Intellect and innovation for warfighing capability.
August 21st, 2016 by Brigadier Mick Ryan, AM and Brigadier Marcus Thompson, AM
Knowledge is generated anew from connections that weren’t there before.
Margaret Wheatley, Leadership and the New Science
Social media has revolutionised global communication and professional discourse. It has demonstrated a capacity for penetration that is historically unprecedented, especially compared to other means of communication. For example Facebook took just 12 years to gain 1.65 billion users globally and Twitter has gained over 300 million users in a decade. Social media are distinct from other forms of media primarily because of two key reasons. First, they are more viral; users are more likely to share content in their social networks. Second, social media users are highly mobile. Social networking has a very high penetration of Australian society. In June 2016, there were 15 million Facebook, 5 million Instagram and 2.8 million Twitter users in Australia.[i]
Members of the Australian Army are no different to other members of Australian society. They have largely embraced the various forms of social media available to them, and they use it to communicate at home, on courses, in the field and on operations. The story of social media is one of opportunity and threat for members of the military. It offers a level of transparency and global interaction that has not been possible before. But is also presents potential threats to our people, units and operations that can materialise without clever, informed use of the various social media available.
This paper reviews the rationale for the use of social media in the military. It does so by examining the benefits and the risks of social media use – by Army’s people, and the institution. The paper then provides an analysis of the most appropriate and effective use of social media, ensuring that individuals, units and commanders are able to exploit this most modern of communication forms in a way that is informed yet interesting, and protects essential friendly information.
Why the Military Should Use Social Media
In a recent article on the Strategy Bridge website on the lessons from employing social media in the military, Brigadier Mick Ryan described the lessons from employing social media in a single combat brigade within the Australian Army. Collectively, many lessons were learned over a year of implementing this enhanced approach to communicating with a range of different audiences. But how might this approach ‘scale up’? That is, how can military leaders institutionalise the use of social media for the variety of ‘raise, train, sustain’ functions that are executed on a daily basis? This is not to say that military organisations don’t have a social media presence; they do. In the Australian context, the Army Facebook page has a following nearly ten times the size of the regular Army. The Twitter feed, while having a smaller presence, at least has established a foothold for Army in the ‘Twittersphere’.
But presence is not the same as an institution fully exploiting the potential of social media. It is therefore worth examining the opportunities of organisational adoption of social media, and the areas where it is most likely to have a good return on the time and people invested in generating social media product, presence and discourse. And, if military institutions are to fully realise the potential of social media, it will need all leaders from top to bottom of the Services to embrace and advocate its use. Therefore, below are seven reasons why military leaders should embrace and advocate for the institutional adoption of social media.
Some have found the challenges of social media, particularly security concerns or misunderstanding its value, difficult to surmount or to be sufficient cause to lag behind in adopting its use. For military organisations, social media must now move beyond the discretionary and into the realm of business as usual. In the absence of face-to-face interaction, social media is one of the most powerful ways for leaders to pass information, broadly convey intent, and for all of us to communicate, interact and foster professional sharing and discourse. But that is not to say that there are not some negative aspects; there are. As the following section of the paper describes, there are perils in the employment of social media which members of the military – and military institutions – must appreciate.
The Perils of Using Social Media
War is tough. It’s tougher if you’re stupid.
The key strength of social media described above, principally its ‘global audience’, ‘open access’ and ability to rapidly share information is also its Achilles heel. The use of social media and other online services by members of the Australian Defence Force generates significant security vulnerabilities for themselves, their friends, and their families, as personal information (including family details) can be exploited by malicious threat actors as a potentially rich source of intelligence.
Recent observations during a major Australian Army exercise highlight an apparent operations security risk resulting from the prolific personal use of social media by members of the Australian Defence Force. There are three potential ramifications of this operational security risk. First, threats to individual members of the Australian Defence Force, their friends, and their families in the present day. Second, it poses risks to individual members of the Australian Defence Force, their friends, and their families in the future due to the cumulative use of social media as Australian Defence Force members become more senior and potentially gain the interest of Foreign Intelligence Services. Finally, it creates conditions that allow a malicious actor to generate actionable intelligence from aggregating and correlating multiple sources of information.
During Exercise Hamel in June 2016, personal or sensitive information was identified on social media for 680 Australian Defence Force members. This information was freely available and gained via the internet without the use of malicious or even remotely sophisticated methods. Using only openly available tools and techniques, and social media information posted by members of the Australian Defence Force, Intelligence Analysts were able to identify the location, nomenclature, equipment, and organisation of deployed forces. The process of geo-location, enables the location of images to be determined often with a very high degree of accuracy. Confirmation through the correlation of other open sources of content can, in some cases, result in the production of highly accurate, actionable intelligence that could be immediately targetable.
