MICC8 TTP Notebook - Real-Time Intelligence With Social Media

MASTER INSTRUCTOR
CERTIFICATION COURSE
[CLASS 8]
October,
2014
Real-time Intelligence with Social Media,

Total Training Package
Owen Berger
[Student]
:Los Angeles Police Department:
Christopher Bouse
[Mentor]
:Los Angeles Police Department:
Kris Allshouse
[Facilitator]
:San Diego Regional Training Center:
POST Master Instructor Certification Course Class 8

Owen Berger
Los Angeles Police Department
Table of Contents
Executive Summary
POST Certification Package
165
Training Schedule
Hourly Distribution
166
Course Modules
Certification Request
167
Instructor Resumes
168
Module I Lesson Plan

Learning Activities
26
Owen Berger
168
Grading Rubric
45
Chris Bouse
171
Module II Lesson Plan
50
Budget
174
Learning Activities
63
Expanded Course Outline
179
Grading Rubric
78
Module I
179
86
Module II
194
Learning Activities
100
Module III
203
Grading Rubric
110
Module IV
213
Module III Lesson Plan
Module IV Lesson Plan
114
Roster
223
Learning Activities
126
Safety Plan
225
Grading Rubric
145
Evaluation Instruments
151
References
227
Table of Contents
PG. 2

Owen Berger
Executive Summary
This course shows law enforcement students from any discipline how to process the
vast amount of information from online resources, including Social Media. Students will be
able to apply that information directly to their respective organizations decision-making
processes. The course is 24 hours in length and has separate sections of content, or modules.
Each module focuses on different aspects of the overall course goal, including cybermonitoring, policy development and intelligence-systems design and implementation. There is
also a train-the-trainer section that shows students how to train peers in the subject matter.
Each module is supplemented by two distinct components. The first component is legal
application, where students will analyze law enforcements use of real-time intelligence in a
legal context including a review of current case law and changing legislation. The second
component is critical thinking, which will encourage students to constantly think about their
methods, techniques, and ideas. The critical thinking component will help students to not only
perform at a higher level in the performance of their duties, but it will help them keep up with
the dynamic nature of real-time intelligence and the constantly evolving Internet.
An experiential and task-oriented approach will be used for delivering course ideas and
concepts. Students will actively monitor events, develop policy for their organization, design
intelligence systems, and develop training for cyber-monitoring. In addition to participating in
hands-on reality-based activities, students will also examine the legal repercussions of those
activities while thinking about them in a metacognitive fashion. These experiences and
behavioral outcomes will help students carry the course content from use in the classroom to
use in their real-world duties.
Table of Contents
PG. 3

Owen Berger
Training Schedule
Real-time Intelligence with Social Media
Day 1
Module 1
0800 1030
Introductions/Safety
Search Plans
Critical Thinking and
Searches
1030 1130
Twitter Presentations
Finding Criminals
Lunch, 1130 - 1230
Module 1, continued
1230 1430
Facebook Presentations
Finding Events
Site Presentations
Situational Awareness
1430 1700
Monitoring Events
Module Evaluation
Day 2
Module 2
0800 1000
Current Systems
Legal Analysis
System Elements
1000 1130
System Design
Module Evaluation
Lunch, 1130 - 1230

Module 3
1230 1430
Legal Research and
Arguments
Critical Thinking Applied
Policy Elements
1430 1700
Policy Development
Module Evaluation
Day 3
Module 4
0800 - 1100
Teaching Generations
Teaching Cops
Constraints and Resources
Adult Learning
Learning Activities
Lunch, 1100 - 1200

Module 4, continued
1200 1600
Learning Activity Design
Activity Presentations
Module Evaluation
1600 1700
Review
Certificates
Training Location
Holiday Inn Burbank Media Center (http://www.ihg.com/holidayinn)
150 East Angeleno Avenue, Burbank, CA 91502
(818) 841-4770
Course Coordinators and Instructors
Officer Owen Berger, Los Angeles Police Department
Officer Christopher Bouse, Los Angeles Police Department
Table of Contents
PG. 4

Owen Berger
Course Modules
Module I Gathering Intelligence with Social Media and the Internet
Date Revised: September, 2014
Instructors: Berger/Bouse
Course Goal: To teach students how to gather and disseminate real-time intelligence with
Social Media and the Internet
Module Goal: To teach students how to monitor events with Social Media and the Internet
Learning Objective: The students will utilize cyber-monitoring while working on an assigned
event in small groups with internet access and a time-limit of 45 minutes for preparation and 5
minutes for presentation, and must score a three (3) or higher on each category of the Cybermonitoring Grading Rubric.
Module Time: 8 hours (Day 1 from 0800-1700)
Resources Needed:
Computer or tablet for each student, with power cable and Wi-Fi capabilities.
Wi-Fi capabilities for every student, i.e. enough bandwidth for class size.
Flip chart for every five (5) students.
Flip chart stand for every five (5) students.
Markers, preferably 5 different colors for each table.
Round table for every five (5) students.
Chair for each student.
Extension power cord for each table (per five students) with at least five plug-ins.
Projector system with HDMI compatibility.
Instructor computer with PowerPoint installed.
Flash-drive with back-up file for the learning and evaluated activities PowerPoint
presentation files, located in the online folder under Module Summary below.
Cable to connect computer to projector.
(1) copy of the handout Critical Thinking Standards and Elements per student
Cyber-monitoring Grading Rubric handout per student.
One notepad or several pieces of paper per student.
One writing implement per student.
Table of Contents
PG. 5

Owen Berger
Module Summary:
This module will start with student-generated types of cyber-monitoring and definitions for
several key terms that will be used throughout the course. Next, there will be several
exercises on the basics of searching, including search plans and critically thinking about
searches. After basic searching, students will learn, through peer presentations and realworld searches, how Twitter, Facebook, and other websites can help them when searching
for criminals and events in their area. The peer presentations and real-world searches all will
build into a final evaluated activity where the student groups will present to the rest of the
class on a fully researched event that the group found and agreed upon.
All of this modules instructor and student materials can be downloaded here:
https://www.dropbox.com/sh/3z1gg36kry1mex4/AACZBtUPRmVEpChbAk-zbKKua
Outline
I. Gathering Intelligence with Social Media and
the Internet [1] [1a]
Instructor Notes
[1] Greet students as they walk in and
gauge/assess computer expertise.
Ensure that the expertise is spread
evenly around the room by requesting
that highly-skilled students are at tables
with lesser-skilled students.
[1a] Introductions, Safety, and Rules
Introduce the instructors, talk about
classroom safety, and then have the
students come up with classroom rules,
including:
Cellphone use during class
Being on-time after breaks
Unrelated computer use
Etc
A. Types of cyber-monitoring [2]

1. Criminal Investigations
a. Ongoing criminal investigation
b. Aftermath
c. Fugitive tracking
2. Planned Events
a. Demonstration
b. Protest
[2] Facilitate Facilitate a discussion

about all of the different types of things
that law enforcement will monitor.
Make the class generate a list (with the
instructor as the scribe on a flip-chart)
that contains elements like those listed
on the left, Types of cyber-monitoring.
Make sure this list is posted in a place
Table of Contents
PG. 6

Owen Berger
c. Rally
d. Celebration
e. Sit-in
visible to all students for the rest of the

course.
3. Critical Events
a. Sniper Attack
b. Public shooting
c. Terrorist attack
4. Natural Disasters
a. Earthquakes
b. Fires
c. Floods
d. Snow
e. Rain
f. Tsunami
g. Tornado
h. Hurricane
5. Monitoring for Intelligence vs
Information [3]
B. Searching the Internet

1. Internet Search Plans [4] [4a] [4b]
a. Identify key points
1) Identify what information we
are looking for

a) Purpose, purpose, purpose
b) Specific information
c) General information or
survey
2) Distilling
a) Distill the information we
want into words or search
terms
(1) Different ways of saying
the same thing
(2) Varying specificity
(3) Skewing results with
our own words
[3] Facilitate Write down the word

Intelligence on one side of a flip-chart,
and then Information on the other
side of the flip-chart. Facilitate a
discussion amongst the class and come
up with an agreed-upon definition for
each word. Write down the
collaborative definition underneath the
word on the flip-chart, and ensure the
definitions are visible by the class.
[4] Activity Learning Activity #1,

Creating Search Plans. Have students
write a search plan for a criminal in their
jurisdiction. Then students will search
using someone elses search plan.
[4a] Facilitate After Learning Activity
#1, facilitate a discussion about the
importance of search plans, and about
how even a small amount of thought
before conducting a search can help
increase the effectiveness of any search.
[4b] Ask
Why is it important to plan a search
for intelligence/information?
Table of Contents
PG. 7

Owen Berger
b) Too much information after
distillation
(1) Need for running
multiple searches
(2) The need for multiple
plans
(3) More research to
determine other
keywords
b. Implementation methods
1) Write plan down
2) Remember plan
3) E-mail plan
What are the potential

consequences of not planning a
search?
How can search planning be
implemented in your current
position?
2. Safe searches with law enforcement
[5] [5a]
a. Protection
1) Anonymizers
a) HideMyAss
b) Firefox Plugins
c) Tor browser
2) Cold computers
a) Ease of use
b) IP Identifiers
(1) White supremacist
example
(2) Arin.net
(3) Dawhois
(4) Others
c) Associated costs
3) Fake accounts
a) Legality of fake accounts
b) Photos for profile use
c) Face vs no face
d) Other persons photos
e) False impersonation
f) Situations for fake accounts
b. Purpose will define protection
1) Again, purpose, purpose,
purpose

about being safe while searching for law
enforcement.
[5a] Ask
What should law enforcement do to
stay safe while working online, and
what should our primary online
safety concerns be?
How can we best separate personal
Social Media access from work Social
Media access?
How can your work set-up or
environment affect your health?
a. How can we help ourselves and
our health?
Can you please describe a scenario
where you would uncomfortable
reporting your online research
findings to your superiors?
a. Why are you uncomfortable,
what are some possible solutions
or outcomes to your scenario.
Table of Contents
PG. 8

Owen Berger
2) Necessary protection v
paranoia
3) Use cases
a) Apparent/overt
b) Discreet
c) Covert
c. Health
1) Environment
a) Chairs
b) Monitors
c) Desk
2) Take care of yourself
a) Stretch
b) 20 20 20 rule
c) Exercise
3. General Internet Searches [6] [6a]
a. Search Engines
1) Google
a) Largest of the search
engines
b) Tie results to logged in
Google account
c) Ads will immediately
result/respond
2) Bing
a) Microsoft-run
b) Tie results to Microsoft and
Facebook accounts
c) Bing Social
3) Yahoo
4) Ask
b. Types of searches
1) Content
a) Informational
(1) Broad information
request, usually for
things
(2) Find out
b) Navigational

Critically Thinking about Searches.
Students will fill out the Critical Thinking
Standards and Elements while thinking
about an Internet search for subversive
or anarchist elements. The content from
this section should be created by the
students, or brought out during the
facilitated discussions at the end.
[6a] Ask What are some of the different kinds
of search operators and how can
they help you?
If you arent finding the results that
you need, what are some things to
consider in order to achieve better
results?
What are some of the ways in which
searches are different for different
websites?
a. Why is it important to be aware
of these differences?
Table of Contents
PG. 9

Owen Berger
(1) A search to get
somewhere on the
Internet
(2) Finding a specific site, or
persons page
c) Transactional
(1) Means youre looking to
buy or sell or exchange
something
(2) Brands product names
2) Geographical
a) Geo-tagging
b) Quantity of information
actually geo-tagged
c) Use scenarios
(1) Protest areas
(2) Parties
(3) High-crime locations
c. Search Terms
1) Keywords
2) Names
3) Titles
4) Special Characters
a) Are they allowed, are they
included
b) Cross-site Scripting (XSS)
d. Common search operators
1) Quotes
2) Minus sign 3) Plus sign +
4) OR
5) AND
6) Attitude
a) Reliability
b) Narrowing search results
7) Other operators
e. Utilize the elements of Critical
Thinking
1) Intellectual Standards
a) Clarity
b. Please give a specific example of

how such differences could
affect a search?
How specifically can you use Internet
searches in your assignment? Why?
What information do you need to
successfully perform an Internet
search? Please rank that information
from most important to least
important.
How can different kinds of searches
affect the search results we see?
What kinds of searches are there,
and which are the most powerful?
How can the search terms and
design affect the results?
Table of Contents
PG. 10

Owen Berger
Accuracy
Precision
Relevance
Depth
Breadth
Logic
Fairness
2) Elements of reasoning
a) Purpose/Goal/End
b) Question at issue/Problem
to be solved
c) Assumptions
d) Point of View/Frame of
reference
e) Facts/Data/Evidence
f) Theories/Concepts/Ideas
g) Inferences/Conclusions
h) Implications/Consequences
b)
c)
d)
e)
f)
g)
h)
C. Cyber-monitoring and the law [7] [7a]

1. Current case law
a. Konop v Hawaiian
b. Cromer v Lexington
1) What you do off-duty can
affect your employment

2) Dont identify yourself off-duty
c. Garcetti v Ceballos
1) Make sure you know if you are
acting as employee or citizen

2) Same goes for Social Media
d. New York v Harris
1) Good search warrants are key
2) Read the terms of service
e. U.S. v Meregildo
1) Expectation of privacy does not
equal privacy
2) Confidential Social Media
informants?
2. Other legal questions
a. Reactive case law

about why it is important to stay current
on case law when gathering real-time
intelligence.
[7a] Ask
What are some of the legal issues
surrounding cyber-monitoring?
a. Have those issues affected your
daily duties in the past?
b. How could those issues affect
your daily duties in the future?
What is some of the current case law
regarding cyber-monitoring?
a. Do you agree with the courts
decisions? Why?
b. How will these legal decisions
impact your job?
c. Which one impacts your specific
assignment the most? Why?
Table of Contents
PG. 11

Owen Berger
b. False personas
c. Purpose, purpose, purpose
3. 28 CFR Part 23 -
https://it.ojp.gov/documents/28cfr_pa
rt_23.pdf
D. Useful sites and tools [8]

1. Understanding Twitter
a. Twitter Accounts
1) Signing up for Twitter
a) Full Name
(1) Resistance to sign up
(2) Fake Name
(3) Work Name
b) E-mail Address
(1) Use your work e-mail
(2) Use a throw-away e-
[8] Individual work Give students

however long they need to ensure that
every student has an active Twitter
account that they can access during the
course. Students that already have an
account should assist those without an
account.
mail
c) Password
(1) Password security
(a) Never write down
passwords
(b) Ensure password is
different for each
account
(2) Consequences of poor
password security
(a) Public
embarrassment
(b) Loss of trust
d) Username
(1) Be descriptive
(2) Or not
(3) This is your Twitter
handle
e) Keep me signed-in
checkbox
(1) Stores a cookie in
your browser
Table of Contents
PG. 12

