The Police Chief, the Professional Voice of Law Enforcement
Advanced Search
September 2016HomeSite MapContact UsFAQsSubscribe/Renew/UpdateIACP

Current Issue
Search Archives
Web-Only Articles
About Police Chief
Law Enforcement Jobs
buyers Your Oppinion

Back to Archives | Back to June 2013 Contents 

Developing Policy on Using Social Media for Intelligence and Investigations

By Vernon M. Keenan, Director; Dawn Diedrich, Director of Privacy Compliance; and Bradley Martin, Accreditation Manager, Georgia Bureau of Investigation

aw enforcement agencies need to be able to respond to criminals who are using technology for their criminal enterprises. Today, law enforcement agencies have numerous modern high-technology tools including license plate readers, digital voice recorders, mobile data terminals, electronic control weapons with high-quality digital cameras, and rapid identification devices. While some agencies have successfully used these tools, many have been caught off guard by criminals’ growing use of social media.

When social media first appeared, few in law enforcement predicted that using it would increase communication between law enforcement and citizens. Even fewer predicted using social media as a crime-fighting tool. Now, law enforcement social media pages feature tools to collect complaints, tips, and compliments, as well as allowing the public to subscribe to feeds.

Despite many law enforcement agencies’ having social media sites, many agencies lack social media policies, general orders, or directives that govern when and under what circumstances employees may post law enforcement–related information such as pictures or patches or identify themselves as law enforcement officers.1 This lack of policy guidance can cause problems and interfere with investigations, making some information inadmissible in court.

Agencies should develop policy guidance on using social media for conducting criminal investigations and gathering intelligence. Law enforcement agencies can use social media as a crime-fighting tool by capturing public data as well as by developing undercover online profiles to befriend suspects.2

Written policies will ensure that agency executives know what their employees are doing and why they are doing it, as well as protect citizens’ privacy and civil rights and liberties.

The Georgia Bureau of Investigation’s Social Media Policy

In response to the growing use of social media in criminal investigations and for intelligence purposes, the Georgia Bureau of Investigation (GBI) 3published a policy in October 2012.3

Fortunately for law enforcement executives and policy coordinators, the Global Justice Information Sharing Initiative, through the work of the Global Justice Information Sharing Initiative (Global) Intelligence Working Group (GIWG) and the Criminal Intelligence Coordinating Council had outlined the elements of a comprehensive policy regarding using social media in intelligence and investigations in February 2013.4 Law enforcement agencies of all sizes and jurisdictions can use the document.

Using information from the CICC Privacy Committee meetings and the agency policy from the survey, the GBI Office of Privacy and Compliance began crafting its social media policy, holding meetings with employees and supervisors who use social media for investigations, staff and supervisors from the GBI intelligence unit, the fusion center, the child exploitation and computer crimes unit, legal counsel, agency policy coordinator, and command staff. Informational interviews revealed how agency employees were currently using social media tools in criminal investigations and intelligence gathering.

Law Enforcement Purpose

While social media has become more important, it is only one tool. Law enforcement uses many tools and methods, all of which must be lawful and have a valid purpose. While all uses of social media for law enforcement purposes must be lawful, a policy should detail when it is authorized and used. Not every intelligence or investigative operation will require agencies to access social media sites.

For an effective social media policy, the agency must be able to describe why and how it plans to capture social media information. The social media policy must address

  • why the law enforcement agency is using social media to investigate criminal activity and gather intelligence, and
  • how this purpose is consistent with the agency’s mandate and authority.

The news media may well report on the agency’s social media policy,5 and it is best to demonstrate that the policy not only complies with the jurisdiction’s law, but also is consistent with the agency’s mission.

Levels of Use

Law enforcement officers operate in various roles including an overt uniformed presence, a plainclothes status, and undercover. Officers and analysts may also operate in different levels when viewing and gathering social media information.

The first level, apparent/overt status, is when employees are not concealing their identities and are viewing open source information.6 For example, a background investigator may view an applicant’s open Facebook page, LinkedIn profile, or Twitter page to find out any relevant information. In instances where user profiles and pages have no privacy settings and are open to any viewer, supervisory oversight will likely be minimal.

In the second level, discreet status, the agency law enforcement identity is not overt because the information-gathering efforts would be hampered if the law enforcement identity was discovered. For example, an intelligence analyst who is working a child exploitation case may want to view a blog or Facebook page. Individuals might possess tools to monitor and track Internet protocol (IP) addresses; therefore, the analyst would need to use a tool to avoid having a law enforcement IP address. The agency policy should ensure supervisory approval and oversight for such actions.

