NCIER®

Social Media

19 claims on pp. 31–87 (statement 14, evidence 5).

Claims about Social Media

Statement [V] p031-03

BTAM requires corroboration from diverse sources beyond the individual

The BTAM team should evaluate information from others who know the individual, as well as lawfully accessible records and social media, not only interviews with the individual.

the BTAM team should also evaluate information obtained from others who know the individual (e.g., colleagues, supervisors, family members), as well as lawfully accessible information contained in records, social media activity, and other forms of documentation.

p. 31 · NCIER Claim Map
Report page 31 with the cited passage highlighted
Source page 31 · click to enlarge · all claims on this page
Statement [V] p050-13

Concerning behavior: concerning social media content

Concerning social media content is among the behaviors that may be concerning.

Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.

p. 50 · NCIER Claim Map
Report page 50 with the cited passage highlighted
Source page 50 · click to enlarge · all claims on this page
Statement [V] p058-08

Digital monitoring of platforms for threats against executives

Dedicated analysts routinely monitor digital platforms, including social media, to assess and respond to threats and harassment targeting executives.

Dedicated analysts routinely monitor digital platforms, including social media, to assess and respond to threats, harassment, or other concerning behaviors targeting executives.

p. 58 · NCIER Claim Map
Report page 58 with the cited passage highlighted
Source page 58 · click to enlarge · all claims on this page
Statement [V] p062-09

Full assessments typically use interviews, records, social media and devices

A full assessment typically involves multiple interviews, records checks, reviews of publicly available social media, and analysis of employer-issued electronic devices.

A full assessment typically involves multiple interviews, records checks, reviews of publicly available social media, and analysis of employer-issued electronic devices

p. 62 · NCIER Claim Map
Report page 62 with the cited passage highlighted
Source page 62 · click to enlarge · all claims on this page
Statement [I] p062-16

Preliminary inquiry may include review of public social media as needed

Information for a preliminary inquiry may also come from additional sources, such as a review of the individual's publicly available social media, as needed.

Information for a preliminary inquiry may also come from additional sources, for example, a review of the individual's publicly available social media, as needed.

p. 62 · NCIER Claim Map

Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.

Report page 62 with the cited passage highlighted
Source page 62 · click to enlarge · all claims on this page
Evidence [I] p063-18

Figure 10: Online & Social Media is an external system

Figure 10 shows Online & Social Media as an external system (blue circle) surrounding the individual of concern.

Online & Social Media (blue)

p. 63 · NCIER Claim Map

Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text

Report page 63 with the cited passage highlighted
Source page 63 · click to enlarge · all claims on this page
Evidence [V] p064-03

Fictional retail case: low physical risk, high disruption, no-trespass order

In this fictional example, a retail customer's social media posts prompted employee interviews, an IT review and a consensual law enforcement interview, leading to a no-trespass order from physical stores.

The BTAM team determines that the individual presents a low risk for physical harm but a high risk for causing disruption at the store

p. 64 · NCIER Claim Map
Report page 64 with the cited passage highlighted
Source page 64 · click to enlarge · all claims on this page
Evidence [V] p064-14

Fictional customer case: disruptive frequent customer posts ominous social media

In the fictional retail example, a frequent customer with a history of disruptive and concerning behaviors recently posted on social media alluding to something bad happening to the store.

A major retail outlet has a frequent customer with a history of disruptive and concerning behaviors who recently made posts on social media alluding to something bad happening to the store.

p. 64 · NCIER Claim Map
Report page 64 with the cited passage highlighted
Source page 64 · click to enlarge · all claims on this page
Evidence [V] p064-15

Fictional customer case: staff interviews, IT social media review, police interview

In the fictional retail example, the BTAM team gathered information by interviewing store employees, directing company IT to review the customer's publicly available social media posts, and coordinating with law enforcement on a consensual interview about the posts.

The BTAM team uses the Systems Approach to gather information through interviews with employees from the store, direct the company IT department to further review the individual's publicly available social media posts, and coordinate with law enforcement to conduct a consensual interview with the individual regarding the social media posts.

p. 64 · NCIER Claim Map
Report page 64 with the cited passage highlighted
Source page 64 · click to enlarge · all claims on this page
Statement [V] p066-08

Public social media posts can reveal grievances, intent and interest in violence

Publicly available posts on social media, forums, or content-sharing platforms can reveal grievances, intent, or interest in violence.