Owen Berger
(2) Inherently safe, if only
you are using the device

f) Tailor Twitter to my most
recent websites checkbox
(1) They are storing your
information for
advertisements
(2) Dont check these boxes
(3) Its unclear how much
information they store,
and for how long
g) Terms of Service
b. Post sign-up operations
1) Follow five people
a) Not necessary to complete
for this course
b) Only follow people you are
actually interested in
c) As soon as you follow
someone, that information
is public
2) Complete profile
a) Uploading a photo
b) Entering background
information
c) Entering a website
3) Find your friends
4) Confirm your e-mail address
a) Not necessary for this
course
b) Common practice that
ensures you own your email address
c. Twitter terms and nomenclature
[8a] [8b]
1) Users
a) Username
(1) The same thing as a
Twitter handle
[8a] Activity Learning Activity #3,

Twitter Mini-presentations and Criminal
Searches. Group members will prepare
mini-presentations on different aspects
Table of Contents
PG. 13

Owen Berger
(2) Be descriptive
(3) Or not
Profile
Profile picture
Profile background
Followers
(1) These are the people
following you
(2) They can see all of your
tweets, and re-tweet
them
(3) You can restrict who is
following you
f) Following
(1) These are the people
you are following
(2) They can view your
information
(3) They can disallow you
to follow them
2) Tweets
a) Tweet
(1) 140 Character-limit
(2) Goes to all followers
(3) Is publicly searchable
(4) NEVER GOES AWAY
b) Re-tweet (RT)
(1) Twitter for lazy people
(2) This is how information
goes viral
c) Modified Tweet (MT)
d) Link
(1) To picture/photo
(2) To website
(3) URL Shorteners
(a) Purpose
(b) Dangers of overuse
3) Hashtag
a) Groups content
b)
c)
d)
e)
of twitter, including (groups with more

than five can double up):
Signing up
Terms and nomenclature
Searching Twitter
Events and Twitter
Preservation of digital evidence for
Twitter
ALL presentations should have a strong
tie-in to exactly how that subject
translates into gathering real-time
intelligence for events or #SMEM.
After the mini-presentations, each

student will be tasked with finding a
criminal or gang-member in their area
using only Twitter.
[8b] Ask
What are common Twitter
terms/nomenclature, and what do
they mean? Which of these terms
have you heard in the news lately?
What makes Twitter such a powerful
tool? Which parts of Twitter are the
most useful for law enforcement?
What considerations do we need to
make when using Twitter for event
monitoring/awareness? Facebook?
Instagram?
Why is Twitter different than other
means of communication?
What are the best ways you use the
information from Twitter in your
current assignment?
When have you used Twitter before
as law enforcement personnel?
a. Was it successful?
Table of Contents
PG. 14

Owen Berger
b) Organic way to organize
tweets
c) Large range from specific to
general
d) No special characters
4) @-Mention
a) Tied to a username
b) Can be used to reply
c) Can draw attention to a
Twitter profile.
5) Photos
a) Are attached to the Tweet
b) Can be linked to
(1) Instagram
(2) Other websites
c) EXIF and META data
(1) Information stored with
the photograph
(2) Included geo-location
data
(3) Camera information
(4) Shutter speed, etc
(5) Sometimes its scrubbed
(6) Can be obtained via
search warrant
(7) Command staff love
pictures
6) Other
a) Direct Messages (DM)
(1) Only between your
followers or people you
are following
(2) Used the same as text
messages
(3) Can be obtained via
search warrant
b) Reach
(1) How does something go
viral
b. If not, what would you change or

how would you do it differently?
How does law enforcements view of
Twitter differ from that of the
general public? Or criminals?
What do you need to work on to
better understand how to monitor
events with Twitter?
What real-life scenarios can you
think of where Twitter would be a
helpful tool?
How can successful preparation help
us with remote event monitoring?
How can the tools you learned today
be applied to other websites, such as
Backpage or Craigslist?
How does the type of event we are
preparing for affect our search
terms?
Can you please describe a scenario in
which information from Twitter
would require further investigation
or vetting before being relied upon?
What is the best way to find
meanings of terms we dont
understand?
How could we teach our peers to
find the same information?
How would you convince your
command staff to allow you to
access Twitter on the job?
What kind of resistance do you
expect when you go back to work
and are using Twitter to gather
information?
a. How can you mitigate/prepare
for/overcome this resistance?
Can you describe why the
information flow that Twitter uses is
good for event monitoring? Try to do
Table of Contents
PG. 15

Owen Berger
(2) Multiple layers of re-
tweets makes for a

huge audience
c) Trending
d) Geo-location
(1) Uncommon
(2) Used in Twitter
mapping software and
applications.
so without using any of our Twitterspecific terms or nomenclature.

Is the amount of information in a
tweet limited to 140 characters?
Why?
Can we track peoples location using
Twitter? How?
Why would Twitter users need to use
Direct Messages?
2. Searching Twitter
a. Types of searches
1) Keywords
a) Autocomplete
b) Multiple types of returned
2)
3)
4)
5)
information
(1) Hashtags
(2) Profiles
(3) General search terms
Hashtags
Profiles or @-mentions
Search operators
(https://www.twitter.com/sear
ch-home for full list)
a) Quotes
b) Minus sign
c) OR
d) AND
e) Attitude
(1) Reliability
(2) Narrowing search
results
f) Other operators
Twitter search engines
a) Native Twitter search
b) Other Twitter search
engines
(1) Bing Social
(2) Google (Twitter: )
(3) IceRocket
Table of Contents
PG. 16

Owen Berger
6) Twitter feeds (continuous
searches) or Aggregators
a) Current Twitter feed/API
issues
(1) Twitter has begun to
disallow access to their
data
(2) Several smaller twitter
services have closed
(Monitter)
b) Twitter feeds
(1) Most require a Twitter
account
(2) Some have different
refresh rates
(a) Refresh rates are
how often the
information is
updated
(b) Important to know
depending on how
critical updated
information is to the
task at hand
(3) Feed providers
(a) Tweetdeck
(b) Twitterfall
c) Multiple feed windows
(1) Advantages
(a) Helpful during most
major events
(b) Can use multiple
screens
(2) Disadvantages
(a) Bandwidth issues
(b) Eye-problems
(c) Practice the 20-2020 rule
3. Events and Twitter
Table of Contents
PG. 17

Owen Berger
a. What Twitter provides
(Advantages)
1) Real-time intelligence from
anywhere people are
2) Location-centric data
a) Limitations of geo-tagging
information
b) Small amount of people
with geo-tagging turned on
3) Used the same as other
intelligence
a) Multiple (difference)
sources lend credibility
b) Intel must be
independently verified for
action to be taken
c) Twitter is a good starting
point
4) Photographs can be a gold
mine
a) Crowd estimates
b) Weather
c) Evidence
d) Piecing events together
e) Disaster breadth
b. What Twitter does not provide
(Pitfalls)
1) 100% credible information
a) Believe it or not, people lie
on Twitter
b) Invalid information can be
as viral as true information
2) Not a replacement for
deployed resources
a) Typically, the more
resources, the less helpful
Twitter is
b) Should not be used for
major decisions
c. Using Twitter specifically for Events
Table of Contents
PG. 18

Owen Berger
1) Generating search terms

a) Preparation is key
(a) Every event is
different
(b) Examples
i. Baseball game
ii. Awards show
iii. Gang funeral
iv. Slang
v. Emergencies
vi. Natural disasters
vii. #SMEM
(c) Research can help a
lot
(d) Gang experts
(e) Fans
(f) Other news sites
(g) Slang
i. Helpful sites
ii. Transl8it
iii. UrbanDictionary
iv. Pay attention
b) Terms and hashtags are
DYNAMIC
(a) Dynamic
terminology
(b) Terms can change
i. Always be
watchful for new
hashtags &
keywords
ii. Variations
iii. #occupy
iv. #occupyla
v. #occupymay1
vi. #occupylamayda
y
vii. #buildingcollaps
e
(c) Hashtag hijacking
Table of Contents
PG. 19

Owen Berger
Context is
important
ii. The
person/entity
tweeting can
change the
meaning
Hashtags can pop up
anywhere
#ShuttleEndeavour5
HoursLate
#CrashGate7
#TailgateNow
#FlashMob711
i.
(d)
(e)
(f)
(g)
(h)
4. Understanding Facebook
a. Facebook Accounts
1) Signing up for Facebook [9]
a) Initial Page
(1) First Name
(2) Last Name
(3) E-mail address
(4) Password
(5) Birthday
(6) Male/Female
(7) Phone number
b) Find Friends
c) Fill out Info
d) Profile Pic
[9] Individual work Give students

however long they need to ensure that
every student has an active Facebook
account that they can access during the
course. Students that already have an
account should assist those without an
account.
2) Facebook terms and
nomenclature [10] [10a]

a) Page
b) Post
c) Profile
d) User
e) Username
f) Vanity URL
g) Banner
h) Profile ID

Facebook Presentations. Groups will
prepare presentations on different
aspects of Facebook, including (in order
of importance):
Terms and nomenclature
Searching/Monitoring Facebook
Events and Facebook
Table of Contents
PG. 20

Owen Berger
(1) Never changes

(2) JSON pathway
(a) Change www to
i)
j)
k)
l)
m)
n)
o)
p)
q)
r)
s)
graph
Status
Update
Timeline
Groups
Apps
Friends
(1) Friend Request
(2) How many friends
should you have
Followers
Likes
Comments
Messages
Privacy
5. Searching Facebook
1) Keywords
a) Autocomplete
b) Multiple types of returned
information
(1) Profiles
(2) Pages
(3) Events
(4) Photos
(5) Apps
(6) Games
(7) Groups
2) Profiles (People)
3) My Friends
4) Photos, movies, music, games
I might like
5) Nearby Restaurants
6) Photos I have liked
b. Facebook Search Engines
1) Native Facebook Search
Preservation of digital evidence for

Facebook
Positives and negatives of Facebook
for cyber-monitoring
Facebook feeds / APIs / aggregators.
student will be tasked with finding an
event in their area using only Facebook.
[10a] Ask
In Geek-speak, what do I mean when
I say a picture is worth a thousand
words?
a. What is EXIF/META data? How
does it affect law enforcement?
How do we know if we have found
enough information?
a. How do you define enough
information?
b. Why?
In what ways can intelligence from
Social Media and the Internet be
used during an emergency or natural
disaster?
Can you map those ways
chronologically for a given
emergency or natural disaster, e.g.
earthquake, fire, building collapse?
What actions would need to be
taken if you found a specific threat
to the public or to law enforcement
online?
a. In what order should these
actions be taken?
b. Why?
Table of Contents
PG. 21

Owen Berger
2) Other Facebook search engines

a) Bing Social
b) Google (Facebook: )
c) IceRocket
3) Graph search
a) Can replace www. With
graph.
(1) JSON
(2) Plain text
representation of
information
(3) What
b) Results different for
everyone
c) What information is or is
not shown
6. Events and Facebook
a. What Facebook provides
(Advantages)
1) Real-time intelligence from
anywhere people are
2) Some Location-centric data
a) Limitations of geo-tagging
information
b) Small amount of people
with geo-tagging turned on
c) Locations can be entered
incorrectly or faked
3) Used the same as other
intelligence
a) Multiple (different) sources
lend credibility, links to
other Facebook
b) Intel must be
independently verified for
action to be taken
c) Facebook is a good starting
point, and has less fake
pages than Twitter
Table of Contents
PG. 22

Owen Berger
4) Photographs and videos linked
to accounts
a) Location can be deduced
from photo OR
account/page
b) Valuable information
(1) Crowd estimates
(2) Weather
(3) Evidence
(4) Piecing events together
b. What Facebook does not provide
(Pitfalls)
1) Easy searches/Automation
a) Facebooks Graph API isnt
great for law enforcement
b) Advertising drives results,
not relevant information
2) Not as real-time as Twitter
a) Twitter offers more for
ongoing events
b) Twitter offers less for
upcoming events
c. Using Facebook specifically for
Events
(1) Uniform page layout
means most events
have same setup
(2) Examples
(a) Parties
(b) Protests
(3) Slang
(a) Helpful sites
(b) Transl8it
(c) UrbanDictionary
(d) Pay attention
b) Different searches, think in
person terms, not keywords
(1) Names
Table of Contents
PG. 23

Owen Berger
(2) Phone Numbers

(3) Locations
(4) Groups
2) Respondents Who is coming?
a) Yes
b) No
c) Maybe
7. Preserving Digital Evidence [11]
a. Preservation Requests
b. Preservation Letter
c. Search.org for contact information
d. Arin.net for IP Address Information
e. Facebook.com/records
f. Instagram Facebook.com/records
g. Otherwise look for e-mail or fax
8. Understanding Instagram [12]
a. Instagram basics
1) Instagram is phone-only
2) Signing up requires your phone
3) Must download app
b. Instagram accounts
1) Profile/Username
2) Chosen at signup
3) No publicly available id
4) http://jelled.com/instagram/lo
okup-user-id
c. Instagram terms
1) Profile
2) Caption/Description
3) Title
4) Message
5) Like heart
6) Follow
7) Comment
8) Direct Send
d. Searching Instagram
1) IconoSquare (used to be
Statigram)
[11] Facilitate Re-cap how to preserve

digital evidence when necessary (should
have been covered in the minipresentations, twice), and ensure that all
students understand the basic steps to
preserving online evidence
[12] Activity Learning Activity #5, Site

Mini-presentations and Awareness
Searches. Group members will prepare
mini-presentations on different websites
, including (everyone chooses a site, no
repeats):
Instagram
Craigslist/Backpage
Etc
student will be tasked with finding
something current in their area using
only the sites presented by their group.
Table of Contents
PG. 24

Owen Berger
2) Hashtags from Twitter and
Facebook work also

9. Other sites [13]
a. Trending
b. New Technologies
c. Online Buy/Sell
1) Craigslist
2) Backpage
d. General searches
e. Fly-by-night aggregators
10. Commercial tools
a. Geofeedia
1) Geo-fencing
2) Stateful monitoring
b. LexisNexis/Accurint
c. Torch (Palantir)
d. Radian 6
e. SAS Social Media

about different websites (other than
Facebook and Twitter):
Instagram
Craigslist
Search Engines
Commercial Tools
Backpage
Etc
The discussion should include exactly
how those other sites can be used for
gathering real-time intelligence for
events or #SMEM.
[14] Evaluated Activity The last activity
will involve full group work and an
evaluated presentation covering the
main points of the modules, Evaluated
Activity #1, Event Research and
Presentations.
[14a] Ask
What is your biggest takeaway from
today, and why did you choose that
over other takeaways?
Why were you allowed to work in
groups for your final presentation?
a. Why were you given a time limit?
Table of Contents
PG. 25

Owen Berger
Learning Activity #1 Create a Search Plan

Purpose:
To have students develop effective search plans.
Description:
Preview
The students will create a search plan, and then trade with a partner. The students will
then look for a criminal in their city, but only looking according to the plan written by their
fellow students. Then the instructor will facilitate a discussion about things that were perhaps
left out of the search plans, or what types of things could have made the search plan better.
Prior to the activity
Ensure that all students have some sort of writing implement (pencil or pen) and at least
two blank sheets of paper.
Bring up the first slide of the
PowerPoint presentation entitled
Creating Search Plans ->
During the activity
Pull of the second slide of the

PowerPoint presentation, Create a
Search Plan ->
Allow the students to read the slide, ask if there are any questions, and then give the
students time to work, approximately 10 to 15 minutes.
Table of Contents
PG. 26

Owen Berger
Pull up the third slide of the

PowerPoint presentation, Trade and
Find ->
Pull up the fourth slide of the
PowerPoint presentation, Discussion
->
Facilitate a discussion about how the students searches went, and whether or not their
search plans hindered them, and why.
While the students talk about the search plans and their effectiveness, write down
primary elements of a good search plan on a flip-chart at the front of the room (a
second instructor should do this if possible).
Key Learning Points:
Students will understand why search plans are important.

