Good morning everyone,Thank you for the introduction Pearl. Welcome to the Toronto Police College. Housekeeping detailsThere is one aspect of my career that Pearl hasn’t alluded to. In fact, I don’t talk about it very often. However, in 1980, I was working as an agent to the RCMP trying to infiltrate a complex gang that was responsible for fraudulent Pampers being distributed across the country. This photo was takenshortly after the project was taken down.
It would seem that policing has always been in my blood.Hard to believe that I have just celebrated my 35th year as a sworn police officer.
We are here talking about social media and how it applies to our investigations and the families we deal with on a daily basis. I hope that the material I’m presenting in this presentation will be informative and entertaining. Also, I hope to provide a few pointers and suggestions that will help protect your own personal accounts. I can appreciate that this is a diverse group, as with any forum in which I am speaking with. Some of us have an extensive background in the use of the internet and others may only use it for job specific requirements.By a show of hands, can I see how many people have at least one profile through social media platforms?How many of your employers have specific rules and regulations regarding employee-use of the internet?Who here has been involved with investigations that involved some use of social media?Lastly, who is using their left hand to answer these questions?
The internet itself, in it’s current format, has been in existence for 20 years. There have been extreme developments in the applications of the world wide web. I can’t even begin to fathom how many jobs have been created as a result of this technology and how many millions of dollars change hands on a daily basis from sales of software, computer products and other web-based products.Naturally, newer generations will utilize technology more frequently as they know no different. It seems that kids these days are inherently tech-savy. Many of us grew up in an era where research was done at a library from these archaic objects known as “books”. We made phone calls on landlines to converse with our friends and used stamps to deliver mail.Five years ago, Professor Faye Mishna conducted a study based on cyber-bullying. What she found from this study is that almost every student in Toronto had access to at least one computer at home and almost half of them owned their own cell phone. This is my daughter at three years of age, holding the digital SLR camera. Without any guidance, she is able to turn the camera on, focus the picture and take great shots! This is the picture she took of me the other day as I was getting ready for work…
So, exactly what is social media? We have all heard of platforms such as Twitter and Facebook. There are countless websites that cater to this genre. New sites are popping up on a daily basis. Supply, demand and potential for huge financial gains. I describe social media as being a perfect blend of mainstream media and keeping a personal diary. Social media gives users the ability to write their opinions just as we did 30 years ago. However, the internet has created a new means. These writings are now able to be viewed by anyone who wishes to see it, from anywhere in the world.Much like printed media such as newspapers and magazines, consumers will seek out information from these sources. They can customize the information they receive more thoroughly by accessing information more specific to their needs. Of all the known social media platforms, today I will be focusing on the “big six” that are more relevant to our fields of practice.
I will start with Twitter. This platform was created by Jack Dorsey in 2006 as a means for employees of a company called Odeo to share ideas during brainstorming sessions. Based on information from last summer, there are approximately 175 million accounts. Naturally, that number is growing rapidly. On any given day, 180,000 tweets are being posted every minute.Twitter is considered to be a micro-blogging site in which users can post messages using up to 140 characters/key strokes. These messages can include external links or have associated photographs. This is easily my most preferred platform as it plays well into my adult ADHD.In order to view someone’s messages, you either need to be “following” that individuals feed or have searched for that user or their content. The “at” symbol is associated with an individuals account. So, for example @TorontoPolice. The term hash tag are the messages we tend to see on traditional media. The number sign followed by a term is used to focus groups conversations towards a specific topic. It makes searching for a topic easier for the user.
You’ve seen these before. *CLICK* Most recently, in Hamilton with the Tim Bosma investigation #FindTimBosma, the bombing of the #BostonMarathon and the global aboriginal demonstrations of #IdleNoMore
Facebook…Pretty straight forward. It was created in 2003 by Mark Zuckerberg. In the initial stages of development, its use was much different than it is today. Much more sinister too. Harvard University maintains a book of faces (and personal information) of its students. Zuckerberg successfully hacked into the database and created a “Face Book” of its students and encouraged people to comment if they were hot or not. There are well over 1 billion Facebook profiles.Every minute, 70,000 messages are being posted to Facebook. The net worth of Mark Zuckerberg is nearly 14 billion dollars. It’s not easy living pay cheque to pay cheque. Users who have profiles on this site can post messages, share stories, publish photo albums, play games and converse with other Facebook users.
Instagram is owned by Facebook. It is a platform that users can post photographs they have taken. It became available to the general public in 2010. As recent information shows, there are approximately 30 million Instagram subscribers. Instagram was once supported by Twitter. By this I mean, a user can post a link during a tweet to an instagram photograph and allow people to see the photo without having to leave the Twitter site. When they stopped supporting it, those links would send viewers to the Instagramsite. This caused so much controversy in the social media community that petitions were making their rounds on the internet and people tried influencing others to delete their Instagram accounts.There are approximately 28,000 photos uploaded to Instagram every minute.
Starting to see a bit of theme here? Silicon Valley became the hotbed for all things tech. As a matter of natural progression, social media companies are very well represented in California.MySpace has existed for roughly ten years. Once Facebook and Twitter came up through the ranks, MySpace suffered a noticeable decline in users. However, once JT took over partnership of the company, it has once again increased in the ranks of social media platforms. MySpace users can post information to a bulletin board style system. What makes this so lucrative for organized crime is that the messages have an expiry. After that time, the posts are automatically expunged. Another major draw to the platform is the MySpace music exchange interface.
Another social media platform from Cali. I think you’d be hard pressed to find anyone who hasn’t used Youtube to view a video.These numbers speak volumes on the amount of data flowing through this website.72 hours of video are uploaded every minute!
Lastly, we have four-square. Any guesses where Foursquare is based out of?You’re thinking California, right?The Big Apple actually. Strange, right? Almost a clean sweep!On October the 22nd, 2010 astronaut Douglas Wheelock “checked in” at the International Space Station. I think that’s pretty cool! I’m adding that to my bucket list. There are approximately 4300 check-ins per minute, around the world.