The final level, covert, is when the law enforcement officer’s efforts require concealing the undercover police officer’s identity. For example, an officer might have an undercover profile or an alias to interact with a subject who buys and sells images of child pornography. Since this level could include significant interactions between law enforcement and suspects, agency policy should identify who may use a covert identity and indicate the level of supervisory authority needed for approval for this level of use. Additionally, the officer should use local, state, and federal deconfliction efforts in order to reduce duplicated effort or interference between law enforcement agencies investigating the same allegation.

Confidence in Source Reliability and Content Validity

Informant-provided information must be reliable and valid. Intelligence and information gathered from social media is no exception. For example, in narcotics investigations, law enforcement will verify ownership and occupation information from utility companies and government real estate records.

In the case of social media, law enforcement will verify registration information on IP addresses from Internet service providers. Social media users know scammers and spammers set up fake accounts and profiles. According to a regulatory filing provided by Facebook, there are 83 million fake Facebook accounts.7

This presents a problem—how can investigators verify and authenticate social media user information, postings, and profiles?

Law enforcement must develop good procedures to verify and authenticate information. Law enforcement agencies use many methods and tools when conducting investigations and social media investigations are no different. Law enforcement may obtain

  • suspect confessions;
  • witness statements;
  • IP address authentication information; and
  • computer use/security information showing how a suspect had control over an account, profile, or postings.

Law enforcement may also work with more suspects or corroborating witnesses to “friend,” “follow,” or access suspect information.

While it may be challenging to ensure social media findings are reliable and valid, law enforcement can certainly verify information using the same methods they use for normal intelligence gathering and criminal investigations.

Social Media Monitoring Tools

Social media monitoring tools such as Twitterfall, Netbase, Trackur, CrowdControlHQ, or Socialpointer that can capture data and monitor social media sites are useful to law enforcement. These sites can be automated to collect the data, enabling law enforcement agencies to make predictions and follow trends. Social media monitoring can also detect and track emergencies and disasters, and follow community events. These tools might save investigators and analysts thousands of hours of work; however, social media monitoring tools can also be abused.

When developing policies on using social media monitoring tools, agencies should identify a timeline, purpose, and parameters for using them. In most instances, these tools offer the ability to search for keywords and thus enable law enforcement to aggregate large amounts of data and refine them into smaller items of interest.

For example, during a large-scale sporting event, law enforcement agencies can monitor the day before, during, and several hours after the event to check for disturbances at or near the event location. Social media monitoring tools also enable real-time tracking, so fans can report disorderly conduct or other criminal acts. Without these tools, analysts would need numerous hours to aggregate what could be thousands of social media pages and feeds.

While there is a lot of information available online—for example, some half billion tweets a day8—law enforcement should not engage in ongoing data mining operations with no law enforcement purpose. Agency’s policies should restrict using social media monitoring tools for only approved law enforcement purposes and determine what, if any, information the agency needs to retain after the event is over.

The GBI policy requires a written request to use a social media monitoring tool. The request must identify the purpose, time frame, the type of tool, a list of the websites the monitoring tool will access, and whether information will be maintained and for how long. The GBI Privacy Office and Deputy Director for Investigations must approve this request before investigators and analysts can use the tool. If the tool will be used for more than 90 days, the work unit supervisor must submit a summary after 90 days that describes what law enforcement actions occurred based upon the use of the monitoring tool.

Documentation, Storage, and Retention Requirements

State, local, and federal laws may govern law enforcement agency records. Record retention policies should incorporate the relevant law and, in the absence of legal requirements, determine records’ retention periods.

Agency policy should cover the documentation, storage, and retention of social media information gathered for criminal investigations or background employment investigations. Information gathered from social media sites should be printed and electronically archived. Internet information—including social media—may change instantaneously: what you can see today may not be available tomorrow.

To gather information from social media for intelligence purposes, 28 C.F.R. Part 23 establishes federal law.

  • When the information rises to the criminal intelligence level, agencies should retain that information in accordance with 28 C.F.R. Part 23 and the agency policy.
  • For information gathered that does not indicate a nexus to a criminal offense, agencies should retain it for the minimum amount of time and then purge it from agency files, records, and databases.

Regardless of whether agency data are destroyed after 30 days or retained forever, the public will question agency policy.9 Policy makers must consider the need to retain social media information and determine retention based on how the information is needed and used.