Students will understand how to think about search plan development from a users
point of view.
Students will understand the elements of an effective search plan.
Students will be able to apply search plans to actual searches.
Resources Needed:
-
(1) Computer or tablet for each student, with power cable and Wi-Fi capabilities.
(1) Flip chart
Markers, for instructor use
Table of Contents
PG. 27

Owen Berger
(1) Round table for every five (5) students

(1) Chair for each student.
(1) Extension power cord for each table (per five students) with at least five plug-ins
(1) Projector system with HDMI compatibility
Instructor computer with PowerPoint installed
Flash-drive with back-up file for the PowerPoint presentation file Creating Search Plans.
Cable to connect computer to projector
(1) notepad (or two pieces of notebook paper) per student
(1) writing implement per student (pen or pencil)
Time Required:
30 to 45 minutes
Table of Contents
PG. 28

Owen Berger
Learning Activity #2 Critically Thinking about Searches

Purpose:
To have students analyze the thought process behind searching for information.
Description:
Preview
In this multi-layered activity, students will be analyzing an upcoming search for
subversive or anarchist organizations or individuals in their geographic jurisdiction. Students
will fill out the Critical Thinking Standards and Elements worksheet while thinking about finding
such organizations or individuals in their respective areas. Students will then choose their most
interesting choices and write them on their flip-chart. The groups/tables will present the top
three (after discussion) choices from the worksheets. The last part of the activity will be a
facilitated discussion seeking deeper meaning behind the groups choices.
Before the activity

Ensure that every student has a copy of the handout entitled Critical Thinking Standards
and Elements as well as a writing implement (pen or pencil).
Pull up the first slide of the
Critical Thinking and Online Searches
->
During the activity

Pull up the second slide of the
PowerPoint presentation,
Definitions ->
Facilitate a discussion amongst the students, asking what the definition of a subversive
and/or anarchist organization would be.
Tell the students that they are going to be searching for a subversive or anarchist
element in their geographical jurisdiction, but first
Table of Contents
PG. 29

Owen Berger

PowerPoint presentation, Critical
Thinking Worksheet ->
Explain to the students that they are to fill out the entire Critical Thinking Standards and
Elements worksheet, putting one to three words in each box, applying that specific
intersection of the elements and standards to the idea of searching for a subversive or
anarchist organization or individual in their area.
Answer any questions, and then let the students work for about 30-45 minutes,
depending on the level of students still working and paying attention to unrelated
conversations. Try to steer non-working students back to the worksheet by engaging
them in individual conversations if necessary.
After the 30 minute worksheet
period, pull up the fourth slide of
the PowerPoint presentation,
Cherry-picking ->
Ask every student to write their two most interesting boxes on their groups flip-chart,
including three things, (1) the element of thought, (2) the intellectual standard, and (3)
the words the student wrote for that box on their worksheet. This should take about
five to ten minutes. Try to keep the students moving and writing on their flip-chart as
quickly as possible.
Pull up the fifth slide of the
Distillation ->
Ask every group to discuss their other group members selections and what they mean,
and then to choose the two or three most interesting of that groups selections. The
groups should be prepared to explain their selections, with a different group member
talking about each selection and the reason behind choosing it for class discussion.
Table of Contents
PG. 30

Owen Berger
Pull up the last slide of the

->
Have each group present their chosen items, and explain the reasoning behind them
and what they mean.
Facilitate a discussion amongst the class after each presentation, asking for deeper
meaning and or thought on each selected box.
Students will better understand the process of Critical Thinking Applying the
Elements of Thought with sensitivity to the Intellectual Standards.
Students will be able to apply critical thinking to their own searching thought processes.
Students will understand why critical thought about searching is important for real-time
intelligence-gathering with Social Media and the Internet.
Resources Needed:
-
(1) Flip chart and stand for every five (5) students.
(1) Flip chart stand for every five (5) students.
Flash-drive with back-up file for the PowerPoint presentation file Critically Thinking
about Searches.
(1) copy of the handout Critical Thinking Standards and Elements per student
Time Required:
60-70 minutes.
Table of Contents
PG. 31
Critical Thinking Standards and Elements

Selected thought process -
Everyone thinks; it is our nature to do so. But much of our thinking, left to itself, is biased, distorted,
partial, uninformed, or downright prejudiced. If we want to think well, we must understand at least the
rudiments of thought, the most basic structures out of which all thinking is made. We must learn how to
take thinking apart. CriticalThinking.org
Intellectual Standards
Clarity
Purpose
(goal, objective)
Question at issue
(problem, issue)
Elements of Thought
Information
(data, facts,
observations,
experiences)
Interpretation and
Inference
(conclusions,
solutions)
Concepts
(theories,
definitions, axioms,
laws, principles,
models)
Assumptions
(presupposition,
taking for granted)
Implications and
Consequences
Point of View
(frame of reference,
perspective,
orientation)
Accuracy
Precision
Relevance
Depth
Breadth
Logic
Significance
Fairness

Owen Berger
Learning Activity #3 Twitter Mini-presentations and Criminal Searches

Purpose:
To have students understand Twitter through presentations and searches.
Description:
Preview
The students will create a small presentation on a specific aspect of Twitter, and then
present to their respective group. After the presentations, students will be asked to find a gang
member or criminal in their jurisdiction using only (or mainly) Twitter.

Twitter Presentations and Searches >
During the activity

PowerPoint presentation, Twitter
Mini-presentations ->
Allow the students to read the slide.

Pull of the third slide of the
PowerPoint presentation, Topics ->
Table of Contents
PG. 33

Owen Berger
Ask if there are any questions and then give the students time to work, approximately
15 minutes.
PowerPoint presentation, Present ->
students time to work, approximately 15 minutes (3 minutes per student).
Every three minutes, ensure that the student presenter is changing and that every
student has a chance to conduct their presentation. If a group has less than five
students, ask the students to discuss the most important aspects of the others
presentations.
PowerPoint presentation, Searching
Twitter, Criminals and Gangsters ->
students time to work, approximately 5-10 minutes.
After 5-10 minutes ask all of the students who have NOT found a criminal in their area
to raise their hands. Next, tell all of the students who dont have their hands up to help
the closest person to them that hasnt found a criminal/gang member.
Allow the students to work for another 5 minutes or so.
Facilitate a discussion, asking any unasked in-depth questions from the lesson plan, and
asking specifically what is different about finding people through Twitter than finding
them through other online resources.
Students will understand the basics of Twitter.

Students will understand how to find specific targets in a geographical area.
Students will practice presenting ideas and concepts about Social Media.
Students will practice helping others with searches (search collaboration).
Table of Contents
PG. 34

Owen Berger
Resources Needed:
-
(1) Flip chart
Flash-drive with back-up file for the PowerPoint presentation file Twitter Presentations
and Searches.
Time Required:
50 minutes
Table of Contents
PG. 35

Owen Berger
Learning Activity #4 Facebook Presentations and Event Searches

Purpose:
To have students understand Facebook through presentations and searches.
Description:
Preview
The students will create a small presentation on a specific aspect of Facebook, and then
present to their respective group. After the presentations, students will be asked to find an
upcoming or ongoing event in their jurisdiction using only (or mainly) Facebook.

Facebook Presentations and
Searches ->
During the activity

PowerPoint presentation, Facebook
Mini-presentations ->

PowerPoint presentation, Topics ->
Table of Contents
PG. 36

Owen Berger
15 minutes.
presentations.
Facebook, Events ->
After 5-10 minutes ask all of the students who have NOT found an event in their area to
raise their hands. Next, tell all of the students who dont have their hands up to help
the closest person to them that hasnt found a criminal/gang member.
asking specifically what is different about finding events through Facebook than finding
Students will understand the basics of Facebook.

Students will understand how to find specific targets in a geographical area.
Students will practice presenting ideas and concepts about Social Media.
Table of Contents
PG. 37

Owen Berger
Resources Needed:
-
(1) Flip chart
Flash-drive with back-up file for the PowerPoint presentation file Facebook Minipresentations and Event Searches.
Time Required:
50 minutes
Table of Contents
PG. 38

Owen Berger
Learning Activity #5 Site Mini-presentations and Awareness Searches

Purpose:
To have students understand various websites through presentations and searches.
Description:
Preview
The students will create a small presentation on a website that isnt Facebook or
Twitter, and then present to their respective group. After the presentations, students will be
asked to find a current situation or something going on right now in their jurisdiction using only
the websites presented at their table.

Site Mini-presentations and
Awareness Searches ->
During the activity

PowerPoint presentation, Site Minipresentations ->

PowerPoint presentation, Sites ->
Table of Contents
PG. 39

Owen Berger
15 minutes.
presentations.
Websites, Situational Awareness ->
After 5-10 minutes ask all of the students who have NOT found something current in
their area to raise their hands. Next, tell all of the students who dont have their hands
up to help the closest person to them that hasnt found a current situation.
asking specifically what is different about finding events through Facebook than finding
Students will understand the basics of various websites that can be used for searches.
Students will understand how to conduct situational awareness searches for their
jurisdiction.
Table of Contents
PG. 40

Owen Berger
Students will practice presenting ideas and concepts about Social Media and Internet
Searches.
Resources Needed:
-
(1) Flip chart
Flash-drive with back-up file for the PowerPoint presentation file Site Mini-presentations
and Awareness Searches.
(1) notepad (or two pieces of notebook paper) per student, for notes
Time Required:
50 minutes
Table of Contents
PG. 41

Owen Berger
Evaluated Activity #1 Event Research and Presentations

Purpose:
To have students fully research an event and then present their findings.
Description:
Preview
The students will individually search for an event in their area, different from the event
they found during the earlier Facebook exercise. Students will then talk about their events with
their respective groups, and choose one event to fully research. Students will then find out all
of the information they can about their group project, and present this information along with
their actions as law enforcement.

IMPORTANT - Ensure that all students have their own copy of the Cyber-monitoring
Grading Rubric.
Evaluated Activity 1 Event
Research and Presentations ->
During the activity

Pull of the second slide of the
PowerPoint presentation, Find an
Event ->
Table of Contents
PG. 42

Owen Berger

PowerPoint presentation, Choose an
Event ->
PowerPoint presentation, Research
and Prepare ->
Ask if there are any questions, and then give the students 45-50 minutes to work, letting
them know that they can break as needed.
PowerPoint presentation, When in
Doubt ->
At some point before the end of the

research period, pull up the last
slide, Presentations:
After each group presentation, facilitate a good discussion (5 minutes or so) on that
presentation, its positives and negatives, and anything about the presentation that
reinforced or used lessons from the course content.
Table of Contents
PG. 43

Owen Berger
Learning Objective:
The students will utilize cyber-monitoring while working on an assigned event in small groups
with internet access and a time-limit of 45 minutes for preparation and 5 minutes for
presentation, and must score a three (3) or higher on each category of the Cyber-monitoring
Grading Rubric.
Resources Needed:
-
(1) Flip chart
Flash-drive with back-up file for the PowerPoint presentation file Evaluated Activity
Event Research and Presentations.
Time Required:
Two hours
Table of Contents
PG. 44

Owen Berger
Note The pages below consist of a modified view of the Cyber-monitoring Grading Rubric.
The full version (better for printing) can be downloaded from the link below (in Word format or
PDF format):
https://www.dropbox.com/sh/cak9000jwkjvbrl/AACdOSS15-gTalvgaqrMg3M3a
Cyber-monitoring Grading Rubric

This rubric is designed to give guidelines on how to rate the student groups during the
evaluated activity section of Module I Gathering Intelligence with Social Media and the
Internet. The final score is a pass/fail rating, where each group must score a 3 or higher on
ALL categories to pass. A 1 in any category is an automatic fail and requires remediation.
Student:
Evaluator:
Date:
Category Search Plan
1-Not
acceptable
Students did
not create a
search plan
for their
event.
2-Not acceptable
One or two in the group
actively cooperated in the
creation of a search plan
for their assigned event
by verbally giving input or
writing the plan down.
Students explicitly
referenced the search
plan zero or one time
verbally or by reading it
during the research of
their event.
4-Outstanding
3-Competent
Most students in the
group actively cooperated
in the creation of a search
plan for their assigned
event by verbally giving
input or writing the plan
down. Students explicitly
referenced the search
plan at least twice
during the research of
their event.
Score
All students in the group

actively cooperated in the
creation of a search plan
for their assigned event by
verbally giving input or
writing the plan down.
Students explicitly
referenced the search plan
at least three times
during the research of their
event.
Comments:
Table of Contents
PG. 45

Owen Berger
1-Not
acceptable
Students did
not use the
Social Media
and Internet
terms and
nomenclature
that were
taught or
found during
the course.
Category Vocabulary / Nomenclature

2-Not acceptable
4-Outstanding
3-Competent
Student showed little
Student showed
Students showed
understanding of the
technical Social Media technical Social Media and
technical Social Media and
and Internet
Internet
Internet
terms/nomenclature
terms/nomenclature that
terms/nomenclature that
that were taught, by:
were taught, by: discussing were taught, by: discussing
discussing them at
them during their group
them during their group
most one time during
evaluated activity at least
evaluated activity at least
their group evaluated
once, using them correctly
twice, using them correctly
activity, while
while monitoring their
while monitoring their
monitoring their
assigned event at least
assigned event at least
assigned event, or
once, and using them
twice, and using them
during the group
correctly during the group
correctly during the group
presentation of their
finding.
findings at least once.
findings a minimum of
twice.
Score
Comments:
1-Not
acceptable
Students were
not observed
utilizing the
websites and
tools that were
introduced or
used during
training.
Category Site / Tool Knowledge

2-Not acceptable
3-Competent
Students utilized the
websites and tools that
were introduced or used were introduced or used
during training for the
majority of their
majority of their
research. Students were research. Students were
observed using the
observed using the
demonstrated sites and
demonstrated sites and
tools at least once while tools at least twice while
researching and
researching and
monitoring their event.
4-Outstanding
Score

were introduced or used
majority of their research.
Students were observed
using the demonstrated
sites and tools at least
three times while
researching and
Comments:
Table of Contents
PG. 46

Owen Berger
1-Not acceptable
Students did not
demonstrate
legal ramifications of
using Social Media
and Internet to
monitor events.
Students did not
openly discuss the
constitutionality or
lawful consequences
of the performed
cyber-monitoring.
Category Legal Application

2-Not acceptable
3-Competent
Students demonstrated Students demonstrated
using Social Media and using Social Media and
Internet to monitor
Internet to monitor
events. Students
events. Students
openly discussed, more openly discussed, at
than once, the
least once, the
lawful consequences of lawful consequences of
the performed cyberthe performed cybermonitoring. Their
monitoring. Their
discussions did not
discussions included,
include law that was
but werent limited to,
introduced or
false personas, current
mentioned during the
case law, data storage
course.
and retention, and
constitutional
amendment issues.
4-Outstanding
Students demonstrated
using Social Media and
Internet to monitor
events. Students
openly discussed, more
than once, the
lawful consequences of
the performed cybermonitoring. Their
but werent limited to,
false personas, current
case law, data storage
and retention, and
constitutional
amendment issues.
Comments:
Table of Contents
PG. 47
Score