Since I began this presentation…*CLICK* 1.8 million Tweets have been published*CLICK* 700,000 Facebook posts have been generated*CLICK* 280,000 photos have been uploaded to Instagram*CLICK* 720 hours of video have been added to YouTube*CLICK* 50,000 check-ins have occurred on Four Square and finally*CLICK* 6 people in this room have vowed to cancel their child’s cell phone plan
In 2009, an internet marketing company based in San Antonio called Pear Analytics conducted a study on the usage of Twitter. Over the course of two weeks, they collected 2000 random tweets from users in the United States and the United Kingdom. The broke these messages down into six categories.As you can see from their analysis the two categories sharing a majority of the content is pointless babble and conversational. Social Media is a mirror to that of our live interactions. If you were to remove the medium and sit in any random coffee shop or a bar, listen to 2000 unique conversations, would the content be any different?We have all overheard stories of legendary shoe sales or heated debates over whether Wendel, Darryl or Mats was the best Leafs captain of all time. Notice that I didn’t say “Dion”.It is these conversations that become the base point for friendships, alliances and relationships.
Social media hasn’t necessarily changed the way in which converse. It has expanded our means in which we engage other people. Geographical boundaries no longer exist that once prevented us from extending our social circles.Interesting photo here. This picture is taken in the same position at St. Peter’s Square, eight years apart.In 2005, the anticipation leading to the naming of Pope Benedict.In 2013, the masses waiting for Pope Francis to appear on the balcony.
In terms of who uses Social Media and how it is used, there are some examples of the purely ridiculous, along side the meaningful, impactful users.Lady Gaga holds the current record for the highest number of followers. 38 million in fact. Putting aside her fame for other reasons, what possible content from less than 3000 messages can yield so many followers?
February the 11th, 2013…Baby loves to dance in the dark. Retweeted 26,000 times….Well, that was insightful and inspiring.
Then we have the epitome of silly. Someone has created a Twitter profile and is tweeting as a squirrel.Messages such as Jump…blink blink….and run run run are being followed by 104,000 followers.
As a contrast, we can look at the information provided from social media platforms that actually hold some value. The internet is not entirely evil. Believe me. What sets social media apart from traditional media is the ability of the users to have a voice and an interaction towards other users, groups and events. Social media gives us a ground in which we can openly express our beliefs. It is no different than standing on a street corner and shouting to the passerby's. Through social media though, that voice has great potential to reach many more people. The medium will forever be changing but our ability to have an opinion will not.The use of overt social media has been integral to the TPS in broadcasting public safety messages, locating and apprehending wanted criminals and seeking assistance in the prevention of crimes. Furthermore, the information generated as a result of social media is instantaneous.
In June of 2009, the Toronto Police Service was faced with an interesting challenge. Perez Hilton (aka Mario Armando Lavanderia Jr.) posted this tweet after alleging being assaulted by the Black Eyed Peas manager, Polo Molina. The obvious question is, why not call 9-1-1 instead of posting a tweet about the incident. I don’t think I need to answer that query.What I will ask though is, what should we do? Hilton has six and a half million followers. Can you imagine how many phone calls the Toronto Police Service received that day? Problem was, Perez never stated he was in Toronto. 911 calls were generated all over the world!The Toronto Police were receiving calls from the Canada, United States, Europe and even China. Over 1100 calls for service through social media came through to the Toronto Police in 2011. Those numbers are likely going to be much higher for 2012.
Fast forward only four years from the date of that incident with Perez Hilton. With the influence that social media has created, it is important to learn what the public expects of this phenomenon. In 2012, Red Cross commissioned Ipsos-Reid to conduct a survey on the usage of social media. From this study, it was determined that 63% of Canadians expect emergency services to respond to calls for help over social media.Of the 63% of those surveyed, one-third expected that services within an hour.
There is a dark side to social media however. Computer assisted criminal offences have become more prevalent in recent years.Individuals can use these aforementioned beneficial tools to facilitate criminality. Mostly any crime can be perpetrated with a keyboard, a mouse and an internet connectionIn my opinion, offences committed with the use of the internet and social media are far more damaging and severe than that of traditional means. Not only does the harm establish a digital footprint and a continuous reminder of the resulting torment, but the suspect can remain almost entirely anonymous.
Think back to your days in school…..I’m still waiting on a few people in the room. We have time. Remember your days of grade school. When research was done in the school library by sifting through books and encyclopedia’s. There was no internet, no digital message boards and no email.THIS was bullying. This was harassment. *click over*Well, that’s awfully harsh! Also, entirely fictitious. Those in the immediate vicinity of the incident could have witnessed the harassment. Some could comment on it and join in on the bullying.
But get rid of the poster and what do you have left? No evidence of the bullying, no direct re-victimization, no constant reminders.
The same message posted in 2013….Retweets, forwards, the endless lines of people able to receive that message through social networking…The re-victimization happens at the click of a mouse. The original message may come down but once it’s established a footprint on social media, it’s always going to be there.
The psychological trauma and causation of the fear on the part of the victim is the element of the unknown. What is the suspect going to do next? When are they going to attack me? Is the suspect going to try to harm my family? Criminal harassment does not necessarily require additional or related offences from occurring. Threats of death or bodily harm, extortion, vandalism and assaults are all charges that stand on their own and may or may not be included to the elements of criminal harassment. The understanding of the severity and harmful effects of criminal harassment has been recognized by the courts across Canada. During a sentencing of an individual convicted of criminal harassment in Ontario, *CLICK OVER* Justice Margaret Woolcott stated “the primary impact of harassment is very often psychological … there is no requirement that there be physical harm to make out a very serious case of criminal harassment.”Bruce MacFarlane, a former Department of Justice prosecutor, made the following statement in an article he wrote on stalking,*CLICK OVER* “ Many stalkers are not violent but all are unpredictable. The irrational mania that drives them to pursue their victims is beyond comprehension within the normal framework of social behaviour. It is this unpredictability that generates the most fear, coupled with the knowledge that, in some cases, the stalker's behaviour may, without warning or apparent reason, rapidly turn violent. Escalation of the level of threat forms one of the most common features of stalking”
In 1993, Criminal Harassment became an offence under federal statute, that being the Criminal Code. You’ll note that nowhere within the definition of the offence, is there a specific element to include computer usage to commit the act. Aggravating factors under this section can be included in sentencing if there was already a court order in place, such as a restraining order or a peace bond. There have been a number of court decisions that further address the issues surrounding this charge. For example, in the case of R. vs. Kosikar, the Ontario court of appeals upheld the ruling that a single incident can constitute threatening conduct.