Publicly available posts on social media, forums, or content-sharing platforms can reveal grievances, intent, or interest in violence

p. 66 · NCIER Claim Map
Report page 66 with the cited passage highlighted
Source page 66 · click to enlarge · all claims on this page
Statement [V] p066-09

Social media may signal crisis and warrant further assessment

Social media content can also contain indicators that an individual is in crisis (e.g., expressions of hopelessness, desperation, pleas for help), which could warrant further assessment.

Social media content can also contain indicators that an individual is in crisis

p. 66 · NCIER Claim Map
Report page 66 with the cited passage highlighted
Source page 66 · click to enlarge · all claims on this page
Statement [V] p066-10

Open-source investigations expertise can significantly enhance BTAM teams

Including a team member with open-source investigations expertise can significantly enhance a BTAM team's ability to identify digital and online indicators of concern.

Including a team member with expertise in open-source investigations can significantly enhance a BTAM team's ability to identify digital and online indicators of concern

p. 66 · NCIER Claim Map
Report page 66 with the cited passage highlighted
Source page 66 · click to enlarge · all claims on this page
Statement [V] p066-11

Open-source team members should be trained to gather and analyze ethically

Team members with open-source expertise should be trained to ethically and efficiently find, gather, and analyze publicly available open-source information.

These team members should be trained to ethically and efficiently find, gather, and analyze publicly available open-source information

p. 66 · NCIER Claim Map
Report page 66 with the cited passage highlighted
Source page 66 · click to enlarge · all claims on this page
Statement [V] p069-12

Fixation on attackers, isolation and violent posts require risk management strategies

As an example, if an assessment reveals an individual is fixated on past attackers, has grown increasingly isolated, and has posted concerning violent content on social media, the BTAM team will need to develop appropriate strategies to manage the risk the individual may pose toward the workplace.

For example, if an assessment reveals an individual is fixated on past attackers, has grown increasingly isolated, and has posted concerning violent content on social media, the BTAM team will need to develop the appropriate strategies to manage the risk the individual may pose toward the workplace.

p. 69 · NCIER Claim Map
Report page 69 with the cited passage highlighted
Source page 69 · click to enlarge · all claims on this page
Evidence [V] p079-08

Monitoring can include observation, check-ins, movement tracking, device activity

Monitoring can include observing behavior and communications, check-ins, tracking physical movement, and monitoring online activity on a company device or network.

Monitoring can include observing the employee's behavior, interactions, and communications with coworkers and clients; check-ins; tracking physical movement throughout a workplace; and monitoring online activities while on a company device or network.

p. 79 · NCIER Claim Map
Report page 79 with the cited passage highlighted
Source page 79 · click to enlarge · all claims on this page
Statement [V] p081-03

Post-separation strategies: follow-up, online monitoring, re-evaluating supports

Post-separation strategies can include following up with an employee or their friends, family, or mental health provider; monitoring online behavior and communications (e.g., social media posts); and re-evaluating potential resources or support mechanisms to assist the employee in coping with stressors.

These strategies can include following up with an employee or their friends, family, or mental health provider; monitoring online behavior and communications (e.g., social media posts); and re-evaluating potential resources or support mechanisms to assist the employee in coping with stressors.

p. 81 · NCIER Claim Map
Report page 81 with the cited passage highlighted
Source page 81 · click to enlarge · all claims on this page
Statement [V] p083-08

Develop a strategy for continued monitoring of records and social media

Organizations should develop a strategy for continued monitoring, such as allocating staff to search public court records and monitor open-source online activity.

Develop a strategy for continued monitoring. This can include allocating staff to search public court records and monitor open-source online activity and social media accounts.

p. 83 · NCIER Claim Map
Report page 83 with the cited passage highlighted
Source page 83 · click to enlarge · all claims on this page
Statement [V] p087-04

Supplement interviews with background, reference, or digital-footprint checks

Organizations may consider supplementing a standard interview with background checks, reference checks, or a review of an applicant's digital footprint.

organizations may consider supplementing a standard interview with background checks, reference checks, or a review of an applicant's digital footprint

p. 87 · NCIER Claim Map
Report page 87 with the cited passage highlighted
Source page 87 · click to enlarge · all claims on this page

Top

Find the Perfect Training Class For You