Owen Berger
1-Not acceptable
Students were able to
produce results from
their cybermonitoring. They
found less than five
separate pieces of
information on their
event. In addition,
students were not able
to extrapolate
necessary actions or
tactics from their
found information.
Comments:
1-Not acceptable
Students were not
able to clearly
communicate their
findings to the rest of
the class. Students
did not convey how
they obtained their
information, and did
not present any
actions were
implemented due to
the found
information.
Comments:
Category Event Results

2-Not acceptable
3-Competent
their cyber-monitoring. their cyber-monitoring.
They found at least
They found at least
five separate pieces of seven separate pieces
of information on their
event. In addition,
event. In addition,
students were able to
extrapolate at least
one necessary actions
two necessary actions
or tactics from their
found information.
found information.
4-Outstanding
Score
their cyber-monitoring.
They found at least ten
separate pieces of
event. In addition,
three necessary actions
found information.
Category - Presentation
2-Not acceptable
3-Competent
communicate their
clearly communicate
findings to the rest of
their findings to the
the class. Students
rest of the class.
conveyed how they
Students conveyed how
obtained their
they obtained their
information by giving
information by
at least one sites/tools detailing at least two
that were used, and at sites/tools that were
least one actions were used, and at least two
implemented due to
actions were
the found information. implemented due to
the found information.
4-Outstanding
Score
clearly communicate
their findings to the
rest of the class.
Students conveyed how
they obtained their
information by
detailing at least three
sites/tools that were
used, and at least three
actions were
implemented due to
the found information.
Table of Contents
PG. 48

Owen Berger
1-Not acceptable
Only one or two
group members
presented over
ninety percent of
the material.
Category - Participation
2-Not acceptable
3-Competent
Most of the group members Every group member
participated in the
participated in the
presentation, but one or
presentation, though one
two members presented
or two members presented
more than seventy-five
more than fifty percent of
percent of the material.
the material.
4-Outstanding
Score
Every group
member
participated in the
presentation
equally.
Comments:
1-Not acceptable
The presentation was more
than 45 seconds less than
or more than 5 minutes in
length, and one or two
group students
participated in presenting.
Category Time Management

2-Not acceptable
3-Competent
The presentation was
within 45 seconds of 5 within 30 seconds of 5
minutes in length, and minutes in length, and
most of the group
the entire group
participated in
participated in
presenting.
presenting.
4-Outstanding
The presentation
was within 15
seconds of 5
minutes in length
Comments:
Please total the scores for all categories and type the number in the box to the right.
Twenty-one (21) is the minimum passing score. Twenty-eight (28) is the maximum
score.
Overall Presentation Comments:
Please enter a selection of pass or fail in the box to the right.
Table of Contents
PG. 49
Score

Owen Berger
Module II - Real-time Intelligence Systems: Design and Implementation

Instructors: Berger / Bouse
Module Goal: To teach students how to design and implement systems for gathering and
disseminating intelligence from Social Media and the Internet
Learning Objective: The students will create an intelligence system while working in small
groups with Internet access and a time-limit of 60 minutes for preparation and 6 minutes for
presentation, and must score a three (3) or higher on each category of the Systems Design
Component of the Intelligence Systems Rubric.
Resources Needed:
(1) Flip chart for every five (5) students.
(1) Round table for every five (5) students.
(1) Extension power cord for each table (per five students) with at least five plug-ins.
(1) Projector system with HDMI compatibility.
(1) Intelligence Systems Rubric Systems Design Component handout per student.
One printed version of the two-page document entitled Element-driven Systems
Design Notecards (for instructor use only).
One printed version of the Intelligence Systems Elements Checklist for each student.
One notepad or several pieces of paper and a writing implement per student.
Table of Contents
PG. 50

Owen Berger
Module Summary:
This module will utilize two learning activities and one evaluated activity, building toward the
creation of a customized intelligence system. Students will first review their own
organizations intelligence systems and review case law. Students will then do an hour long
element-driven design activity, where they will build three separate systems for specific
messages. Last, students will choose a non-existing intelligence system that will benefit their
workplace, design it, and then present that system and be graded according to the module
grading rubric.
Outline
II. Designing Intelligence Systems [1] [1a]
A. Definitions
1. Intelligence
a. Universal definition
b. Defining the term
1) Command staff
2) Multi-jurisdictional
3) Policy
c. Intelligence vs information
2. System
a. Systems Definition
1) System vs Policy
2) System vs Guideline
3) System vs Law
b. Breadth
1) Organization-wide
2) Division/Bureau wide
3) Unit-wide
Instructor Notes
[1] Facilitate Start a group discussion
about the meaning of an intelligence
system or information system. Then,
lead a prolonged discussion about how a
system differs from other law
enforcement terms and how intelligence
systems are used by law enforcement
today.
NOTE For the above facilitated
discussion, please write down important
points on a flip chart that the class can
view.
[1a] Ask What is an intelligence system? How
did you come up with your
definition? Would all of us define it
the same way? Why or why not?
How do you define intelligence? How
does it differ from information?
Does your organization see it the
same way? Why or why not?
Table of Contents
PG. 51

Owen Berger
B. Intelligence Systems and the Law [2] [2a]

1. System legalities
a. System illegalities or pitfalls
1) Storage of information
2) Automation
a) Storing information
(1) Insecure
(2) Too long
(3) Outside of intended
purpose
b) Sending information
c) Gathering information
3) Purpose, purpose, purpose
a) Outside of mandate
b) Outside of jurisdiction
c) Outside of authority
b. Intended Use
1) Internal
a) Criminal Investigations
b) Facilitate information flow
2) External
a) Media Relations
b) Public Alerts
3) Both
a) Protests
b) Mass Demonstrations
2. Current case law
a. Konop v Hawaiian
1) Legally viewing a website
a) User
b) Administrator
c) Law enforcement
2) Defining a user
a) Login or free access
b) Terms of Service
(1) Authenticating the

Current Systems and Legal Analysis.
Students are going to summarize current
intelligence systems at their work place,
and then they are going to legally
analyze the systems. (40-45 minutes)
[2a] Ask What current case law is applicable
to designing an intelligence system?
Why?
When designing an intelligence
system, what are our most important
legal concerns?
What intelligence systems are
currently in place at your
organization?
How effective are those systems on a
scale of one to ten? Please articulate
why you gave that rating.
What are some instances during the
course of your current duties where
an intelligence system could be
used?
How could an intelligence system be
used outside of its intended use?
What effects could that unintended
use have on you or your
organization?
agreement
(2) TOS allow/disallow
c) Determining actual Terms
of Service
Table of Contents
PG. 52

Owen Berger
(1) Importance
(2) Invitation vs pre-
subscribed
(3) Intentional recipient vs
open subscription
3) Methods of communication
a) Interception vs Reception
vs Storage/Retrieval
b) Direct sending
c) Post and retrieve
d) Actively transmitting vs
retrieval from storage
b. Garcetti v Ceballos
1) Employee vs Citizen
2) Two-prong tests
a) Determine who you are
speaking as
(1) Employee
(a) Statements for work
purposes
(b) Whistleblower laws
(c) During work hours
(d) At work location
(e) Using work
resources
(f) Work Equipment
(g) Work supplies
(h) Work Technology
(2) Citizen
(a) On off-time (offduty)
(b) Using
private/personal
equipment
b) Matter of public interest
(1) Raising public concerns
(2) Normal situation arising
out of work
(3) Right to know / Need to
know
Table of Contents
PG. 53

Owen Berger
c. Cromer v Lexington
1) Separation of concerns
a) On-duty
(1) Acting as representative
of your organization
(2) Must abide by all
policies/procedures
(3) Can identify as law
enforcement
(4) Can hide identity for
certain operations
b) Off-duty
(1) Should not identify as
law enforcement
(2) Behavior that can
(a) Affect your ability to
work
(b) Affect your
employers ability to
function
(c) Affect reputation of
you or your
employer
2) Termination for off-duty
behavior
a) It is possible
b) It is legal
c) Never identify yourself as
law enforcement
d) Complaints about employer
(1) Use whistleblower
protections if needed
(2) Use the proper channels
for reporting
misconduct
1) NY District Attorney used
tweets from @destructuremal
to prosecute
Table of Contents
PG. 54

Owen Berger
a) Wrote search warrant to
Twitter
b) Harris opposed as a third
party
c) Twitter withheld warrant
until judgment was given
d) Judge ruled in favor of NY
DA, with time limits.
(1) Valid search warrant
with probable cause
was used
(2) Harris had no standing
(a) Third party only
(b) Twitters Terms of
Service specifically
stated
i. All content sent
to or via Twitter
belongs to
Twitter
ii. They can give
information with
valid L.E. request
(3) Search warrant is
necessary for info
within last 180 days.
e) Twitter gave warrant return
back to NY DA.
2) Lessons
a) Valid search warrants
usually trump other
considerations
(1) Warrant scope
(a) Limited to only what
is necessary
(b) No overreach
(c) Not overly broad
i. Informationwise, and
ii. Time-wise
Table of Contents
PG. 55

Owen Berger
(d) Specific and related,
no fishing
expeditions.
(2) Probably cause
(a) Good PC can
articulate the level
of information
needed
(b) Dont ask for it if
you shouldnt get it.
(c) Traverse and quash
will eliminate all
information from
warrant
b) Terms of Service
e. U.S. v Meregildo
1) Communications were
intended as private
a) However, after sending
information
b) Recipient is free to do with
information as they please
c) Social Medias expectation
of privacy is narrowing
d) How do you know who you
are sending information to?
2) Projection/amplification of
Social Media
a) Sharing in one method can
become several methods
(1) Linked accounts
(2) Using same e-mail as
base account
(3) Sign-in with Facebook
b) Private accounts can link to
non-private accounts.
c) Law enforcement should
look at all avenues and
accounts
Table of Contents
PG. 56

Owen Berger
C. Intelligence System Purpose [3] [3a]

1. Types of information systems
purposes
a. Correcting a deficiency
1) Reasons for Deficiency
a) Too few resources
b) Too few personnel
c) Not enough training
d) Liability issues
2) Systemic vs particular/specific
a) Complete system redesign
b) Component redesign
b. Better, broader, or faster
information flow
1) Getting information
a) To more people
b) To people faster or to a
repository faster
c) More detailed, complete,
accurate, or better
information.
2) Modifying an existing system
a) to incorporate new
technology
b) to incorporate new
information sources
3) Create one system to
supplement another, or several
a) Interfaces
b) Nodes
c) Storage methods
d) Repositories
c. Dealing with new technology
1) New system to incorporate
technology into organization
2) Utilizing new technology for
current intelligence
d. Dealing with new sources of
information

Competitive Telephone. Students are
going to play a game of telephone, and
then they are going to come up with the
elements of an intelligence system. Last,
the students are going to design minisystems while critically thinking about
the elements of an intelligence system.
(50 minutes)
System Elements:
Purpose
Nodes/Data Points/Relays
Accuracy
Message Contents
Security
Economy
Speed
Spread
Medium/Method
Vetting/Validation
[3a] Ask
What are the elements of an

intelligence system?
Which elements are more
important/less important?
What is the difference between an
internal or external intelligence
system?
a. Can they be combined? How so?
Why?
What could be the differences
between an intelligence system for
law enforcement and one for a
private company?
a. What are the most significant of
those differences, and why?
Table of Contents
PG. 57

Owen Berger
1) Systems that gather and
disseminate new types of

information
2) Pulling information from a new
site or place
3) Pulling information from a
different information collector
or aggregator
2. Continuity of Purpose
a. Narrowing the purpose
1) Multiple systems with one
purpose
2) Overlap happens constantly
3) Bureaucracy breeds overlap
4) Overlap is the opposite of
efficiency
b. Keep your systems DRY
1) Research is important
2) Talk with, though I hate to say
it, stakeholders
3) Systems can interact, but
shouldnt overlap
c. The same information in multiple
places is DIFFERENT INFORMATION
1) Game of Telephone
2) Information interpretation
a) Different viewpoints
b) Least distance principle
d. Is the purposed maintained from
start to finish?
D. System Terminology
1. Nodes
2. Interfaces
3. Start point
4. End point
5. Information flow
6. User
7. Intelligence
8. Vetting
9. Validation
How should we articulate the

purpose of a specific law
enforcement intelligence system?
How could our stated purpose effect
the overall design of an intelligence
system?
What types of intelligence systems
are needed for your current duties?
a. Can you define the purpose for
each of those systems?
What could the effects be of
overlapping intelligence systems?
a. Are this positive or negative
effects, and why?
What is the most effective way to
transmit information?
a. Why is that the most effective
way over other methods?
What are some of the terms used
when designed intelligence systems?
a. Which ones do you think would
be used most in your current
duties, and why?
What are some of the real-world
considerations that might influence
the implementation of an
What is the difference between a
centralized system and a distributed
system?
a. What examples can you think of
where those systems are in use
outside of law enforcement?
What are the basic types of
communication used by law
enforcement?
a. Which are the most suited to use
in an intelligence system?
Table of Contents
PG. 58

Owen Berger
10. Target
11. Suspect
12. Target v Suspect
E. Real-world considerations
1. Information storage/repositories
a. Centralized
1) All information in same place
2) User can check at their leisure
3) Information is immutable
except by originator
4) Central node
b. Distributed
1) Information lies with end user
2) Open to interpretation by user
3) Can be relayed multiple times
c. Types
1) E-mail
2) Website
3) Phones
4) Text messaging
5) Talking to someone in person
(?)
2. Constraints
a. Human behavior
1) Checking sources:
a) Checking e-mail
b) Checking phone messages
c) Checking text messages
d) Texting and driving
2) Do anything while driving other
than driving
3) Fatigue, keep work-ups DRY
4) Necessary information only
a) Push vs pull
b) Best of both worlds
5) CREDIT IS NOT IMPORTANT
b. Nodes
1) Centralized node has to be able
to handle the traffic
What constraints or limitations does

the real world put on intelligence
system design?
a. What are the most impeding of
those constraints?
Can you damage information? If
so, how?
Why is it important to understand
how information flows in an
What are the consequences of not
critically thinking about information
flow?
How could we apply critical thinking
to the design and implementation of
an intelligence system?
What levels can you think of to
define the importance of
information?
a. How many levels are there, what
are they, and can you please rank
them from least to most
important?
What does it mean to vet
information? Is this the same as
validating information?
Why is it important to vet
information? Why or why not?
When, in the course of your
employment, have you had to vet
information?
a. What were your considerations
when doing so?
b. What would you change about
your considerations now?
Does all information have to be
vetted? Please give examples of
when and when information would
have to be or not have to be vetted?
2) Do the nodes
Table of Contents
PG. 59

