More recently, Big Data sources and analytics are beginning to be explored in the public safety arena. Computer science, physics, bio-informatics, economics, and political science are among fields that have already seen progress through adopting Big Data, but have encountered pitfalls as well (Boyd and Crawford, 2012; Lazer et al., 2009), particularly if the data they are engaged with are “digital traces” of online activity. Many businesses have embraced Big Data as critical to gaining market advantage, yet still struggle with developing analytics that provide actionable insights (LaValle et al., 2011). Law enforcement can learn from these experiences as it seeks to adapt the use of Big Data to its unique challenges and constraints.

What do we mean by “Big Data” in a law enforcement or public safety context? The sheer size of the data in question—gigabytes, terabytes, even petabytes of data—could be sufficient to deem it “big”. However, a more nuanced and useful definition might be “data whose size forces us to look beyond the tried-and-true methods that are prevalent at that time” (Jacobs, 2009). Furthermore, data that are complex, heterogeneous, or ambiguous in nature may demand moving beyond tried-and-true methods sooner than a larger but well-understood, well-structured, and predictable dataset. The velocity at which data arrive can pose another problem.

Potential sources of Big Data for law enforcement and public safety are varied. Some are familiar sensor-based feeds, such as public surveillance cameras or traffic cameras that can produce huge amounts of video data. Technological innovations such as computer-aided dispatch and other electronic record management efforts produce volumes of data that can be mined in hopes of reducing crime (Byrne and Marx, 2011), perhaps in conjunction with relevant data from the U.S. Census, the Federal Bureau of Investigation, the National Institute of Justice, or comparable sources. Such data sources have well-understood structures and properties and may have been intentionally built to support law enforcement needs. Both the sensors and the databases in question are likely to be law enforcement assets. This greatly simplifies the challenges of working with this type of Big Data. Forensic analyses of computer hard drives or cloud data stores as part of criminal investigations can also involve extremely large quantities of data (Garfinkel, 2010). In this case, the focus is on gathering evidence pertinent to a specific investigation of a known suspect from systems used by that suspect.

Another potential source of Big Data for law enforcement is social media (see Chapter 11). Social media has been widely adopted in the US, with nearly three-quarters of online adults reporting they use one or more types of social media regularly (Duggan and Smith, 2013). Through social media, people can freely and easily create, post, and share online content in many forms, including text, images, audio, and video. They can converse with others, build and maintain social networks, plan, organize and execute events, exchange knowledge and commentary, rate and recommend, interact in educational or scientific endeavors, and engage in a host of other social activities. Although thousands of social media platforms exist, a far smaller number have been widely adopted and are likely to be broadly relevant as information sources in a public safety context.

Social media can be an unparalleled real-time source of information about the thoughts, feelings, behaviors, perceptions, and responses to events for large numbers of individuals. In particular, the microblogging platform Twitter has been observed to provide a timely source of direct observations and immediate reactions to events such as natural disasters (Starbird et al., 2010), human-caused disasters such as the London riots (Glasgow and Fink, 2013), as well as campus shootings and other violent crises (Heverin and Zach, 2012) with strong public safety implications.

Social media have been recognized as a potential tool for local governments during crisis events both as a way of keeping the public accurately informed and as a source of situational awareness. Some law enforcement agencies have begun employing social media actively. One notable example is the Boston Police Department. Shortly after the initial explosions near the finish line of the Boston Marathon in April 2013, during the early stages of the investigation of the bombing and the manhunt and throughout the following weeks, the Boston Police Department used Twitter to communicate with the public. They provided updates on police activities and the status of the investigation, announced road closures, requested public assistance with the investigation, and expressed sympathy for the victims (Davis et al., 2014). In general, police departments that use Twitter have been observed to predominantly tweet information on recent crimes or incidents, department-related activities, traffic problems, and crime prevention tips (Heverin and Zach, 2011).

Law enforcement has significant experience and familiarity with sensors such as cameras. Social media, the output of humans as social sensors in their communities, may seem arcane and unfamiliar in comparison. The scale of publicly shared social media and the inherent technical complexities of acquiring, processing, and interpreting it can seem daunting. A social media post containing a keyword of interest such as “shooting” could be an accurate eyewitness text description of a crime accompanied by a photograph of the event, global positioning system coordinates, and a precise timestamp. Alternately, it could be a sarcastic comment, a joke, song lyrics, an uninformed opinion, a different meaning of the term (“shooting hoops”), a falsehood, hearsay, or some other form of self-expression unrelated to a crime. Billions of social media messages are posted each day, which further complicates the challenge of finding the right information for law enforcement.

Beyond searching for specific relevant posts in a sea of data, it may also be important to uncover trends or patterns in large collections of social media data, to detect anomalies or understand connections between individuals or groups.