The advent of the smart phone and a proclivity to share information on social media with wide-ranging networks has simplified the opportunity for Australian Defence Force members to inadvertently breach security. The monitoring capability used to gather and collate this social media information during Exercise Hamel was relatively unsophisticated, when compared to known capabilities of current and potential adversaries.
Sensitive and/or personal information was freely available on social media. The key reasons for this availability included:
In isolation, the security effect of each individual observation was minor. However, the aggregation of multiple sources of open source information created significant weaknesses in the online profiles of a large number of Australian Defence Force members.
The proliferation of the use of social media and open source media platforms by Australian Defence Force members and the general public has resulted in a plethora of publicly available sensitive and personal information that has the potential to be exploited by malicious threat actors, who do not respect Australian domestic laws, such as the Privacy Act 1988. Such threat actors could potentially use sensitive and personal information on Australian Defence Force members for malicious activity such as:
While social media has many clear benefits in sharing information regarding the raising, training and sustaining of military forces, much of that information is also relevant to operations. Details regarding the status of friendly military capabilities, including personnel information; family information; tactics, techniques and procedures; and training standards are valuable to current and potential future adversaries. The risk of using social media to share such information must be recognised, assessed, treated, and the residual risk accepted.
Noting the observations from Exercise Hamel, a re-assessment of Army’s social media usage policy is required. This is to ensure an appropriate balance where the safety of Army personnel and sensitive information is protected, while at the same time, our people and organisations continue to employ appropriate social media to engender transparency and a closer connection between the military and Australian society.
A Safe Middle Path – Some Rules for Australian Defence Force Use
This paper does not propose that members of the Australian Defence Force, and the Army in particular, should be banned or dissuaded from using social media. The benefits of personal and institutional use of social media, and the likelihood many would ignore any bans, precludes such an approach. But the Australian Defence Force does have an obligation to ensure its members use social media responsibly and safely. This will ensure the safety of individuals and operational information.
Such a social media safety campaign would help ensure that exposure to online threats can be reduced. This might entail relatively simple security measures such as locking accounts so that they are accessible by known entities only. There are a number of other actions that can be taken by Australian Defence Force members to limit individual and organisational online vulnerability, including:
These rules can provide the balance of safe use by our people, while allowing them to use social media for personal and professional applications. But it is also clear that employment of social media for collecting information also has great utility.
If used appropriately, social media and open source content can also provide an excellent opportunity to develop tactical situational awareness in support of military planning and decision making. Fusion with other intelligence sources can present friendly commanders with a near real-time understanding of atmospherics and critical warnings and indicators for adversarial force actions and intent. Information that would have previously taken traditional intelligence sources days or weeks to confirm can now be collated and analysed almost immediately.
Additionally, social media can be used for our own influence, psychological operations, and deception purposes. Russian sympathisers utilised such capabilities to good effect in Ukraine, and the Australian Army could develop similar tactics for use against our adversaries. It is also clear that social media has military application in sentiment analysis, influence operations and locating persons of interest.
Army must educate soldiers and officers regarding the threats and vulnerabilities of posting information on social media, and the importance of essential elements of friendly information. It is not clear how many Army unit commanders produce essential elements of friendly information and then advise their soldiers and officers so that they can know what information they can and cannot post on social media. The observations from Exercise Hamel 16 highlight the lack of security planning and awareness that comes from the absence of command prioritisation and formal articulation of what information is to be protected.
Unsurprisingly, social media can be both the cause of and the solution to your organisational crisis. It’s an ally and an enemy at the same time.
The employment of social media by our people and institutions has a compelling logic. It is simple to use, allows the easy sharing of information and enhances transparency of national institutions such as the Army. But the use of social media is not risk free. As this paper has described, unconstrained and uninformed use of social media poses a threat to personnel and sensitive information in the Australian Defence Force.
There is neither a rationale nor capacity to prevent the use of social media by Australian Defence Force personnel for security reasons. But as an institution that seeks to successfully prosecute operations and keep its people safe, the Australian Defence Force has a responsibility to provide education and guidance to its people on safe social media use. That has been the primary aim of this paper; to highlight the benefits and risks of social media and then provide a reasonable middle path.
About the authors
Brigadier Mick Ryan, AM is the Australian Army’s Director General Training and Doctrine and recently authored A study of Army’s education, training and doctrine needs for the future.
Brigadier Marcus Thompson, AM is Australian Army’s Commander 6th Combat Suport Brigade and has a PhD in cyber security from the University of New South Wales.
[i] David Dowling, Social Media Statistics Australia – June 2016, http://www.socialmedianews.com.au/social-media-statistics-australia-june-2016/, accessed 26 July 2016.
[ii] Australian Government, Attorney Generals Department, Identity Crime and Misuse in Australia, 2013-14, 2015. Source: https://www.ag.gov.au/RightsAndProtections/IdentitySecurity/Documents/Identity-Crime-and-Misuse-in-Australia-2013-14.pdf