Owen Berger
a) Process information
b) Mutate information
c) Interpret information
c. Mandated checking of information
source
1) Positives
a) Ensures right people get the
information
b) Everyone gets the same
information
c) Interpretation can be
relayed to everyone
2) Negatives
a) Induces fatigue
b) Failure to cooperate
c) Different interpretations
F. Intelligence flow
1. Follow the path
a. Path of least resistance
b. As the crow flies
c. All necessary personnel are
1) Notified
2) Have access to the information
2. Static points or nodes
a. Points where information can be
distorted
b. Places where interpretation or
subjectivity can be injected
c. Dependent on node for transmittal
3. Importance of information
a. Tactical scale
1) Officer or Public safety
2) Possible safety issue
3) Crime issue
4) Protest/demonstration
5) Natural Disaster
a) Earthquake
b) Flood
c) Tsunami
d) Fire
What are some examples of failures

to vet information in the news
recently?
a. What could those organizations
have done better to verify that
information?
How does information vetting fit into
intelligence systems design?
Where should the vetting process
take place in the flow of
information?
Have you ever had an e-mail or
conversation misinterpreted? How
did that make you feel? Why?
When making notifications, how can
we ensure that our information is
not misinterpreted or misused?
How can we emphasize or minimize
the importance of certain
information?
Table of Contents
PG. 60

Owen Berger
6) Emergency
a) Bridge collapse
b) Traffic-related
c) Building collapse
7) Etc
b. Should be designated prior (Hint,
hint)
c. When and who needs to know
1) Designated beforehand
2) Who gets credit
a) Not important
b) Not important
c) Not important
d. Vetting and validation system
should determine this

1) Interface or node
2) Automatic for all information?
4. Vetting and validating information
a. Consider the source
1) Reliable
2) Unreliable
3) Unknown
4) History of information
a) Good
b) Bad
c) Accurate
d) Poor
e) Exaggerated
5) Other
sites/posts/messages/info from
same source
b. Consider the actual information
1) Context
a) Fit/Doesnt fit
b) Tone
(1) Serious
(2) Threatening
(3) Warning
(4) Joking
(5) Sarcasm
Table of Contents
PG. 61

Owen Berger
c) Location
2) Accuracy
a) Demonstrably false
b) Outnumbered by
opposing information
c) Quantifiable
[4] Activity Evaluated Activity #1,
Design an Intelligence System. Students
will design and present an intelligence
system of their choosing. The activity
will be evaluated using the Intelligence
Systems Grading Rubric Systems
Design Component. (120 minutes)
Table of Contents
PG. 62

Owen Berger
Learning Activity #1 Current Systems and Legal Analysis

Purpose:
To have students summarize current systems at their workplace and legally analyze them.
Description:

Current Systems and Legal Analysis
->
During the activity

PowerPoint presentation, Current
Intelligence Systems ->
Ask the students if there are any questions, and then ask them to get started coming up
with three current intelligence/information systems at their workplace. Give the
students 5-10 minutes to work, and ensure all students have three choices, talking with
specific tables or students if they need help.
PowerPoint presentation, Share and
Choose ->
Give the students time to read the slide, then tell them to go around the table and
collectively choose one intelligence system for each student, out of that particular
students three chosen systems.
Table of Contents
PG. 63

Owen Berger

PowerPoint presentation, Share and
Choose ->
Give the students time to read the slide, and then time to choose, approximately 5-7
minutes.
PowerPoint presentation, Merry-goround
(about 5 minutes per student) ->
Give the students time to read the slide, and then time to work, approximately 5-7
minutes per student at each table. So a group of five students should take about 25
minutes. NOTE Please verbally remind the students to move on to the next student
after five minutes.
Pull up the fifth and final slide of the
->
Lead a facilitated discussion about some of the groups findings, asking the questions on
the PowerPoint if need be.
Students will know what current systems are in place at their organization.
Students will understand how to rapidly research legal cases and case law.
Students will apply current case law to existing intelligence systems.
Table of Contents
PG. 64

Owen Berger
Resources Needed:
-
Cable to connect computer to projector Flash-drive with back-up file for the Current
Systems and Legal Analysis PowerPoint presentation file
Time Required:
40-45 minutes.
Table of Contents
PG. 65

Owen Berger
Learning Activity #2 Competitive Telephone

Purpose:
To have students assess communication methods and understand intelligence system
elements.
Description:

Have a stack of handouts, one per student, ready to go on the instructor table though
not visible to the students. This handout is titled Intelligence Systems - Elements
Checklist.
Create several sets of (3) notecards based on the document entitled Element-driven
Systems Design Notecards. There should be one set of three notecards for each group in
the class (up to five groups). The PowerPoint presentation goes up to four groups, so
please add one if necessary. Make sure each notecard has the proper label on the back,
e.g. Msg #1, Msg #2, or Msg #3. To clarify, each group/table should have one stack of
three different notecards, however, the notecards labeled Msg #1 and Msg #2 are going
to be the same for each table.
Write a secret message on a flip-chart, that the students cannot see at any point before
the activity (either cover the flip-chart or put a page over the flip-chart page with the
message). The message should contain three short sentences, one technical-sounding
sentence, one personal non sequitur, and the phrase Pass it on. Example messages:
- We are implementing phase red alpha 20. Dolphins can be mean sometimes.
Pass it on.
- The chief wants to start the 897 tactical plan, now. What is your favorite tree?
Pass it on.
- All of the captains are creating the 054 plan documents. Is bubbles and squeak
good for you? Pass it on.
Also write this message on a two different note cards or pieces of paper.
Competitive Telephone ->
Table of Contents
PG. 66

Owen Berger
During the activity (Part 1)

Ask the students to stand up and walk to the opposite longer-sided walls of the
classroom, with half of the students along one wall and the other half along the other
wall.
Ask the students: What are some important components to getting a message from
one point to another? Please discuss with the students closest to you.
Give the first student in each line one of the handwritten messages to read and
memorize. This should be the SAME message as is written on the concealed flip-chart
page that the instructor wrote prior to the activity.
Have the students that originally read the message walk to the person closest to them in
their respective line, and whisper the message to that next person. Tell the students to
continue this down the line.
Have the last person in each line to receive the message tell you (the instructor) the
message, and then write it on a flip chart at the front of the room.
Put the three messages (the pre-activity message and the one received from the last
students in each line) next to each other at the front of the classroom.
Pull up slide two of the PowerPoint
presentation, Discussion:
Facilitate a discussion about the message, if it was altered, and why.

Continue discussing the limitations, positives, and negatives to that kind of
communication system.
Pull up slide three of the PowerPoint
presentation, Discussion, Continued
->
IMPORTANT Have a copy of the handout entitled Intelligence Systems - Elements

Checklist towards the front of the classroom, and guide the students discussion
towards naming ALL of these elements, but DO NOT show the slide naming these
elements, instead, write them in large lettering on a flip chart at the front of the
classroom. We do not want to give the students the answers, we want them to come
up with the elements on their own.
Table of Contents
PG. 67

Owen Berger
During the facilitated discussion

above. At the point when anything
relating to the economy of a
message comes up, pull up slide
number four, What is Economy? This
means that messages should use the
least amount of resources to get to
their destination. You can expand
upon this with the class. Slide four->
ONLY AFTER the facilitated
discussion about policy elements
and economy, and most of the
elements are on a flip-chart at the
front of the room, pull up slide
number 5, Intelligence Systems:
Some Basic Elements:
Thank the students for coming up with the basic elements, and let them view the slide
for a minute or two, perhaps going over the elements verbally and highlighting how they
came up during the facilitated discussion above.
Pull up slide 6 of the PowerPoint
presentation, Element-driven
Systems Design ->
Ask the students to please read the slide, and while they do so, put one stack of
notecards (as you created prior to the activity) on each table, these are based off of the
handout entitled Element-driven Systems Design Notecards.
presentation, Message #1 ->
Table of Contents
PG. 68

Owen Berger
Ask the groups to design their system around their assigned policy element, ask if there
are any questions, and then give the students time to work, about 5 minutes.
Presentation, Discussion Msg #1 ->
Go through each group, ask them what their assigned element was, and then ask them
to explain their system. Then ask the questions on slide 8 (already on projector).
Facilitate a discussion using the created systems for message #1.
presentation, Message #2 ->
Ask the groups to design their system around their assigned policy element, ask if there
are any questions, and then give the students time to work, about 5 minutes.
Presentation, Discussion Msg #2 ->
Go through each group, ask them what their assigned element was, and then ask them
to explain their system. Then ask the questions on slide 10 (already on projector).
Facilitate a discussion using the created systems for message #2.
presentation, All Elements
Considered (Msg #3) ->
Table of Contents
PG. 69

Owen Berger
Give the students time to read slide 11, then ask them to begin work and give them
enough time so that they can work on this, but still have about 15 minutes left in the 50
minute activity period. If they will only have a couple of minutes, warn them that this
will be a fast systems design.
presentation, Presentations ->
Give the students time to read slide 12, and then ask the first group to start. After each
group presentation, facilitate a discussion about their designed system, and ask for the
other students best/worst elements.
After all of the groups have gone, lead a facilitated discussion about the activity, flipcharting important points.
Students will list, understand and use the basic elements of in intelligence system.
Students will be designing and implementing several basic intelligence systems while
prioritizing specific design elements.
Students will critically think about positives and negatives of other peoples intelligence
systems.
Resources Needed:
-

Flash-drive with back-up file for the Competitive Telephone PowerPoint presentation file
One printed version of the two-page document entitled Element-driven Systems Design
Notecards (for instructor use only).
Table of Contents
PG. 70

Owen Berger
Time Required:
50 minutes.
Table of Contents
PG. 71

Module II Real-time Intelligence Systems: Design and Implementation
Intelligence Systems: Basic Elements
Purpose
Nodes/Data Points/Relays
Accuracy
Message Contents/Details (WITM)
Security
Economy
Speed
Spread (Breadth)
Medium/Method
Vetting/Validation
Other:_______________________

Element-driven Systems Design Notecards

(For instructor use only)
Instructions Please print out the following notecards and mark the back with the
appropriate number, as indicated on the notecard. For example, if the front of the notecard
says Message #1, write a large #1 on the back of the notecard. Note, Message #1 and #2 are
the same for all groups, and are repeated five times, the next page contains Message #3, which
will consist of one different message for each group, so it is not repeated.
Messages #1 and #2 below will be given to every group
Message #1
Message #2
There appears to be a major assault starting

downtown, and there have been reported
shootings in three different areas. Enact
protocol 1911 as soon as possible.
All personnel must turn in their POSTcertification hours by midnight tonight or they
will be de-certified as law enforcement officers.
Message #1
Message #2

Message #1
Message #2

Message #1
Message #2

Message #1
Message #2


One of the distinct messages below, Message #3 will be given to every group.
Message #3, Group #1

Major crimes just received information that
someone was going to attempt to shoot
down a helicopter from stations one through
five like Mark Wahlberg in the movie the
Shooter.
Stations #1 through #5 have been
contaminated with the Ebola virus due to a
group of arrestees from Liberia. Please
enact quarantine and containment
protocols.
I.A. Investigator Jones, Officer Chester was
just found with child pornography on his
personal computer, which he was also using
here at work. Please start your investigation
immediately.
Hey everyone, dont forget that there is a
BBQ fundraiser today at 1000 for one of our
officers with leukemia. Please be there, $10
per plate.

Officer Smith, your wife has gone into labor.

Owen Berger
Evaluated Activity #1 Design an Intelligence System

Purpose:
To have successfully design and present a custom intelligence system.
Description:

Ensure every student has a printed copy of the Intelligence Systems Grading Rubric
Systems Design Component.
Evaluated Activity Design an
Intelligence System ->
During the activity

PowerPoint presentation, Discuss
and Choose ->
with their idea, talking with specific tables or students if they need help, this should take
about five minutes.
PowerPoint presentation, Design
Away ->
Table of Contents
PG. 75

Owen Berger
Give the students time to read the slide, then ask if there are any questions. Tell the
students they have until the end of the hour to come up with their presentations, and to
take breaks as needed. Presentations will start immediately after the design period.
Leave the Design Away slide up during this period.
Walk around and ensure you are paying attention to students conversations for the
necessary check-list items on the grading rubric.

Presentations ->
Let every group give their presentation, with a good facilitated discussion about that
groups work after every group has gone. With six minutes per presentation and several
minutes of discussion after each presentation, this section should take about an hour.
and Overview ->
Lead a facilitated discussion about the group presentations, and re-cover important
material while emphasizing interesting or surprising outcomes from the activity, design
process, and presentations.
Learning Objective:
The students will create an intelligence system while working in small groups with Internet
access and a time-limit of 60 minutes for preparation and 6 minutes for presentation, and must
score a three (3) or higher on each category of the Systems Design Component of the
Intelligence Systems Rubric.
Table of Contents
PG. 76

Owen Berger
Resources Needed:
Flash-drive with back-up file for the Intelligence Systems PowerPoint presentation file
(1) Intelligence Systems Rubric Systems Design Component handout per student
One printed version of the two-page document entitled Element-driven Systems Design
Notecards (for instructor use only).
Time Required:
120 minutes.
Table of Contents
PG. 77

Owen Berger
Note The pages below consist of a modified view of the Intelligence Systems Grading Rubric
Systems Design Component. The full version (better for printing) can be downloaded from the
link below (in Word format or PDF format):
https://www.dropbox.com/sh/cak9000jwkjvbrl/AACdOSS15-gTalvgaqrMg3M3a
Intelligence Systems Grading Rubric Systems Design Component

evaluated activity section of Module II Real-time Intelligence Systems: Design and
Implementation. The final score is a pass/fail rating, where each group must score a 3 or
higher on ALL categories to pass. A 1 in any category is an automatic fail and requires
remediation.
Student:
Evaluator:
Date:
Table of Contents
PG. 78

Owen Berger
Category Lawful Design

1-Not
acceptable
Students did
not
demonstrate
understanding
of the legal and
liability issues
surrounding
intelligence
systems design.
Students did
not discuss the
constitutionalit
y or lawful
consequences
of their
intelligence
system during
the
development/pl
anning phase.
Additionally,
students did
not mention a
pertinent legal
issue during the
group
presentation.
2-Not acceptable
4-Outstanding
3-Competent
Students did not
Students
demonstrate
demonstrated
understanding of
the legal and liability legal and liability
issues surrounding
issues surrounding
intelligence systems intelligence systems
design. Students
design. Students
openly discussed
openly discussed
once the
more than once the
lawful consequences lawful consequences
of their intelligence of their intelligence
system during the
system during the
development/planni development/plannin
ng phase. Their
g phase. Their
discussions
included, but
but werent limited
werent limited to,
to, current case law,
current case law,
data sharing, storage
data sharing,
and retention, or
storage and
constitutional
retention, or
amendment issues.
constitutional
Additionally,
amendment issues. students mentioned
Additionally,
at least one
students mentioned pertinent legal issue
one pertinent legal
during the group
issue during the
presentation.
group presentation.
Score
Students
demonstrated
understanding of
the legal and liability
issues surrounding
intelligence systems
design. Students
openly discussed
more than twice the
lawful consequences
of their intelligence
system during the
development/planni
ng phase. Their
but werent limited
data sharing,
storage and
retention, or
constitutional
amendment issues.
Additionally,
students mentioned
at least two
pertinent legal
issues during the
group presentation.
Comments:
Table of Contents
PG. 79

