Threat Intelligence Blog

Posted December 2, 2013

As mobile devices and texting became common in the early 2000s, people realized they could be used to encourage a large group to meet in a coordinated manner, particularly in cities, giving rise to the modern phenomenon known as the “flash mob”. At first, flash mobs were a fun way for people to organize a choreographed performance or event that to random spectators, appeared to materialize out of thin air.

As YouTube became popular, the idea of a flashmob as a spectacle grew exponentially as groups of people could organize a flashmob, perform it in a public place while filming it, and then post it to the Internet in the hopes of it becoming a viral hit. With the arrival of Twitter, the ability for groups of people to organize these synchronized gatherings at a moment’s notice became even easier.

In the early 2010s, flashmobs started to evolve. The media began reporting instances of large numbers of youth gathering in urban business districts, with the purpose of swarming a business and engaging in theft. The idea was that if a large enough number of people flooded a store at the same time, the business’ ability to mitigate shoplifting would be overwhelmed, and the perpetrators would be less likely to be caught.  Media reports showed that from 2010 to 2013, this illegal form of flashmobs was on the rise, to the point where the mayor of Philadelphia instituted a curfew during the summer of 2011 to crack down on youths’ ability to carry them out.

Fast forward to July 9 of this year; police in Long Beach, CA responded to reports of more than 100 teenagers congregating in groups in what appeared to be a fast-moving series of random muggings, assaults, and vandalism. Although the police apprehended some of the participants, the vast majority of them escaped.  In an attempt to learn more about the motive for this random but seemingly organized event, police turned to Twitter for clues.  In minutes, they discovered scores of tweets encouraging others to take part in a “#bashmob” in the same location that coming Friday.

Armed with this intelligence, police began organizing efforts to prevent another planned bashmob. Before that Friday arrived, however, the verdict for the Trayvon Martin case was released. Police used social media monitoring and soon saw plans appearing for bashmobs invoking the Zimmerman verdict. The media speculated on whether this type of event was a protest, or instead essentially an organized roving mob, but regardless, police were able to react quickly with the information they found via monitoring social media platforms. When the media began reporting on the reaction to the Zimmerman verdict, and revealed that police had undeniably been monitoring social media for tips on localized threats, privacy advocates initially criticized the surveillance. Rather than quitting social media, however, organizers simply began to employ different symbols, hashtags, and delivery techniques in their calls for future disruptive activity.

The rise of bashmobs shows that individuals or groups with an agenda are more than willing to use social media to organize their efforts, even though they know that it is being increasingly monitored. Just like law enforcement, enterprise companies need to be aware of how social media is being used and abused to generate ill-will, protests, and criminal behavior, particularly as the holiday shopping season draws near and organized shoplifting and other crimes increase both in retail and other settings. Regular monitoring of social media and related websites can help you spot problems earlier and therefore reduce the impact to your business.

Additional Posts

Trust the Doc, but Trust the App?

During our recent webcast, Six Types of Rogue Mobile Apps and How They’re Hurting Your Brand, we ...

Six Things You Can Learn from the Affordable Care Act (ACA) Website Snafus: Part II

In Part I of our blog series, we discussed three things your organization can learn from the ...