On January 25, 2014, authorities received reports of shots fired at a shopping mall in Columbia, Maryland. A young man had entered the mall, shot and killed two employees of a skate shop, and fired on additional patrons of the mall before taking his own life. He clearly met the Federal Emergency Management Agency definition of active shooter, “one or more suspects who participate in an ongoing, random or systematic shooting spree, demonstrating the intent to harm others with the objective of mass murder” (FEMA, 2013).

Law enforcement personnel arrived at the mall within 2 min. In all, hundreds of officers from Howard County, Maryland and allied agencies, special weapons and tactics teams from throughout the region, and explosives experts from several agencies responded to the event. They effectively secured the large and complex scene of roughly 1.6 million square feet, over 200 stores, multiple floors, and numerous entry and exit points. They searched the facility, evacuated thousands of mall patrons safely, ensured medical attention was provided to the injured, confirmed there was only one perpetrator, and identified and removed an improvised explosive device left by the perpetrator at the scene. During and after the incident, the Howard County Police Department (HCPD) actively used social media, particularly Twitter, to communicate directly with the public, providing informational updates and guidance and correcting misinformation (Police Executive Research Forum, 2014). Law enforcement handling of the incident was viewed positively, a sentiment reflected in this Twitter message:

A few months later, Johns Hopkins Applied Physics Laboratory (JHU/APL) sponsored a workshop on social media as a data source during emergencies and disasters. The event was a collaboration among 17 expert participants from HCPD, the Division of Fire and Rescue Services, the Office of Emergency Management, the Public Information Office, and the National Institute of Justice and a team of JHU/APL researchers, data scientists, engineers, and computer scientists. It explored how social media Big Data could provide insights during a crisis and how these insights could be applied in incident response and other law enforcement and public safety contexts. In addition, methods for measuring the effectiveness of official messaging in incident response were examined. Based on gaps and needs identified by experts in the course of response to the mall shooting or developed through professional experience in policing and public safety, JHU/APL staff developed prototype analytics and tools to illustrate potential approaches to resolving these gaps. This exercise advanced the art of the possible and illuminated potential challenges.

Initial sessions of the workshop focused on information sharing. A panel discussion on the mall shooting incident and response was conducted and a timeline was presented. Brainstorming sessions explored high-level topics regarding response to the mall shooting:

These discussions brought forth both incident-specific observations and broader needs of the law enforcement and public safety community. To help spur creativity for how social media and Big Data approaches could contribute to these challenges, JHU/APL demonstrated a small set of social media tools and technologies that helped illustrate the art of the possible.

The output of the brainstorming and discussion sessions was synthesized and used to prioritize goals for quick-turnaround prototyping of potential analytics and tools. These approaches were applied to large-scale social media data gathered for the incident and demonstrated to law enforcement and public safety participants at the end of the workshop. Feedback was collected after the initial information sharing and brainstorming sessions and at the end of the workshop. We worked through the active shooter case guided by the experience of law enforcement and other public safety officials who responded to the incident. We examined actual social media data from that local area during the time frame of the incident. This combination generated unique and powerful insights into key issues, promising strategies and potential pitfalls in using Big Data to help meet law enforcement and public safety needs.

At a high level, desirable features of a system to support the use of social media for law enforcement included:

Usability and accessibility-oriented features:

Information-oriented features:

Implicit in such a system are numerous technical challenges to be faced if hopes of making sense of Big Data or developing situational awareness are to be realized. These challenges go beyond coping with the scale and velocity of the data. They may require approaches drawn from machine learning or other fields to identify relevant signals in the noise of social media Big Data. Aggregations of large amounts of social media data may enable significantly different approaches or novel analytics that would not be part of the typical law enforcement repertoire.

Although crisis response to an active shooter incident was the motivation for the workshop, law enforcement and public safety experts quickly uncovered additional needs and opportunities for leveraging social media Big Data. The days after the incident were times of elevated risk. There was real potential for additional copycat attacks or other disturbing and potentially violent public incidents to be triggered or influenced in some way by the mall shooting. Two such incidents did occur at the mall during the following week. The need for timely, effective communications with the local populace spiked shortly after the first 911 call and continued long after the physical incident was resolved. Besides providing updates on the situation at the mall and the status of the investigation, public information officers had to monitor social media to manage and mitigate rumors and false information, such as persistent inaccurate claims of a romantic relationship between the victims and the shooter. Investigators digging into the background of the shooter found indicators of troubling online behavior more than a year before the shooting. Building and maintaining situational awareness in the present, monitoring and interacting with the public, examining past activities in investigative or intelligence contexts, and alerting or predictive capabilities can all contribute to crisis response and to a broader spectrum of law enforcement and public safety situations. Each of these thematic areas was explored in the workshop and will be described further. Other potential areas of interest, such as policy considerations for the use of social media by law enforcement, were outside the technical scope of this workshop, but have been addressed elsewhere (Global Justice Information Sharing Initiative, 2013). Budget and other resource constraints are also out of scope, but affordability and sustainability are practical considerations, particularly for smaller departments.