Owen Berger
1-Not
acceptable
The studentcreated system
does not have a
clear purpose
that is explicitly
defined or
explained in the
final
presentation.
The purpose
does not match
the end-result
system. The
correlation
between the
purpose and the
systems main
elements are
not mentioned
during the
presentation.
Category Purposed
2-Not acceptable
3-Competent
The studentThe student-created
created system
system has a clear
has a clear
purpose that is
purpose that is
explicitly defined or
mentioned in the explained in the final
final presentation presentation at least
at least once.
once. The purpose
The purpose
matches or aligns with
matches or aligns the end-result system,
with parts of the meaning the students
end-result
did not state the
system, The
purpose and then
correlation
create a system that
between the
solves a different
purpose and the
problem or addresses
systems main
a separate issue. The
elements are
correlation between
mentioned once
the purpose and the
during the
systems main
presentation.
elements are
mentioned at least
once during the
presentation.
4-Outstanding
Score
The student-created
system has a clear
purpose that is
explicitly defined or
explained in the final
presentation more
than once. The
purpose matches or
aligns with the endresult system,
meaning the
students did not
state the purpose
and then create a
system that solves a
different problem or
addresses a separate
issue. The
correlation between
the purpose and the
systems main
elements are
mentioned more
than once during the
presentation.
Comments:
Table of Contents
PG. 80

Owen Berger
1-Not acceptable
Students did not
speak openly
about the
constraints and
hurdles that their
system would
confront in the
real world.
Students did not
articulate such a
constraint, nor
any strategies to
mitigate such a
constraint.
Category Dealing with Constraints and Hurdles

2-Not acceptable
3-Competent
4-Outstanding
Students spoke
Students spoke
Students spoke
openly about the
openly about the
openly about the
constraints and
constraints and
constraints and
hurdles that their
hurdles that their
hurdles that their
system would
system would
system would
confront in the real confront in the real confront in the real
world. Students
world. Students
world. Students
articulated one
articulated more
articulated more
such constraint, as than one such
than two such
well as matching
constraint, as well
constraint, as well
strategies to
as matching
as matching
mitigate those
strategies to
strategies to
constraints.
mitigate those
mitigate those
constraints.
constraints.
Score
Comments:
Table of Contents
PG. 81

Owen Berger
1-Not acceptable
The students
system was not
well-thought out
and organized
meaning the
elements of the
system were not
arranged or
presented in a
particular order,
either
chronologically or
conceptually. The
system was
constructed
without apparent
real-world use in
mind, and the
group presented
zero real-world
scenarios where
their system
could be used.
Category System Flow/Organization

2-Not acceptable
3-Competent
4-Outstanding
Score
The students
The students
The students system
system was
system was wellwas well-thought out
presented in
thought out and
and organized
order, either
organized
meaning the
chronologically or meaning the
elements of the
conceptually. The elements of the
system were
system was
system were
arranged and
constructed with
arranged and
presented in order,
real-world use in
presented in order,
either
mind, and the
either
chronologically or
group presented
chronologically or
conceptually. The
one real-world
conceptually. The
system was
scenario where
system was
constructed with
their system could constructed with
real-world use in
be used. The
real-world use in
mind, and the group
systems
mind, and the group presented more
organization
presented at least
than two real-world
matched the
two real-world
scenarios where
stated purpose,
scenarios where
their system could
and had clearly
their system could
be used. The
defined starting
be used. The
systems
points and ending systems
organization
points for
organization
matched the stated
intelligence and
matched the stated purpose, and had
information.
purpose, and had
clearly defined
clearly defined
starting points and
starting points and
ending points for
ending points for
intelligence and
intelligence and
information.
information.
Comments:
Table of Contents
PG. 82

Owen Berger
1-Not acceptable
The system
addressed one or
less of the system
elements that
were presented
during the course.
Category System Elements

2-Not acceptable
3-Competent
The system
The system
addressed at least addressed at least
two of the system three of the system
elements that
elements that were
were presented
presented during
during the course. the course.
4-Outstanding
The system
addressed at least
four of the system
elements that were
presented during
the course.
Score
Comments:
Table of Contents
PG. 83

Owen Berger
1-Not acceptable
Students were not
able to clearly
communicate their
system to the rest
of the class.
Students conveyed
less than half of the
primary
elements/aspects
of their system,
including starting
and ending points.
Additionally, only
one or two group
members
participated in the
presentation by
either speaking or
directly supporting
the speakers during
the presentation.
2-Not acceptable
3-Competent
Students were able Students were able
to clearly
to clearly
communicate their communicate their
system to the rest
system to the rest
of the class.
of the class.
Students conveyed Students conveyed
at least half of the
all but one or two
primary
of the primary
elements/aspects
elements/aspects
of their system,
of their system,
including starting
including starting
and ending points.
and ending points.
Additionally, most
Additionally, every
group members
group member
participated in the
participated in the
presentation by
presentation by
either speaking or
either speaking or
directly supporting directly supporting
the speakers during the speakers during
the presentation.
the presentation.
4-Outstanding
Score
Students were
able to clearly
communicate
their system to
the rest of the
class. Students
conveyed every
primary
element/aspect
of their system,
including starting
and ending
points.
Additionally,
every group
member
participated in
the presentation
by either speaking
or directly
supporting the
speakers during
the presentation.
Comments:
Table of Contents
PG. 84

Owen Berger

1-Not acceptable
2-Not acceptable
3-Competent
The presentation was The presentation
The presentation
more than 45 seconds was within 45
was within 30
less than or more
seconds of 6
seconds of 6
than 6 minutes in
minutes in length,
minutes in length,
length, and one or
and most of the
and the entire
two group students
group participated
group participated
participated in
in presenting.
in presenting.
presenting.
Comments:
4-Outstanding
The
presentation
was within 20
seconds of 6
minutes in
length
Score
score.
Table of Contents
PG. 85

Owen Berger
Module III Real-time Intelligence Systems: Policy Development

Module Goal: To teach students how to develop policies for gathering and disseminating
intelligence from Social Media and the Internet
Learning Objective: The students will develop Social Media policy while working in small
groups with Internet access and a time-limit of 60 minutes for preparation and 6 minutes for
presentation, and must score a three (3) or higher on each category of the Policy Component of
the Intelligence Systems Rubric.
Resources Needed:
(1) Intelligence Systems Rubric Policy Component handout per student.
(1) Copy of the handout entitled Critical Thinking Standards and Elements for each
student.
Table of Contents
PG. 86

Owen Berger
Module Summary:
This module is going to start out with an active legal research and arguments section, then
will move on to a facilitated discussion about general policy purpose with related in-depth
questions. The students will then examine policy by switching roles, violating policy, and
then coming up with ways to curb certain behaviors with policy elements and critical
thinking. The last part of this module is an evaluated activity where students will develop a
policy governing the intelligence system they created earlier in the class, and then present
that policy. The presentations will be graded according to the policy rubric.
Outline
III. Social Media and Intelligence Policy
A. Policy and the Law [1] [1a] [1b]
1. Current case law
a. Konop v Hawaiian
1) About
a) Konop made private website
(1) Restricted access to only
other pilots
(2) Blogged about union and
employer
(3) Critical of both union and
employer
b) Airlines president used, with
permission, other pilots
logins
(1) Spoke with current union
head
(2) Current union head
called and threated
Konop with lawsuit
c) Konop sued for violations of
(1) Wiretap act
(2) Railway Act
(3) Stored Communications
Act
d) Ultimately there was
suppression of union activity
Instructor Notes
[1] Activity Learning Activity #1, Legal
Research and Arguments. Students will
research given case law, and then argue
points on that case law after being
assigned to a specific side of the case.
The last part will include each table
coming up with their own case law.
[1a] Facilitate Facilitate a discussion,
about each case, and why it is
important to stay current on case law.
[1b] Ask
What are some of the legal issues
surrounding cyber-monitoring?
a. Have those issues affected your
daily duties in the past?
b. How could those issues affect
your daily duties in the future?
What is some of the current case
law regarding cyber-monitoring?
a. Do you agree with the courts
decisions? Why?
b. How will these legal decisions
impact your job?
Table of Contents
PG. 87

Owen Berger
2) Legally view a website - Roles

a) User
b) Administrator
c) Law enforcement
3) Definition of User
a) Login or open access
b) Terms of Service
(1) Authenticating the
agreement
specific items
c) Determining the actual
person
(1) Gleaning importance
(2) Invitation vs presubscribed
(3) Intentional recipient vs
open subscription
a) Interception vs Reception vs
Storage/Retrieval
b) Direct sending
d) Actively transmitting vs
retrieval from storage
2) Two-prong tests
a) Determine who you are
speaking as
(1) Employee
(a) Statements for work
purposes
(e) Using work resources
(f) Work Equipment
(g) Work supplies
(h) Work Technology
c. Which one impacts your specific

assignment the most? Why?
What are the legal considerations
when writing a policy on Social
Media?
What are the main legal cases that
could impact Social Media policy?
How would you address those cases
in your policy?
Table of Contents
PG. 88

Owen Berger
(2) Citizen
(a) On off-time (off-
duty)
(b) Using
private/personal
equipment
(2) Normal situation arising
out of work
(3) Right to know / Need to
know
3) Punishment and Retaliation
a) Government has to function
b) Did the action impair that
function
(1) Effect on the employees
ability to continue
working
(2) Effect on employers
mandate or reputation
c) Punishment/retaliation
(1) Warranted
(2) Proportional
(3) Unusual
1) Cromer arrested John Michael
Montgomery
a) DUI Arrest
(1) Popular
Country/Western singer
(2) Lawful arrest
(3) Led to misdemeanor
plea-bargain
b) Posts on Myspace
(1) Posts and comments by
Cromer
(2) Posts and comments by
Myspace friends
c) Punishments
Table of Contents
PG. 89

Owen Berger
(1) Cromer put on leave

(2) Cromer
dismissed/terminated
a) On-duty
(1) Acting as representative
of your organization
(2) Must abide by all
policies/procedures
(3) Can identify as law
enforcement
(4) Can hide identity for
certain operations
b) Off-duty
(1) Should not identify as
law enforcement
(2) Can behavior
(a) Affect your ability to
work
(b) Affect your
employers ability to
function
(c) Affect reputation of
you or your employer
3) Termination for off-duty
behavior
a) It is possible
b) It is legal
c) Never identify yourself as
law enforcement
(1) Use whistleblower
protections if needed
(2) Use the proper channels
for reporting misconduct
1) Setting: Occupy Wall Street
2011-2012
a) @destructuremal (Malcolm
Harris)
Table of Contents
PG. 90

Owen Berger
b) Assisted with organizing
move to protest on bridge

c) Assembly was declared
unlawful
d) Several arrested for civil
disturbance, including Harris
2) NY District Attorney used tweets
from @destructuremal to
prosecute
a) Wrote search warrant to
Twitter
b) Harris opposed as a third
party
c) Twitter withheld warrant
until judgment was given
d) Judge ruled in favor of NY
DA, with time limits.
(1) Valid search warrant
with probable cause was
used
(b) Twitters Terms of
Service specifically
stated
i. All content sent
to or via Twitter
belongs to
Twitter
ii. They can give
information with
valid L.E. request
(3) Search warrant is
necessary for info within
last 180 days.
e) Twitter gave warrant return
back to NY DA.
3) Lessons
a) Valid search warrants usually
trump other considerations
Table of Contents
PG. 91

Owen Berger
(1) Warrant scope

(a) Limited to only what
is necessary
(b) No overreach
i. Information-wise,
and
ii. Time-wise
(d) Specific and related,
no fishing
expeditions.
(2) Probably cause
(a) Good PC can
articulate the level of
information needed
(b) Dont ask for it if you
shouldnt get it.
(c) Traverse and quash
will eliminate all
information from
warrant
b) Terms of Service
e. U.S. v Meregildo
1) Suspect Melvin Colon was
involved in racketeering case
a) Sent evidence to Facebook
friend, which indicated guilt.
b) Colon opposed the evidence
(1) Stated info was meant to
be private
(2) Was confidential
(3) Sent to Facebook friend
only
c) Facebook friend was a
Confidential Information
2) Ruling found in favor of law
enforcement
a) Communications were
intended as private
Table of Contents
PG. 92

Owen Berger
b) However, after sending
information
(1) Recipient is free to do
with information as they
please
(2) Social Medias
expectation of privacy is
narrowing
(3) How do you know who
you are sending
information to?
3) Projection/amplification of
Social Media
a) Sharing in one method can
become several methods
(1) Linked accounts
(2) Using same e-mail as
base account
b) Private accounts can link to
non-private accounts.
c) Law enforcement should
look at all avenues and
accounts
2. Other legal considerations
1) Definition
2) Detrimental to law enforcement
a) Preventing overreach can
become limiting to law
enforcement
b) Public distrust becomes
tangible
c) Information sources dry up
d) Public accounts become
private
b. Law and ethics
1) Law vs ethics
2) Ethical behavior online
3) Sorry, but here it is, Netizen
Table of Contents
PG. 93

Owen Berger
4) The other persons shoes
thing
a) Private citizen
b) Criminal
c) Law enforcement
c. What other laws govern the same
behavior
1) Confidential informants
2) Privacy laws
3) On-duty vs off-duty snooping
B. Policy Purpose [2] [2a]
1. Defining a purpose (Why?)
a. To correct a deficiency
1) Worthy of written policy
2) Methods to correct this
deficiency
a) Training
(1) In-service
(2) Academy
(3) Online/Portal training
(4) Outside training if few
enough personnel
(5) Outside training with
train-the-trainer
section
b) Background screening
c) Case law
d) New Laws
(1) Federal
(2) State
(3) Local
b. Guidelines for new technology
1) Technology/issue requiring
guidelines
a) More training
b) Liability issues surrounding
technology
c) Impact of technology on
(1) Citizens
[2] Facilitate Facilitate a deep

discussion on what it means to define
the purpose of a policy.
[2a] Ask
What are some concerns we should
have when designing an intelligence
system policy? Where are those
concerns on a scale of major to
minor?
What are some of the types or
examples of policy used today?
How would you rate the success of
those policies? Please articulate
why you gave that rating.
What is the best way to organize
law enforcement policy in general?
Why?
In your current position, what
activities are governed by a policy?
Of those activities that are not
governed by policy, which should or
should not be, why or why not?
Table of Contents
PG. 94

Owen Berger
(2) Criminals
(3) Law enforcement
2) Technology policy coverage
under different and existing

policy
a) Use of force examples
(1) Taser
(2) Baton
(3) Bean bag shotgun
(4) CRCH
b) Media relations policy
c) Undercover/plainclothes
policy
c. Guidelines for new issues
1) Requiring guidelines
2) Applicable under different and
existing policy
3) Circumstances under which this
issue arose
4) New laws to address this issue
a) Federal
b) State
c) Local (Municipal)
d. Prevent possible future
lawsuits/legal action
1) Ramifications with and without
policy
2) Policy that hinders law
enforcement
3) Safety issues/concerns
e. Prevent abuse by law enforcement
1) Bad cop v deficiency in policy
2) Reactive case law
3) Cops are their own worst
enemies
2. Defining a purpose
a. Write it down
1) On paper
2) During planning
3) In the actual policy
Table of Contents
PG. 95