Off-Duty Conduct and Reporting Violations

Agency policies vary regarding social media use. Some agencies prohibit employees from identifying where they work, while others prohibit posting images of badges, patches, or agency property such as vehicles.

With the great expansion of mobile devices and smartphone applications, most employees use social media in a personal capacity.

Employees may come into contact with criminals or possible criminal conduct when using either personal or departmentsanctioned social media. Agency policy must identify who should receive information about possible criminal conduct detected or observed by an officer while offduty and should direct employees to document (for example, taking a screenshot) or print the information.

Because criminals may be able to detect and obtain IP addresses or global positioning system (GPS) information, the policy should discourage using personal devices or social media for sustained official agency activities.

Privacy and Precautions

Law enforcement must avoid any appearance of collecting intelligence or information solely on an individual or organization due to religious, political, or social views. Collecting data exclusively for those reasons destroys community trust and confidence in law enforcement. Just as agencies will not tolerate bias-based profiling, agencies must not use social media to collect information without understanding and following basic civil rights protections.

Many agencies already have policies to protect civil rights and civil liberties. Agencies should include references to agency privacy protections when drafting social media policies to collect intelligence and investigate crimes.

Verification and Review Procedures

An important component of any policy is the ability to verify adherence, so agencies should develop an annual report, review, or audit to determine an agency’s policy adherence. The policy should also include periodic reports, inspections, and monitoring by agency supervisors. Verification and review procedures seek to ensure adherence to the
law and policy.


Many tools and resources are available so law enforcement agencies can develop social media policies. Developing a social media policy for criminal investigations and intelligence gathering is not the end. Given the explosive growth of and changes in social media, policies cannot remain static; they must be updated.

The use of social media in criminal investigations and intelligence gathering relies upon many of the practices law enforcement officers are already performing. Officers and analysts already use basic independent verification and content validity to conduct investigations. Creating a policy that governs these activities is simply responsible practice and will ensure that all employees keep to the agency’s mission and purpose when utilizing social media. ♦


1Training, best practices, and a model policy on the use of social media may found at the IACP Center for Social Media, (accessed March 1, 2013).
2Heather Kelly, “Police Embrace Social Media as Crime-Fighting Tool,” CNN.COM, August 30, 2012, (accessed March 1, 2013).
3A copy of the GBI social media policy entitled “Guidelines for the Use of Social Media by the Investigative Division” is attached as Appendix B to the Global Justice Information Sharing Initiative, Developing a Policy on the Use of Social Media in Intelligence and Investigative Activities: Guidance and Recommendations (February 2013), 29–35, (accessed March 10, 2013).
4Global Justice Information Sharing Initiative, Developing a Policy on the Use of Social Media in Intelligence and Investigative Activities.
5See Rocco Parascandola, “New York Police Department Issues First Rules for Use of Social Media during Investigations,”Daily News America, September 11, 2012, (accessed March 19, 2013).
6Public Domain or open source information is defined as “Any Internet resource that is open and available to anyone” in GBI Investigative Division Directive 8-6-5, “Guidelines for the Use of Social Media by the Investigative Division” in Global Justice Information Sharing Initiative, Developing a Policy on the Use of Social Media in Intelligence and Investigative Activities, 28.
7Heather Kelly, “83 Million Facebook Accounts Are Fakes and Dupes,” CNN.COM, August 2, 2012, (accessed March 11, 2013).
8Daniel Terdiman, “Report: Twitter Hits Half a Billion Tweets a Day,” CNET.COM, October 26, 2012, (accessed March 11, 2013).
9International Association of Chiefs of Police, Privacy Impact Assessment Report for the Utilization of License Plate Readers (September 2009), 38, March 20, 2013).

Please cite as:

Vernon M. Keenan et al., "Developing Policy on Using Social Media for Intelligence and Investigations," The Police Chief 80 (June 2013): 28–30.



From The Police Chief, vol. LXXX, no. 6, June 2013. Copyright held by the International Association of Chiefs of Police, 515 North Washington Street, Alexandria, VA 22314 USA.

The official publication of the International Association of Chiefs of Police.
The online version of the Police Chief Magazine is possible through a grant from the IACP Foundation. To learn more about the IACP Foundation, click here.

All contents Copyright © 2003 - International Association of Chiefs of Police. All Rights Reserved.
Copyright and Trademark Notice | Member and Non-Member Supplied Information | Links Policy

44 Canal Center Plaza, Suite 200, Alexandria, VA USA 22314 phone: 703.836.6767 or 1.800.THE IACP fax: 703.836.4543

Created by Matrix Group International, Inc.®