adaptability can go a
long way to solving most student- and course-related issues.
Table of Contents
PG. 216

Owen Berger
Course Goal
The overall course goal for the class entitled Real-time Intelligence with Social Media is:
To teach students how to gather and disseminate real-time intelligence with Social Media
and the Internet.
The course title and goal were formed after reviewing the data from the Training Needs
Assessment (TNA). Several course priorities were identified (see Priorities section above), but
all of the course priorities were supplemental to or in support of the gathering and
dissemination of real-time intelligence from Social Media and the Internet. This primary course
goal can be broken down further into several key modules, as listed here with both module title
and module goal:
Module No. 1 Gathering Intelligence with Social Media and the Internet
The goal of Module I is To teach students how to monitor events with Social Media and
the Internet.
Module No. 2 Real-time Intelligence Systems: Design and Implementation
The goal of Module II is To teach students how to design and implement systems for
gathering and disseminating intelligence from Social Media and the Internet.
Module No. 3 Real-time Intelligence Systems: Policy Development
The goal of Module III is To teach students how to develop policies for gathering and
disseminating intelligence from Social Media and the Internet.
Module No. 4 Teaching Cyber-monitoring
The goal of Module IV is To teach students how to teach others how to gather and
disseminate real-time intelligence with Social Media and the Internet.
Table of Contents
PG. 217

Owen Berger
Task List
There were several key course components identified in the conclusion section of the
Training Needs Assessment (TNA) and the priorities section of this Instructional System Design
(ISD) notebook. To briefly reiterate those components, they are: monitoring for intelligence or
information, search skills, legal application and knowledge, training on how to teach others,
developing policy for and designing intelligence systems, and critical thinking.
These key components were distilled into four separate tasks which will consolidate the
necessary material into an actual behavior the students will be expected to perform during an
evaluation. The four tasks are as follows:
Task One: Utilize cyber-monitoring (see course design worksheet)
Students taking this course will be expected to be able to monitor real-time intelligence
with Social Media and the Internet, also known as cyber-monitoring. This course task will
develop the students search skills while showing them how to effectively monitor ongoing or
upcoming events, including both criminal and non-criminal events. This task focuses on the
actual gathering of information, and will include case law and critical thinking components to
ensure that the students will be able to utilize cyber-monitoring in a manner that is both lawful
and adaptive.
Task Two: Create an intelligence system (see course design worksheet)
The flip-side to gathering intelligence is the dissemination of intelligence. Intelligence
system design deals with what happens to information while it is being gathered, as well as its
path to, and means of, dissemination. The broad spectrum of law enforcement technology in
use today necessitates students who can utilize the information from this course in the creation
of organization-specific intelligence systems that are simultaneously efficient, secure, and legal.
Just as with the other tasks, this section will have a legal component that deals with intelligence
once it has been gathered, and how law enforcement has certain mandates and regulations on
the storage and sharing of certain types of information.
Task Three: Develop Social Media policy (see course design worksheet)
An important aspect of any law enforcement duty is the responsibility to ensure that the
actions taken to fulfill this duty adhere ethically to all department, local, municipal, state, and
federal laws and regulations. The normal manifestation of this responsibility is departmental or
organizational policy. Policies cover a broad range of documentation that can guide or even
dictate the actions of law enforcement. This task will help students develop and critically think
about how policies can benefit or harm the use of real-time intelligence by law enforcement.
Table of Contents
PG. 218

Owen Berger
This task will have a strong legal component to ensure lawful compliance and liability
protection. This section will also have a critical thinking portion that shows students how to
create policy from a broad yet purposed perspective.
Task four: Teach cyber-monitoring (see course design worksheet)
As shown by the TNA, and due to the lack of an existing course, the knowledge of how
to gather and disseminate real-time intelligence has a long way to go to reach the majority of
California law enforcement. Therefore, this course task will concentrate on broadening the
reach of such training by showing students how to instruct other employees at their
organization. The talks will show students many of the same considerations that occur in this
ISD, including course topics, constraints, learner characteristics, and many others. Students will
leave the course with the ability to make the course material portable and easily digestible by
others that need or want the same training.
Table of Contents
PG. 219

Owen Berger
Learner Characteristics
The learner characteristics for this course were extrapolated from the Training Needs
Assessments (TNA) data. The TNA had multiple sections where the extracted data spoke
towards certain learner characteristics. Of the TNAs methodologies, the survey and subject
matter experts were the two most important parts when determining possible students and
their learning styles.
The TNA survey gave several useful pieces of information regarding potential students.
First, Question No. 1 (d) gave the position and rank of the respondents, which were broken
down into four main categories for law enforcement personnel. This showed that the majority
of personnel would be what are called line personnel, because they work the front line of law
enforcement, conducting investigations, responding to radio calls, and combating crime trends.
Question No. 11 backed-up this assertion, where:
No. 11 (a) showed 86% of respondents new of at least one member that would attend
this training from patrol, with 39% stating that more than ten patrol personnel would
attend.
No. 11 (b) showed 98% of respondents new of at least one member that would attend
this training from specialized units (gangs, narcotics, vice), with 47% stating that more
than ten such personnel would attend.
No. 11 (d) showed 99% of respondents new of at least one member that would attend
this training from detectives or investigators, with 47% stating that more than ten such
personnel would attend.
The numbers were lower for all other positional categories, leading to a strong data assertion
that the primary learners would be line personnel.
Second, the survey gave us information on the generational make-up of possible
attendees. Please see the data for Question No. 1 (e), and the chart entitled Respondent
Generational Breakdown. This data shows us that, independent of average respondent starting
age in law enforcement, the majority of students would be from Generation X. That majority
would slowly give way to the Millennial generation as time passes, with obviously decreasing
numbers of student from the Boomer generation.
Table of Contents
PG. 220

Owen Berger
The generational information for this section of the TNA was drawn from four different
sources:
1.
2.
3.
4.
The Six Living Generations In America26

Teaching Across the Generations: Challenges and Opportunities for Preceptors27
American generations through the years28
Adapting Teaching to the Millennial Generation: A Case Study of a Blended/Hybrid
Course29
Third, survey Question No. 9 demonstrated that law enforcement, for the most part,
does not find technical courses challenging. In fact, the only category where respondents found
a subject more challenging than not was Understanding the vernacular or terms used when they
werent explained or before they were explained. This particular question was posed to help
identify possible technical deficiencies in students, but the data clearly shows that
unintroduced vernacular and terms are the largest such deficiency or challenge.
The subject matter experts argued for basic computer and Internet search skills, an
argument that was seconded by the survey respondents in Question No. 12 (g) where the
majority of respondents stated that Basic online searching skills would be more important to
learn at real-time intelligence training. However, contradictorily, the subject matter experts
also stated that basic Internet search skills were universally lacking, while in survey Question
No. 8, 85% of respondents rated themselves a five or higher (on a scale to ten) on their own
Internet search capabilities. The learner characteristic derived from this contradiction is that
for law enforcement at least, the Internet and technical skills of students will be varied.
The lists below define the characteristics identified for the identified student make-up,
including positional-, generational-, and employment- related characteristics with their impact
on the course design.
Line personnel (detectives, patrol, and specialized unit personnel)
Line personnel are pragmatic, and interested only in new methods and techniques if they
can assist them complete their duties as efficiently as possible. Additionally, these same line
personnel are willing to learn techniques outside of their investigative comfort zone if they
are proven to show results. Therefore, the course design will introduce tools, time-saving
26
(Friesner, 2014)
(Ginsburg, 2014)
28
(CNN (Cable News Network), 2011)
29
(Jr., 2011)
27
Table of Contents
PG. 221

Owen Berger
techniques, and efficiency practices without a lot of introductory philosophy or theoretical

strategy discussion.
Line personnel can be resistant to using soft investigative or information-gathering
tools such as Social Media sites. Therefore, the course will utilize real-life success stories from
investigations that contained Social Media evidence or information. These anecdotes will assist
in getting a buy-in from line personnel who dont initially want to use Social Media.
Generation X
Students from Generation X are self-reliant and independent. They are willing to try
things on their own, self-starting, and dont need authority or a formal learning structure to
succeed. Therefore, Students will be given the opportunity to work on their own and create
their own work product. They will be able to work in groups without instructor control or direct
oversight.
Students from Generation X are adaptive to and comfortable with technology. They
learn by doing and have used dynamic technologies throughout their lives. Therefore, Students
will not be given step-by-step instructions on the technological aspects of learning. Students
will be expected to either know how to use basic technology or catch-up/assimilate on their
own (see above trait, Self-reliant/Independent).
Students from Generation X are pragmatic. They need clear, real-life reasons for
learning or performing specific tasks and behaviors. Therefore, rather than theoretical
exercises, these students will be given real-life scenarios to evaluate and work with. In
addition, real-world case-studies should be used to draw a nexus between training and the
students functional duties.
Students from Generation X have a tendency to question, or are skeptical of, authority.
They also inherently distrust institutions and society. Therefore, instructors should share
responsibility of course direction with these students, and they should be part of setting course
goals and rules. This participation in rule-setting will have another benefit make students feel
accountable to each other. Generation X students should see instructors as facilitators, not as a
ruling authority during training. This means that lecture and one-way communication should
be limited. These students should be empowered to achieve course goals without constant
attention or instruction, and the majority of activities should be minimally supervised or selfguided. Students will, and should be allowed to, question authority and/or experts. More time
should be built into activities and facilitated discussions to allow for these conversations to run
Table of Contents
PG. 222

Owen Berger
their course. Allowing longer discussions based on these student questions will get more of a
buy-in from other skeptical students and will serve to not alienate the original questioner.
Students from Generation X are outcome-based learners. They need a clear goal and the
freedom to achieve that goal in the manner they choose. Therefore, student expectations
should be clearly articulated prior to activities or content delivery. Students may need
reminders of course goals, but do not need instructors to hold their hands while the students
work towards those goals.
Millennial (Generation Y)
Millennials are technically savvy, and have grown up with dynamic technology as part of
their daily lives. Therefore, the instructor will identify these employees and ensure that they
are seated evenly throughout the classroom. They will then be able to assist the less
technologically skilled students if they are having trouble keeping up with the class during
activities using the Internet and Social Media.
Millennials enjoy working in groups and are collaborative learners. Therefore, group
activities will be emphasized and students will be encouraged to collaborate with fellow
students to solve problems. This trait and its impact on course design are contradictory to the
self-reliant Generation X students. Therefore, although group activities will be emphasized,
there should be a fair balance that allows for students to work individually as part of the group
projects or activities.
Millennials want to feel special. Therefore, group activity use will need to include
avenues for individual Millennial students to stand-out or feel valuable. This can be achieved
either through instructor- or student- initiated recognition. However, any activity or
recognition must be designed so that individual students are not left out (without meaning to
be).
Boomers
Boomers are not as technically savvy as subsequent generations. Therefore, the
instructor will identify these employees, particularly in this technology-heavy course, and
ensure that they are seated evenly throughout the classroom. They will then be able to receive
assistance from the students with greater technological skills. Instructors should also ensure
that these students because they are the minority of attendees, are not becoming frustrated or
falling behind during the course.
Table of Contents
PG. 223

Owen Berger
Boomers are achievement oriented learners who work hard but need clear expectations
to do so. Therefore, much like with Generation X, these students will be given clear guidelines
on what to expect during an activity, and specifics about what constitutes the desired outcome
for each activity or lesson.
Sworn law enforcement personnel
Some law enforcement lack knowledge of technology related terms and vernacular. Law
enforcement personnel often have long-term careers with the same organization, and have not
worked in a technology driven job or do not use the latest technology as a hobby. Therefore,
the course will need repetition of commonly used technology terms/vernacular, and should
have handouts (either digital or print) readily available for student reference.
Law enforcement attendees to the course will come in with varied computer, Internet,
and search skills. Therefore, the instructor will identify the more technologically skilled
employees and ensure that they are seated evenly throughout the classroom. They will then be
able to assist the less technologically skilled students if they are having trouble keeping up with
the class during activities using the Internet.
Table of Contents
PG. 224

Owen Berger
Course Design Worksheets (CDWS)

CDWS No. 1 Utilize Cyber-monitoring
Instructor/Designer: Owen Berger
Team Facilitator: Kris Allshouse
Course Name: Real-time Intelligence with
Social Media
Date of Draft: June 3, 2014
Mentor: Chris Bouse

Module Name: Gathering Intelligence with
Social Media and the Internet
Date of Final Approval:
Course Goal:
and the Internet
Module Goal:
To teach students how to monitor events with Social Media and the Internet
Task/Behavior:
Learner Characteristics:
Note The research showed that students would primarily be from Generation X, with a
smaller portion of students from the Boomer and Millennial generations. However, as the
class is taught into the future, the number of Millennials will obviously increase relative to
Boomers and Generation Xers (see the Generational Chart in the Training Needs
Assessment).
The data also showed that students would be primarily line personnel: detectives, specialized
(vice, narcotics, gangs), and patrol. (see the Training Needs Assessment Survey Results and
Analysis, Question No. 11)
Task List | Table of Contents
PG. 225

Owen Berger
Line personnel (detectives, patrol, specialized unit personnel)

Line personnel are pragmatic, and interested only in new methods and techniques if
they can assist them complete their duties as efficiently as possible. Additionally, these same
line personnel are willing to learn techniques outside of their investigative comfort zone if
they are proven to show results. Therefore, the course design will introduce tools, timesaving techniques, and efficiency practices without a lot of introductory philosophy or
theoretical strategy discussion.
tools such as Social Media sites. Therefore, the course will utilize real-life success stories
from investigations that contained Social Media evidence or information. These anecdotes
will assist in getting a buy-in from line personnel who dont initially want to use Social
Media.
Generation X
their own work product. They will be able to work in groups without instructor control or
direct oversight.
learn by doing and have used dynamic technologies throughout their lives. Therefore,
Students will not be given step-by-step instructions on the technological aspects of learning.
Students will be expected to either know how to use basic technology or catchup/assimilate on their own (see above trait, Self-reliant/Independent).
responsibility of course direction with these students, and they should be part of setting
PG. 226

Owen Berger
course goals and rules. This participation in rule-setting will have another benefit make
students feel accountable to each other. Generation X students should see instructors as
facilitators, not as a ruling authority during training. This means that lecture and one-way
communication should be limited. These students should be empowered to achieve course
goals without constant attention or instruction, and the majority of activities should be
minimally supervised or self-guided. Students will, and should be allowed to, question
authority and/or experts. More time should be built into activities and facilitated discussions
to allow for these conversations to run their course. Allowing longer discussions based on
these student questions will get more of a buy-in from other skeptical students and will
serve to not alienate the original questioner.
Students from Generation X are outcome-based learners. They need a clear goal and
the freedom to achieve that goal in the manner they choose. Therefore, student
expectations should be clearly articulated prior to activities or content delivery. Students
may need reminders of course goals, but do not need instructors to hold their hands while
the students work towards those goals.
Millennials (Generation Y)
Millennials are technically savvy, and have grown up with dynamic technology as part
of their daily lives. Therefore, the instructor will identify these employees and ensure that
they are seated evenly throughout the classroom. They will then be able to assist the less
students to solve problems. This trait and its impact on course design are contradictory to
the self-reliant Generation X students. Therefore, although group activities will be
emphasized, there should be a fair balance that allows for students to work individually as
part of the group projects or activities.
avenues for individual Millennial students to stand-out or feel valuable. This can be
achieved either through instructor- or student- initiated recognition. However, any activity
or recognition must be designed so that individual students are not left out (without meaning
to be).

PG. 227

Owen Berger
Boomers
ensure that they are seated evenly throughout the classroom. They will then be able to
receive assistance from the students with greater technological skills. Instructors should also
ensure that these students because they are the minority of attendees, are not becoming
frustrated or falling behind during the course.
Boomers are achievement oriented learners who work hard but need clear
expectations to do so. Therefore, much like with Generation X, these students will be given
clear guidelines on what to expect during an activity, and specifics about what constitutes the
desired outcome for each activity or lesson.
Some law enforcement lack knowledge of technology related terms and vernacular.
Law enforcement personnel often have long-term careers with the same organization, and
have not worked in a technology driven job or do not use the latest technology as a hobby.
Therefore, the course will need repetition of commonly used technology terms/vernacular,
and should have handouts (either digital or print) readily available for student reference.
employees and ensure that they are seated evenly throughout the classroom. They will then
be able to assist the less technologically skilled students if they are having trouble keeping up
with the class during activities using the Internet.
Teaching Domains:
The primary learning domain used in this task is cognitive, as using Social Media and the
Internet to find information and monitor events (cyber-monitoring) is knowledge-based. This
task does not have affective or psycho-motor components.

PG. 228

Owen Berger
Delivery Strategies:
Overall, students will build their knowledge with a series of smaller, related tasks
eventually finding and monitoring a chosen event.
First, the students will develop online personas that they can use to search for people,
organizations, or events on sites that require membership or login. While they create
these personas, they will discuss legal ramifications of false online personas.
Next, the students will build Internet search skills by finding suspects, crimes, or
events in their area.
Students will then try or test various intelligence-gathering tools to find out the
positives and negatives of various tools/sites.
Students in given scenarios will differentiate how they gather intelligence for certain
types of events, e.g. criminal vs demonstration.
Students will contemplate the legal issues surrounding cyber-monitoring.
Last, the students will be tested by choosing an event, monitoring it, and presenting
the outcomes and findings to the class.
Evaluation Method:
Performance will be based on observations of how students perform during a final module
assessment, which consists of finding, monitoring, and presenting event-related intelligence.
The students will be evaluated on their ability to locate and actively monitor an event that
directly affects a chosen geographical area. The Cyber-monitoring Rubric will be used to
grade the examination.
In-Depth Questions:
1. What are the primary sites/tools for gathering intelligence with Social Media and the
Internet? What types of scenarios would necessitate different sites or tools?
2. What are some of the legal issues surrounding cyber-monitoring? Have those issues
affected your daily duties in the past? How could those issues affect your daily duties
in the future?

PG. 229

Owen Berger
3. What is some of the current case law regarding cyber-monitoring? Do you agree with
the courts decisions? Why? How will these legal decisions impact your job? Which
one impacts your specific assignment the most? Why?
4. Why is it important to plan a search for intelligence/information? What are the
potential consequences of not planning a search? How can search planning be
implemented in your current position?
5. What are some of the different kinds of search operators and how can they help you?
6. If you arent finding the results that you need, what are some things to consider in
order to achieve better results?
7. Why is it important to develop a search plan prior to starting an Internet search?
What are the possible consequences of not implementing a search plan?
8. What are some of the ways in which searches are different for different websites?
Why is it important to be aware of these differences? Please give a specific example
of how such differences could affect a search?
9. How specifically can you use Internet searches in your assignment? Why?
10. What search engines do you prefer? Please explain why you prefer those search
engine to other search engines.
11. What information do you need to successfully perform an Internet search? Please
rank that information from most important to least important.
12. What are common Twitter terms/nomenclature, and what do they mean? Which of
these terms have you heard in the news lately?
13. What makes Twitter such a powerful tool? Which parts of Twitter are the most useful
for law enforcement?
14. What considerations do we need to make when using Twitter for event
monitoring/awareness? Facebook? Instagram?
15. Why is Twitter different than other means of communication?