While the offence of threatening does stand to be fairly straight forward, there are a few points to consider. For instance, the intended victim of the threat does not need to be aware of the threat. This is a fairly common occurrence within our schools, is it not?At a guess, I would say that around half of the reports I received for threatening behaviour as a youth crime investigator, came from a 3rd party observer.As stated, the threat that is conveyed can be by any means. This of course, includes the internet.
Easiest way to summarize this offence is “blackmail”.This section is often used for the threat of distributing nude photos of an ex during a tumultuous break-up. This is a very common occurrence and I found that has become much more reported since the incident involving Amanda Todd.
This section is very similar to that of Extortion.However, this is generally a threat to the victim if they continue to do something that they were lawfully entitled to do.A perfect example of this would be “if you come back to class after the lunch break, I’m going to break your legs.”
The wording of this section if fairly straight forward. Again, these are only a few of the most commonly applicable sections as it relates to the work that we all collectively do. In considering how many offences under Canadian law can be perpetrated through the use of social media, I feel it is of utmost importance to take a closer look at the issues.
Considering the prevalence of social media, there should be no question as to why we need to embrace it and become familiar with it. Unfortunately, there have been countless lives who have been negatively impacted by their interactions from social media. Bullying has been occurring within our schools for as long as an educational system has been in place. The victims of bullying can come from every walk of life and are not gender or age specific. Physical violence and threats continue to be a major causation of bullying. They are certainly not the only factors to consider. The more persistent the bully, the more damaging the results. Yet a single incident can be just as detrimental as long-term harassment.The internet has created a new means.Teenagers are judged by the number of followers or their online friends. Their real life includes the world wide web. Unfavorable photos or drawings depicting lewd behaviour of an individual are becoming common place in the cyber world. Creation and distribution of rumours can lead to additional torment from more than just the original source. A single message can be rebroadcasted, repeated or mentioned countless times. Harassment is no longer restricted to the immediate circle of friends and fellow students. The accessibility of the internet has removed the geographical restrictions that once applied. Groups are created online with the direct intention to preclude a fellow student; then openly comment on how this person was purposely excluded. Content on the internet does not go away. Re-victimization can occur at any time. Extortion, blackmail, sexual exploitation, bullying and death threats. None of these terms are new. The occurrence of bullying can intimidate observers, lead observers to excuse, accommodate or even encourage the bully or, worst of all, lead them to try bullying themselves. The victims of bullying have suffered mental anguish, a complete destruction of their self-esteem, physical harm and even death.
Asia McGowan was a student at the Henry Ford College in Dearborn Michigan.A student by the name of Anthony Powell also attends this campus. Of note, his father is a retired Detroit police office and his mother, a registered nurse.Asia uses Youtube to create blogs empowering other black women to challenge themselves and thrive in every aspect of their lives.Powell took a hatred to McGowan and responded to a number of her posts.In March of 2009, Powell threatened to kill McGowan by posting to one of her YouTube videos. April the 10th, 2009, Anthony Powell walked in HFC and shot and killed Asia in a classroom. He then turned the gun on himself.
I don’t believe I need to introduce this incident to anyone in the room. However, if you are not familiar with what had occurred with Amanda, I’ll summarize by saying this.Amanda was repeatedly bullied by fellow students at her school. During a video chat, she agreed to expose her breasts, as she was receiving overly complimentary comments. The video became wide spread and was observed by countless people. She attempted to commit suicide by drinking bleach. However, when she was recovering from that attempt, her tormenters continued to harass her. On September the 7th, 2012, Amanda posted this video to YouTube and utilized cue cards to explain everything that had happened to her. All the hatred and how it has affected her. On October the 10th, 2012, a month after posting this video, Amanda took her own life.
Ask.fm is a website that allows people to create a profile and then other users can interact by asking them questions. The website has some high-end users like Justin Bieber and One Direction.The questions are as simple as “What shoes do you prefer?”, “what is your favorite food.”Jessica Laney created a profile and was subjected to endless ridicule. However, she exercised valor by countering her negative commentary. Her posts included, “Why are you so ugly?” for which her response was “I’m not ugly. I’m beautiful”. Her friends had asked her why she continued to go to the website. She stated that “She needed to hear what people were saying about her”*CLICK* On December the 9th, 2012, Jessica Laney took her own life because of the ongoing harassment from this website. *CLICK* Ciara Pugsley– a 13 year old from Leitrim Ireland.*CLICK* Erin Gallagher – a 13 year old from Donegal Ireland, both took their own life due to their bullying created on this platform.Her sister Shannon is beside her in this picture. *CLICK* She took her life two months later.
This is a 14 Division case. One that thankfully didn’t end in a coroner’s report. On Friday, December the 29th, 2012, TPS received a 911 call from a friend of 14 year old. This girl had posted a photo of herself, similar to this one, to her Tumblr account. Her caption was entitled, “First batch. I hope death feels good.”Officers attended the house and spoke with the girl’s grandmother. She was not only entirely unaware of her post, she believed her to be asleep in her room. The call came in at around 2am so that wasn’t outside the realm of possibility. However, when officers entered her room, they observed the same girl from the photograph, laying in bed. On her left ankle, she had written “I’m so sorry. I love you. It’s no ones’ fault”On her left hand was written “32 + 2”.As it turns out, she had consumed 34 pills of medication that she had taken from her grandmother’s kitchen. Barely conscious and now near death, she was rushed to the hospital where her life was saved.