Owen Berger
b. Is it
1) Narrow
2) Specific
3) Necessary
c. Utilize the elements of Critical
Thinking:
a) Clarity
b) Accuracy
c) Precision
d) Relevance
e) Depth
f) Breadth
g) Logic
h) Fairness
a) Purpose/Goal/End
b) Question at issue/Problem
to be solved
c) Assumptions
d) Point of View/Frame of
reference
d. Articulation
1) Proper English
2) Organized
3) On-target
C. Social Media and Internet Policy Elements
[3] [3a]
1. Purpose, Purpose, Purpose
a. Criminal Activity
b. Gather Intelligence/Information
c. Consistent with
1) Mandate
a) Agency
b) Division/Bureau
[3] Learning Activity Learning Activity

#2, Policy Element Creation and Critical
Thinking. Students are going to create
a basic policy, and then come up with
ways to violate their partners policy.
They will then come up with policy
element to curb the offending behavior
and align those elements with aspects
of critical thinking.
Table of Contents
PG. 96

Owen Berger
c) Unit
2) Authority
a) Agency
b) Division/Bureau
c) Unit
[3a] Ask
Of your duties, which could be
abused the most by an unethical or
immoral employee?
2. Duty categories
What are the best ways to guard
a. Apparent/overt
against abuse of power by law
1) No concealing
enforcement, and how could you
2) Privy to public
improve upon them?
3) Identity is known
What are some recent examples of
b. Discreet
police misconduct and how could
1) Knowledge could hamper
policy have prevented them?
investigation
How could law enforcement abuse
2) Covering tracks
intelligence-gathering with Social
3) Not giving identity
Media?
c. Covert
How can policy help to curb abuse
1) True identity cannot be revealed
or misuse of intelligence-gathering
2) Contact between law
with Social Media?
enforcement and target
At what point does policy hinder
3) False personas
instead of help and protect? What
d. Supervisor oversight increases up
times have you seen policy
the scale
overreach in your own experience?
3. Information vetting/validation
How would you prevent policy
a. Different than traditional methods
overreach if you were writing a
1) Often cannot be:
policy?
a) Verified
Do different types of information
b) Validated
require different handling? What
c) Corroborated
are those different types and please
2) Is reaction
specify the handling for each type?
a) Necessary
How would Social Media or Internet
b) Mandatory
policy differ from other types of
c) Lawful
policy, say Use of Force policy?
b. Types of vetting
What are the different perspectives
1) Respond to or question source
that should be considered when
2) Multiple sources
writing Social Media policy? Of
3) Radio call example
those perspectives which are the
4) Target/user
most/least important? Why?
a) Tone
Who should be responsible for
b) History
writing policy on intelligencec) Other accounts
gathering? Why?
Table of Contents
PG. 97

Owen Berger
c. Necessity
1) Validation
2) Demonstrations
3) Officer Threats
4) Public Threats
4. Tools and technologies

a. New source of information
b. Covered by other policies
c. Time frame of use
d. Purpose
e. Authorization
f. Approval
g. Tracking
1) Formal
2) Informal
3) Case notes
4) Discoverability
h. Automation
1) Could expand use beyond
Who would be best suited to writing

policy on intelligence-gathering?
Why?
Who should be asked to have input
when writing policy on intelligencegathering? Why?
What elements should be in every
intelligence-related policy? Which
elements are most important to
your duties, and why?
What is the purpose of this policy?
How does policy stand up to
scrutiny using the intellectual
standards of critical thinking?
Can you analyze your policys
purpose using the elements of
reasoning? What viewpoint were
you using? Why?
purpose
2) Could inadvertently expose
monitoring
3) Over-reliance
5. Information Storage and
Documentation
a. 28 CFR Part 23
1) Policy guidelines for federally
funded intelligence systems
2) Nexus to criminal activity
3) Belief that ones conduct may
be criminal
b. Minimum amount of time possible
c. Secure storage and distribution
1) Attention Gmail users
2) Encryption
3) HTTPS
4) Law enforcement networks
(monitored by civilians)
d. Rules of evidence apply
Table of Contents
PG. 98

Owen Berger
6. Use of resources is within all laws and
guidelines
a. Federal
b. State
c. Local
d. Laws
e. Regulations
f. Policy
g. Guidelines
7. Off-duty considerations
a. Off-duty conduct
1) Personal Social Media for work
2) Personal Social Media affecting
work
3) If related at all to work, should
be covered under same policy
b. Off-duty conduct under on-duty
policy
c. Employees personal Social Media
1) Illegal to mandate viewing in CA
for backgrounds
2) Circumstances that allow for
employee snooping
a) Workers compensation
claims
b) Alcohol/Drug abuse claims
3) Termination or firing
a) Cromer vs Lexington
b) Complete and utter
separation of concerns
8. Information or Intelligence
Dissemination
a. Encryption
b. HTTPS
c. Cold Computers
d. Department e-mail
e. Civilian Oversight
f. Content being sent
g. System in place
[4] Activity Evaluated Activity #1,

Policy Development. Students are
going to create a policy for the
intelligence system they designed in
Module II.
Table of Contents
PG. 99

Owen Berger
Learning Activity #1 Legal Research and Arguments

Purpose:
To have students think about current case law from different perspectives.
Description:
Preview
Students will have five minutes to research a given case, and then they will stand across
from another student and argue a side to the case given certain questions that will be shown on
the projector screen. There will be no talking allowed during the information gathering section
of each segment. Lastly, students will come up with a case on their own, research it, and
explain it quickly to their group.

Legal Research and Arguments ->
During the activity

Explain to the students that they will be researching some current case law. Let them
know that during the research portion of each case, there will be no talking aloud. Have
everyone in the room count, from one person to the next, as either a 1 or a 2,
effectively dividing the room into two groups.
NOTE There is a matching process for each of the four cases in this exercise. The cases
are as follows:
o Cromer v Lexington
o Garcetti v Ceballos
o New York v Harris
o United States v Meregildo
The following list is an example process/run-through for each case, starting with Cromer
v Lexington. All of the slides are in order, so just follow the instructions on the slides if
need be, from the PowerPoint presentation entitled Legal Research and Arguments.
Table of Contents
PG. 100

Owen Berger
Process for each case:

o Pull of the second slide of the PowerPoint presentation, Cromer v Lexington.
o Allow the students five minutes to research the case.
o Pull up the next slide, Cromer v Lexington, Instructions.
o After the students have found their partner for this case, pull up the next slide,
Cromer v Lexington, Question #1.
o Give the students approximately 1-2 minutes of discussion for each question on
Cromer v Lexington, Questions No. 1 through No. 3.
o Next, pull up the first slide for Garcetti v Ceballos, repeat the process for each
case:
Start with Cromer v Lexington, then
Garcetti vs Ceballos, then
New York v Harris, then
United States v Meregildo
NOTE This process will be repeated for each of the four cases listed above. Each
case should take about ten minutes to complete.
Once you have finished with all four

cases, ending with U.S. v Meregildo
(Melvin Colon), you can pull up the
slide entitled Individual Research ->
Ask the students if there are any questions, and give them five minutes to work.
PowerPoint presentation, Group
Discussion ->
Give the students one minute each to present their chosen cases.
Facilitate a discussion, highlighting any cases that were duplicated or could have a
considerate impact on cyber-monitoring by law enforcement.
Table of Contents
PG. 101

Owen Berger
Students will have researched several notable cases that affect law enforcements use
of Social Media and the Internet.
Students will have thought about current case law from several different perspectives.
Students will be able to rapidly find case law and summarize the aspects of that law that
are pertinent to law enforcement.
Resources Needed:
-
(1) Flip-chart for each group/table.
(5) Markers per group/table.
Flash-drive with back-up file for the PowerPoint presentation file entitled Learning
Activity 1 Legal Research and Arguments.
Time Required:
Approximately 50 minutes
Table of Contents
PG. 102

Owen Berger
Learning Activity No. 2 Policy Element Creation and Critical Thinking

Purpose:
To create a list of basic policy elements utilizing critical thinking.
Description:
Preview
The students will create a hand-written policy for child pornography investigations. The
students will then trade policies with a partner and attempt to figure out how to get around the
policy to conduct deviant activity. They will do this by role-playing as a deviant officer who has
transferred into the unit to obtain child pornography in order to sell it. Lastly, students will
identify how to curb the deviant behavior using parts of the critical thinking process.

Bring up the PowerPoint
presentation Policy Element
Exercise on the projector screen ->
During the activity

Ask all of the students, verbally, to close their laptops and turn off their tablets. Explain
that they will not need to do any searching during the next exercise. (Note this activity
involves creating policy for child pornography investigations, and it would be a bad idea
for any student to type in child pornography on their computer or tablet).
PowerPoint presentation, Create A
Policy ->
Table of Contents
PG. 103

Owen Berger
Allow the students to read the slide, ask if there are any questions, and then give them
time to work, usually 10 to 15 minutes or until the students start to have unrelated
conversations.
PowerPoint presentation, Trade
Policies, Then be a Deviant ->
time to work, usually five to ten minutes (5-10) or until the students start to have
unrelated conversations.
PowerPoint presentation, Develop
Policy Elements with Critical
Thinking ->
time to work, usually 15 to 20 minutes or until the students start to have unrelated
conversations.
Facilitate a class conversation and ask each group (pair) for a quick summary of their
experience, making sure they elaborate on their created policy elements. As the
students come up with or share their elements, write them on a flip-chart at the front of
the classroom in large writing.
Summarize the activity, the reasons for it, and the developed policy elements that were
written on the instructors flip-chart.
This activity helps students understand why policy is written.

The students will create/develop key policy elements that can be applied to any policy.
Students will understand the correlation between behavior and policy utilizing critical
thinking.
Table of Contents
PG. 104

Owen Berger
Resources Needed:
-
Flash-drive with back-up file for the PowerPoint presentation file entitled Learning
Activity 2 Policy Element Creation and Critical Thinking.
student.
Time Required:
Approximately 45 minutes to one hour
Table of Contents
PG. 105

Clarity
Purpose
(goal, objective)
Question at issue
(problem, issue)
Elements of Thought
Information
(data, facts,
observations,
experiences)
Interpretation and
Inference
(conclusions,
solutions)
Concepts
(theories,
laws, principles,
models)
Assumptions
(presupposition,
taking for granted)
Implications and
Consequences
Point of View
perspective,
orientation)
Accuracy
Precision
Relevance
Depth
Breadth
Logic
Significance
Fairness

Owen Berger
Evaluated Activity No. 1 Policy Development

Purpose:
To have students develop policy for a custom intelligence system of their own making
(completed in Module II).
Description:
Preview
Working in their assigned groups, students are going to develop a formal policy for an
aspect of the intelligence system they created in Module II. The students are then going to
present their policy to the rest of the class, and be evaluated by the Intelligence Systems
Grading Rubric Policy Component.

Ensure every student has a printed copy of the Intelligence Systems Grading Rubric
Policy Component.
Policy Development ->
During the activity

Evaluated Activity Develop Policy >
with their ideas, talking with specific tables or students if they need help, this should
take about five minutes.
Table of Contents
PG. 107

Owen Berger

PowerPoint presentation, Develop
Away ->
Give the students time to read the slide, then ask if there are any questions. Tell the
students they have until the end of the hour to come up with their presentations, and to
take breaks as needed. Presentations will start immediately after the development
period. Leave the Develop Away slide up during this period.
Walk around and ensure you are paying attention to students conversations for the
necessary check-list items on the grading rubric.
Presentations ->
Let every group give their presentation, with a good facilitated discussion about that
groups work after every group has gone. With six minutes per presentation and several
minutes of discussion after each presentation, this section should take about an hour.
and Overview ->
Lead a facilitated discussion about the group presentations, and re-cover important
material while emphasizing interesting or surprising outcomes from the activity,
development process, and presentations.
Learning Objective:
The students will develop Social Media policy while working in small groups with Internet
access and a time-limit of 60 minutes for preparation and 6 minutes for presentation, and must
Table of Contents
PG. 108

Owen Berger
score a three (3) or higher on each category of the Policy Component of the Intelligence
Systems Rubric.
Resources Needed:
Flash-drive with back-up file for the Evaluated Activity 1 Policy Development
PowerPoint presentation file
(1) Intelligence Systems Rubric Policy Component handout per student
Time Required:
120 minutes.
Table of Contents
PG. 109

Owen Berger
Note This is only a view of the Intelligence Systems Grading Rubric Policy Component. The
full version (better for printing) can be downloaded here (in Word format or PDF format):
https://www.dropbox.com/sh/m5v050k2ggc8fpg/AAAKKBiPx2YHsObFlQpIrDnSa
Intelligence Systems Grading Rubric Policy Component

evaluated activity section of Module III Real-time Intelligence Systems: Policy Development.
The final score is a pass/fail rating, where each group must score a 3 or higher on ALL
categories to pass. A 1 in any category is an automatic fail and requires remediation.
Student:
Evaluator:
Date:
1-Not acceptable
Students did not
demonstrate
understanding of
the legal
ramifications of
Social Media
policy. Students
did not openly
discuss the
constitutionality
or lawful
consequences of
the policy they
developed.
Category Lawful Design

2-Not acceptable
3-Competent
Students
Students
demonstrated
demonstrated
some
understanding of legal ramifications of
the legal
Social Media policy.
ramifications of
Students openly
Social Media
discussed, more
policy. Students
than once, the
openly discussed, constitutionality or
at least once, the lawful consequences
constitutionality
of the policy they
or lawful
developed. Their
consequences of discussions included,
the policy they
but werent limited
developed.
data storage and
retention, and
constitutional
amendment issues.
4-Outstanding
Score
Students
demonstrated
Students openly
discussed, more than
twice, the
lawful consequences
of the policy they
developed. Their
but werent limited
data storage and
retention, and
constitutional
amendment issues.
Comments:
Table of Contents
PG. 110

Owen Berger
Category Purposed
1-Not acceptable
The studentgenerated policy does
not have a clear
purpose that is noted
in the policy. The
purpose does not
fulfill any needs that
align with concerns or
questions arising out
of the students
related intelligence
system design.
2-Not
acceptable
The
studentgenerated
policy has
at least
one
purpose
that is
noted in
the policy.
4-Outstanding
3-Competent
The studentgenerated policy has
at least one clear
purpose that is
explicitly noted in the
policy. The purpose
fulfills at least one
need that aligns with
concerns or questions
arising out of the
students related
intelligence system
design.
Score
The studentgenerated policy has

at least one clear
purpose that is
explicitly noted in the
policy. The purpose
fulfills at least two
needs that align with
concerns or questions
arising out of the
students related
intelligence system
design.
Comments:
1-Not acceptable
The students policy
was not well-thought
out and was
unorganized. The
policy was not broken
into categorical
sections based on
policy elements
taught during the
course. The studentgenerated policy
contained one or
fewer elements
taught during the
course.
Comments:
Category Organization and Elements

2-Not acceptable
3-Competent
4-Outstanding
The students
The students policy was The students policy was
policy was
well-thought out and
well-thought out and
somewhat
organized. The policy
organized. The policy was
organized. The
was broken into
broken into categorical
policy was broken
categorical sections
sections based on policy
into categorical
based on policy
elements taught during
sections based on
elements taught during the course. The studentpolicy elements
the course. The
generated policy
taught during the
student-generated
contained at least three
course. The
policy contained at least elements taught during
student-generated two elements taught
the course as well as at
policy contained at during the course as
least one studentleast two elements well as at least one
generated element.
taught during the
student-generated
course.
element.
Table of Contents
PG. 111
Score

Owen Berger
1-Not acceptable
Students were not
able to clearly
communicate their
policy to the rest of
the class. Students
in the group did not
present equally
(only one or two
presented most of
the material), and
students conveyed
only some primary
elements of their
policy.
Comments:
1-Not acceptable
more than 45
seconds less than or
more than 6 minutes
in length.
2-Not acceptable
3-Competent
Students were able Students were able
to clearly
to clearly
communicate their communicate their
policy to the rest of policy to the rest of
the class. Most of the class. Every
the students in the student in the
group presented
group presented
equally, and
equally, and
students conveyed students conveyed
all but one or two all but one or two
primary elements
primary elements
of their policy.
of their policy.