PG. 230

Owen Berger
16. What are the best ways you use the information from Twitter in your current
assignment?
17. When have you used Twitter before as law enforcement personnel? Was it
successful? If not, what would you change or how would you do it differently?
18. How does law enforcements view of Twitter differ from that of the general public? Or
criminals?
19. What do you need to work on to better understand how to monitor events with
Twitter?
20. What real-life scenarios can you think of where Twitter would be a helpful tool?
21. Why were you allowed to work in groups for your final presentation? Why were you
given a time limit?
22. How can successful preparation help us with remote event monitoring?
23. How can the tools you learned today be applied to other websites, such as Backpage
or Craigslist?
24. What is your biggest takeaway from today, and why did you choose that over other
takeaways?
25. How does the type of event we are preparing for affect our search terms?
26. Can you please describe a scenario in which information from Twitter would require
further investigation or vetting before being relied upon?
27. What is the best way to find meanings of terms we dont understand? How could we
teach our peers to find the same information?
28. How would you convince your command staff to allow you to access Twitter on the
job?
29. What kind of resistance do you expect when you go back to work and are using
Twitter to gather information? How can you mitigate/prepare for/overcome this
resistance?
PG. 231

Owen Berger
30. Can you describe why the information flow that Twitter uses is good for event
monitoring? Try to do so without using any of our Twitter-specific terms or
nomenclature.
31. What equipment/resources are you going to need in order to start remotely
monitoring events, what is the most important, and why?
32. What should law enforcement do to stay safe while working online, and what should
our primary online safety concerns be?
33. Can you please describe a scenario where you would uncomfortable reporting your
online research findings to your superiors? Why are you uncomfortable, what are
some possible solutions or outcomes to your scenario.
34. What actions would need to be taken if you found a specific threat to the public or to
law enforcement online? In what order should these actions be taken? Why?
35. How can you investigate or follow-up on information from an anonymous website like
Twitter?
36. How does free speech play into our monitoring of Twitter, and our agencys policy
regarding the use of Twitter for special events?
37. How can we best separate personal Social Media access from work Social Media
access?
38. How can different kinds of searches affect the search results we see?
39. What kinds of searches are there, and which are the most powerful?
40. Is the amount of information in a tweet limited to 140 characters? Why?
41. How would you personalize your work environment, would that help you, why?
42. How can the search terms and design affect the results?
43. Can we track peoples location using Twitter? How?

PG. 232

Owen Berger
44. Why would Twitter users need to use Direct Messages?

45. How can your work set-up or environment affect your health? How can we help
ourselves and our health?
46. What does it mean if I say that a Hashtag is dynamic? What other types of dynamic
information are there?
47. In Geek-speak, what do I mean when I say a picture is worth a thousand words? What
is EXIF/META data? How does it affect law enforcement?
48. How do we know if we have found enough information? How do you define enough
information? Why?
49. In what ways can intelligence from Social Media and the Internet be used during an
emergency or natural disaster? Can you map those ways chronologically for a given
emergency or natural disaster, e.g. earthquake, fire, building collapse?
Learning Objective Elements: (A B C D)

A (Audience) = Students
B (Behavior) = Utilize cyber-monitoring
C (Condition) = Working on an assigned event in small groups with Internet access and a
time-limit of 45 minutes for preparation and 5 minutes for presentation
D (Degree) = Score a three (3) or higher on each category of the Cyber-monitoring Rubric
Learning Objective: (ABCD in sentence form)

The students will utilize cyber-monitoring while working on an assigned event in small groups
with Internet access and a time-limit of 45 minutes for preparation and 5 minutes for
presentation, and must score a three (3) or higher on each category of the Cyber-monitoring
Grading Rubric.
PG. 233

Owen Berger
Specific Learner Expectations:

The below items are the grading categories that are in Cyber-monitoring Rubric, and are the
top level (4 out of 4) on the rubric scale.
1. Search Plan
All students in the group actively cooperated in the creation of a search plan for their
assigned event by verbally giving input or writing the plan down. Students explicitly
referenced the search plan at least three times verbally or by reading it during the
research of their event.
2. Vocabulary/Nomenclature
Student showed understanding of the technical Social Media and Internet
terms/nomenclature that were taught, by: discussing them during their group
evaluated activity at least twice, using them correctly while monitoring their assigned
event at least twice, and using them correctly during the group presentation of their
findings a minimum of twice.
3. Site/Tool Knowledge
Students utilized the websites and tools that were introduced or used during training
for the majority of their research. Students were observed using the demonstrated
sites and tools at least three times while researching and monitoring their event.
4. Legal Application
Students demonstrated understanding of the legal ramifications of using Social Media
and Internet to monitor events. Students openly discussed, more than once, the
constitutionality or lawful consequences of the performed cyber-monitoring. Their
discussions included, but werent limited to, false personas, current case law, data
storage and retention, and constitutional amendment issues.
5. Event Results
Students were able to produce results from their cyber-monitoring. They found at
least ten separate pieces of information on their event. In addition, students were
able to extrapolate at least three necessary actions or tactics from their found
information.

PG. 234

Owen Berger
6. Presentation
Students were able to clearly communicate their findings to the rest of the class.
Students conveyed how they obtained their information by detailing at least three
sites/tools that were used, and at least three actions were implemented due to the
found information.
7. Participation
Every group member participated in the presentation equally.
8. Time Management
The presentation was within 15 seconds of 5 minutes in length.
Course Outline (Content):

I.
Gathering Intelligence with Social Media and the Internet

A. Types of cyber-monitoring
1. Criminal Investigations
a. Ongoing criminal investigation
b. Aftermath
c. Fugitive tracking
2. Planned Events
a. Demonstration
b. Protest
c. Rally
d. Celebration
e. Sit-in
3. Critical Events
a. Sniper Attack
b. Public shooting
c. Terrorist attack
4. Natural Disasters
a. Earthquakes
b. Fires
c. Floods
d. Snow
e. Rain
f. Tsunami

PG. 235

Owen Berger
g. Tornado
h. Hurricane
B. Searching the Internet
1. Internet Search Plans
a. Identify key points
1) Identify what information we are looking for
a) Purpose, purpose, purpose
b) Specific information
c) General information or survey
2) Distilling
a) Distill the information we want into words or search terms
(1) Different ways of saying the same thing
(2) Varying specificity
(3) Skewing results with our own words
b) Too much information after distillation
(1) Need for running multiple searches
(2) The need for multiple plans
(3) More research to determine other keywords
b. Implementation methods
1) Write plan down
2) Remember plan
3) E-mail plan
2. Safe searches with law enforcement
a. Protection
1) Anonymizers
a) HideMyAss
b) Firefox Plugins
c) Tor browser
2) Cold computers
a) Ease of use
b) IP Identifiers
(1) White supremacist example
(2) Arin.net
(3) Dawhois
(4) Others
c) Associated costs
3) Fake accounts
a) Legality of fake accounts

PG. 236

Owen Berger
Photos for profile use

Face vs no face
Other persons photos
False impersonation
Situations for fake accounts
b. Purpose will define protection
1) Again, purpose, purpose, purpose
2) Necessary protection v Paranoia
3) Use cases
a) Apparent/overt
b) Discreet
c) Covert
b)
c)
d)
e)
f)
3. General Internet Searches

a. Search Engines
1) Google
a) Largest of the search engines
b) Tie results to logged in Google account
c) Ads will immediately result/respond
2) Bing
a) Microsoft-run
b) Tie results to Microsoft and Facebook accounts
c) Bing Social
3) Yahoo
4) Ask
b. Types of searches
1) Content
a) Informational
(1) Broad information request, usually for things
(2) Find out
b) Navigational
(1) A search to get somewhere on the Internet
(2) Finding a specific site, or persons page
c) Transactional
(1) Means youre looking to buy or sell or exchange something
(2) Brands product names
2) Geographical
a) Geo-tagging
b) Quantity of information actually geo-tagged

PG. 237

Owen Berger
c) Use scenarios
(1) Protest areas
(2) Parties
(3) High-crime locations
c. Search Terms
1) Keywords
2) Names
3) Titles
4) Special Characters
a) Are they allowed, are they included
b) Cross-site Scripting (XSS)
d. Common search operators
1) Quotes
2) Minus sign 3) Plus sign +
4) OR
5) AND
6) Attitude
a) Reliability
b) Narrowing search results
7) Other operators
e. Utilize the elements of Critical Thinking:
1) Intellectual Standards
a) Clarity
b) Accuracy
c) Precision
d) Relevance
e) Depth
Breadth
g) Logic
h) Fairness
2) Elements of reasoning
a) Purpose/Goal/End
b) Question at issue/Problem to be solved
c) Assumptions
d) Point of View/Frame of reference
e) Facts/Data/Evidence
f)

PG. 238

Owen Berger
Theories/Concepts/Ideas
g) Inferences/Conclusions
h) Implications/Consequences
f)
C. Cyber-monitoring and the law

1. Current case law
a. Konop v Hawaiian
b. Cromer v Lexington
1) What you do off-duty can affect your employment
2) Dont identify yourself off-duty
c. Garcetti v Ceballos
1) Make sure you know if you are acting as employee or citizen
2) Same goes for Social Media
d. New York v Harris
1) Good search warrants are key
2) Read the terms of service
e. U.S. v Meregildo
1) Expectation of privacy does not equal privacy
2) Confidential Social Media informants?
2. Other legal questions
a. Reactive case law
b. False personas
c. Purpose, purpose, purpose
3. 28 CFR Part 23 - https://it.ojp.gov/documents/28cfr_part_23.pdf
D. Useful sites and tools

1. Understanding Twitter
a. Twitter Accounts
1) Signing up for Twitter
a) Full Name
(1) Resistance to sign up
(2) Fake Name
(3) Work Name
b) E-mail Address
(1) Use your work e-mail
(2) Use a throw-away e-mail
c) Password
(1) Password security

PG. 239

Owen Berger
(a) Never write down passwords

(b) Ensure password is different for each account
(2) Consequences of poor password security
(a) Public embarrassment
(b) Loss of trust
d) Username
(1) Be descriptive
(2) Or not
(3) This is your Twitter handle
e) Keep me signed-in checkbox
(1) Stores a cookie in your browser
(2) Inherently safe, if only you are using the device
f) Tailor Twitter to my most recent websites checkbox
(1) They are storing your information for advertisements
(2) Dont check these boxes
(3) Its unclear how much information they store, and for how long
g) Terms of Service
b. Post sign-up operations
1) Follow five people
a) Not necessary to complete for this course
b) Only follow people you are actually interested in
c) As soon as you follow someone, that information is public
2) Complete profile
a) Uploading a photo
b) Entering background information
c) Entering a website
3) Find your friends
4) Confirm your e-mail address
a) Not necessary for this course
b) Common practice that ensures you own your e-mail address
c. Twitter terms and nomenclature
1) Users
a) Username
(1) The same thing as a Twitter handle
(2) Be descriptive
(3) Or not
b) Profile
c) Profile picture
d) Profile background

PG. 240

Owen Berger
e) Followers
(1) These are the people following you
(2) They can see all of your tweets, and re-tweet them
(3) You can restrict who is following you
f) Following
(1) These are the people you are following
(2) They can view your information
(3) They can disallow you to follow them
d. Tweets
1) Tweet
a) 140 Character-limit
b) Goes to all followers
c) Is publicly searchable
d) NEVER GOES AWAY
2) Re-tweet (RT)
a) Twitter for lazy people
b) This is how information goes viral
3) Modified Tweet (MT)
4) Link
a) To picture/photo
b) To website
c) URL Shorteners
(1) Purpose
(2) Dangers of overuse
5) Hashtag
a) Groups content
b) Organic way to organize tweets
c) Large range from specific to general
d) No special characters
6) @-Mention
a) Tied to a username
b) Can be used to reply
c) Can draw attention to a Twitter profile.
7) Photos
a) Are attached to the Tweet
b) Can be linked to
(1) Instagram
(2) Other websites
c) EXIF and META data

PG. 241

Owen Berger
(1)
(2)
(3)
(4)
(5)
(6)
(7)
Information stored with the photograph

Included geo-location data
Camera information
Shutter speed, etc
Sometimes its scrubbed
Can be obtained via search warrant
Command staff love pictures
e. Other
1) Direct Messages (DM)
a) Only between your followers or people you are following
b) Used the same as text messages
c) Can be obtained via search warrant
2) Reach
a) How does something go viral
b) Multiple layers of re-tweets makes for a huge audience
3) Trending
4) Geo-location
a) Uncommon
b) Used in Twitter mapping software and applications.
2. Searching Twitter
a. Types of searches
1) Keywords
a) Autocomplete
b) Multiple types of returned information
(1) Hashtags
(2) Profiles
(3) General search terms
2) Hashtags
3) Profiles or @-mentions
4) Search operators (https://www.twitter.com/search-home for full list)
a) Quotes
b) Minus sign
c) OR
d) AND
e) Attitude
(1) Reliability
(2) Narrowing search results
f) Other operators

PG. 242

Owen Berger
5) Twitter search engines

a) Native Twitter search
b) Other Twitter search engines
(1) Bing Social
(2) Google (Twitter: )
(3) IceRocket
6) Twitter feeds (continuous searches) or Aggregators
a) Current Twitter feed/API issues
(1) Twitter has begun to disallow access to their data
(2) Several smaller twitter services have closed (Monitter)
b) Twitter feeds
(1) Most require a Twitter account
(2) Some have different refresh rates
(a) Refresh rates are how often the information is updated
(b) Important to know depending on how critical updated
information is to the task at hand

(3) Feed providers
(a) Tweetdeck
(b) Twitterfall
c) Multiple feed windows
(1) Advantages
(a) Helpful during most major events
(b) Can use multiple screens
(2) Disadvantages
(a) Bandwidth issues
(b) Eye-problems
(c) Practice the 20-20-20 rule
3. Events and Twitter
a. What Twitter provides (Advantages)
1) Real-time intelligence from anywhere people are
2) Location-centric data
a) Limitations of geo-tagging information
b) Small amount of people with geo-tagging turned on
3) Used the same as other intelligence
a) Multiple (difference) sources lend credibility
b) Intel must be independently verified for action to be taken
c) Twitter is a good starting point
4) Photographs can be a gold mine

PG. 243

Owen Berger
Crowd estimates
Weather
Evidence
Piecing events together
Disaster breadth
b. What Twitter does not provide (Pitfalls)
1) 100% credible information
a) Believe it or not, people lie on Twitter
b) Invalid information can be as viral as true information
2) Not a replacement for deployed resources
a) Typically, the more resources, the less helpful Twitter is
b) Should not be used for major decisions
c. Using Twitter specifically for Events
1) Generating search terms
a) Preparation is key
(a) Every event is different
(b) Examples
i. Baseball game
ii. Awards show
iii. Gang funeral
iv. Slang
v. Emergencies
vi. Natural disasters
vii. #SMEM
(c) Research can help a lot
(d) Gang experts
(e) Fans
(f) Other news sites
(g) Slang
i. Helpful sites
ii. Transl8it
iii. UrbanDictionary
iv. Pay attention
b) Terms and hashtags are DYNAMIC
(a) Dynamic terminology
(b) Terms can change
i. Always be watchful for new hashtags & keywords
ii. Variations
iii. #occupy
a)
b)
c)
d)
e)

PG. 244

Owen Berger
#occupyla
#occupymay1
#occupylamayday
#buildingcollapse
Hashtag hijacking
i. Context is important
ii. The person/entity tweeting can change the meaning
Hashtags can pop up anywhere
#ShuttleEndeavour5HoursLate
#CrashGate7
#TailgateNow
#FlashMob711
iv.
v.
vi.
vii.
(c)
(d)
(e)
(f)
(g)
(h)
4. Understanding Facebook
a. Facebook Accounts
1) Signing up for Facebook
a) Initial Page
(1) First Name
(2) Last Name
(3) E-mail address
(4) Password
(5) Birthday
(6) Male/Female
(7) Phone number
b) Find Friends
c) Fill out Info
d) Profile Pic
2) Facebook terms and nomenclature
a) Page
b) Post
c) Profile
d) User
e) Username
f) Vanity URL
g) Banner
h) Profile ID
(1) Never changes
(2) JSON pathway
(a) Change www to graph

PG. 245

Owen Berger
i)
j)
k)
l)
m)
n)
o)
p)
q)
r)
s)
Status
Update
Timeline
Groups
Apps
Friends
(1) Friend Request
(2) How many friends should you have
Followers
Likes
Comments
Messages
Privacy
5. Searching Facebook
a. Types of searches
1) Keywords
a) Autocomplete
b) Multiple types of returned information
(1) Profiles
(2) Pages
(3) Events
(4) Photos
(5) Apps
(6) Games
(7) Groups
2) Profiles (People)
3) My Friends
4) Photos, movies, music, games I might like
5) Nearby Restaurants
6) Photos I have liked
b. Facebook Search Engines
1) Native Facebook Search
2) Other Facebook search engines
a) Bing Social
b) Google (Facebook: )
c) IceRocket
3) Graph search
a) Can replace www. With graph.

PG. 246

Owen Berger
(1) JSON
(2) Plain text representation of information
(3) What
b) Results different for everyone
c) What information is or is not shown
6. Events and Facebook
a. What Facebook provides (Advantages)
1) Real-time intelligence from anywhere people are
2) Some Location-centric data
a) Limitations of geo-tagging information
b) Small amount of people with geo-tagging turned on
c) Locations can be entered incorrectly or faked
3) Used the same as other intelligence
a) Multiple (different) sources lend credibility, links to other Facebook
b) Intel must be independently verified for action to be taken
c) Facebook is a good starting point, and has less fake pages than Twitter
4) Photographs and videos linked to accounts
a) Location can be deduced from photo OR account/page
b) Valuable information
(1) Crowd estimates
(2) Weather
(3) Evidence
(4) Piecing events together
b. What Facebook does not provide (Pitfalls)
1) Easy searches/Automation
a) Facebooks graph API isnt great for law enforcement
b) Advertising drives results, not relevant information
2) Not as real-time as Twitter
a) Twitter offers more for ongoing events
b) Twitter offers less for upcoming events
c. Using Facebook specifically for Events
1) Generating search terms
a) Preparation is key
(1) Uniform page layout means most events have same setup
(2) Examples
(a) Parties
(b) Protests
(3) Slang

PG. 247

Owen Berger
Helpful sites
Transl8it
UrbanDictionary
Pay attention
b) Different searches, think in person terms, not keywords
(1) Names
(2) Phone Numbers
(3) Locations
(4) Groups
2) Respondents Who is coming?
a) Yes
b) No
c) Maybe
(a)
(b)
(c)
(d)
7. Preserving Digital Evidence

a. Preservation Requests
b. Preservation Letter
c. Search.org for contact information
d. Arin.net for IP Address Information
e. Facebook.com/records
f. Instagram Facebook.com/records
g. Otherwise look for e-mail or fax
8. Understanding Instagram
a. Instagram basics
1) Instagram is phone-only
2) Signing up requires your phone
3) Must download app
b. Instagram accounts
1) Profile/Username
2) Chosen at signup
3) No publicly available id
4) http://jelled.com/instagram/lookup-user-id
c. Instagram terms
1) Profile
2) Caption/Description
3) Title
4) Message
5) Like heart

PG. 248

Owen Berger
6) Follow
7) Comment
8) Direct Send
d. Searching Instagram
1) Iconosquare (used to be Statigram)
2) Hashtags from Twitter and Facebook work also
9. Other sites
a. Trending
b. New Technologies
c. Online Buy/Sell
1) Craigslist
2) Backpage
d. General searches
e. Fly-by-night aggregators
10. Commercial tools
a. Geofeedia
1) Geo-fencing
2) Stateful monitoring
b. LexisNexis/Accurint
c. Torch (Palantir)
d. Radian 6
e. SAS Social Media
Anticipated Resources Needed:

-
(1) Computer or tablet for each student, with power cable and Wi-Fi capabilities.
Wi-Fi capabilities for every student, i.e. enough bandwidth for class size.
(1) Flip chart for every five (5) students.
(1) Flip chart stand for every five (5) students.
Markers, preferably 5 different colors for each table.
(1) Round table for every five (5) students.
(1) Chair for each student.
(1) Extension power cord for each table (per five students) with at least five plug-ins.
(1) Projector system with HDMI compatibility.
Instructor computer with PowerPoint installed.