A Ryerson University student named Alex Haney is credited with saving a school in Arizona from being the victim of a mass shooting. The suspect posted to a Youtube channel stating, “I now literally have a plan of seriously hurting, killing, murdering people in my high school.”Other posts by the suspect indicated that she had could easily bomb her school and had every intention to follow through. However, she just lacked the materials to make it happen. Toronto Police received the call and with Alex’s help, contacted the Maricopa County Sherrif’s Office. Within three hours of the time Alex first viewed the post, detectives located the 16 year old student at her residence. She admitted to the threat as well as her intention of carrying it out. Three firearms were located inside of her home as well as the computers used to facilitate the Youtube posts.
This is another 14 Division occurrence. January the 16th, 2013, three girls and one boy were having ongoing conversations over Twitter regarding them making bombs within the hallway of their school.A three-letter agency in the United States picked up on the conversation due to keyword recognition. They were immediately able to see the geo-tagging of the tweets between the group. By then using Google maps, they determined that the group was in fact inside of Harbord Collegiate. The school officials were contacted by the NSA and advised of the situation. Thankfully, the incident wasn’t intended to gain so much attention. The group were in fact having some fun with a can of hairspray and a lighter and referring to it as a bomb. Lesson learned.
During the summer of 2012, a 15 year old boy named “Richard” came to my attention. For the purpose of background, Richard was adopted by a family who lives in downtown Toronto. Despite the exceptional efforts and love provided by his foster parents, Richard is a troubled youth. He has extreme anger management issues, coupled with ADHD and being bi-polar. Richard didn’t like following the rules and would often run away from home. Each and every time I was able to locate him within an hour. I found him at his friends house, at Christie Pitts smoking up, putting up graffiti in a laneway…the list goes on.He is convinced that the police are literally everywhere! The police have informants on every corner and are the elite amongst the surveillance community. Nothing, and I mean NOTHING happens in this city without Det. Bangild hearing about it. I would hate to burst his bubble. I still haven’t told him that I just checked his Facebook status updates. Richard is also involved in mid-level drug trafficking. He was gracious enough to create a Facebook group for this business venture and tagged all of his friends who are involved. Thanks for the intelligence report, Richard!
As more technology emerges, the more individuals will use it for perpetrating offences, stealing identity and engaging in cyber bullying. We need to level the playing field. When we consider the use of the internet , how can we use this to leverage the strength of our investigations and continue providing protection for the members of our communities? *CLICK* *CLICK again when animation is finished*
The following is an active case that I have before the courts in Ontario. Pictured here is the accused’s Twitter page.The suspect is a 52 year old man that lives in downtown Toronto. He has been divorced for some time and has four adult children. He is employed by a municipality in Ontario as a graphic designer. His tumultuous relationship with another former girlfriend led to the issuance of two restraining orders. These were the result of a two separate criminal harassment charges.He has been extremely active on Twitter. As you can see from his profile, he has created over 50,000 messages.
In November of 2012, a woman attended my division and wished to file a report to the police regarding a man who had been harassing her for some time. Her twitter handle, for the purpose of this case study, is @MarySmithHowever, she was apprehensive to do this. Not for any concerns regarding the validity of her complaint. She was concerned that the police wouldn’t understand the medium in which the harassment was occurring.Fortunately, I was able provide the trifecta. I’m a criminal investigator, the complainant lives within my jurisdiction and most importantly, I do Twitter. Many users of social media and those that are simply observers believe that the digital world doesn’t cross over and become part of our true reality. Interactions and content may simply be words on a screen. Most social media platforms have policies and rules in place to protect their users from spam, hate speech and harassment. But what constitutes criminality? When should law enforcement be called in? Will the police understand the content to be harassment as well? The complainant was aware of this stigma. Mary Smith was also well aware of the possible ramifications of coming forward to the police.
This individual has nothing to do with the investigation. He is neither a witness nor a co-accused.In fact, he lives in Calgary.
The complainants in this matter were still unsure of how to proceed. The question that was asked amongst them, was what I had stated earlier, “would the police understand the medium? Would they see their interactions as being harassment as well?” The Toronto Police Service has been using social media platforms in an overt format for some time. Several members of the TPS have active Twitter and Facebook accounts.As a law enforcement community, we continuously strive to make ourselves more involved in our communities and more approachable when concerns arise. A friend close to the complainants contacted the Toronto Police for advice. Through those discussions, Mary agreed that it was time to bridge the gap between her community and the police.
The accused was arrested and held in custody until a bail hearing was commenced. After his arrest, this message *CLICK* was sent over Twitter. I had already seen a majority of his recent online content. I was certain that additional victims would come forward. And that they did. By the time the accused’s bail hearing was concluded, four additional complainants had come forward. So, we’ve come full circle. Mary Smith and several others had provided me with their statements. It was clear to me that the elements of Criminal Harassment had certainly been satisfied. Mary and the other complainants were clearly afraid of the suspect and it was my job to stop the harassment. It was my job to allow the complainants to live without concern for further attacks and the element of the unknown.
Initiating a criminal charge against an individual isn’t complex. I’ve laid thousands of charges during my career. What sets this case apart from others is how to collect the evidence and how to make it court-ready. Twitter is an open sourced platform. Meaning anyone can view his tweets. Yet, I didn’t know where to start. I was already aware that using Twitter.com, you can only view the most recent 3200 tweets. I needed to find some way to get ALL of the tweets. Furthermore, I needed to use the medium itself to strengthen the case to provide for a successful prosecution.You should remember that the complainant must demonstrate that they are fearful of the suspect. Albeit that we can read each and every interaction on open sources such as Twitter, the reaction to these messages are entirely individualistic.
Fortunately, the complainants in this matter are far more tech savvy than I am. Storify is an online program that allows users to extract information from across the internet and catalogue the messages in chronological order. The user is also able to add their own commentary through the document. Some of the complainants in this investigation utilized Storify to document their interactions with the suspect.The storify stories can be published in order to be viewed by anyone or simply kept as a draft or work in progress for confidentiality reasons. You’ll notice that in each embedded message, there is an option to view the original link. For the purposes of the investigations, this becomes important. The original source should be captured to ensure accuracy and validity.