Law enforcement and other first responders need to ascertain critical factors in their environment to guide appropriate decision making and response to a dynamic situation. Failures to attain situational awareness during incident response can have catastrophic consequences (Endsley, 1995). Information overload and lack of awareness of key information are major impediments to attaining situational awareness. The scale of social media data is part of the problem. For example, the social media platform Twitter has tens of millions of new posts created every hour. The difficulties of finding the right data in this Big Data—data that are geographically relevant, topically relevant, temporally relevant, and associated with relevant individuals or groups—are even greater.

Twitter users have developed the convention of hashtags, a type of marker included in a tweet. Hashtags are words, phrases, or abbreviations that are preceded by the hash symbol “#,” such as #mallshooting. Users may choose to incorporate well-established hashtags in their tweets to provide a topical label, or they may spontaneously invent a new hashtag for a new event or idea. Use of a hashtag makes a tweet easily discoverable by anyone interested in that topic. Hashtags can be used to express emotion (#anguished) or evaluation (#ridiculous).

In addition, there are several distinct tweet-based social behaviors common in Twitter. “Retweeting” is directly quoting and rebroadcasting another user’s tweet, often an indication that the message was considered noteworthy or important enough to share. Other behaviors include mentioning another user in one’s tweet (that is, talking about that user) or directly addressing one’s tweet to another user, as if talking to that person, albeit in a public forum. Thus, people can carry on conversations in Twitter involving two to many dozens of individuals. Twitter provides additional affordances, such as the ability to follow other users or “favorite” specific tweets.

Tweets are complex objects. In addition to the message content of the tweet, each tweet has many pieces of associated metadata, such as the username of the sender, the date and time the tweet was sent, the geographic coordinates the tweet was sent from (if available), and much more. Most metadata are readily interpretable by automated systems, whereas tweet message content may require text processing methods for any automated interpretation of meaning.

Like many social media platforms, Twitter allows users to share images, either by embedding the image in the tweet or by including a link to the image. From a sample of tweets that contained links to images, over 1000 images were retrieved. These images included photos taken by survivors sheltering in place within the mall. The images provide a basis for determining whether advanced methods could be applied to images themselves and not just to text. Automatic identification of photos containing objects such as firearms is one application.

The prototyped dashboard illustrated capabilities in all of these areas. Integrating open source technologies and libraries of algorithms, we parsed, enriched, classified, summarized, and visualized social media text and images. Through analytics tailored to law enforcement needs, we helped tame potential torrents of Big Data into focused, manageable, interpretable information to promote understanding and help guide action.

These efforts are best thought of as an initial foray into this space, not a turnkey solution. To meet public safety needs, Big Data must be tackled at many levels. Key concerns include:

We encountered a range of potential challenges. First is the challenge of geography. Knowing where someone was or where something happened can be essential in public safety; yet, most items in the social media Big Data source we used, Twitter, are not geotagged. Advances in methods are critical to associate or infer location information, potentially from mentions of landmarks or locations (geocoding) in the text (Fink et al., 2009), associated images, or past patterns of activity.

This ties into the challenge of relevance. To get the right information from Big Data, one must ensure the data not only come from the right location, but that they are about the right thing. Keyword-based methods must be augmented by more advanced language or image processing techniques to improve precision and recall, capturing more wheat while discarding the chaff. Both supervised and unsupervised machine learning methods can contribute to this challenge.

Law enforcement experts expressed the perspective that exhaustive data from their jurisdiction were more important than a larger dataset sampled over a broader area. This highlights another challenge: the challenge of completeness. Social media providers allow various degrees of access to the publicly shared information they host. They may limit the amount of data that can be accessed through their APIs or the types of queries that can be asked. It can be difficult to gauge how complete or representative a dataset is. It will be the case that for different types of law enforcement or public safety applications, those data do not need to be exhaustive to be informative. A sample may still successfully provide tips or leads or inform about trends.

Big Data derived from social media is leading to “a revolution in the measurement of collective human behavior” (Kleinberg, 2008), requiring advances in theory, computation, modeling, and analytics to cope. For law enforcement, this final challenge holds tremendous promise for improving our ability to serve and protect the populace. Further partnerships and collaborations among researchers, technologists, and public safety professionals will hold the key to meeting this challenge.