PG. 249

Owen Berger
Flash-drive with back-up file for the Learning and Evaluated Activity PowerPoint
presentation files.
Cable to connect computer to projector.
(1) Cyber-monitoring Rubric handout per student.
One notepad or several pieces of paper per student.
One writing implement per student.

PG. 250

Owen Berger
CDWS No. 2 Create an Intelligence System

Social Media
Mentor: Chris Bouse

Module Name: Real-time Intelligence
Systems: Design and Implementation
Course Goal:
and the Internet
Module Goal:
To teach students how to design and implement systems for gathering and disseminating
intelligence from Social Media and the Internet
Task/Behavior:
Create an intelligence system
Assessment).

PG. 251

Owen Berger

Media.
Generation X
direct oversight.
PG. 252

Owen Berger
to be).

PG. 253

Owen Berger
Boomers
Teaching Domains:
The primary learning domain used in this task is cognitive, as creating intelligence systems for
law enforcement is knowledge-based. This task does not have affective or psycho-motor
components.

PG. 254

Owen Berger
The students can start out by reviewing their own organizations intelligence or
information systems.
After reviewing their own systems, students can present their systems to other
students at their table, and discuss the positives and negatives of the presented
systems.
The students can evaluate what would make a good intelligence system, and then
evaluate how that system would function in real-life, with constraints and hurdles
arising from normal law enforcement duties.
Students can discuss concepts and theories about how systems should be designed,
and elements that they should contain.
Students can design their own system for use at their organization, whether for the
entire organization or just for their unit.
Students can then improve or critique each others policies, noting the positives and
negatives from the individual system design.
After working individually, students can design a system based on a common need
amongst the groups at the table.
Students can then work together to create an intelligence system keeping in mind all
of the aspects reviewed in this course module.
Evaluation Method:
assessment, which consists of creating an intelligence system and then creating a policy
governing that system. The students will be evaluated on their ability to create an
intelligence system and the reasoning behind their creation process. The Systems Design
Component of the Intelligence Systems Rubric will be used to grade the examination.
In-Depth Questions:
1. What is an intelligence system? How did you come up with your definition? Would
all of us define it the same way? Why or why not?
2. How do you define intelligence? How does it differ from information? Does your
organization see it the same way? Why or why not?

PG. 255

Owen Berger
3. What are the elements of an intelligence system? Which elements are more
important/less important?
4. When designing an intelligence system, what are our most important legal concerns?
5. What intelligence systems are currently in place at your organization? How effective
are those systems on a scale of one to ten? Please articulate why you gave that
rating.
6. What are some instances during the course of your current duties where an
intelligence system could be used?
7. How could an intelligence system be used outside of its intended use? What effects
could that unintended use have on you or your organization?
8. What is the difference between an internal or external intelligence system? Can they
be combined? How so? Why?
9. What current case law is applicable to designing an intelligence system? Why?
10. What could be the differences between an intelligence system for law enforcement
and one for a private company? What are the most significant of those differences,
and why?
11. How should we articulate the purpose of a specific law enforcement intelligence
system?
12. How could our stated purpose effect the overall design of an intelligence system?
13. What types of intelligence systems are needed for your current duties? Can you
define the purpose for each of those systems?
14. What could the effects be of overlapping intelligence systems? Are this positive or
negative effects, and why?
15. What is the most effective way to transmit information? Why is that the most
effective way over other methods?
16. What are some of the terms used when designed intelligence systems? Which ones
do you think would be used most in your current duties, and why?
17. What are some of the real-world considerations that might influence the
implementation of an intelligence system?
18. What is the difference between a centralized system and a distributed system? What
examples can you think of where those systems are in use outside of law
enforcement?
19. What are the basic types of communication used by law enforcement? Which are the
most suited to use in an intelligence system?
20. What constraints or limitations does the real world put on intelligence system design?
What are the most impeding of those constraints?
21. Can you damage information? If so, how?
22. Why is it important to understand how information flows in an intelligence system?
What are the consequences of not critically thinking about information flow?
PG. 256

Owen Berger
23. How could we apply critical thinking to the design and implementation of an
intelligence system?
24. What levels can you think of to define the importance of information? How many
levels are there, what are they, and can you please rank them from least to most
important?
25. What does it mean to vet information? Is this the same as validating information?
26. Why is it important to vet information? Why or why not?
27. When, in the course of your employment, have you had to vet information? What
were your considerations when doing so? What would you change about your
considerations now?
28. Does all information have to be vetted? Please give examples of when and when
information would have to be or not have to be vetted?
29. What are some examples of failures to vet information in the news recently? What
could those organizations have done better to verify that information?
30. How does information vetting fit into intelligence systems design?
31. Where should the vetting process take place in the flow of information?
32. Have you ever had an e-mail or conversation misinterpreted? How did that make you
feel? Why?
33. When making notifications, how can we ensure that our information is not
misinterpreted or misused?
34. How can we emphasize or minimize the importance of certain information?

B (Behavior) = Create an intelligence system
C (Condition) = Working in small groups with Internet access and a time-limit of 60 minutes
for preparation and 6 minutes for presentation
D (Degree) = Score a three (3) or higher on each category of the Systems Design Component
of the Intelligence Systems Rubric

PG. 257

Owen Berger

The students will create an intelligence system while working in small groups with Internet
access and a time-limit of 60 minutes for preparation and 6 minutes for presentation, and
must score a three (3) or higher on each category of the Systems Design Component of the
Intelligence Systems Rubric.

The below items are the grading categories that make up the Systems Design Component of
the Intelligence Systems Rubric, and are the top level (4 out of 4) on the rubric scale.
1 Lawful Design
Students demonstrated understanding of the legal and liability issues surrounding
intelligence systems design. Students openly discussed more than twice the
constitutionality or lawful consequences of their intelligence system during the
development/planning phase. Their discussions included, but werent limited to,
current case law, data sharing, storage and retention, or constitutional amendment
issues. Additionally, students mentioned at least two pertinent legal issues during
the group presentation.
2 Purposed
The student-created system has a clear purpose that is explicitly defined or explained
in the final presentation more than once. The purpose matches or aligns with the
end-result system, meaning the students did not state the purpose and then create a
system that solves a different problem or addresses a separate issue. The correlation
between the purpose and the systems main elements are mentioned more than
once during the presentation.
3 Dealing with Constraints and Hurdles
Students spoke openly about the constraints and hurdles that their system would
confront in the real world. Students articulated more than two such constraints, as
well as matching strategies to mitigate those constraints.
4 System Flow/Organization
The students system was well-thought out and organized meaning the elements of
the system were arranged and presented in order, either chronologically or
conceptually. The system was constructed with real-world use in mind, and the group
PG. 258

Owen Berger
presented more than two real-world scenarios where their system could be used.
The systems organization matched the stated purpose, and had clearly defined
starting points and ending points for intelligence and information.
5 System Elements
The system addressed at least four of the system elements that were presented
during the course.
6 Presentation
Students were able to clearly communicate their system to the rest of the class.
Students conveyed every primary element/aspect of their system, including starting
and ending points. Additionally, every group member participated in the
presentation by either speaking or directly supporting the speakers during the
presentation.
7 Time Management

II. Designing Intelligence Systems
A. Definitions
1. Intelligence
a. Universal definition
b. Defining the term
1) Command staff
2) Multi-jurisdictional
3) Policy
c. Intelligence vs information
2. System
a. Systems Definition
1) System vs Policy
2) System vs Guideline
3) System vs Law
b. Breadth

PG. 259

Owen Berger
1) Organization-wide
2) Division/Bureau wide
3) Unit-wide
B. Intelligence Systems and the Law
1. System legalities
a. System illegalities or pitfalls
1) Storage of information
2) Automation
a) Storing information
(1) Insecure
(2) Too long
(3) Outside of intended purpose
b) Sending information
c) Gathering information
3) Purpose, purpose, purpose
a) Outside of mandate
b) Outside of jurisdiction
c) Outside of authority
b. Intended Use
1) Internal
a) Criminal Investigations
b) Facilitate information flow
2) External
a) Media Relations
b) Public Alerts
3) Both
a) Protests
b) Mass Demonstrations
2. Current case law
a. Konop v Hawaiian
1) Legally viewing a website
a) User
b) Administrator
c) Law enforcement

PG. 260

Owen Berger
2) Defining a user
a) Login or free access
b) Terms of Service
(1) Authenticating the agreement
(2) TOS allow/disallow
c) Determining actual Terms of Service
(1) Importance
(2) Invitation vs pre-subscribed
(3) Intentional recipient vs open subscription
3) Methods of communication
a) Interception vs Reception vs Storage/Retrieval
b) Direct sending
c) Post and retrieve
d) Actively transmitting vs retrieval from storage
b. Garcetti v Ceballos
1) Employee vs Citizen
2) Two-prong tests
a) Determine who you are speaking as
(1) Employee
(a) Statements for work purposes
(b) Whistleblower laws
(c) During work hours
(d) At work location
(e) Using work resources
(f) Work Equipment
(g) Work supplies
(h) Work Technology
(2) Citizen
(a) On off-time (off-duty)
(b) Using private/personal equipment
b) Matter of public interest
(1) Raising public concerns
(2) Normal situation arising out of work
(3) Right to know / Need to know

PG. 261

Owen Berger
c. Cromer v Lexington
1) Separation of concerns
a) On-duty
(1) Acting as representative of your organization
(2) Must abide by all policies/procedures
(3) Can identify as law enforcement
(4) Can hide identity for certain operations
b) Off-duty
(1) Should not identify as law enforcement
(2) Behavior that can
(a) Affect your ability to work
(b) Affect your employers ability to function
(c) Affect reputation of you or your employer
2) Termination for off-duty behavior
a) It is possible
b) It is legal
c) Never identify yourself as law enforcement
d) Complaints about employer
(1) Use whistleblower protections if needed
(2) Use the proper channels for reporting misconduct
1) NY District Attorney used tweets from @destructuremal to prosecute
a) Wrote search warrant to Twitter
b) Harris opposed as a third party
c) Twitter withheld warrant until judgment was given
d) Judge ruled in favor of NY DA, with time limits.
(1) Valid search warrant with probable cause was used
(2) Harris had no standing
(a) Third party only
(b) Twitters Terms of Service specifically stated
All content sent to or via Twitter belongs to Twitter

ii. They can give information with valid L.E. request
(3) Search warrant is necessary for info within last 180 days.
e) Twitter gave warrant return back to NY DA.
i.

PG. 262

Owen Berger
2) Lessons
a) Valid search warrants usually trump other considerations
(1) Warrant scope
(a) Limited to only what is necessary
(b) No overreach
(c) Not overly broad
Information-wise, and
ii. Time-wise
(d) Specific and related, no fishing expeditions.
(2) Probably cause
(a) Good PC can articulate the level of information needed
(b) Dont ask for it if you shouldnt get it.
(c) Traverse and quash will eliminate all information from warrant
b) Terms of Service
e. U.S. v Meregildo
1) Communications were intended as private
a) However, after sending information
b) Recipient is free to do with information as they please
c) Social Medias expectation of privacy is narrowing
d) How do you know who you are sending information to?
2) Projection/amplification of Social Media
a) Sharing in one method can become several methods
(1) Linked accounts
(2) Using same e-mail as base account
(3) Sign-in with Facebook
b) Private accounts can link to non-private accounts.
c) Law enforcement should look at all avenues and accounts
C. Intelligence System Purpose
1. Types of information systems purposes
a. Correcting a deficiency
1) Reasons for Deficiency
a) Too few resources
b) Too few personnel
c) Not enough training
i.

PG. 263

Owen Berger
d) Liability issues
2) Systemic vs particular/specific
a) Complete system redesign
b) Component redesign
b. Better, broader, or faster information flow
1) Getting information
a) To more people
b) To people faster or to a repository faster
c) More detailed, complete, accurate, or better information.
2) Modifying an existing system
a) to incorporate new technology
b) to incorporate new information sources
3) Create one system to supplement another, or several
a) Interfaces
b) Nodes
c) Storage methods
d) Repositories
c. Dealing with new technology
1) New system to incorporate technology into organization
2) Utilizing new technology for current intelligence
d. Dealing with new sources of information
1) Systems that gather and disseminate new types of information
2) Pulling information from a new site or place
3) Pulling information from a different information collector or aggregator
2. Continuity of Purpose
a. Narrowing the purpose
1) Multiple systems with one purpose
2) Overlap happens constantly
3) Bureaucracy breeds overlap
4) Overlap is the opposite of efficiency
b. Keep your systems DRY
1) Research is important
2) Talk with, though I hate to say it, stakeholders
3) Systems can interact, but shouldnt overlap

PG. 264

Owen Berger
c. The same information in multiple places is DIFFERENT INFORMATION

1) Game of Telephone
2) Information interpretation
a) Different viewpoints
b) Least distance principle
d. Is the purposed maintained from start to finish?
D. System Elements and Terminology
1. Nodes
2. Interfaces
3. Start point
4. End point
5. Information flow
6. User
7. Intelligence
8. Vetting
9. Validation
10. Target
11. Suspect
12. Target v Suspect
E. Real-world considerations
1. Information storage/repositories
a. Centralized
1) All information in same place
2) User can check at their leisure
3) Information is immutable except by originator
4) Central node
b. Distributed
1) Information lies with end user
2) Open to interpretation by user
3) Can be relayed multiple times
c. Types
1) E-mail
2) Website
3) Phones

PG. 265

Owen Berger
4) Text messaging
5) Talking to someone in person (?)
2. Constraints
a. Human behavior
1) Checking sources:
a) Checking e-mail
b) Checking phone messages
c) Checking text messages
d) Texting and driving
2) Do anything while driving other than driving
3) Fatigue, keep work-ups DRY
4) Necessary information only
a) Push vs pull
b) Best of both worlds
5) CREDIT IS NOT IMPORTANT
b. Nodes
1) Centralized node has to be able to handle the traffic
2) Do the nodes
a) Process information
b) Mutate information
c) Interpret information
c. Mandated checking of information source
1) Positives
a) Ensures right people get the information
b) Everyone gets the same information
c) Interpretation can be relayed to everyone
2) Negatives
a) Induces fatigue
b) Failure to cooperate
c) Different interpretations
F. Intelligence flow
1. Follow the path
a. Path of least resistance
b. As the crow flies

PG. 266

Owen Berger
c. All necessary personnel are

1) Notified
2) Have access to the information
2. Static points or nodes
a. Points where information can be distorted
b. Places where interpretation or subjectivity can be injected
c. Dependent on node for transmittal
3. Importance of information
a. Tactical scale
1) Officer or Public safety
2) Possible safety issue
3) Crime issue
4) Protest/demonstration
5) Natural Disaster
a) Earthquake
b) Flood
c) Tsunami
d) Fire
6) Emergency
a) Bridge collapse
b) Traffic-related
c) Building collapse
7) Etc
b. Should be designated prior (Hint, hint)
c. When and who needs to know
1) Designated beforehand
2) Who gets credit
a) Not important
b) Not important
c) Not important
d. Vetting and validation system should determine this
1) Interface or node
2) Automatic for all information?
4. Vetting and validating information

PG. 267

Owen Berger
a. Consider the source

1) Reliable
2) Unreliable
3) Unknown
4) History of information
a) Good
b) Bad
c) Accurate
d) Poor
e) Exaggerated
5) Other sites/posts/messages/info from same source
b. Consider the actual information
1) Context
a) Fit/Doesnt fit
b) Tone
(1) Serious
(2) Threatening
(3) Warning
(4) Joking
(5) Sarcasm
c) Location
2) Accuracy
a) Demonstrably false
Outnumbered by opposing information

c) Quantifiable
b)

-
PG. 268

Owen Berger
(1) Round table for every five (5) students

(1) Extension power cord for each table (per five students) with at least five plug-ins
(1) Projector system with HDMI compatibility
Instructor computer with PowerPoint installed
Flash-drive with back-up file for the Intelligence Systems PowerPoint presentation file
Cable to connect computer to projector
(1) Intelligence Systems Rubric handout per student

PG. 269

Owen Berger
CDWS No. 3 Develop Social Media Policy

Social Media
Mentor: Chris Bouse

Module Name: Real-time Intelligence
Systems: Policy Development
Course Goal:
and the Internet
Module Goal:
To teach students how to develop policies for gathering and disseminating intelligence from
Social Media and the Internet
Task/Behavior:
Develop Social Media policy
Assessment).

PG. 270

Owen Berger

Media.
Generation X
direct oversight.
PG. 271

Owen Berger
to be).

PG. 272

Owen Berger
Boomers
Teaching Domains:
The primary learning domain used in this task is cognitive, as developing Social Media policy
for law enforcement is knowledge-based. This task does not have affective or psycho-motor
components.

PG. 273

Owen Berger
Students will start out by building individual policies for certain aspects of gathering and
disseminating real-time intelligence with Social Media and the Internet. For example, they
could develop policies for:
Using false personas

Internet usage
Using evidence from the Internet
Storing information or intelligence on groups
Etc
After writing policies for these specific things, students could analyze the information from
different perspectives, such as command staff, patrol, specialized units, detectives, etc, in
order to understand the impact of policy on certain personnel.
Students could also examine polices for legal loopholes, weaknesses, strengths, etc
After students get some practice building policies, they could analyze existing polices, talk
about the different approaches, and compare the advantages and disadvantages of each
approach.
Last, students will be given time to build and present a comprehensive policy to the rest of
the class on a chosen subject.
Evaluation Method:
assessment, which consists of creating an intelligence system and then creating a policy
governing that system. The students will be evaluated on their ability to develop policy and
articulate the reasoning behind their policy development process. The Policy Component of
the Intelligence Systems Rubric will be used to grade the examination.

PG. 274

Owen Berger
In-Depth Questions:
1. What are some concerns we should have when designing an intelligence system
policy? Where are those concerns on a scale of major to minor?
2. What are some of the types or examples of policy used today? How would you rate
the success of those policies? Please articulate why you gave that rating.
3. What is the best way to organize law enforcement policy in general? Why?
4. In your current position, what activities are governed by a policy? Of those activities
that are not governed by policy, which should or should not be, why or why not?
5. Of your duties, which could be abused the most by an unethical or immoral
employee?
6. What are the best ways to guard against abuse of power by law enforcement, and
how could you improve upon them?
7. What are some recent examples of police misconduct and how could policy have
prevented them?
8. How could law enforcement abuse intelligence-gathering with Social Media?
9. How can policy help to curb abuse or misuse of intelligence-gathering with Social
Media?
10. At what point does policy hinder instead of help and protect? What times have you
seen policy overreach in your own experience? How would you prevent policy
overreach if you were writing a policy?
11. Do different types of information require different handling? What are those
different types and please specify the handling for each type?
12. How would Social Media or Internet policy differ from other types of policy, say Use
of Force policy?
13. What are the legal considerations when writing a policy on Social Media?
14. What are the main legal cases that could impact Social Media policy? How would you
address those cases in your policy?
15. What are the different perspectives that should be considered when writing Social
Media policy? Of those perspectives which are the most/least important? Why?
16. Who should be responsible for writing policy on intelligence-gathering? Why?
17. Who would be best suited to writing policy on intelligence-gathering? Why?
18. Who should be asked to have input when writing policy on intelligence-gathering?
Why?
19. What elements should be in every intelligence-related policy? Which elements are
most important to your duties, and why?
20. What is the purpose of this policy?
21. How does policy stand up to scrutiny using the intellectual standards of critical
thinking?
PG. 275

Owen Berger
22. Can you analyze your policys purpose using the elements of reasoning? What
viewpoint were you using? Why?