Clicking on this link will bring you to the website and the original message. This can be cross-referenced for validity. An entire storify document can be considered as “best evidence”. Not only does it act as a pseudo-statement, but it includes screen captures and materials that the complainants themselves have witnessed with their own eyes. Now, Storify has come under some heavy scrutiny lately. People are complaining about the breach of an individuals privacy by cataloging their interactions on this platform.But I suggest that the privacy has absolutely nothing to do with the software.I’m going to take a picture of everyone in this room and include it in my presentation, complete with home addresses and cell phone number. I think that would sufficiently annoy just about everyone in here. However, is that the fault of PowerPoint or Microsoft?...or does that liability fall on the shoulders of me?Blame the user, not the technology.
Let’s consider something on a much smaller scale. If an individual has received a single or very few messages on a social media site, perhaps in the nature of death threats, we clearly need to collect that evidence. Photographing the messages is perhaps the easiest way to collect this. Be sure that the unique URL is captured though. This can always be referenced at a later time should the need arise.In Twitter, each published message is assigned an individual URL. A serial number, so to speak.Having said that, the investigation I had just mentioned is more complex than an isolated incident. As I had mentioned, I needed some way to retrieve all the messages between the complainants and the accused. Furthermore, I also needed to collect all the times that the accused had mentioned the various hash tags created by the complainants. Going through each individual tweet would be onerous and exhausting. Furthermore, I would only be able to retrieve the last 3200 messages from the accused’s account. Remember, his account has over 50,000 tweets. Less than 7% of the total available evidence is not nearly accurate enough for a criminal proceeding.I had an opportunity to discuss this investigation with a colleague and I was introduced to a new term called “fire hose”.
As a reference, I’ll start by referring to tools that have historically been utilized by the police in criminal investigations. It is a rare occasion for the police to be present when a crime is in progress. (click to advance picture)CCTV has been instrumental in countless investigations of various offences. The quality of video and audio has increased exponentially in the last decade.
A “good” video can afford us many key points of information. Description of the suspects and witnesses, licence plates of crime related vehicles, date and time references and locations of potential evidence, to name a few. The offence happened, the crime was caught on video and officers can obtain that recording for evidentiary purposes.
Due to the ever increasing usage of social media and it’s far reaching audiences, software companies have developed marking research tools specific to that of social media.“Fire hose” is a program that will search across the internet for the information the user is seeking. This can range from persons or a products to rock bands and sports teams . It can be searched over all websites or a specific platform, such as Twitter. The resulting material is subjected to analysis and the marketing gurus work their magic. This information is used for promoting their products, reaching new markets and increasing sponsorship opportunities. Companies follow the social trends.Numerous software companies distribute social media monitoring tools. Radian 6, Topsy Labs and Sysmos to name a few. Just as a side note, Radian 6 was purchased by Salesforce in 2011 at a price of $340 million.
Using a fire hose program, I was able to run to a few searches. First and foremost, I ran the suspect’s twitter handle. This is the result. The software provided me with the following information. His total number of followers, including their geographical location and gender. The authority of his followers. The higher the number of followers, the higher the authority. Think for a minute, if one of his messages was retweeted by this follower. Jonah Lupton. That message enters the Twitter feed of almost 460,000 people. Lastly, the analysis provides us with the day of the week and the time in which the suspect most commonly posts information. I continued with my searches. Within 2 minutes, I obtained each one of his 50,000 + tweets. A question you may be asking yourself? Would it not have been easier to simply seize his computer? Not really. In fact, in order to even obtain a search warrant to allow for that seizure, I’d have to prove that the computer was in fact the source of the message. I would also be required to prove that the accused was in possession of the computer. Did he use his smart phone? A work computer? Perhaps he frequented various internet cafes across the city.
Let’s go back to the elements required to prove the charge of criminal harassment. By observing the accused’s tweets and interactions, do we really need to conduct a thorough hardware analysis? What can I evidence can I glean simply from the open sourced information I collected.I knew I would require a breakdown of the conversations between the suspect and each individual complainant. I was able to tell the program that I needed to capture all the communication from the suspect to each of the complainants and vice versa.Furthermore, as the complainant had mentioned the suspects’ persistence in tweeting about their associated hashtags, I was also able to extract each time he mentioned them. Once again, catalogued nicely into a spreadsheet. Here is the results of a few of the hash tag references.
And here is an example of the conversations occurring between the complainant and the suspect.For ease of reading, I added the highlight on the chatter started by the complainant. The non-highlighted areas are those of the suspects.
Now, we need to be able to prove that the accused is in fact the same person who is maintaining the Twitter profile AND was also the person who sent the messages. I looked at the content of the messages that the suspect himself provided. This is an open sourced investigation. These messages are available to anyone on Twitter to see.In 2012, the suspect would have been celebrating his 52nd birthday on April the 13th. *CLICK* These are all tweets that the suspect himself published.
I knew that the suspect of my case had four adult sons. It said so in the bio of his Twitter feed. I was certain that the suspect fired off a tweet about them. So, I queried “my sons” into the extracted tweets database *CLICK* and came up with this picture. Without the ultra high-tech blurring on their faces of course. This suspect doesn’t have his location settings turned on. However, we can use photographs to further prove his identity.
I’m aware of where my suspect lives. It’s at the intersection of Queensway and Berl Avenue. ..*CLICK* as pictured here on the map.
When we look closer at the picture the suspect posted, you can clearly see some storefronts in the background.Let’s look at the store on the right. *CLICK*Not only does the sign have the company phone number, showing that it’s a Toronto number. After running the company name on a internet search engine, I acquired the address.So, where exactly is 2991 Bloor Street West?*CLICK*Here it is on the map, just east of Royal York Road.
The difference between the home address of the suspect and the location of where the photograph was taken is only 2.8kms. Almost a straight line between the two points as well.
