BGU Researcher Finds Social Media Security Breaches May Have Prolonged Takeover of Kenyan Mall by Terrorists

Ben-Gurion University of the Negev PhD candidate Tomer Simon has discovered that during the takeover of the Westgate Mall in Kenya in 2013, there were security breaches that led to the relay of sensitive data online to the public. Such breaches might have contributed to prolonging the takeover, as the terrorists received live information detailing the armed response against them and were able to use this information to strengthen their positions.

In September 2013, an attack on the Westgate mall in Kenya led to a four-day siege by the military and police, resulting in 67 fatalities and 175 wounded. A research study conducted by Simon, a PhD candidate in the Department of Emergency Medicine in the Faculty of Health Sciences (academic supervision by Prof. Avishay Goldberg and Dr. Bruria Adini), showed that during the crisis Twitter became a crucial channel of communication between the government, emergency responders and the public. The paper, which was recently published in PLOS One,presents the main activities, use patterns and lessons learned from the usage of social media during the crisis.

Although social media offers an accessible, widely available means for a bi-directional flow of information during crisis, emergency responders need to be adept in the use and leverage of social media networks for communicating both with the public and among themselves, without releasing sensitive information.

Simon has developed a system called “TwitterMate” to collect, store and analyze tweets. The system enables the user to collect and follow the main hashtags generated by the crowd and specific Twitter accounts of individuals, emergency responders and NGOs. TwitterMate was used throughout the four-day takeover of the Westgate mall to collect and analyze tweets. Many organizations posted simultaneously, by their individual leaders and under the auspices of the organizations.

For example, the photos of almost every soldier, police officer and helicopter were published in near real-time during the siege. Breach attempts were also published in real-time.

Simon also researched the use of social media by the IDF and Hamas during Operation Protective Edge this past summer.

“Both organizations were very active and tweeted information via a number of different Twitter accounts,” Simon explains. Yet “while the IDF used different accounts in different languages, Hamas had to use a number of accounts because Twitter would occasionally block an account for violating the user agreement, primarily by calling for the use of violence.”

The IDF Spokesperson’s Unit tweeted more than 1,000 times during the 50-day conflict, approximately 20 tweets a day, which included real time information about the situation on the ground. Hamas only tweeted 450 times. At the same time, the IDF made limited use of the two-way communication capabilities of Twitter, and responded to only 10 tweets. In contrast, Hamas retweeted 250 times and responded 500 times to tweets users brought to their attention.

“The IDF Spokesperson’s Unit used Twitter to convey its messages and build narratives for large audiences quite quickly. The IDF began using these tools during Operation Cast Lead in 2012 and it seems that since then they have invested in improving their capabilities and increasing the number of social media channels they use,” according to Simon.

Publication in PLOS One