B (Behavior) = Develop Social Media policy
C (Condition) = Working in small groups with Internet access and a time-limit of 60 minutes
for preparation and 6 minutes for presentation
D (Degree) = Score a three (3) or higher on each category of the Policy Component of the
Intelligence Systems Rubric

The students will develop Social Media policy while working in small groups with Internet
access and a time-limit of 60 minutes for preparation and 6 minutes for presentation, and
must score a three (3) or higher on each category of the Policy Component of the Intelligence
Systems Rubric.

The below items are the grading categories that make up the Policy Component of the
Intelligence Systems Rubric, and are the top level (4 out of 4) on the rubric scale.
8 Lawful Design
Students demonstrated understanding of the legal ramifications of Social Media
policy. Students openly discussed, more than twice, the constitutionality or lawful
consequences of the policy they developed. Their discussions included, but werent
limited to, current case law, data storage and retention, and constitutional
amendment issues.
PG. 276

Owen Berger
9 Purposed
The student-generated policy has at least one clear purpose that is explicitly noted in
the policy. The purpose fulfills at least two needs that align with concerns or
questions arising out of the students related intelligence system design.
10 Organization and Elements
The students policy was well-thought out and organized. The policy was broken into
categorical sections based on policy elements taught during the course. The studentgenerated policy contained at least three elements taught during the course as well
as at least one student-generated element.
11 Presentation
Students were able to clearly communicate their policy to the rest of the class. Every
student in the group presented equally, and students conveyed every primary
element of their policy.
12 Time Management

III. Social Media and Intelligence Policy
A. Policy and the Law
1. Current case law
a. Konop v Hawaiian
1) About
a) Konop made private website
(1) Restricted access to only other pilots
(2) Blogged about union and employer
(3) Critical of both union and employer
b) Airlines president used, with permission, other pilots logins
(1) Spoke with current union head
(2) Current union head called and threated Konop with lawsuit
c) Konop sued for violations of
(1) Wiretap act

PG. 277

Owen Berger
(2) Railway Act

(3) Stored Communications Act
d) Ultimately there was suppression of union activity
2) Legally view a website - Roles
a) User
b) Administrator
c) Law enforcement
3) Definition of User
a) Login or open access
b) Terms of Service
(1) Authenticating the agreement
(2) TOS allow/disallow specific items
c) Determining the actual person
(1) Gleaning importance
(2) Invitation vs pre-subscribed
(3) Intentional recipient vs open subscription
4) Methods of communication
a) Interception vs Reception vs Storage/Retrieval
b) Direct sending
c) Post and retrieve
d) Actively transmitting vs retrieval from storage
b. Garcetti v Ceballos
1) Employee vs Citizen
2) Two-prong tests
a) Determine who you are speaking as
(1) Employee
(a) Statements for work purposes
(b) Whistleblower laws
(c) During work hours
(d) At work location
(e) Using work resources
(f) Work Equipment
(g) Work supplies
(h) Work Technology

PG. 278

Owen Berger
(2) Citizen
(a) On off-time (off-duty)
(b) Using private/personal equipment
b) Matter of public interest
(1) Raising public concerns
(2) Normal situation arising out of work
(3) Right to know / Need to know
3) Punishment and Retaliation
a) Government has to function
b) Did the action impair that function
(1) Effect on the employees ability to continue working
(2) Effect on employers mandate or reputation
c) Punishment/retaliation
(1) Warranted
(2) Proportional
(3) Unusual
c. Cromer v Lexington
1) Cromer arrested John Michael Montgomery
a) DUI Arrest
(1) Popular Country/Western singer
(2) Lawful arrest
(3) Led to misdemeanor plea-bargain
b) Posts on Myspace
(1) Posts and comments by Cromer
(2) Posts and comments by Myspace friends
c) Punishments
(1) Cromer put on leave
(2) Cromer dismissed/terminated
2) Separation of concerns
a) On-duty
(1) Acting as representative of your organization
(2) Must abide by all policies/procedures
(3) Can identify as law enforcement
(4) Can hide identity for certain operations

PG. 279

Owen Berger
b) Off-duty
(1) Should not identify as law enforcement
(2) Can behavior
(a) Affect your ability to work
(b) Affect your employers ability to function
(c) Affect reputation of you or your employer
3) Termination for off-duty behavior
a) It is possible
b) It is legal
c) Never identify yourself as law enforcement
d) Complaints about employer
(1) Use whistleblower protections if needed
(2) Use the proper channels for reporting misconduct
1) Setting: Occupy Wall Street 2011-2012
a) @destructuremal (Malcolm Harris)
b) Assisted with organizing move to protest on bridge
c) Assembly was declared unlawful
d) Several arrested for civil disturbance, including Harris
2) NY District Attorney used tweets from @destructuremal to prosecute
a) Wrote search warrant to Twitter
b) Harris opposed as a third party
c) Twitter withheld warrant until judgment was given
d) Judge ruled in favor of NY DA, with time limits.
(1) Valid search warrant with probable cause was used
(2) Harris had no standing
(a) Third party only
(b) Twitters Terms of Service specifically stated
All content sent to or via Twitter belongs to Twitter

ii. They can give information with valid L.E. request
(3) Search warrant is necessary for info within last 180 days.
e) Twitter gave warrant return back to NY DA.
3) Lessons
a) Valid search warrants usually trump other considerations
i.

PG. 280

Owen Berger
(1) Warrant scope

(a) Limited to only what is necessary
(b) No overreach
(c) Not overly broad
Information-wise, and
ii. Time-wise
(d) Specific and related, no fishing expeditions.
(2) Probably cause
(a) Good PC can articulate the level of information needed
(b) Dont ask for it if you shouldnt get it.
(c) Traverse and quash will eliminate all information from warrant
b) Terms of Service
e. U.S. v Meregildo
1) Suspect Melvin Colon was involved in racketeering case
a) Sent evidence to Facebook friend, which indicated guilt.
b) Colon opposed the evidence
(1) Stated info was meant to be private
(2) Was confidential
(3) Sent to Facebook friend only
c) Facebook friend was a Confidential Information
2) Ruling found in favor of law enforcement
a) Communications were intended as private
b) However, after sending information
(1) Recipient is free to do with information as they please
(2) Social Medias expectation of privacy is narrowing
(3) How do you know who you are sending information to?
3) Projection/amplification of Social Media
a) Sharing in one method can become several methods
(1) Linked accounts
(2) Using same e-mail as base account
(3) Sign-in with Facebook
b) Private accounts can link to non-private accounts.
c) Law enforcement should look at all avenues and accounts
2. Other legal considerations
i.

PG. 281

Owen Berger
a. Reactive case law

1) Definition
2) Detrimental to law enforcement
a) Preventing overreach can become limiting to law enforcement
b) Public distrust becomes tangible
c) Information sources dry up
d) Public accounts become private
b. Law and ethics
1) Law vs ethics
2) Ethical behavior online
3) Sorry, but here it is, Netizen
4) The other persons shoes thing
a) Private citizen
b) Criminal
c) Law enforcement
c. What other laws govern the same behavior
1) Confidential informants
2) Privacy laws
3) On-duty vs off-duty snooping
B. Policy Purpose
1. Defining a purpose (Why?)
a. To correct a deficiency
1) Worthy of written policy
2) Methods to correct this deficiency
a) Training
(1) In-service
(2) Academy
(3) Online/Portal training
(4) Outside training if few enough personnel
(5) Outside training with train-the-trainer section
b) Background screening
c) Case law
d) New Laws
(1) Federal

PG. 282

Owen Berger
(2) State
(3) Local
b. Guidelines for new technology
1) Technology/issue requiring guidelines
a) More training
b) Liability issues surrounding technology
c) Impact of technology on
(1) Citizens
(2) Criminals
(3) Law enforcement
2) Technology policy coverage under different and existing policy
a) Use of force examples
(1) Taser
(2) Baton
(3) Bean bag shotgun
(4) CRCH
b) Media relations policy
c) Undercover/plainclothes policy
c. Guidelines for new issues
1) Requiring guidelines
2) Applicable under different and existing policy
3) Circumstances under which this issue arose
4) New laws to address this issue
a) Federal
b) State
c) Local (Municipal)
d. Prevent possible future lawsuits/legal action
1) Ramifications with and without policy
2) Policy that hinders law enforcement
3) Safety issues/concerns
e. Prevent abuse by law enforcement
1) Bad cop v deficiency in policy
2) Reactive case law
3) Cops are their own worst enemies

PG. 283

Owen Berger
2. Defining a purpose
a. Write it down
1) On paper
2) During planning
3) In the actual policy
b. Is it
1) Narrow
2) Specific
3) Necessary
c. Utilize the elements of Critical Thinking:
1) Intellectual Standards
a) Clarity
b) Accuracy
c) Precision
d) Relevance
e) Depth
Breadth
g) Logic
h) Fairness
2) Elements of reasoning
a) Purpose/Goal/End
b) Question at issue/Problem to be solved
c) Assumptions
d) Point of View/Frame of reference
e) Facts/Data/Evidence
f) Theories/Concepts/Ideas
g) Inferences/Conclusions
h) Implications/Consequences
d. Articulation
1) Proper English
2) Organized
3) On-target
C. Social Media and Internet Policy Elements
1. Purpose, Purpose, Purpose
f)

PG. 284

Owen Berger
a. Criminal Activity
b. Gather Intelligence/Information
c. Consistent with
1) Mandate
a) Agency
b) Division/Bureau
c) Unit
2) Authority
a) Agency
b) Division/Bureau
c) Unit
2. Duty categories
a. Apparent/overt
1) No concealing
2) Privy to public
3) Identity is known
b. Discreet
1) Knowledge could hamper investigation
2) Covering tracks
3) Not giving identity
c. Covert
1) True identity cannot be revealed
2) Contact between law enforcement and target
3) False personas
d. Supervisor oversight increases up the scale
3. Information vetting/validation
a. Different than traditional methods
1) Often cannot be:
a) Verified
b) Validated
c) Corroborated
2) Is reaction
a) Necessary
b) Mandatory

PG. 285

Owen Berger
c) Lawful
b. Types of vetting
1) Respond to or question source
2) Multiple sources
3) Radio call example
4) Target/user
a) Tone
b) History
c) Other accounts
c. Necessity
1) Validation
2) Demonstrations
3) Officer Threats
4) Public Threats
4. Tools and technologies
a. New source of information
b. Covered by other policies
c. Time frame of use
d. Purpose
e. Authorization
Approval
g. Tracking
1) Formal
2) Informal
3) Case notes
4) Discoverability
h. Automation
1) Could expand use beyond purpose
2) Could inadvertently expose monitoring
3) Over-reliance
5. Information Storage and Documentation
a. 28 CFR Part 23
1) Policy guidelines for federally funded intelligence systems
2) Nexus to criminal activity
f.

PG. 286

Owen Berger
3) Belief that ones conduct may be criminal

b. Minimum amount of time possible
c. Secure storage and distribution
1) Attention Gmail users
2) Encryption
3) HTTPS
4) Law enforcement networks (monitored by civilians)
d. Rules of evidence apply
6. Use of resources is within all laws and guidelines
a. Federal
b. State
c. Local
d. Laws
e. Regulations
Policy
g. Guidelines
7. Off-duty considerations
a. Off-duty conduct
1) Personal Social Media for work
2) Personal Social Media affecting work
3) If related at all to work, should be covered under same policy
b. Off-duty conduct under on-duty policy
c. Employees personal Social Media
1) Illegal to mandate viewing in CA for backgrounds
2) Circumstances that allow for employee snooping
a) Workers compensation claims
b) Alcohol/Drug abuse claims
3) Termination or firing
a) Cromer vs Lexington
b) Complete and utter separation of concerns
8. Information or Intelligence Dissemination
a. Encryption
b. HTTPS
c. Cold Computers
f.

PG. 287

Owen Berger
d. Department e-mail
e. Civilian Oversight
Content being sent

g. System in place
f.

-
Flash-drive with back-up file for the Social Media Policy PowerPoint presentation file
(1) Intelligence Systems Rubric handout per student

PG. 288

Owen Berger
CDWS No. 4 Teach Cyber-monitoring

Social Media
Mentor: Chris Bouse

Module Name: Teaching Cyber-monitoring
Course Goal:
and the Internet
Module Goal:
To teach students how to teach others how to gather and disseminate real-time intelligence
with Social Media and the Internet
Task/Behavior:
Teach cyber-monitoring
Assessment).

PG. 289

Owen Berger

Media.
Generation X
direct oversight.
PG. 290

Owen Berger
to be).

PG. 291

Owen Berger
Boomers
Teaching Domains:
The primary learning domain used in this task is cognitive, as teaching others how to use
Social Media and the Internet to find information and monitor events (cyber-monitoring) is
knowledge-based.
This task has a minor affective component in that students will need to learn to empathize
with and understand their trainees in order to obtain a buy-in for, or cooperation with, the
lesson. This task does not contain a psycho-motor component.

PG. 292

Owen Berger
Students will start out creating a small lesson, and then build over the course of the module
(1 day) to a full 15 minute lesson at the end.
Students could build lessons according the following variable parameters:
Age
Experience
Position
Generation
Duties
Subject Matter with real-world constraints
The students could role-play different people according to the parameters above, and could
evaluate the lessons critically.
Students could then come up with a method on how to incorporate critical thinking into their
own duties, and then think of how they could teach that critical thinking to the others in their
unit.
Lastly, students could create an entire 15 or 20 minute lesson of a pre-determined subject to
a pre-determined audience, keeping in mind all of the course content.
Evaluation Method:
assessment, which consists of creating and teaching a lesson for a specified cyber-monitoring
topic. The students will be evaluated on their ability to cater their lesson to the target
audience and teach their lessons material. The Teaching Cyber-monitoring Rubric will be
used to grade the examination.
In-Depth Questions:
1. How could the position or duty of law enforcement effect their learning style?
PG. 293

Owen Berger
2. How could you plan a lesson to incorporate that effect?

3. What are the categories of types of personnel for law enforcement? What are their
respective learning styles?
4. Who are the most difficult law enforcement students? Why? Easiest? Why?
5. What are some strategies for teaching different types of law enforcement? Which
strategies are the easiest to employ? The most difficult?
6. How does an employees current duties affect their learning environment or style?
7. What are the generations in todays workplace?
8. What are their main characteristics with regards to work, home life, society, etc?
Why?
9. What are their formative events? How did those events affect that generation? Why?
10. What are these generations learning styles? Most obvious to least obvious?
11. What are some strategies to adapt a lesson to these learning styles?
12. How can we adapt to multiple generations in one classroom? Which generations
need the most/least attention, and why?
13. What are some of the constraints of teaching law enforcement in general? What are
some strategies to mitigate those constraints? What are the most/least common?
14. What are some of the constraints to teaching technology in general? What are some
strategies to mitigate those constraints? What are the most/least common?
15. How can we fit more course material into less time? When have you faced this
problem, or seen someone else face this problem?
16. What are some of the key resources for teaching technical skills for law enforcement?
How can we ensure the availability of those resources?
17. What are some of the constraints on a course or classroom that are presented by the
students?
18. What are the key ideas behind learning activities?
19. How could you ensure those ideas are implemented in all of your learning activities?
20. What important considerations are there for learning activities? Rank them, please.
21. What should the goal of a learning activity be?
22. Can you have too few or too many learning activities? When have you been the
subject or teacher during such a scenario? What were you thinking? How could you
change that scenario today?
23. What is a resistant student? Are you one or do you know any?
24. What strategies have you employed for resistant students or co-workers?
25. What are some strategies we could use for resistant students? Which are the most
effective, and when?
26. How can we prevent student resistance?
27. What is critical thinkings role in education?
28. How can critical thinking be applied to any lesson?
PG. 294

Owen Berger
29. What questions should be asked to ensure that critical thinking is taking place during
a course?
30. When have you had to use critical thinking in your assignment? Most recent
example? Most relevant example?
31. How can critical thinking be interwoven into your lessons? Can you provide an
example, and what the students should be getting out of the lesson at the end?

B (Behavior) = Teach cyber-monitoring
C (Condition) = Working in small groups with a specified audience type and lesson subject, as
well as a time-limit of 120 minutes for preparation and 15 minutes for presentation
D (Degree) = Score a three (3) or higher on each category of the Teaching Cyber-monitoring
Rubric

The students will teach cyber-monitoring while working in small groups with a specified
audience type and lesson subject, as well as a time-limit of 120 minutes for preparation and
15 minutes for presentation, and must score a three (3) or higher on each category of the
Teaching Cyber-monitoring Rubric.

PG. 295

Owen Berger

The below items are the grading categories that are in the Teaching Cyber-monitoring Rubric,
and are the top level (4 out of 4) on the rubric scale.
Generational Consideration
The students lesson took into account the generational learning characteristics of their
target audience. There were at least two specific examples during the students lesson that
demonstrated tailoring of the lesson to the target audiences generation (or generations).
Activity
The students lesson contained one activity, and the activity lasted for at least three quarters
of the lesson. The activity was directly related to the subject matter, and brought out
student knowledge, either verbally or in the form of work product.
Positions/Duties
The students lesson demonstrated an understanding of their target audiences
positions/duties by incorporating at least two components or strategies that were tailored
specifically to the target audience and their specified positions/duties.
Constraints
The students lesson planning session included at least two discussions about lesson
constraints. This discussion, or discussions, included talking about the constraint as well
strategies to mitigate that constraint. Examples of such constraints could be time
management, difficult target audience, etc
Overcoming Resistance
If applicable, the group demonstrated the ability to overcome resistant students. Either the
group considered this resistance beforehand at least once and developed strategies
accordingly, or were able to do so on the fly during the lesson. Whether developed prior to
or during the lesson, the students strategy to overcome resistance was successful, and did
not distract from the lesson or take more than thirty seconds of extra time to deal with.
Critical Thinking
The students lesson incorporated at least two elements of critical thinking, either implicit or
explicit. The critical thinking components were directly related to the subject matter.

PG. 296

Owen Berger
Time management
The lesson flowed smoothly and there were no apparent parts removed or added during the
actual lesson to modify the timed lesson length. The lesson was within 15 seconds of the
overall 15 minute length. Students appeared to be conscious of the time on their own and
did not need any instructor prompting for when to end the lesson.