If I wasn’t aware of the suspect’s home address and I needed to track him down, I could easily plot out any information that he himself as provided through his tweets. *CLICK* Where do you think I’d focus my surveillance team based on this map?
With this specific case, the suspect was told openly on Twitter to stop all communication with the victim. Twice he was told this in fact. By looking through the complainants previous tweets, I found her follow-up message to the suspect. I’ll draw your attention to the bottom left corner of the screen capture. *CLICK* The message was posted on September the 9th, 2012 at 8:11am.So, is it possible then to find out if the suspect had attempted to contact the complainant after receiving this second caution?
Absolutely we can. He tried to contact her on at least six different occasions after September the 9th.Not through any subliminal means either. He included her exact Twitter handle. One that he himself has known for years, is owned by her.
During an investigation I had a few years ago, not at all related to social media; there were two friends who had just left a nightclub and were having a great time. They were passing through a gas station at the end of their night and were engaged in a bout of horseplay. Entirely accidentally, one of them fell into a car. The five occupants of the car got out and laid a beating down on the victim. Numerous witnesses on the scene recorded the licence plate of the car and brief description of the suspects.One guy was wearing a white zipped up jacket. Another one was wearing a shiny grey suit with a black t-shirt underneath. Another of them was wearing a black blazer with a dark red dress shirt underneath. When the owner of the car was arrested, I had the opportunity to interview him. He hadn’t the slightest idea why he had been arrested and stated that he had never been in a fight that evening. However, I was already armed with an incriminating photograph that the suspect himself had posted to Facebook. *CLICK* Recognize the clothing? This photograph was posted an hour before him and his buddies attacked the partygoer. He also conveniently tagged all of the other suspects in the photograph. Needless to say, the interview changed dramatically after I showed him this evidence.
It’s a common practice for judges to place conditions on accused parties who they are releasing from custody. Their bail (or recognizance) will likely read, “Not to be within 100m of John DOE or to attend any place they live, work or happen to be”.Another such condition may include “Not to purchase, possess or consume any alcohol”.And lastly, perhaps another condition may include, “Not to leave the Province of Ontario”*CLICK*Sometimes, it’s just too easy. Here is our suspect with his friend John Doe, sipping on a can of JD and celebrating his departure to France in the coming days.Social media doesn’t have to make our jobs harder. It can make it considerably easier! But remember, information obtained through social media doesn’t necessarily constitute an automatic arrest. We generally always need further investigation, corroboration and supporting evidence. Social media doesn’t take away the need for boots on the ground and squad cars on the street.
What is also great about social media is the ever increasing usage of the various platforms. The operative word here is social. As I had stated earlier, Foursquare is another platform in which people record and publicly announce where they are in the world. The police have always sought out assistance from the public to help gather information regarding crimes that have occurred in our city. Foursquare, and other such applications, gives us additional insight into the possibility of witnesses or even suspects, who were near an area where a crime had been committed. I’m not at all suggesting that Johnny the Bank Robber checked in to the bank on the corner just before walking in with a ski mask and a gun. But, you won’t know unless you look!
Here is a picture of coffee. Pretty boring! I know. Disregard the actual imagine. Think of it being something much more sinister and incriminating. Is there any other information we can extract from this photo?
From yet another open sourced website, look at all the information that is available! These details are called “exif data”. This is just a screenshot of the first screen. There is much more details available included in these searches. EXIF is short for exchangeable image file.This is a picture I took from my office at headquarters. *CLICK* And look here….The geotagging of the photograph. AND the height where it was taken.
Here’s the map that was provided from the same website.As far as the height? We can work on an industry standard that every story of a building is roughly 3 and a half metres. But keep in mind, this isn’t a measurement from street level, it’s a measurement from sea level. May need to do some calculations. The harbour front is 76m above sea level and the highest point is Keele and Steeles at 209m.You can get a pretty accurate idea of what floor of the building I took this photo from. This is just a photo I took of a coffee cup. But, what if it was a photograph of an abducted child? I’ve had that situation. I was emailed a photograph of a child that was taken by a parent and removed from the country. The photo was apparently taken somewhere in Turkey. I can use a website similar to this to establish where and when the photograph was taken. Child pornography, child abuse, missing persons, threats of death, weapons, drugs….you name it. www.tineye.com
So….I got a phone call yesterday *CLICK* literally just happened.*CLICK* A Toronto Police Service member observed this tweet.
This is hisTwitter account
And this is what he was packing for the trip.
Here is one of the websites that the individual included in his Twitter bio.
He was gracious enough to post his flight itinerary.*CLICK* He arrived in Toronto yesterday at 1:28pm. I received this information at noon. I had an hour and a half to get to work. I need more information about who this guy is.
Well, let’s start with one of the photos he has posted. Apparently, he carries an iPhone with a decorative case. Good identifier. He’s also white with short hair and wears black plastic rimmed glasses. At least he did at the time of this photograph.
This individual also has a tattoo on the top of his right foot.
Looks like he has plans on staying at the Hotel Le Germain while visiting Toronto.
This is his other website….Can you read the text along the right side in red? Brian Larue at hush dot com.
So, based on the information I had regarding a possible gun on board of a plane, the screen captures, his possible identity and flight information, I decided to call a few of my friends. *CLICK*
Of course, one must exercise some caution regarding the content on the internet. *CLICK*Thank you, Mr. President. Great golfer. Super nice guy. *CLICK*Oh come on. You’re too much, Hugh. Thank you! These tweets look very genuine. First time I saw this spoof, I was shocked as well. There are websites and applications out there that can send fake tweets, emails, phone calls…you name it. The internet does have the ability to assist with our investigations. However, it can also be used to steer us into an opposite direction.
So, how can we confirm the validity of a message received on a social media platform. Also, what happens if that message is pulled down or deleted?It may no longer appear on the actual interface. However, the recipient will also get an email notification when a message or post has been made to them or has mentioned them.On the right side of the screen is how a direct message through Twitter appears when viewed on a desktop. To the left is the corresponding email notification. These emails can be kept as proof of the message that has since disappeared. Or, to prove the validity of the content.Some of the examples of Twitter messages that I have included in this presentation have been altered to protect the identity of the individuals involved. The associated emails will show the original content of the message.
And here it is on the Facebook platform. Again, on the right, the posting as it would appear on the Facebook interface on a desktop. To the left, the email notification.
When we do require judicial orders, we have a number a tools available to us.For the most part, we use production orders and search warrants. Search warrants are granted to seize certain items from within a building or place. Once granted by a Justice of the Peace or a judge, it allows officers to obtain the items listed within the search warrant. Generally speaking, this is used to obtain tangible evidence to strengthen an investigation. A production order is geared towards corporations and recognized institutions to produce documents that are in their possession. For example, phone records from Bell Canada, medical records from a hospital or internet subscriber information from Cogeco cable.
Once we receive information regarding the IP source of an email or social media posting, we can run that IP address through any of the search engines available on the internet. This search will yield information about the service provider is, specific to that IP.
From that information, the investigator can author a production order.The production order is served on the Service Provider.Most, if not all companies will accept service of the production order by fax to start extracting the required information. The way that information is produced back to the law enforcement agency, varies from company to company, as well as the required information.For example, phone companies that were required to produce a list of every outgoing phone call from a cell phone, may catalog this information into an Excel file.While hospital records may come back as a PDF document.
This is the information that Cogeco provided back to me based on the production order for the subscriber of IP address 10.10.10.10And voila! You receive a package with all of the subscriber information.Name, address, billing information, date that the account was created, etc. Keep in mind though. This is only a step towards identifying a suspect. Further investigation may be required to solidify the evidence.
Many of the social media platforms do provide contact information in the case of emergency situations, such as child abductions and when the life of an individual is in perils. However, information that is required for evidentiary purposes that is NOT available through open sources, can only be obtained through a judicial order.
A subpoena can be served via a fax or at the locations of the relevant social media company. But, what about those of us outside of the US? A Canadian production order or search warrant has no jurisdiction south of our shared border. We need to go through a process known as an MLAT or Mutual Legal Assistance Treaty. It is a cumbersome process that takes months to go through the proper channels. In some instances, it can take up to 18 months to obtain the information we require.Given how much unused land we have in Canada, I can’t understand for the life of me why the big social media conglomerates didn’t establish their headquarters in our fine country.*CLICK*
Let’s take it down a notch. My intention is not at all to make people uneasy about the internet and social media. However, it’s inevitable that we need to address the various components of its usage to promote safety and security within our society. Specifically, to that of the children in our communities. Like the title here suggests, there is more tools available to us to address the concerns surrounding internet-based crimes and cyber-bullying.As some of you may be aware, recent changes to the Education Act grants greater expulsion and suspension powers school administratorsfor incidents involving bullying on and off off-school property. Toronto Crime Stoppers…A phone number I hope you are all familiar with. All tips are protected for anonymity as per case law. These tips work. Trust me! I’ve worked on many cases where anonymously provided information has been integral in a successful prosecution. Cybertip.ca is another mechanism in which internet based offences can be reported. It is operated and maintained by the Canadian Centre for Child Protection. This agency has been involved with child safety for nearly 30 years. They have an incredible website with great information and links. I strongly urge each of you to have a look at it and make use of their resources. And of course, we have Boost for Kids as well. I’ve had a great experience dealing with them and once again, for the opportunity to be presenting today.
In April of this year, the Toronto Police Service assisted with a campaign to spread the word on a new website created by the Canadian Centre for Child Protection. While technology has certainly opened up new opportunities, it has also had an impact on teens’ lives in ways no one could have imagined.In creating the Needhelpnow.ca, the Canadian Centre for Child Protection is letting these kids know that they are never alone.Anyone can visit the site for information on how to remove pictures posted online, how to obtain coping tools and to learn how to report online incidents that have gone too far.The main page of the website is straight forward and guides the user to the area specific to their concerns. Including how to take down photos or videos from the internet and how to stop someone from distributing your photos or videos.Something to keep in mind about the settings on Facebook. If someone is under the age of 18 posts a photograph and makes it available to “everyone”, Facebook will restrict that allowance and only share it with friends and family. It stops the photograph from going to anyone on that platform.
As far as reporting the incident to the police, there are a few ways to go about it. Obviously, if it is an emergency situation, 9-1-1 is the appropriate call to be made. The Non-Emergency number is (416) 808-2222. Once an investigation has commenced, it will inevitably involve a number of different units within a Division. This will likely be the Youth Bureau but may also include the Criminal Investigations Bureau, School Watch, Community Response Unit and the Primary Response Unit. I should also mention that contained within each courthouse in Toronto is a branch of the Ministry of the Attorney General known as the Victim Witness Assistance Program. The staff here work directly with the Crown Attorney’s. They will inevitably become involved within individuals should charges be laid during the course of an investigation. I’ll end this portion of the presentation. However, I welcome any questions you may have at this time.
Social Media For Investigations By Detective Jeff Bangild Toronto Police #BoostSM
INVESTIGATIONS INVOLVINGTHE INTERNET ANDSOCIAL MEDIADetective Jeff Bangild #5158Toronto Police Service – Operation Rebootjeffrey.email@example.com
Just a couple of questions beforewe get started
Modern Day Familiarization with TechnologyRoughly 99% of the students in theToronto area have access to at least onecomputer at home.2/3 of these students have more than onecomputer.Approximately half of the students own acellular phone.During a 2010 Canadian Census, 78% ofCanadians reported having more thanone cell phone per householdCyber Bullying Survey – 2008Factor – IntwentashProfessor Faye MishnaUniversity of Toronto*students in Grade 6,7, 10 and 11
• Created in 2006 in San Francisco, California• The platform was originally designed for theOdeo company to be utilized by employees toconverse during brainstorming sessions.• As of June 2012, there are reported to be 175million Twitter accounts• There are approximately 180,000 Tweets senteach minute of everyday
• Created in 2003 at Harvard University by MarkZuckerberg• Now based in Menlo Park, California• As of October 2012, there are reported to beover 1 billion Facebook profiles• There are approximately 70,000 messagesposted to Facebook each minute of everyday
• Launched in October of 2010 and owned by theFacebook corporation• As of April of 2013, there are approximately 30million users of Instagram.• There are approximately 28,000 photographsuploaded every minute.