IV. Teaching cyber-monitoring
A. Teaching cops
1. Positional
a. Types
1) Line personnel
a) Patrol
b) Specialized Units
(1) Gangs
(2) Narcotics
(3) Vice
c) Detectives/Investigators
(1) Divisional
(2) Homicide
(3) Force Investigation
(4) ICAC
(5) Terrorism
d) School Resource
e) Reserve
f) Traffic
(1) Motors
(2) Collision Inv.
(3) Traffic Enforcement
(4) Parking Enforcement
2) Non-line Specialized Personnel
a) SWAT
b) Bomb Squad
c) Force Investigation
d) Parole

PG. 297

Owen Berger
e) Probation
3) Administrative Personnel
a) Command Staff
b) Event staff
c) Audits
d) Community Relations
e) Internal Affairs
4) Civilian Personnel
a) Analysts
b) Service Representatives
c) Dispatchers
d) Reports
e) Jail
b. Strategies
1) Tactics
2) Clearing cases
3) Caseload Management
4) Crime prevention
5) Crime management
2. Duties
a. Types
1) Investigative
2) Reactive
3) Radio Calls
4) Special Orders
5) Audits
6) Community Relations
b. Strategies
1) Tailored Buy-in or WIIFM
2) Efficiency vs Accuracy
3) Strategy vs Tactical
4) Targeting
a) Criminals
b) Community-oriented
B. Generational
1. Types
a. Greatest/Mature/Silent

PG. 298

Owen Berger
1927 1945
Conformists
Married for life
Readers
Self-sacrifice
Debt-free
Radio
Flight
b. Baby Boomers
1) 1946 1964
2) Revolutionaries/Hippies
3) Yuppies
4) Buy now save later
5) First TV generation
6) Active in retirement
7) More Acceptance
a) Divorce
b) Homosexuals
c. Generation X
1) 1965 1980
2) Latch-key kids
3) Individualistic
4) Entrepreneurial
5) Feel misunderstood
6) Learners
7) Explorers
8) Drugs
9) Life/Work balance
10) Tolerant
11) Weary of authority
12) Weary of societal structure
13) Weary of company oversight/structure
d. Generation Y / Millennium
1) 1981 2000
2) Nurtured
3) Respect Authority
4) Lower crime rates
1)
2)
3)
4)
5)
6)
7)
8)

PG. 299

Owen Berger
Academically pressured
Great expectations
Want things immediately
Unlimited access to information
Teamwork, not individual
e. Generation Z / Boomlets / Homeland
1) After 2001
2) Majority have TVs
3) Always have had computers and cell phones
4) Eco-fatigue
5) KGOY kids growing older younger
6) Smith vs Rodriguez
2. Formative Events
a. Greatest/Mature/Silent
1) 1927 1945
2) Great Depression
3) WWII
4) Korean War
5) Vietnam War
6) Rise of labor unions
7) The New Deal
b. Baby Boomers
1) 1946 1964
2) Vietnam War
3) Civil Rights
4) The Cold War
5) Woodstock
6) Kennedy Assassination
c. Generation X
1) 1965 1980
2) Latch-key kids
3) Fall of Berlin wall
4) Challenger explosion
5) PC Boom
6) MTV
7) AIDS
5)
6)
7)
8)
9)

PG. 300

Owen Berger
1981 2000
Iraq
Afghanistan
Pakistan
The Internet
Columbine
9/11
Oklahoma City Bombing
e. Generation Z / Boomlets / Homeland
1) After 2001
2) 9/11
3) Facebook
4) Twitter
5) Cyberbullying
6) Texting
3. Learner Characteristics
a. Mature/Silent
1) 1927 1945
2) Loyal
3) Follows Orders
4) Structured
5) Set in their way
6) Logical
7) Appreciate Consistency
8) Read (need written materials)
b. Baby Boomers
1) 1946 1964
2) Workaholics
3) Needs Recognition
4) In to problem-solving
5) Interested in efficiency
c. Generation X
1) 1965 1980
2) Latch-key kids
3) Techno-literate
4) Self-starters
5) Individualistic
1)
2)
3)
4)
5)
6)
7)
8)

PG. 301

Owen Berger
6) Skeptical
7) Dont need authority/structure
8) Learn by doing
1) 1981 2000
2) Goal-oriented
3) Collaborative
4) Achievement
5) Team-players
6) Require supervision
7) Sociable
8) Possible cheating problems
9) Need feedback/attention
e. Generation Z / Boomlets
1) After 2001
2) Instant information gratification
3) Extreme technical know how
4) Will figure it out
C. Constraints
1. Time
a. To prepare
1) Specific Students
a) By duty
b) By generation
c) Other learner characteristics
2) Classroom location
a) Obtaining resources
b) Changing learning activities
c) Late Students
b. Management
1) Too much material, too little time
a) Priorities
b) End goal
c) Specific Behavior
d) Student
(1) Priorities
(2) Goals

PG. 302

Owen Berger
(3) Limitations
2) Too little material, too much time
a) Possible?
b) Review
c) 7 times rule
3) Ending on time
a) Letting students out early
b) Breaks
c) 50 Minute attention span
2. Resources
a. Reliance on others
1) Ensure you have backups
2) Dont rely on presenter or hotel
3) SPECIFY requirements in course flyer
b. Multiple ways to conduct same activity
1) Flip chart
2) Computer
3) Projector
4) Activity
5) Outside of classroom
c. Computer Investigations course with no Internet
d. Preparation
1) Test everything
2) Student safety is first
3) Arrive early
4) Be prepared
5) No peeks behind the scenes
3. Student constraints
a. Disabilities
b. Desire
c. Improper materials
d. Forced to go
e. Overcoming resistance (see later section)
f. Not prepared
g. Tired/Overworked
D. Learning Activities
1. Design considerations

PG. 303

Owen Berger
a. Student-centered
1) Centered on students or on instructor expectations
2) Dynamic activity vs static scenario
3) Student Considerations
a) Generational
b) Positional
b. Empathetic
c. Safe
1) Physical safety
a) Leaving classroom
b) Crossing major streets
c) Equipment
d) Firearms?!
e) Other weapons
f) Environment
(1) Construction
(2) Power cords
(3) Creating or building with materials
2) Other safety
a) Emotional (Trauma, PTSD, etc)
b) Hurt feelings
(1) Verbal boundaries
(2) Over-active participation
(3) Relative participation
(4) Duds
d. Interesting
1) Related to subject matter
2) WIIFM
3) Buy-in
4) Different than other activities
5) Flip-chart exhaustion
e. Appropriate
1) Student-screening
2) Self-screening
3) Role-playing
f. Realistic
2. Knowledge vs behavior

PG. 304

Owen Berger
a. End goal
1) Knowledge-based
2) Behavior-based
b. Testing
1) Evaluated activities
2) Rubric Presentation
3) Prepared for evaluation/test
E. Overcoming Resistance
1. Problem Students
a. Types
1) Forced to be there
2) Outside of comfort zone
3) Other issues
a) Family
b) Work
c) Time
4) Generally resistant (e.g. generational)
5) Disrespectful
a) Blatant disrespect
b) Passive disrespect
(1) Late, late from breaks
(2) Cell phones
6) No buy-in/WIIFM
b. Options
1) Direct approach
a) Side talk
b) In front of class
2) Student boundaries/enforcement
3) Asked to leave
2. Prevention Strategies
a. Student rules
1) Guided
2) Students become enforcers
3) Buy-in on following rules
b. Instructor expectations
1) Clear
2) Laid-out beforehand

PG. 305

Owen Berger
3) Respectful
4) Realistic
c. List of classroom rules/expectations
1) In student flyer/preparation e-mail
2) Handout
3) PowerPoint Slide
F. Introduce Critical Thinking
1. Utilize the elements of Critical Thinking:
a. Intellectual Standards
1) Clarity
2) Accuracy
3) Precision
4) Relevance
5) Depth
6) Breadth
7) Logic
8) Fairness
b. Elements of reasoning
1) Purpose/Goal/End
2) Question at issue/Problem to be solved
3) Assumptions
4) Point of View/Frame of reference
5) Facts/Data/Evidence
6) Theories/Concepts/Ideas
7) Inferences/Conclusions
8) Implications/Consequences
2. Critical thinking as applied to the subject matter
a. Define the central focus
1) Issue
2) Point
3) Problem
4) Concern
b. Apply critical thinking
1) Intellectual standards
2) Applied with sensitivity to

PG. 306

Owen Berger
3) The elements of thought/reasoning

3. Critical Thinking in law enforcement
a. Time consideration
1) Instant reaction
2) Planning
3) Analysis
b. Used in
1) Policy-making
2) Current Duties
3) Investigations
4) Community relations

-
Flash-drive with back-up file for the Teaching Cyber-monitoring PowerPoint
presentation file
(1) Teaching Cyber-monitoring Rubric handout per student
(1) Handout per table that gives the groups possible teaching subjects and audience
type for the end lesson, entitled Group #X, Topics and Audience Type.

PG. 307

Owen Berger
Instructional Resources
The course presenter is the Los Angeles Police Department (LAPD). The course will be
taught in Burbank, California, at the Holiday Inn Media Center, a common off-site facility used
by the LAPD. The hotel has three conference rooms with enough room for the estimated 25 to
30 students arranged in table seating: Room No. Four, Room No. 14, and Room No. 16. The
basic information for the Holiday Inn is as follows:
Holiday Inn Burbank Media Center
150 East Angeleno Avenue, Burbank, CA 91502
(818) 841-4770
Web Site - http://www.ihg.com/holidayinn
As stated in the course goals section, there are four main modules for this course. The
resources needed are organized first by base course materials, and then by module-specific
resources.
Base Instructional Resources (applicable to all course modules)
Classroom resources. This course will require several things that are not specific to the
course material and appear in most classroom or instructional settings:
Conference room capable of holding 25 to 30 students arranged in five-per-table

table seating.
One circular table per five students (approximately five to six tables). Each table
should be large enough to comfortably fit five students with computing devices (5
to 6' in diameter).
One chair per student (approximately 25 to 30 chairs).
One projection (or projector) system with HDMI connectivity.
One HDMI cable, 20, to connect the projection system and instructor computer.
One lectern with 2 by 3 top (large enough to hold instructor laptop)
One large projection screen, with a minimum size of ten feet in width when
displaying at an aspect ratio of 16:9.
One rectangular table (minimum 3 by 4) on which to place the projection system.
One chair for instructor seating at projection table.
One instructor computer with Microsoft PowerPoint installed, a compatible power
cord, Wi-Fi capability, and speaker projection with power cord if needed.
One remote PowerPoint controller with USB compatibility.
Table of Contents
PG. 308

Owen Berger
One large (minimum 6 by 4) chalk-board or white-board in a location that is visible

to the entire classroom.
Chalk or dry-erase markers (3-4 in different colors) for the above-listed board as well
as a compatible eraser.
One tented student name-card for each student (approximately 25 to 30).
One office-supply packet per student (approximately 25 to 30) containing:
o Pen or pencil
o Notebook
o Ten index cards
o Scratch paper (2 to 3 sheets of printer paper is sufficient)
One copy per student of CriticalThinking.orgs Critical Thinking: Concepts & Tools,
7th edition (approximately 25 to 30), available for order.
Administrative resources. The course will require certain standardized paperwork for
POST operations:
California Peace Officer Standards and Training (POST) roster with pen, one page per
15 students.
One student certificate per student (approximately 25 to 30 with personalized
names).
One course evaluation per student (approximately 25 to 30).
One module evaluation (four modules total) per student (approximately 25 to 30).
One instructor evaluation per student (approximately 25 to 30).
Reimbursement forms as needed, either a POST Travel Reimbursement Request
(TRR) or a POST Letter of Agreement (LOA).
Activity resources. The course activities will necessitate writing of key points for display
or presentation by each group to the rest of the class. The easiest way to achieve this type of
presentation is by using a flip-chart, or easel that holds a large pad of paper. The items
necessary to complete the courses activities are:
One flip-chart stand or easel per table (approximately five to six).

One flip-chart pad or easel-pad per table (approximately five to six).
Five or six markers of various dark colors per table, e.g. black, brown, green, red, or
blue (approximately 30 to 36 markers. Note, highlighters will NOT suffice for this
resource, as they are too lightly-colored for classroom display and cause problems
for students on the opposite side of the room or students with poor eyesight.
Table of Contents
PG. 309

Owen Berger
Technical resources. This course relies heavily on students use of electronic devices
that are capable of both accessing the Internet and creating electronic documents. Wireless
Internet access is preferred for both safety reasons and for ease of use. Here are the resources
required for the technical aspects of this course:
One Computer, tablet, or device per student that is capable of:

- Accessing the Internet via a wireless-fidelity (Wi-Fi) connection, and
- Creating typed electronic documents that can be converted to PDF format,
- Charging with compatible power cord over the course of each day.
One extension power cord and power-strip (or outlet-strip) for every table with at
least five three-prong plug-in ports (approximately five to six cords, totaling 25 to 30
plug-in ports). If necessary, or if the tables are far away from the power source,
both an extension cord and power-strip could be necessary.
Wireless Internet from a hard-wired router/modem that is capable of handling 25 to
30 students who are all accessing the Internet. The minimum average speed for
such a connection should be around forty mega-bits-per-second download speed
(40 mbps).
If no hardwired Internet base is available, then the following items will be required,
- One Wi-Fi hotspot per table (approximately 5 to 6),
- One hotspot power cord per hotspot
Any necessary wireless code or access information.
Four to five back-up Internet-ready laptops, with compatible power cords, for
students without a device. These laptops should be for emergency use only, and
every chance should be taken to ensure that all students bring an Internet-ready
device with them from their own agency. Students should not be aware of and
should not rely upon the back-up computers.
Specific Instructional Resources (applicable to individual course modules)

Module One Gathering Intelligence with Social Media and the Internet. The
resources specific to this module center around the actual gathering of intelligence and
subsequent evaluated activity:
Two copies of the Cyber-monitoring Rubric per student one for each student and
one for instructor use (approximately 54 to 64).
One USB flash drive with a back-up copy of the Cyber-monitoring PowerPoint
Presentation.
Table of Contents
PG. 310

Owen Berger
Module Two Real-time Intelligence Systems: Design and Implementation. The

resources specific to this module center around intelligence systems and subsequent evaluated
activity:
Two copies of the Intelligence Systems Rubric per student one for each student
and one for instructor use (approximately 54 to 64).
One USB flash drive with a back-up copy of the Intelligence Systems: Design
PowerPoint presentation.
Module Three Real-time Intelligence Systems: Policy Development. The resources

specific to this module center around the actual gathering of intelligence and subsequent
evaluated activity:
Two copies of the Intelligence Systems Rubric per student one for each student
and one for instructor use (approximately 54 to 64).
One USB flash drive with a back-up copy of the Intelligence Systems: Policy
Module Four Teaching Cyber-monitoring. The resources specific to this module

center around the actual gathering of intelligence and subsequent evaluated activity:
Two copies of the Teaching Cyber-monitoring Rubric per student one for each
student and one for instructor use (approximately 54 to 64).
One USB flash drive with a back-up copy of the Teaching Cyber-monitoring
Table of Contents
PG. 311

Owen Berger
Logistical Support
Registration Information
Registration for this course will occur through the Los Angeles Police Departments
Detective Training Unit (LAPD - DTU).
LAPD Detective Training Unit
1880 North Academy Drive, Los Angeles, CA 90012
(323) 223-6959
Web Site - http://www.lapddtu.org/
E-mail Address detectivetraining@lapd.lacity.org
Registration can happen via several different methods, all through the DTU:
1) Online registration at the LAPD DTU website (see above).
2) Phone registration by calling the DTU (see phone number above).
3) Registration by e-mail request (see e-mail above), though further verification of identity
will be required if the inquiring e-mail is not from a valid work e-mail address.
After registering, students will be given course location, requirements, and any other
necessary information via e-mail. Students will also be notified that failure to meet any of the
requirements could result in disqualification from taking the course on the initially scheduled
date and time. Any overflow registration, meaning more students than one class instance can
handle, will be handled with a wait list. The wait list will be filled on a first come, first serve
basis, and subsequent course registrations will begin with notifications to the wait listed
personnel prior to marketing or advertising the next course.
There is a separate course website at www.calmass.org/real-time-intel. However, this
site will only be used for marketing and informational purposes because it does not have the
means to securely receive and store law enforcement credentials for registration.
Course Location Information
As stated previously, the course will be held at the Holiday Inn in Burbank, California:
(818) 841-4770
Table of Contents
PG. 312

Owen Berger
Directions. The hotel is located one block north of the 5 freeway (I-5) in Burbank,
California. The northbound exit for students travelling from south of the training site is the
Burbank/Olive Avenue E exit. The southbound exit for students travelling from north of the
location is the Verdugo Ave exit.
Southbound 5 map. For students taking the I-5 south, here is a map detailing the exit
and directions to the training site, from Google Maps:
Southbound 5 steps. For students taking the I-5 south, here are step-by-step directions,
from Google Maps:
1)
2)
3)
4)
5)
6)
Head south in I-5 S.

Take the Verdugo Ave exit.
Turn left onto S Front St.
S Front St turns slightly left and becomes E Verdugo Ave.
Turn left onto S First St.
Take the second right onto E Angeleno Ave (parking on the right).
Table of Contents
PG. 313

Owen Berger
Northbound 5 map. For students taking the I-5 north, here is a map detailing the exit
and directions to the training site, from Google Maps:
Northbound 5 steps. For students taking the I-5 south, here are step-by-step directions,
from Google Maps:
1) Head north in I-5 N.
2) Take the Burbank/Olive Ave exit.
3) Slight right onto E Angeleno Ave (parking will be on the right).
Table of Contents
PG. 314

Owen Berger
Parking. Parking is available for $2 per day at the dedicated parking garage which is
located directly north of the hotel. Although free parking is available in downtown Burbank,
this option is not advisable as most of the parking has a two hour limit and the limit is strictly
enforced by the Burbank Police Department.
Parking entrance here, just north of

the hotel entrance.
Transportation. The Holiday Inn provides free shuttle transportation to and from
Burbanks Bob Hope Airport. Additionally, there are taxis on standby or on-call at the hotel (see
photo above). The other nearby airport is the Los Angeles World Airport (LAX). Both airports
support most major airlines and provide access to most car rental agencies.
Table of Contents
PG. 315

Owen Berger
Food and Restaurants. There are many restaurants and eateries of varying tastes
located within walking distance (one half mile) of the hotel training site, see the list below. In
addition there is an on-site restaurant located inside the Holiday Inn one floor above the
classroom. Here are several nearby restaurants:
Wokcano
150 S San Fernando Blvd
Burbank, CA 91502
(818) 524-2288
http://www.wokcanorestaurant.com
Wild Carvery
150 E Olive Ave
Burbank, CA 91502
(818) 859-7233
http://www.wildcarvery.com
Great Grill
126 N San Fernando Blvd
Burbank, CA 91502
(818) 567-0060
http://www.greatgrillburbank.com
Indias Tandoori
Burbank, CA 91502
(818) 848-0004
http://www.theindiastandoori.com
North End Pizzeria
212 E Orange Grove Ave
Burbank, CA 91502
(818) 557-8325
http://www.northendpizza.com
Seoul Korean BBQ
Burbank, CA 91502
(818) 559-5578
Table of Contents
PG. 316

Owen Berger
Lodging Information
On-site reservations. Any student making reservations at the hotel should ask for inhouse reservations and should mention the course by name to receive a discounted
government or State rate of $79 per night, plus tax. Otherwise, the government rate as it
stands for Los Angeles County is $120 per night, plus tax (California Department of Human
Resources). In addition to the room fees, parking rates for attendees will be $2, a rate that
must be specifically requested when setting up the course with the Holiday Inn sales staff.
Off-site reservations. Students who wish to stay at a different hotel than the site can
look for lodging at these nearby locations. The cost for these sites varies and their placement
on this list is in no way an endorsement of their services:
Residence Inn Burbank Downtown

321 S 1st St
Burbank, CA 91502
(818) 260-8787
http://www.marriott.com/hotels/travel/burri-residence-inn-burbank-downtown/
Burbank Inn & Suites

180 W Alameda Ave
Burbank, CA 91502
(818) 842-1114
http://www.burbankinnandsuites.com/
Extended Stay America

2200 W Empire Ave
Burbank, CA 91504
(818) 567-0952
http://www.extendedstayamerica.com/hotels/ca/los-angeles/burbank-airport
Marriot Courtyard Los Angeles Burbank Airport

2100 W Empire Ave
Burbank, CA 91504
(818) 843-5500
http://www.marriott.com/hotels/travel/burcy-courtyard-los-angeles-burbank-airport
Table of Contents
PG. 317