• Also created in 2003 and based out of BeverlyHills, California• Up until 2008, this was the most visited socialnetworking site on the internet.• Beginning to make a huge comeback inpopularity due to the part ownership by JustinTimberlake• Mostly used by youth gangs in the United States• As of June of 2012, there are approximately 25million users on MySpace
• Three former employees of PayPal created thesite in 2003. It is based in San Bruno, California• 25% of the videos viewed from YouTube is beingdone with mobile devices.• Approximately 4 billion hours of video are beingviewed each month• Every minute, 72 hours of video are uploaded toYouTube, each day…That’s the equivalent of 36full length feature films each minute.
• This app was created in 2009. Over 50% of the usersof the site are outside of the US.• It is a location based platform in which usersinteract with their environment. It is a gamifiedversion of social media where individuals canreceive badges and rewards for checking-in.• There are approximately 6.2 million “check-ins” perday. Roughly 4,300 per minute.
In the ten minutes that have just passed…• 1,800,000 Tweets published• 700,000 Facebook postsgenerated• 280,000 photos uploadedto Instagram• 720 hours of video addedto Youtube• 6 people in this room havevowed to cancel theirchild’s cell phone plan• 50,000 Four Squarecheck-ins entered
St. Peter’s Square – What a difference 8 years can make
Impact and Victimization of HarassmentJustice Margaret WoolcottBruce MacFarlane“Many stalkers are not violent but all are unpredictable.The irrational mania that drives them to pursue theirvictims is beyond comprehension within the normalframework of social behaviour. It is this unpredictabilitythat generates the most fear, coupled with theknowledge that, in some cases, the stalkers behaviourmay, without warning or apparent reason, rapidly turnviolent. Escalation of the level of threat forms one ofthe most common features of stalking”“the primary impact of harassment is veryoften psychological … there is norequirement that there be physical harm tomake out a very serious case of criminalharassment”
264. (1) No person shall, without lawful authority and knowing that anotherperson in harassed or recklessly as to whether the other person isharassed, engage in conduct referred to in subsection (2) that causes thatother person reasonably, in all the circumstances, to fear for their safety orthe safety of anyone known to them.(2) The conduct mentioned in subsection (1) consists of(a) repeatedly following from place to place the other person or anyoneknown to them;(b) repeatedly communicating with, either directly or indirectly, the otherperson or anyone known to them;(c) besetting or watching the dwelling-house, or place where the otherperson, or anyone known to them, resides, works, carries on business,or happens to be; or(d) engaging in threatening conduct directed at the other person or anymember of their family.Criminal CodeCriminal Harassment
264.1 (1) Every one commits an offence who, in any manner, knowinglyutters, conveys or causes any person to receive a threat(a) to cause death or bodily harm to any person;(b) to burn, destroy or damage real or personal property; or(c) to kill, poison or injure an animal or bird that is the propertyof any person.Criminal CodeUttering Threats
346. (1) Every one commits extortion who, withoutreasonable justification or excuse and with intent toobtain anything, by threats, accusations, menaces orviolence induces or attempts to induce anyperson, whether or not he is the personthreatened, accused or menaced or to whom violenceis shown, to do anything or cause anything to be done.Criminal CodeExtortion
423. (1) Every one … who, wrongfully and without lawful authority, for the purpose ofcompelling another person to abstain from doing anything that he or she has a lawfulright to do, or to do anything that he or she has a lawful right to abstain from doing;(a) Uses violence or threats of violence to that person or his or her spouse orcommon-law partner or children, or injures his or her property;(b) Intimidates or attempts to intimidate that person or a relative of that person bythreats that, in Canada or elsewhere, violence or other injury will be done to orpunishment inflicted on him or her or a relative of his or hers, or that theproperty of any of them will be damaged;(c) Persistently follows that person(d) Hides any tools, clothes or other property owned or used by that person, ordeprives him or her of them or hinders him or her in the use of them;(e) With one or more other persons, follows that person, in a disorderly manner, on ahighway;(f) Besets or watches the place where that person resides, works, carries on businessor happens to be;(g) Blocks or obstructs a highway;Criminal CodeIntimidation
298. (1) A defamatory libel is matter published, without lawful justificationor excuse, that is likely to injure the reputation of any person by exposinghim to hatred, contempt or ridicule, or that is designed to insult the personof or concerning whom it is published;301. Every one who publishes a defamatory libel is guilty of an indictableoffence and liable to imprisonment for a term not exceeding two years.Criminal CodeDefamatory Libel
What is a “fire hose”Essentially, the social media fire hose wasdesigned as a marketing analytics tool.Using this software tool will gatherinformation across almost any platformany time a specific product or person ismentioned.Marketing firms use this information togauge the content of theircommercials, target audiences, productplacement and countless other positivebusiness influence.
Law Enforcement Informationhttps://support.twitter.com/articles/41949-guidelines-for-law-enforcement#Twitter Link for Police OfficersEmergency Requests – firstname.lastname@example.orgFacebook Link for Police Officershttp://www.facebook.com/safety/groups/law/guidelines/Emergency Requests – www.facebook.com/records
Location, Location, LocationTwitter HeadquartersSan Francisco, CA Facebook HeadquartersMenlo Park, CAYouTube HeadquartersSan Bruno, CAMySpace HeadquartersBeverly Hills, CA
The Toronto Police ServiceThere are 17 Divisions within the City of TorontoThe telephone number of the applicable division is(416) 808…followed by the specific station.For example – 14 Division is (416) 808-1400.The telephone number for any of the divisional Youth Bureaus ends in xx05