Owen Berger
Classroom Information
An on-site visit to the Holiday Inn where the course will be held revealed the probable
classroom layout. Five tables would normally be used, with five students per table. However,
the course can serve up to thirty students. The projected layout below shows the room with a
full 30 students. There is a mobile chalkboard (not shown) that will be used to display
classroom goals and expectations. The room is located on the lower-level of the Holiday Inn,
and digital screens are available to guide students to the correct classroom. There are
restrooms approximately 100 feet down the hallway from the room, as well as upstairs in the
main lobby. There are elevators for access in case any students have a disability which
precludes using the stairs.
Instructor
laptop &
lectern
Projector screen
Projector
Optional table &

easel (if needed)
Beverages
Main door to
exit & restrooms
Paperwork
Table of Contents
PG. 318

Owen Berger
Cost Analysis
The LAPD Detective Training Unit (DTU) will provide instructional resources using
existing equipment and current budget allowances. The DTU will also obtain necessary training
items and locations, tracking them in a running budget. Aside from the cost of a conference
room at the Holiday Inn (Wi-Fi Internet is included), there is a nominal fee for the Critical
Thinking Guide that will be used during the course. Current order information places the guide
at a cost of approximately $90 for a class of 30 students.
Table of Contents
PG. 319

Owen Berger
In-Progress Review Subject Matter Experts and Subject Matter Resource

SME No. 1 Detective Samuel Palmer
Method of Selection. Detective Palmer was chosen for his experience in a crime analysis
position at the Phoenix Police Department and the fact that he is a presenter on and instructor
in the subject matter. Detective Palmer was a survey recipient and requested to be contacted
as a possible subject matter expert. Detective Palmers expertise was assessed both through
online research and a telephonic interview.
Expertise. Detective Samuel Palmer has worked in law enforcement for twenty years.
He is currently a detective with the Phoenix Police Department, and is currently assigned to the
Crime Analysis and Research Units Robbery Investigation Section. Detective Palmers expertise
is not limited to robberies, as he has assisted with investigations for homicides, threats at
schools, gang-related crime, and terrorism investigations in conjunction with the Arizona
Counter-Terrorism Information Center.
For the past seven years, Detective Palmer has utilized the Internet and social
networking to investigate violent crime. He has given presentations and taught courses on
using Social Media in investigations as well. Some of the subjects he teaches are intelligencegathering for violent crime, and modern-day issues such as sexting, and cyber-bullying.
Detective Palmer was recently honored as a ConnectedCOPS Social Media Investigator Award
recipient during the Social Media, the Internet and Law Enforcement (SMILE) conference in
Omaha, Nebraska.
Contributions. As the course development progressed past the initial planning and datagathering phases, Detective Palmer was instrumental in providing an out-of-state in-theweeds perspective. Palmer works daily in the field of cyber-intelligence, though his specialty is
with criminal intelligence. Subsequently, one of Palmers primary concerns for the course was
ensuring up-to-date technological and legal content. Palmer specifically cited a case that will be
used in the course content as it unfolds, United States v. Elonis (U.S. v Elonis).30 The case of U.S.
v Elonis deals with criminality of making direct threats over Social Media, specifically on
Facebook.com. This case could have widespread First Amendment repercussions for law
enforcement, and certainly for those who gather real-time intelligence with Social Media.
In addition to the dynamic course content inclusions, Detective Palmer wanted to
emphasize hands-on development during the course. Meaning, rather than just teaching
policy developments, students should actually create policy. This experiential aspect was
30
(United States of America v. Anthony Douglas Elonis, 2013)
Table of Contents
PG. 320

Owen Berger
already planned for the course, but the reaffirmation by Palmer could mean less classroom
time spent on teaching the material and more classroom time spent using the material in
realistic scenarios.
Table of Contents
PG. 321

Owen Berger
SME No. 2 Sergeant Tom Leveque

Method of Selection. Sergeant Leveque was selected as a subject matter expert
because of his training, current responsibilities and accomplishments with the Arcadia Police
Department. Sergeant Leveques expertise was assessed through online research, peer
recommendations, and a telephonic interview. Sergeant Leveque was chosen for his
supervisory position in charge of Social Media at the Arcadia Police Department, and the fact
that he is a nationally-recognized presenter and instructor on/in the subject matter.
Expertise. Sergeant Tom Leveque has worked in law enforcement for almost thirty
years. He is currently a supervisor of detectives at the Arcadia Police Departments
Investigation Section. Sergeant Leveque pioneered the use of Social Media for his department,
and uses cutting-edge technology and tools to monitor Arcadia PDs Social Media presence, as
well as the Social Media coming from his community.
Sergeant Leveque is experienced in utilizing information obtained from Social Media for
community interaction, investigations and event situational awareness. Throughout the
performance of his duties, Sergeant Leveque has impacted the quality of life for the citizens of
Arcadia though Social Media. Sergeant Leveque is responsible for identifying resources for a
young girl who was threatening suicide on the popular micro-blogging site Tumblr. In addition,
Sergeant Leveque monitors the Breeders Cup horse race in Arcadia, using Social Media to both
engage the large number of visitors during the event and to monitor for information that could
be adverse to Arcadia or to the event itself.
Contributions. Sergeant Leveque, who has since retired during this instructional design
process, was instrumental in maintaining focus for Module I Gathering Intelligence with Social
Media and the Internet. Leveques ability to monitor his entire geographical area of
responsibility led to a categorization of searches, backed by the Literature Review, which will be
used during the course. The two main categories are content-related searches and searches by
geographical area. Both of these categories have a use for law enforcement, albeit in different
scenarios.
Table of Contents
PG. 322

Owen Berger
SME No. 3 Officer Candice Foster

Method of Selection. Officer Foster was chosen for her current position as a Cyber
Support Unit officer at the Los Angeles Police Department. Officer Fosters current assignment
is the full-time duty of monitoring Social Media and the Internet for intelligence that could
affect the Los Angeles Police Department with regards to decision-making, deployment and/or
officer safety.
Expertise. Officer Candice Foster has 23 years of law enforcement experience. She has
been with the Los Angeles Police Department for 20 years and was with the Upland Police
Department for 3 years prior to that. Officer Foster has worked a variety of assignments;
undercover buying narcotics, patrol, accident investigation, vice, gang enforcement - CRASH, as
a training officer, a City Attorney investigator - legal researcher and as a detective trainee. With
such a wide variety of assignments, it has given Officer Foster the experience and opportunity
to work her current assignment at Operation Central Bureau, Cyber Support Unit. Officer Foster
not only assists the Central Bureau divisions with their Social Media pages, she assists with
training the departments employees with new trends in Social Media, criminal investigations
and monitoring unusual activities that occur in the city during protests and other major
incidents.
Contributions. Officer Foster has been a regular contributor throughout the course
development process. Her front-line view of real-time intelligence and work experience in the
subject matter have provided invaluable insights and anchored important content concepts for
the course. Most recently, Foster re-emphasized the need for intelligence systems content,
both in design and implementation. Foster opined that logistics were becoming a very real
problem for real-time intelligence gatherers, as decreasing budgets mean that command staff
were expecting more intelligence with less resources. This inverse relationship has led to less
planning and to what she called re-inventing the wheel every time an intelligence need arises.
Officer Foster raised a very important point that had not been raised before, at least
significantly, Internal Affairs or Professional Standards in law enforcement. An Internal Affairs
section of a law enforcement agency is normally the section assigned to investigating other law
enforcement personnel from the same agency combating police corruption and abuse of
power.
Foster raised two points about this rarely-discussed topic amongst law enforcement.
First, she stated that from a law enforcement personnel standpoint, it really needs to be
hammered home that just as criminals can be monitored, so can law enforcement. Therefore,
law enforcement should be extremely careful about what information they put online. This
Table of Contents
PG. 323

Owen Berger
point was driven home in the literature review section of the Training Needs Assessment (TNA),
where the Arizona Counter-Terrorism Information Center posted information about a trafficstop that revealed digital storage of law enforcement personnel and their photos all from
online sources.31
Second, Officer Foster noted that in the light of recent events, specifically the
Christopher Dorner murders and man-hunt in Los Angeles, law enforcement cannot be exempt
from scrutiny by its own. Therefore, course design will be impacted in that students will be
explicitly told to not ignore other law enforcement that they come across during their online
searches. Any lawful and purposed search for intelligence that could lead to action by the
students respective agency should be continued, regardless of the monitored entitys
employment or status.
31
(Arizona Counter-Terrorism Information Center, 2010)
Table of Contents
PG. 324

Owen Berger
SMR No. 1 Commander Michael Parker, Sergeant Chris Meadows, Sergeant Robert
Boese, and Deputy Anthony Moore
Method of Selection. Commander Parker, Sergeant Meadows, Sergeant Boese, and
Deputy Anthony Moore were chosen collectively as a subject matter resource due to the fact
that they founded the eComm unit and developed the majority of Social Media policies and
procedures for the Los Angeles Sheriffs Department. All four are also instructors for POST
Social Media courses, including a two-day course for Public Information Officers. The four
experts were combined into one subject matter resource due to the fact that all four experts
are from the same agency. This concentration of expertise could cause institutional bias in this
research if they were interviewed individually as subject matter experts.
Expertise. The subject matter resource members have been presenters and instructors
in the subject matter for years, including presenting at the Law Enforcement and Private
Security Conference, where Social Media was the conference theme. In addition, the members
have taught Social Media courses for Public Information Officers and other law enforcement.
All members of the SMR were part of the foundation of the Los Angeles County Sheriffs
Headquarters Bureau, Electronic Communications Triage Unit (eComm). The eComm unit is a
ground-breaking law enforcement idea-turned-reality. The eComm unit consists of both sworn
and civilian personnel, and is responsible for gathering and disseminating information for the
entire Los Angeles Sheriffs Department.
Contributions. The subject matter resource has provided insight throughout the
instructional design process. The most recent content review with the subject matter resource
was perhaps the most valuable of the process, and was conducted through a phone interview
with Commander Parker. Commander Parker provided valuable insight to the development of
this course through his unique work experience working as both command staff and at the
forefront of Social Media use by law enforcement. After reviewing the initial course design,
Commander Parker gave several key points on which to focus course content and course
design.
First, Commander Parker detailed the importance of having a well-thought out purpose
to any monitoring activity involving Social Media or the Internet. This purpose should include
articulation that would stand up to legal scrutiny. Additionally, the purpose, at least for
monitoring, should be fundamentally based on open-source information, with covert
monitoring saved for specific criminal investigations only on an as-needed basis.
Second, the course content should emphasize the importance of adapting to evolving
technologies, summarized by the SMR as dont put all of your eggs in one basket. This
Table of Contents
PG. 325

Owen Berger
reminder to focus on the use of evolving technologies matches the researchs analysis of the
SMRs first interview. This analysis is part of what led to the critical thinking section of course
content.
Lastly, Commander Parker stated his experience has shown him that emergency-related
monitoring should not be ignored, and can actually be a very effective real-world marketing
tool. This effectiveness stems from the fact that some citizens argue against law enforcements
use of Social Media monitoring. Those citizens, however, usually argue against monitoring for
criminal investigations or demonstrations, but do not argue against monitoring of emergencyrelated events or natural disasters. The primary name of this type of monitoring is Social Media
Emergency Management, with the Twitter hashtag #SMEM.
Table of Contents
PG. 326

Owen Berger
Marketing Plan
Primary Focus
The primary focus of this marketing plan will be to drive prospective students and
training coordinators to base information resources for the course, which are detailed below in
Methods of Dissemination. This means that widely disseminated promotional materials should
not contain too many logistical course details. A centralized marketing information system
assures that prospective students will always be accessing the correct and most up-to-date
course information. After reading and seeing the course details on the website and on Social
Media, it is expected that students will register via the appropriate avenues that will be made
readily available in the base resources.
Registration
All registration for the course will be directed through the Los Angeles Police
Departments Detective Training Unit (LAPD DTU), contact information here, who will handle
registration either by phone or on their website. A list of interested students will be kept by the
DTU, and selections for course attendees will be based off of that list. Approximately six weeks
prior to the actual course date, enrollment will end and students will be sent a confirmation
letter (see example below).
If more students are needed or required inside the six week window, enrollment could
possibly stay open until a month prior to the course date with the caveat that students are
warned that some Peace Officer Standards and Training (POST) expenditures or reimbursement
polices might not apply on such short notice. This course is not yet certified through POST.
Subsequently, any POST reimbursement, travel request or plan information will be updated on
each of the resources listed below when known.
Methods of Dissemination
The primary method of marketing for this course will be dissemination of course
information resources via electronic mail (e-mail). Those informational resources include:
The course flyer,

The course website,
The Facebook page Real-time Intelligence with Social Media, and
The Twitter feed - @LERealTimeIntel.
Table of Contents
PG. 327

Owen Berger
The course presenter, the Los Angeles Police Department (LAPD), will also have links to
all of the marketing information along with the course information on the Detective Training
Unit (DTU) website. Prospective students, however, will be encouraged to visit the main course
website. This is due to the fact that the extensibility of the website and Social Media pages
allow for dynamic media addition and removal not available through the presenters website or
through the static course flyer.
Note For security purposes, the actual location of the training will not be listed on any public
documents or websites. The exact location information will only be given in the final course
confirmation letter.
Marketing Phases
The marketing plan for this course involves several phases, detailed below.
Phase I. This phase includes notification list requests and list building for electronic mail
(e-mail) contacts. Course personnel (creators, instructors, coordinators, or presenters) will
request that several major law enforcement organizations help in promotion of the course by
outlining the benefits for those entities members. These organizations include California
Multi-Agency Support Services, the Police Officers Association of Los Angeles County, and the
California Peace Officers Association. In addition to law enforcement organizations, the listbuilding request or request to disseminate training information will also be sent to: the training
coordinators at a variety of law enforcement agencies on the federal, state and local levels, and
to the Training Needs Assessment survey respondents.
Phase II. The second phase involves the actual sending of information to the various
law enforcement organizations and agencies listed or noted above. The information sent shall
include: a link to the course registration page, downloadable course flyer, links to the website,
Facebook page, and Twitter page. Optional information in the course promotional e-mail could
include a bulleted list of course contents as well as a list of benefits for law enforcement
personnel and their agencies. Any responses to the promotional e-mail should be processed if
follow-up is necessary.
Phase III. The last phase of marketing will be a grass-roots type of effort where
training coordinators and POST instructors are given the course information and asked to
promote the course in their own organizations and at their courses. This last phase is
supplemental only and should not be relied upon to fill all of the course vacancies.
Table of Contents
PG. 328

Owen Berger
Dynamic Marketing
Obviously, as communications technologies grow and improve, there will be more ways
to market this course. Course personnel will have the responsibility of keeping up with
improving technology while also maintaining the marketing plans focus. Review of the
marketing plan and its effectiveness should be done on an annual basis, or more often if course
registration numbers are dropping to a level that will not support the courses existence.
Table of Contents
PG. 329

Owen Berger
Downloadable course flyer
Table of Contents
PG. 330

Owen Berger
Example Registration Confirmation Letter
Thank you for registering for the three-day Real-time Intelligence with Social Media course.
Course Title: Real-time Intelligence with Social Media
Course Dates: March 3rd March 5th, 0800 to 1700. (Please note that course registration will
open at 0700 on March 3rd)
Course Location: Burbank, California Holiday Inn/Media Center (directions below)
Requirements
All students must bring an Internet-ready, Wi-Fi-enabled computer/device with wordprocessing capabilities. Additionally, the device must have unrestricted Internet access. Please
test your device prior to arrival, especially if you are using the device through a departmental
firewall or virtual private network (VPN. Failure to bring such a device and a working power
supply could result in dismissal from the course. There will be no back-up devices available.
Students must have valid, current law enforcement credentials which will be checked during
registration.
Additionally, students should arrive having already signed up with a work e-mail account, and a
non-personal Facebook account, and a Twitter account.
Hotel Information
(818) 841-4770
Reservations
Please call the hotel and ask for in-house reservations, and mention the course name Realtime Intelligence with Social Media to be included in the state and group rate. Staying at the
Holiday Inn is not mandatory, and there are several other hotels nearby if you prefer.
Transportation will not be provided for those not staying at the training location.
Table of Contents
PG. 331

Owen Berger
Travel
The Holiday Inn provides free shuttle transportation to and from Burbanks Bob Hope Airport.
Additionally, there are taxis on standby or on-call at the hotel (see photo above). The other
nearby airport is the Los Angeles World Airport (LAX). Both airports support most major airlines
and provide access to most car rental agencies.
Directions
The hotel is located one block north of the 5 freeway (I-5) in Burbank, California. The
northbound exit for students travelling from south of the training site is the Burbank/Olive
Avenue E exit. The southbound exit for students travelling from north of the location is the
Verdugo Ave exit. The airport is north of the location and students will need to take side streets
or the I-5 south to the training location.
For students taking the I-5 south, here are step-by-step directions, from Google Maps:
7) Head south in I-5 S.
8) Take the Verdugo Ave exit.
9) Turn left onto S Front St.
10) S Front St turns slightly left and becomes E Verdugo Ave.
11) Turn left onto S First St.
12) Take the second right onto E Angeleno Ave (parking on the right).
For students taking the I-5 north, here are step-by-step directions, from Google Maps:
4) Head north in I-5 N.
5) Take the Burbank/Olive Ave exit.
6) Slight right onto E Angeleno Ave (parking will be on the right).
Parking
Parking is available for $2 per day at the dedicated parking garage which is located directly
north of the hotel. Although free parking is available in downtown Burbank, this option is not
advisable as most of the parking has a two hour limit and the limit is strictly enforced by the
Burbank Police Department.
POST Reimbursement Information
If this course has been certified as a POST Plan IV course, please send a notice to the presenter
requesting a Letter of Agreement (LOA) which will be provided on the last day of training.
Table of Contents
PG. 332

Owen Berger
Otherwise, please make arrangements with your agencys training coordinator or complete a
Training Reimbursement Request (TRR).
Cancellation and Substitution Policy
The Los Angeles Police Departments Detective Training Unit (DTU) should be notified 10
business days before the first day of class, unless there are extenuating circumstances. Please
notify the DTU with any cancellations or substitutions at (323) 223-6959 or by email at
detectivetraining@lapd.lacity.org. Please give notice for any substitutions, as they will need to
be approved before the start of training.
Table of Contents
PG. 333

Owen Berger
Example Course Promotional E-mail
Subject:
Real-time Intelligence with Social Media Training Opportunity
Body:
For the first time, a full course has been dedicated to gathering and dissemination real-time
intelligence with Social Media and the Internet. This valuable training will help law
enforcement personnel harness the power of Social Media to make better decisions, faster.
Students will learn how to:
Analyze disasters #SMEM (Social Media Emergency Management)

Follow crimes-in-progress
Monitor demonstrations, protests, and mass gatherings
Conduct threat assessments
Course topics:
Cyber-monitoring (gathering intelligence w/ Social Media and the Internet)

Legal and liability issues for Social Media use by law enforcement
Developing organizational policy
Creating intelligence systems
Training-the-trainer (Teaching students how to share their new knowledge)
For more details, please go to the following sites/pages:

Registration
Los Angeles Police Dept. Training www.lapddtu.com
Information
Website www.calmass.org/real-time-intel
Facebook www.facebook.com/RealTimeIntel
Twitter - @LERealTimeIntel
Table of Contents
PG. 334

Owen Berger
Post-Course Evaluation Plan

Brinkerhoffs Success Case Method
In order to measure the effectiveness of this training course personnel (instructors,
coordinators, and presenters) will team-up to utilize a modified version of Robert
Brinkerhoffs Success Case Impact Evaluation Method. This method is also known as the
Success Case Method (SCM). The original SCM has six primary evaluative steps32, as follows:
1) Clarify business goals and training process and costs; complete an Impact Analysis
Profile,
2) Design and administer a brief survey to a sample of trainees (conducted after
training and can be applied in-person, by mail, e-mail or fax),
3) Analyze survey data; gauge scope of impact and identify success and non-success
cases,
4) Conduct success case interviews (usually conducted by phone, can be in-person, 2030 minutes),
5) Analyze all impact and performance support data,
6) Articulate conclusions and recommendations and conduct debriefing with client.
Although clearly delineated, these steps are not immediately applicable to a course in
real-time intelligence for law enforcement. Brinkerhoffs initial evaluation targets were
business-specific trainings where costs and benefits (mainly financial) were clearly definable or
measurable in both the short-term and long-term. The primary goal of this Instructional System
Design (ISD) is assisting law enforcement with gathering and disseminating intelligence from
Social Media and the Internet a goal that does not lend itself to objective financial analysis.
Therefore, the original SCM cannot be applied directly as the evaluation method for this course.
Modified Success Case Method Steps
In order to maintain the structure of Brinkerhoffs SCM without literally applying some
of the core cost-versus-benefit principles, the six steps mentioned above have been slightly retooled. The new steps outlined below are more fitting for a technology course taught to law
enforcement. Any changes to the SCM step are discussed immediately following the modified
step.
32
(Brinkerhoff & Dressler, 2003)
Table of Contents
PG. 335

Owen Berger
Step One - Reiterate course goals, behaviors, and tasks, then briefly summarize
possible impact analysis profiles. The first step was changed to reflect this ISDs concentration
on desired behaviors and tasks versus business goals. Additionally, the expected impact
analysis could be extremely difficult to specify or isolate due to the wide range of outcomes for
law enforcement personnel from different agencies and differing duties. Therefore, only a
broad summary of possible impacts or outcomes is expected in this post-course evaluation
plan.
Step Two Design and administer brief written surveys to trainees at the end of
training (both in-person and online). The second step was changed for one practical reason;
experience has shown that law enforcement personnel are inconsistently responsive to surveys
or questionnaires post-training. A common way to ensure an adequate response is to
administer the survey at the training site. Follow-up interviews can be conducted for willing
personnel, but those personnel must be identified at the training because law enforcement are
especially sensitive to repeated or unwanted contacts.
One exception to the on-site survey will be used in this training the instructor
assessments, which will be given online via Internet link. The reason for this exception is that
more honest data can be compiled by giving students a way to critique instructors anonymously
(i.e. preferably not hand-written). Additionally, this method allows students to evaluate
students outside of the training environment, eliminating mood-altering variables such as
fellow students and course stressors. This method isolates students attitudes about the
instructor, providing more accurate instructor assessments.
Step Three Analyze survey data; gauge scope of impact and identify success and nonsuccess cases. The third step was not changed as analyzing survey data for impact and success
levels can be applied to technical training for law enforcement.
Step Four Conduct success case interviews. The fourth step was not changed as there
is no difference when interviews are used in Brinkerhoffs original SCM versus the current
course context. One important note, however, is that any instructor, coordinator, or presenter
should remember to have permission to contact the law enforcement personnel for interviews.
This permission should be gained during the course (or at the end), or with an e-mail
introduction. Cold-calls should not be used under any circumstances.
Step Five Analyze all impact and performance support data. Much the same as Step
Three, this step was not changed due to the fact that analyzing data can be applied the same in
the context of this course as it could be applied in the original SCM.
Table of Contents
PG. 336

Owen Berger
Step Six Articulate conclusions and recommendations, then conduct debriefing with
involved parties, including possible organizational notifications. The sixth step was modified
for two different reasons. First, the term client has a different meaning for this course, where
the clients are both the individual attendees as well as the organizations who are paying for
their tuition, and often-times their room and board. Therefore, the debriefing will occur with
interested parties, including: instructors, coordinators, presenters, and POST representatives.
Furthermore, if truly valuable data about succeeding is found using the SCM, then organizations
who have sponsored students should be notified about possible methods or ways to replicate
the same success.
Implementation Methods and Techniques
In order to implement the steps of the modified SCM, several methods and techniques
will be used, outlined below in chronological order.
Pre-course Activities. Prior to the actual teaching of the course, this ISD will have
specified the Course Goals and desired behaviors (or tasks) expected of course attendees.
Course instructors will expand these goals into expected impact profiles based on information
they have about attending students. This information is normally available from the presenter
and consists of pieces of information such as organization, position, task force membership,
and others. The instructors will then complete the Expected Impact Analysis Profile Worksheet
prior to class or during the preliminary registration period. The worksheet was designed to
assist instructors with identifying their attendee body make-up, and then with identifying
possible impacts. These pre-course activities combine to fulfill the requirements of the
modified SCM, Step One.
In-course Activities. During the course, two separate types of evaluations will be
administered to the students. First, each student will complete individual module surveys at
the end of each module. The module surveys are meant to assist with evaluating the content
and merit of each module, independent of the other modules and independent of overall
course consideration. Second, just prior to the conclusion of the course, attendees will be
asked to complete the Student Impact Analysis Questionnaire. This questionnaire will evaluate
the students perceived understanding of the course material and help to generate a studentcreated impact analysis profile. The questionnaire will contain questions for contact
information, but unwilling students will be able to option out of being contacted, if desired.
Post-course Activities. After training, an Internet link (hyperlink) to a version of the
Instructor Assessment Survey will be sent to students via electronic mail (e-mail). As explained
in Step Two above, the reasons for sending this linked survey are twofold. One, to give
Table of Contents
PG. 337

Owen Berger
students some distance from the course and instructors so that opinions on the instructors are
not based on either positive or negative sentiments about the training itself. And, two, to
ensure that students are giving honest opinions about the instructor without having to submit
the answers in their own handwriting (please see Step Two above for further). These surveys
and assessments constitute Step Two of the modified Success Case Method.
Course personnel will then gather all of the surveys taken during and after the course,
analyzing the combined data in several different ways. First, the module surveys will be used to
improve each module section, utilizing positive or negative sentiment to change or modify
course content and learning activities as needed. Second, the Student Impact Analysis
Questionnaire data will be compared to the instructors Expected Impact Analysis Profile
Worksheets. This comparison should reveal whether or not the instructors expectations were
met, or were in line with, the trainings impact. Additionally, the Student Impact Analysis will
help to categorize the students experiences as either success or non-success cases. The
combined analysis of this data fulfills the expectations of Step Three of the SCM.
Next, students who meet both of the following conditions will be considered for a
success case interview:
1) The students impact analysis demonstrated a success case, as determined by the
course personnel who reviewed the data.
2) The student completed the work information section of the questionnaire and did
not option out of being contacted.
Qualifying students will then be interviewed telephonically using the Success Case Interview
Guide. E-mail or other correspondence will not be used for this step because the level of detail
needed to fully document a success case is only available through a series of follow-up
questions which are not readily available through, or foreseeable in, an e-mail conversation.
Please note that the Success Case Interview Guide is just that, a guide. Each interview will need
individual preparation to tailor and specify both the initial and follow-up questions to be used
during the interview. These success case interviews make up Step Four of the SCM.
The success case interviews will then be collated and analyzed, first individually, and
then in combination with all of the other survey and questionnaire data. Each success case will
be cross-analyzed, and the found reasons for success will be noted, with more credence given
to congruent data. This comprehensive data analysis constitutes Step Five of the SCM.
Lastly, all of the data analysis will be distilled into articulable points (conclusions), with
subsequent notes on the particular impact of the analysis point on the course design
(recommendations). These conclusions and recommendations will then be presented to all
Table of Contents
PG. 338

Owen Berger
course personnel, whether or not they were involved in this particular courses SCM. Any
accepted recommendations will be processed according to the Revision Plan section of this
Instructional System Design notebook. This presentation of conclusions and recommendations
fulfills the final step of the SCM, Step Six. All data and analysis from this evaluation plan will be
stored securely with the course presenter.
Surveys and Evaluations in the Real World
Experience with teaching law enforcement has shown that students rush through or
event skip surveys at the end of the course in order to simply leave. This leaves the surveys
incomplete and without honest or forthright data. Therefore, the survey portions of this course
will be built-in to the expected course time, and considered as part of the module or course.
Clear expectations will be given to students about completeness of survey responses, along
with an explanation as to exactly why the surveys are being requested and how they help in the
course design and evaluation process.
Table of Contents
PG. 339

Owen Berger
Expected Impact Analysis Profile Worksheet
1) What agencies are represented by the class attendees? (Use back of this page if
necessary)
2) Are most of these agencies local, state, or federal? In what distribution?

Local [
State [
Federal [
Other [
3) What are the primary positions (or duties) of the attendees? Enter the total number of
attendees from each position/duty in the box.
Investigators
Specialized Personnel
Patrol Personnel
Supervisors
Administrative Staff
Special Event Staff
Command Staff
Civilians
4) What recent major events are going to impact this course and the material presented?
5) What do you think the three largest impacts of this course should be on these students?
Please be as specific as possible using the data you collected above. Example Due to
recent school shootings, I expect the high number of investigators in this course to be
able to monitor ongoing shooting situations for evidence, with a system already in place
for storing that evidence.
(1)
(2)
(3)
Table of Contents
PG. 340

Owen Berger
Student Impact Analysis Questionnaire, Page 1 of 2

1) On a scale of one to ten, how would you rate yourself at the following tasks? Please
note that there are ratings for both before and after this training.
Cyber-monitoring (monitoring Social Media and the Internet)
Competency before this training:
1 2 3 4 5 6 7 8 9 10 (Please circle)
Competency after this training:
1 2 3 4 5 6 7 8 9 10
If applicable, why did your score change? What were the most important factors to
changing this score?
Developing Social Media Policy

1 2 3 4 5 6 7 8 9 10
1 2 3 4 5 6 7 8 9 10
Designing Intelligence Systems

1 2 3 4 5 6 7 8 9 10
1 2 3 4 5 6 7 8 9 10
Teaching Others Cyber-monitoring

1 2 3 4 5 6 7 8 9 10
1 2 3 4 5 6 7 8 9 10
Table of Contents
PG. 341

Owen Berger
Student Impact Analysis Questionnaire, Page 2 of 2

2) How do you expect to incorporate this training into your current duties?
3) Which pieces of the training are most pertinent to your duties? Why?
4) What are the most important things you learned during this training, why?
5) Who whom in your organization will you share or teach the information from this
course? Will it be in a formal or informal setting?
Please enter the following information. This information will be securely stored by the course
presenter and will never be distributed or shared, even with your own organization/agency.
Full Name:
Work e-mail address:
Work phone number:
Optional I do not wish to be contacted regarding my survey for personal reasons. Initials [ ]
Table of Contents
PG. 342

Owen Berger
Instructor Assessment Survey, Page 1 of 2

Name of Instructor:
Name of Training Course: Real-time Intelligence with Social Media
Date(s) of Training Course:
Note Please use the grades in the assessment key below to grade each statement about the
instructor and the course below. Please enter any comments that will assist course
administrators in evaluating the instructors in the spaces provided below each evaluation
statement.
Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Classroom Assessments
The room was clean, well set-up, and organized.
The room was comfortable and it was safe to move around.
The course location made it easy to use the restroom, and find food, beverages, and other
amenities.
[
Instructor Assessments
The instructor had a professional demeanor and appearance.
The instructor was on-time and maintained a professional classroom environment.
The instructor was available for questions and personalized help, if needed.
Table of Contents
PG. 343

Owen Berger
Instructor Assessment Survey, Page 2 of 2

Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Instructor Assessments, Continued

The instructor was able to satisfactorily answer students questions and concerns.
The instructor spoke professionally, politely, and only questioned students actions when
necessary.
[
The instructor was knowledgeable about the course material.
The instructor was interested in student learning.
Table of Contents
PG. 344

Owen Berger
Individual Module Assessment

Module I - Gathering Intelligence with Social Media and the Internet
Name of Instructor(s):
Name of Module: Gathering Intelligence with Social Media and the Internet
Date of Training Course Module:
module below. Please enter any comments that will assist course administrators in evaluating
the individual modules in the spaces provided below each evaluation statement.
Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Module Assessments
The instructor gave comprehensive coverage to this module (i.e. the instructor did not appear
to give less credence to this module than others without explanation).
[
]
The instructor seemed knowledgeable about the information contained in this module. [
This module was presented in a prepared, professional, and organized manner.
The instructor was clear about expectations of learning goals for this module.
The instructor was fair when evaluating student performance with the end-of-module
presentation rubric.
Table of Contents
PG. 345

Owen Berger
The learning activities were clearly explained and learning goals for each activity were given up
front (unless by design).
[
]
The learning activities in this module were directly related to the course content and facilitated
learning of the course material.
[
]
Table of Contents
PG. 346

Owen Berger

Module II - Real-time Intelligence Systems: Design and Implementation
Name of Module: Real-time Intelligence Systems: Design and Implementation
Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Module Assessments
[
]
Table of Contents
PG. 347

Owen Berger
[
]
[
]
Table of Contents
PG. 348

Owen Berger

Module III - Real-time Intelligence Systems: Policy Development
Name of Module: Real-time Intelligence Systems: Design, Policy, and Implementation
Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Module Assessments
[
]
Table of Contents
PG. 349

Owen Berger
[
]
[
]
Table of Contents
PG. 350

Owen Berger

Module IV - Teaching Cyber-monitoring
Name of Module: Teaching Cyber-monitoring
Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Module Assessments
[
]
Table of Contents
PG. 351

Owen Berger
[
]
[
]
Table of Contents
PG. 352

Owen Berger
Success Case Interview Guide
According to the Student Impact Analysis Questionnaire, you noted a significant

increase in your knowledge for Module X [insert module name here]. To what do you
attribute that gain? What were the primary factors to that gain, and can you please
rank them from most to least important?
What changes could have been made to make your learning increase even more during
the course?
How have you used what you learned during the course in your current duties?
Who have you shared your knowledge with after the course? In what type of setting
was this knowledge exchange, formal or informal, etc?
If you were going to give training on the subject matter, what learning activities would
you use from the course? What new activities have thought about designing to impart
this knowledge?
What did the instructors do correctly that helped facilitate your understanding of the
subject matter? What did they do incorrectly?
What about the classroom environment or set-up helped you to learn the course
material? What about the classroom environment negatively affected your learning?
What real-world considerations need to be further examined by the course designer?
What real-world limitations have you confronted when using the skills and knowledge
gained from this course? Can you please describe those limitations? Which of those
limitations affect you the most? The least?
Notes:
Table of Contents
PG. 353

Owen Berger
Revision Plan
Student-centered Revisions
The revision plan for Real-time Intelligence with Social Media will be based primarily on
the students evaluations and follow-up interviews. Just as an instructional design should be
based on the students and their learning or behavioral outcomes, so should design or content
revisions. As detailed in the Post-course Evaluation Plan, students will be followed from their
initial post-course evaluations through success-case interviews to determine the courses
success in altering students knowledge and skills as applied to real-world applications.
These success-case interviews (see sample questions) will be the primary drivers of
course revisions, as they will provide the most telling data about course content and design
effectiveness. The reason these interviews provide such a compelling view is that, oftentimes,
students will not fully view a trainings effect in the context of their duties until they have had
time to use the training in their actual jobs outside of the classroom. These interviews should
occur approximately one to two months after the training to ensure that students still have a
fresh memory of the training, but are also distanced enough to put the training in the context
of their duties, not vice versa.
Other Revision Sources
Though student-centered input will be the focus, other sources will be also be used to
guide revisions, including: instructor notes and evaluations, subject matter experts and
resource input, changing policy considerations, dynamic case law or legal decisions, technology
considerations, and changing logistical necessities. Will discuss these sources below with notes
on their use in revision planning and implantation.
Instructor notes. This source is important because it comes from the front-line course
personnel, meaning that instructors are present during the successes and failures of each
individual course. Therefore, instructor input should be given a lot of credence during the
revision process. Instructor notes should be used primarily in revising the structure of the
course. Examples of structural consideration include the chronological placement of the
curriculum along the course timeline and the successful implantation strategy of learning
activities, among others.
Instructor evaluations. This source needs extra scrutiny during the revision process
because a lot of instructor critiques are subjective, rather than objective. However, as noted
first in this revision plan, the student-centered approach dictates that negative instructor
evaluations be processed thoughtfully. Indeed, if many of the negative reviews about an
Table of Contents
PG. 354

Owen Berger
instructor appear to be impacting the students overall course experience, then it would be
necessary to both debrief and re-train the instructor. In the case of an egregious instructor
error, regardless of intention, the instructor should be removed immediately and notifications
should be made directly to the course presenter and the instructors organization, either to the
training coordinator or to the employees direct supervisor.
Subject matter experts and resources. The SMEs and SMR will have important input to
the course and will be able to contribute from a rather wide and objective viewpoint. They
were involved during the entire instructional design, yet they will not have the same
professional, intellectual, or emotional attachment as a course designer. The SMEs and SMR
will be consulted about course changes approximately two months after the initial course.
They will be asked about the data and analysis from the other revision sources. After the initial
course input, the SMEs and SMR should contribute to ongoing revision by acting as a filter of
sorts for major curriculum or design changes. This means that prior to applying a broad
conceptual change at any point, every effort should be made to notify the SMEs and SMR for
input on the proposed change.
Policy. Policy changes usually come from a formative event, a new technology, or new
law-related considerations. These changes could range from a simple policy change at one
agency to a sea change a broad adjustment in the way law enforcement conducts business.
Changing policy could affect this course in two different ways, either directly or indirectly. First,
new and widespread policy could necessitate new or modified course content, which is the
direct effect. Second, new or adjusted policies at students organizations could indirectly affect
the course flow by altering how students use or have used the course content in real-world
applications. There is no timeline or set process for handling policy changes with regards to this
course. Both direct and indirect policy changes will be handled on an as-needed basis.
Law. Most of the case law governing real-time intelligence with Social Media and the
Internet is relatively new or not readily applicable to all of the new technologies available to
contemporary society. Additionally, many of the new laws presented at the local, state, and
federal levels are behind technology the moment they are introduced. Therefore, course
personnel should conduct a periodic review of both case law and new laws or regulations every
six months. This review will ensure that the course has up-to-date curriculum and ensure that
the methods or techniques taught in the course are fully legal for use by California law
enforcement.
Technology. New technologies for gathering and disseminating intelligence will develop
as time goes on. If these new technologies are publicly available, then they should be included
in the course content. The only revision needed for these technological developments is for
Table of Contents
PG. 355

Owen Berger
course personnel to include them in the Trending or New Technologies section of course
content, located in Module I Gathering Intelligence with Social Media and the Internet. Just as
with policy change, there is no timeline for review for new technology, they will be included as
they develop or become available to law enforcement.
Logistics. The last revision source is constantly changing logistics. These changes could
manifest as major closures of freeways, hotel remodels or even presenter-related differences.
These types of logistical issues are often foreseeable and should be noted by course personnel
well in advance of when they become actual logistical problems. Possible prevention
techniques include a review of the host hotel, major freeways, and airports near the hosting
location prior to scheduling a course.
Update and Revision Notifications
As mentioned in the Marketing Plan, most of the detailed information for the course will
centralized on the course website and Social Media pages. Any completed updates or revisions
should be pushed out to these sources as soon as practicable. A periodic review (approximately
every six months) should be conducted to ensure that all information mentioned in the
marketing information sources is up-to-date and accurate. If possible, an electronic mail (email) list should be set up and maintained by course personnel so that updates can be sent to
course attendees, particularly if the changes or updates are contrary to previous course content
and could have legal repercussions.
Table of Contents
PG. 356

Owen Berger
Annotated Bibliography
Arizona Counter-Terrorism Information Center. (2010, October 29). (U//LES) Arizona Fusion
Center Warning: Police Officers Targeted on Facebook. Retrieved March 7, 2014, from
https://publicintelligence.net: https://publicintelligence.net/ules-arizona-fusion-centerwarning-police-officers-targeted-on-facebook/
This document was published as a warning to law enforcement in the United States.
The warning outlines a traffic stop wherein digital evidence was found that contained
photographs of law enforcement personnel. All of the photographs were retrieved from
the Social Media site Facebook.com. The warning serves as a reminder of the dualnature of Social Media visibility for law enforcement. That is, just as law enforcement
can view criminal activity and profiles online, the criminal element can conduct the
same type of research on law enforcement. This report was used by this research to
demonstrate the real-world necessity for thinking on officer safety when using Social
Media.
Table of Contents
PG. 357

Owen Berger
Brinkerhoff, R. O., & Dressler, D. E. (2003). Using the Success Case Impact Evaluation Method to
Enhance Training Value & Impact. (p. 15). Portage, Michigan: The Learning Alliance.
Retrieved July 4, 2014, from
http://www.kenblanchard.com/img/pub/newsletter_brinkerhoff.pdf
This conference report is a summation of the Success Case Impact Evaluation Method
(SCM) for training that was first introduced by Robert Brinkerhoff. The method is used
to evaluate training, and was introduced primarily as a way to discover the efficiency of,
and improve, business-related training. This report gives summations and examples of
the SCM, and was presented at the American Society for Training and Development
International Conference and Exhibition 2003, in San Diego, California. This report was
used as the basis for a modified success case method in this Instructional System Design
(ISD), specifically in the Post-course Evaluation Plan.
Bureau of Justice Assistance, Office of Justice Programs, United States Department of Justice.
(2013). Developing a Policy on the Use of Social Media in Intelligence and Investigative
Actions, Guidance and Recommendations. United States Department of Justice, Bureau
of Justice Assistance, Office of Justice Programs. Global Information Sharing Initiative.
Retrieved April 21, 2014, from https://it.ojp.gov/docdownloader.aspx?ddid=1826
Table of Contents
PG. 358

Owen Berger
This jointly-produced report is aimed at guiding organizational policy regarding Social

Media use for intelligence and investigative actions. The report provides an overview of
how Social Media has become useful for law enforcement. The report then delves into
the reasons for proactive Social Media policy, including privacy, civil rights, and civil
liberties. The delivery strategy for this reports content is a list of seven necessary policy
elements, in paragraph format. The report concludes with an appendix that contains
several versions of current policies that 1) were referenced during the article, or 2) are
for the readers continued reference. This report was used as a basis for the formation
Media Policy.
California Peace Officer Standards and Training. (2014, June 18). California POST Course
Catalog. Retrieved March 24, 2014, from Commission on Peace Officer Standards and
Training: http://catalog.post.ca.gov/
This website contains a full listing of available California Peace Officer Standards and
Training (POST) courses. The list was used to find courses with Social Media content, so
that the course created with this ISD was not redundant. The list of courses with
content on Social Media are listed in the Background section of this ISD, Table No. 1.
Table of Contents
PG. 359

Owen Berger
CNN (Cable News Network). (2011, May 5). American generations through the years. Retrieved
April 13, 2014, from www.cnn.com:
http://www.cnn.com/interactive/2011/05/living/infographic.boomer/
This website contains an infographic that shows, as the title states, a graph of
American generations across several decades. This infographic was used to correlate
the two primary yet different definitions of generational starting and ending years
introduced by the Pew Research Center, and Strauss and Howe. This information was
used to create the data for the Respondent Generational Breakdown.
Cromer v. Lexington/Fayette Urban County Government, 2008-CA-000698-MR (Commonwealth

of Kentucky Court of Appeals April 10, 2009).
In the Cromer v. Lexington/Fayette Urban County Government decision, a law

enforcement officer was terminated by the governing city council after the officer
posted inappropriate material on Social Media after self-identification as a law
enforcement officer. The original trial court ruling was upheld, and the termination was
found to be valid. This case was used in this ISD to show the blurred lines between
personal and professional Social Media for law enforcement. This case also shows the
Table of Contents
PG. 360

Owen Berger
possible employment repercussions of violating an employers misconduct rules,

whether intentional or not.
Friesner, T. (2014, May 8). The Six Living Generations in America. Retrieved from
MarketingTeacher.com: http://www.marketingteacher.com/the-six-living-generationsin-america/
This website page is a list-style collection of information about current American

generations. The information about each generation includes year ranges, formative
events, and characteristics. This information was distilled into articulable generational
differences that were then used as the basis of the learner characteristics and their
impact on course design.
Garcetti et al. v. Ceballos, 547 U.S. 410 (2006) (Supreme Court of the United States May 30,
2006).
In the Garcetti et al. v. Ceballos decision, a deputy district attorney sued his employer
based on 1st and 14th Amendment issues. The deputy district attorney, Ceballos,
claimed that he had been retaliated against for writing a memo critical of a search
Table of Contents
PG. 361

Owen Berger
warrant that was being used in an ongoing case. In this case, the retaliation was reassignment of duties and transfer to a different courthouse.
The Supreme Court of the United States later ruled on appeal that Ceballos right to free
speech was not infringed upon as his comments were made during the course and
scope of his employment. Garcetti v. Ceballos was used in this ISD to clarify the role of
free speech in the course of law enforcement employment. This case expands upon
Pickering v. Board of Education, and will assist course attendees in determining their
specific role (citizen versus employee), and the possible consequences, when using
Social Media to disseminate information.
Ginsburg, D. B. (2014, June 19). Diane Ginsburg: Teaching Across Generations. Retrieved from
University of Utah College of Pharmacy:
http://pharmacy.utah.edu/pharmacotherapy/adjunct/pdf/Ginsburg_Generation_Precep
tor_Presentation_Utah.pdf
This website document is a presentation (in slide format) about the differences between
generations both in general and with regards to learner characteristics. The
presentation was used by this ISD to enumerate generalized (and perhaps simplified)
differences between the generations. These differences were then used as the basis of
the Learner Characteristics and their impact on course design.
Table of Contents
PG. 362

Owen Berger
Internet World Stats. (2010, June 31). United States of America Internet and Facebook Users
Stats. Retrieved March 5, 2014, from www.Internetworldstats.com:
http://www.Internetworldstats.com/stats26.htm
This website was used to gain base statistics on usage of the Internet and
Facebook.com. These statistics were used to show the widespread use of Social Media
in modern society, and how that use translates into an information source for law
enforcement.
Jr., R. G. (2011). Adapting Teaching to the Millennial Generation: A Case Study of a

Blended/Hybrid Course. International CHRIE Conference-Refereed Track, Paper 3 (p. 8).
Denver, CO: University of Massachusetts - Amherst. Retrieved from
http://scholarworks.umass.edu/refereed/ICHRIE_2011/Thursday/3
This case study report delves into the learner characteristics of the Millennial
generation. The report first lists generalized characteristics of Millennials, and then
describes how those characteristics were implemented into a course in Hospitality Sales,
which was subsequently taught many times using increasing amounts of technology and
learner characteristic-driven teaching methods. One key note of the report is that
Table of Contents
PG. 363

Owen Berger
Millennials need to feel special, and that even heavy use of technology cannot make
up for not catering to this learner characteristic.
Keenan, V. M., Diedrich, D., & Martin, B. (2013, June). Developing Policy on Using Social Media
for Intelligence and Investigations. PoliceChief Magazine (80), 28-30. Retrieved March 7,
2014, from
http://www.policechiefmagazine.org/magazine/index.cfm?fuseaction=display_arch&art
icle_id=2951&issue_id=62013
This article was written by several employees from the Georgia Bureau of Investigation,
and discusses policy development for law enforcement and its use of Social Media for
intelligence. The article gives examples of current policies, how they were formed, and
then discusses several key issues regarding policy development, including: policy
purpose, levels of use, reliability and validity of information and intelligence,
documentation, and off-duty conduct. The article was used as a basis for the formation
Media Policy.
Konop vs Hawaiian Airlines, Inc., 236 F.3d 1035 (2001) (United States Ninth District Court of
Appeals January 8, 2001).
Table of Contents
PG. 364

Owen Berger
In Konop vs Hawaiian Airlines, Inc., the plaintiff (Konop) created a website critical of his
employer that was accessible only by other pilots and only by entering a username and
password and accepting the sites terms of service. A Hawaiian Airlines management
official accessed the website using a pilots login credentials (with permission) and later
disclosed website content. The 9th Circuit United States Appellate Court held, under
the Wiretap Act, that the airlines official was not authorized to view or intercept the
electronic communications. The court also held, under the Stored Communications Act,
that the login credentials used by the airlines official were not valid for third-party
permission as they had never been used by the original recipients.
This case, much like Garcetti v. Ceballos, helps to clarify what actions can and cannot be
undertaken by employees. Although this case deals with a private employers, it deals
specifically with an Internet site. One interesting aspect of this case is that it deals with
relatively old legislation to attempt to settle case law for newer technology and
employment issues arising out of that technology.
Lipp, K. (2013, October 28). How Police Use Social Media To Monitor, Respond to, and Prevent
Mass Gatherings. Retrieved March 7, 2014, from https://kennethlipp.wordpress.com:
Table of Contents
PG. 365

Owen Berger
http://kennethlipp.wordpress.com/2013/10/28/how-police-use-social-media-tomonitor-respond-to-and-prevent-mass-gatherings/
Found during an online search, this article is a focused look at law enforcements use of
Social Media to monitor special events. The articles uses photographs and real-life
examples to discuss tactical and policy considerations for law enforcement with regards
to the use of Social Media and the Internet for monitoring protest or protest-like events
and those people associated with the events. The article mainly follows the proceedings
at the 2013 International Association of Chiefs of Police conference, and was used to
gather anecdotal evidence of current trends in intelligence use by modern law
enforcement.
Merriam-Webster. (2014, June 18). Information - Definition and More from the Free MerriamWebster Dictionary. Retrieved June 18, 2014, from Dictionary and Thesaurus - MerriamWebster Online: http://www.merriam-webster.com/dictionary/information
This Internet page is from the online dictionary from Merriam-Webster. The definition
for the word information was copied from this page for use in the glossary section of
this ISD.
Table of Contents
PG. 366

Owen Berger
Murphy, J. P., & Fonticella, A. (2013, April 3). Social Media Evidence in Government
Investigations and Criminal Proceedings: A Frontier of New Legal Issues. Richmond
Journal of Law & Technology, 19(3), 1-30. Retrieved March 7, 2014, from
http://jolt.richmond.edu/v19i3/article11.pdf
This article delves into the nuances of law enforcements use of Social Media and the
subsequent impact on criminal case law and proceedings. Among the topics discussed
are: digital evidence admissibility, the Stored Communications Act, criminal defense and
defendants rights, and the effect or impact on juries. The article gives many current
examples of case law, including several that were included in the TNAs literature
review. This articles provided valuable insight from private sector attorneys who
practice in defense law. This point-of-view gives breadth to not only the literature
review, but to the course content by acknowledging concerns of those in the criminal
justice system who are not in law enforcement.
People of the State of New York v. Malcolm Harris, 2011NY080152 (New York Criminal Court
June 30, 2012).
People v. Malcolm Harris was a case that originated during the Occupy Wall Street
movement in New York during 2011 and 2012. The City of New Yorks District Attorney
Table of Contents
PG. 367

Owen Berger
subpoenaed the Twitter (a Social Media site) records for Harris, a protester during the
Occupy Wall Street movement. The District Attorney was seeking a charge of disorderly
conduct against Harris, the defendant. Harris attempted to quash the search warrant on
1st and 4th Amendment grounds. However, the courts ruled with the District Attorney
and the defendants Twitter records were eventually provided to the District Attorney.
This case is important to this course because it is settled case law on an aspect of exactly
what this course will be teaching students. That is, if students are to gather intelligence
and attempt to retrieve evidence, this case demonstrates how to verify who owns that
evidence or information. As far as course content, this case shows (1) the power of a
legal subpoena, and (2) the need for law enforcement to read and understand private
companies legal publications, such as Terms of Service or End User License Agreements.
Police Executive Research Forum (PERF) and the United States Department of Justice, Office of
Community Oriented Police Services. (2013). Social Media and Tactical Considerations
for Law Enforcement. Washington, DC: Office of Community Oriented Policing Services,
United States Department of Justice. Retrieved March 6, 2014, from
http://www.policeforum.org/assets/docs/Free_Online_Documents/Technology/social%
20media%20and%20tactical%20considerations%20for%20law%20enforcement%202013
.pdf
Table of Contents
PG. 368

Owen Berger
A joint effort of several organizations, this report was created as a reaction to the ability
of citizens to communicate rapidly through Social Media for the purposes of organizing,
protesting, and demonstrating. This rapid communication reality has consequences for
most things law enforcement, including public perception, crime-related information,
and data-mining pre- and post-event. The report focuses on several case studies that
come in the form of either a law enforcement organization that uses Social Media or a
tactical situation that necessitated the use of Social Media. These case studies (and this
report) were used in this ISD to draw several conclusions that were necessary for a
course in real-time intelligence. Perhaps the most important of the conclusions drawn
from this report was the need for an intelligence system to be established prior to an
event occurring.
Saba, J. (2013, August 13). Facebook reveals daily users for U.S. and UK, data aimed at
advertisers. (T. Reinhold, Ed.) Retrieved December 4, 2013, from www.reuters.com:
http://www.reuters.com/article/2013/08/13/us-facebook-usersidUSBRE97C0WY20130813
This site was a news article that showed Facebook user statistics, which were important
for this ISD in establishing the ubiquity of Social Media in todays society. Although the
article has a financial focus, the statistics and user habit information were important to
Table of Contents
PG. 369

Owen Berger
this ISD as a (relatively) current resource for information on the most popular Social
Media sites.
Trottier, D. (2012). Social Media as Surveillance: Rethinking Visibility in a Converging World.

Farnham, Surrey, England: Ashgate Publishing Limited. Retrieved March 7, 2014, from
http://books.google.com/books?id=DOYjUNHs6yEC&pg=PT2&source=gbs_selected_pag
es&cad=3#v=onepage&q&f=false
This book is an extensive look at interpersonal communications via Social Media and
how people and organizations use these communications. It is a study on Social Media
and the intelligence gained with it from many of todays important perspectives. The
book starts with focus on the individual, then builds to institutional uses of Social Media
as surveillance, then delves into issues such as marketing and police uses. The last
chapter, entitled Policing Social Media, is what drew the attention of the researcher.
This book chapter was chosen for the research as an in-depth look at the subject matter,
written with an outside-of-law enforcement viewpoint by a Postdoctoral Fellow of
Social and Digital Media at Westminster Universitys Communication and Media
Research Institute. The key takeaway from this article for this ISD was the limited-scope
approach that must be taken by law enforcement with regards to monitoring the public,
leading to purpose-driven course content.
Table of Contents
PG. 370

Owen Berger
United States Department of Justice, Bureau of Justice Statistics. (2008). Home | Law
Enforcement | Local Police. Retrieved April 13, 2014, from http://www.ojp.usdoj.gov:
http://www.bjs.gov/index.cfm?ty=tp&tid=71
This site was found during an online search for size statistics and data on law
enforcement in the United States. The data retrieved was used exclusively when
analyzing the response to the TNA survey question about estimated organization size.
Neither the survey data nor this article were used as a basis for course content or
design.
United States of America v. Anthony Douglas Elonis, 12-3798 (United States Court of Appeals
for the Third Circuit June 14, 2013). Retrieved June 17, 2014, from
http://www2.ca3.uscourts.gov/opinarch/123798p.pdf
U.S. v. Elonis deals with the First Amendment and threats made online. Anthony Elonis
made specific sexual and threatening remarks against is estranged, then ex-, wife.
Elonis made the threats on Social Media, on Facebook.com. Elonis and his ex-wife were
not friends on Facebook, and this case seeks to determine when a threat online
becomes criminal. The case was used in this research because it is ongoing and shows
Table of Contents
PG. 371

Owen Berger
the importance of law enforcement being aware of changes in laws and legislation when
monitoring Social Media and the Internet for intelligence.
United States of America v. Joshua Meregildo et al., 11 Cr. 576 (WHP) (United States District
Court - Southern District of New York August 10, 2012).
In the case of United States vs Meregildo, a defendant named Melvin Colon attempted
to suppress evidence against him that was obtained via the Social Media site Facebook.
The government gained access through a Facebook friend of Colons, who allowed the
government to view the Facebook posts made by Colon. The court ruled against Colon,
stating that although Colon has an expectation of privacy with regards to private posts,
that privacy does not extend to the Facebook friends who are free to do as they
please with the shared information.
U.S. v. Meregildo demonstrates, for the purposes of this ISD, how information flow can
determine the privacy of information. The case also demonstrates how information can
become part of the public domain despite the intentions of the content originator. Law
enforcement should be weary of where information comes from and its original privacy
attentions in order to avoid complications during criminal investigations or proceedings.
Table of Contents
PG. 372

Owen Berger
Whelan, A., & Newall, M. (2013, November 9). Police probe website targeting crime witnesses.
Retrieved March 7, 2014, from http://www.philly.com: http://articles.philly.com/201311-09/news/43827173_1_witness-north-philadelphia-instagram
This news article covers the publication of witness information on an anonymous Social
Media account for the mobile application Instagram. The issue, as described by
Philadelphia police and prosecutors is the leaking of protected or private information
about police investigations in an attempt to intimidate witnesses in ongoing criminal
investigations. This article was used in the research to show how Social Media has
become so pervasive in modern society that it is even being used to facilitate criminal
activities such as witness intimidation.
YouTube (Google, Inc.). (2014, March 5). Statistics. Retrieved March 5, 2014, from
www.youtube.com: http://www.youtube.com/yt/press/statistics.html
YouTube.com is the largest video-sharing website in the world. Content ranges from
comical sketches to real video of dangerous situations and events, including videos with
subjects pertinent to law enforcement, such as protests and criminal event. This specific
site gives YouTube usage statistics, and was used to show the proliferation of Social
Media in todays society.
Table of Contents
PG. 373

MICC8 ISD Notebook - Real-Time Intelligence With Social Media

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

MICC8 ISD Notebook - Real-Time Intelligence With Social Media

Caricato da

Copyright:

Formati disponibili

MASTER INSTRUCTOR

Real-time Intelligence with Social Media,

:Los Angeles Police Department:

:Los Angeles Police Department:

:San Diego Regional Training Center:

POST Master Instructor Certification Course Class 8

Course Design Worksheets

Training Needs Assessment

Results and Analysis

Post-course Evaluation Plan

POST Master Instructor Certification Course Class 8

POST Master Instructor Certification Course Class 8

POST Master Instructor Certification Course Class 8

Training Needs Assessment

Results and Analysis

Instructional System Design Notebook Table of Contents

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

Course Description (per Presenter)

(California Peace Officer Standards and Training, 2014)

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

Cost: Non-Reimbursable Tuition: $0.00

crime. It provides participants with an

Computer Crime/Social Networking Sites

Social Networks are being utilized in the

California Narcotic Officers Association 8790

This course is designed to educate the

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

the student in monitoring social networking

Students will learn the essentials of how

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

considerations and Department policies they

Ethical Use of Technology for Law

Online Investigations: Tools, Tips, and

The course objective is to train law

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

Search Group, Inc. - 9860

face on a daily basis. Investigators have an

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

Subject Matter Experts and Subject Matter Resource

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

POST Master Instructor Certification Course Class 8

Survey Question No. 1.

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

Survey Question No. 2.

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8

Survey Question No. 3.

Training Needs Assessment | Table of Contents

POST Master Instructor Certification Course Class 8