2-Not acceptable
3-Competent
The presentation
The presentation
was within 45
was within 30
seconds of 6
seconds of 6
minutes in length. minutes in length,
4-Outstanding
Score
Students were
able to clearly
communicate their
policy to the rest
of the class. Every
student in the
group presented
equally, and
students conveyed
every primary
element of their
policy.
4-Outstanding
The presentation
was within 20
seconds of 6
minutes in length.
Score
Comments:
Table of Contents
PG. 112

Owen Berger
score.
Table of Contents
PG. 113

Owen Berger
Module IV Teaching Cyber-monitoring

Module Goal: To teach students how to teach others how to gather and disseminate real-time
intelligence with Social Media and the Internet
Learning Objective: The students will teach cyber-monitoring while working in small groups
with a specified audience type and lesson subject, as well as a time-limit of 120 minutes for
preparation and 15 minutes for presentation, and must score a three (3) or higher on each
category of the Teaching Cyber-monitoring Rubric.
Resources Needed:
(1) Teaching Cyber-monitoring Grading Rubric handout per student.
student.
Five printed copies of the handout entitled Roles for Cops Notecards.
Five printed copies of the handout entitled Roles for Generations Notecards.
One copy per student of the handout/worksheet entitled Learning Characteristics of
Cops and Generations Worksheet.
Table of Contents
PG. 114

Owen Berger
One copy per student of the handout/worksheet entitled Critical Thinking and Adult
Learning Worksheet.
One printed copy of the Problem Children Notecards document.
Module Summary:
This module will build around several different activities related to adult learning and law
enforcement. First, students will assume the role of a specific subset of law enforcement,
and then explain how they learn after some research. They will research and explain a
second time, this time assuming the role of a specific generation. Next, students will
collaborate on real-life constraints/resource limitations, and then strategize on how to
overcome those obstacles. Next, students will design a short activity around critical thinking
and adult learning. Last, students will have sufficient time to create a 15 minute learning
activity, on which they will be evaluated by the grading rubric.
Outline
IV. Teaching cyber-monitoring
A. Teaching cops [1] [1a]
1. Positional
a. Types
1) Line personnel
a) Patrol
b) Specialized Units
(1) Gangs
(2) Narcotics
(3) Vice
c) Detectives/Investigators
(1) Divisional
(2) Homicide
(3) Force Investigation
(4) ICAC
(5) Terrorism
d) School Resource
e) Reserve
f) Traffic
(1) Motors
(2) Collision Inv.
Instructor Notes
[1] Activity Learning Activity 1,
Teaching Cops and Generations.
Students are going to assume the role of
a specific subset of law enforcement or a
generation, and then explain how they
learn. Students will be taking notes on a
handout. Students will also be rotating
tables in this activity to get them out of
their comfort zone.
[1a] Ask
How could the position or duty of

law enforcement effect their
learning style?
How could you plan a lesson to
incorporate that effect?
What are the categories of types of
personnel for law enforcement?
Table of Contents
PG. 115

Owen Berger
(3) Traffic Enforcement

(4) Parking Enforcement
2) Non-line Specialized Personnel
a) SWAT
b) Bomb Squad
c) Force Investigation
d) Parole
e) Probation
3) Administrative Personnel
a) Command Staff
b) Event staff
c) Audits
d) Community Relations
e) Internal Affairs
4) Civilian Personnel
a) Analysts
b) Service Representatives
c) Dispatchers
d) Reports
e) Jail
b. Strategies
1) Tactics
2) Clearing cases
3) Caseload Management
4) Crime prevention
5) Crime management
2. Duties
a. Types
1) Investigative
2) Reactive
3) Radio Calls
4) Special Orders
5) Audits
6) Community Relations
b. Strategies
1) Tailored Buy-in or WIIFM
2) Efficiency vs Accuracy
3) Strategy vs Tactical
4) Targeting
a) Criminals
a.
a. What are their respective

learning styles?
Who are the most difficult law
enforcement students? Why?
Easiest? Why?
What are some strategies for
teaching different types of law
enforcement?
a. Which strategies are the easiest
to employ?
b. The most difficult?
How does an employees current
duties affect their learning
environment or style?
What are the generations in todays
workplace?
What are their main characteristics
with regards to work, home life,
society, etc? Why?
What are their formative events?
How did those events affect that
generation? Why?
What are these generations learning
styles?
Most obvious to least obvious?
What are some strategies to adapt a
lesson to these learning styles?
How can we adapt to multiple
generations in one classroom?
a. Which generations need the
most/least attention, and why?
Table of Contents
PG. 116

Owen Berger
b) Community-oriented
B. Generational
1. Types
a. Greatest/Mature/Silent
1) 1927 1945
2) Conformists
3) Married for life
4) Readers
5) Self-sacrifice
6) Debt-free
7) Radio
8) Flight
b. Baby Boomers
1) 1946 1964
2) Revolutionaries/Hippies
3) Yuppies
4) Buy now save later
5) First TV generation
6) Active in retirement
7) More Acceptance
a) Divorce
b) Homosexuals
c. Generation X
1) 1965 1980
2) Latch-key kids
3) Individualistic
4) Entrepreneurial
5) Feel misunderstood
6) Learners
7) Explorers
8) Drugs
9) Life/Work balance
10) Tolerant
11) Weary of authority
12) Weary of societal structure
13) Weary of company
oversight/structure
d. Generation Y / Millennium
1) 1981 2000
Table of Contents
PG. 117

Owen Berger
Nurtured
Respect Authority
Lower crime rates
Academically pressured
Great expectations
Want things immediately
Unlimited access to
information
9) Teamwork, not individual
e. Generation Z / Boomlets /
Homeland
1) After 2001
2) Majority have TVs
3) Always have had computers
and cell phones
4) Eco-fatigue
5) KGOY kids growing older
younger
6) Smith vs Rodriguez
2. Formative Events
1) 1927 1945
2) Great Depression
3) WWII
4) Korean War
5) Vietnam War
6) Rise of labor unions
7) The New Deal
b. Baby Boomers
1) 1946 1964
2) Vietnam War
3) Civil Rights
4) The Cold War
5) Woodstock
6) Kennedy Assassination
c. Generation X
1) 1965 1980
2) Latch-key kids
3) Fall of Berlin wall
4) Challenger explosion
2)
3)
4)
5)
6)
7)
8)
Table of Contents
PG. 118

Owen Berger
5) PC Boom
6) MTV
7) AIDS
1) 1981 2000
2) Iraq
3) Afghanistan
4) Pakistan
5) The Internet
6) Columbine
7) 9/11
8) Oklahoma City Bombing
e. Generation Z / Boomlets /
Homeland
1) After 2001
2) 9/11
3) Facebook
4) Twitter
5) Cyberbullying
6) Texting
3. Learner Characteristics
a. Mature/Silent
1) 1927 1945
2) Loyal
3) Follows Orders
4) Structured
5) Set in their way
6) Logical
7) Appreciate Consistency
8) Read (need written materials)
b. Baby Boomers
1) 1946 1964
2) Workaholics
3) Needs Recognition
4) In to problem-solving
5) Interested in efficiency
c. Generation X
1) 1965 1980
2) Latch-key kids
3) Techno-literate
Table of Contents
PG. 119

Owen Berger
Self-starters
Individualistic
Skeptical
Dont need authority/structure
Learn by doing
1) 1981 2000
2) Goal-oriented
3) Collaborative
4) Achievement
5) Team-players
6) Require supervision
7) Sociable
8) Possible cheating problems
9) Need feedback/attention
e. Generation Z / Boomlets
1) After 2001
2) Instant information
gratification
3) Extreme technical know how
4) Will figure it out
4)
5)
6)
7)
8)
C. Constraints [2] [2a]

1. Time
a. To prepare
1) Specific Students
a) By duty
b) By generation
c) Other learner
characteristics
2) Classroom location
a) Obtaining resources
b) Changing learning activities
c) Late Students
b. Management
1) Too much material, too little
time
a) Priorities
b) End goal
c) Specific Behavior
[2] Activity Learning Activity 2,

Constraints and Resources. Students are
going to list the most common resource
issues and constraints that they face at
their jobs. They are going to prioritize
these issues, then switch tables and
strategize on how to solve another
tables issues/constraints.
[2a] Ask
What are some of the constraints of
teaching law enforcement in
general?
a. What are some strategies to
mitigate those constraints?
b. What are the most/least
common?
Table of Contents
PG. 120

Owen Berger
d) Student
(1) Priorities
(2) Goals
(3) Limitations
What are some of the constraints to

teaching technology in general?
a. What are some strategies to
mitigate those constraints?
2) Too little material, too much
b. What are the most/least
time
common?
a) Possible?
How can we fit more course material
b) Review
into less time?
c) 7 times rule
a. When have you faced this
3) Ending on time
problem, or seen someone else
a) Letting students out early
face this problem?
b) Breaks
What are some of the key resources
c) 50 Minute attention span
for teaching technical skills for law
2. Resources
enforcement?
a. Reliance on others
a. How can we ensure the
1) Ensure you have backups
availability of those resources?
2) Dont rely on presenter or hotel What are some of the constraints on
3) SPECIFY requirements in course
a course or classroom that are
flyer
presented by the students?
b. Multiple ways to conduct same
activity
1) Flip chart
2) Computer
3) Projector
4) Activity
5) Outside of classroom
c. Computer Investigations course
with no Internet
d. Preparation
1) Test everything
2) Student safety is first
3) Arrive early
4) Be prepared
5) No peeks behind the scenes
3. Student constraints
a. Disabilities
b. Desire
c. Improper materials
d. Forced to go
Table of Contents
PG. 121

Owen Berger
e. Overcoming resistance (see later
section)
f. Not prepared
g. Tired/Overworked
D. Learning Activities [3] [3a]
1. Design considerations
a. Student-centered
1) Centered on students or on
instructor expectations
2) Dynamic activity vs static
scenario
3) Student Considerations
a) Generational
b) Positional
b. Empathetic
c. Safe
1) Physical safety
a) Leaving classroom
b) Crossing major streets
c) Equipment
d) Firearms?!
e) Other weapons
f) Environment
(1) Construction
(2) Power cords
(3) Creating or building
with materials
2) Other safety
a) Emotional (Trauma, PTSD,
etc)
b) Hurt feelings
(1) Verbal boundaries
(2) Over-active
participation
(3) Relative participation
(4) Duds
d. Interesting
1) Related to subject matter
2) WIIFM
[3] Activity Learning Activity 3, Adult

Learning Critical Thinking and
Activities. The students are going to
design a short activity that forces their
table to use critical thinking while
contemplating a specific adult learning
model. Students will use a handout as a
guide to developing their activity. After
conducting their activity, students are
going to compare their expected
behavior with the result of the activity.
[3a] Ask
What are the key ideas behind
learning activities?
How could you ensure those ideas
are implemented in all of your
What important considerations are
there for learning activities? Rank
them, please.
What should the goal of a learning
activity be?
Can you have too few or too many
When have you been the subject or
teacher during such a scenario?
a. What were you thinking?
b. How could you change that
scenario today?
What is a resistant student?
a. Are you one or do you know any?
What strategies have you employed
for resistant students or co-workers?
Table of Contents
PG. 122

Owen Berger
3) Buy-in
4) Different than other activities
5) Flip-chart exhaustion
e. Appropriate
1) Student-screening
2) Self-screening
3) Role-playing
f. Realistic
2. Knowledge vs behavior
a. End goal
1) Knowledge-based
2) Behavior-based
b. Testing
1) Evaluated activities
2) Rubric Presentation
3) Prepared for evaluation/test
E. Overcoming Resistance
1. Problem Students
a. Types
1) Forced to be there
2) Outside of comfort zone
3) Other issues
a) Family
b) Work
c) Time
4) Generally resistant (e.g.
What are some strategies we could

use for resistant students?
a. Which are the most effective,
and when?
How can we prevent student
resistance?
What is critical thinkings role in
education?
How can critical thinking be applied
to any lesson?
What questions should be asked to
ensure that critical thinking is taking
place during a course?
When have you had to use critical
thinking in your assignment?
a. Most recent example?
b. Most relevant example?
How can critical thinking be
interwoven into your lessons?
a. Can you provide an example, and
what the students should be
getting out of the lesson at the
end?
generational)
5) Disrespectful
a) Blatant disrespect
b) Passive disrespect
(1) Late, late from breaks
(2) Cell phones
6) No buy-in/WIIFM
b. Options
1) Direct approach
a) Side talk
b) In front of class
2) Student
boundaries/enforcement
3) Asked to leave
Table of Contents
PG. 123

Owen Berger
2. Prevention Strategies
a. Student rules
1) Guided
2) Students become enforcers
3) Buy-in on following rules
b. Instructor expectations
1) Clear
2) Laid-out beforehand
3) Respectful
4) Realistic
c. List of classroom
rules/expectations
1) In student flyer/preparation email
2) Handout
3) PowerPoint Slide
F. Introduce Critical Thinking
1. Utilize the elements of Critical
Thinking:
a. Intellectual Standards
1) Clarity
2) Accuracy
3) Precision
4) Relevance
5) Depth
6) Breadth
7) Logic
8) Fairness
b. Elements of reasoning
1) Purpose/Goal/End
2) Question at issue/Problem to
be solved
3) Assumptions
4) Point of View/Frame of
reference
5) Facts/Data/Evidence
6) Theories/Concepts/Ideas
7) Inferences/Conclusions
8) Implications/Consequences
Table of Contents
PG. 124

Owen Berger
2. Critical thinking as applied to the
subject matter
a. Define the central focus
1) Issue
2) Point
3) Problem
4) Concern
b. Apply critical thinking
1) Intellectual standards
2) Applied with sensitivity to
3) The elements of
thought/reasoning
3. Critical Thinking in law enforcement
a. Time consideration
1) Instant reaction
2) Planning
3) Analysis
b. Used in
1) Policy-making
2) Current Duties
3) Investigations
4) Community relations
[4] Activity Evaluated Activity 1,
Learning Activities. Students are going
to use a long time (three hours) to
develop a 15 minute learning activity
about something dealing with this
course. Students will then be given a
target audience half-way through the
planning period. All groups will present
their activities with facilitated
discussions to follow.
Table of Contents
PG. 125

Owen Berger
Learning Activity No. 1 Teaching Cops and Generations

Purpose:
To have students understand learning styles for different law enforcement positions and
different generations.
Description:
Preview
Students are going to take the perspective of a specific law enforcement type, and then
explain to the other students how to teach them, and why. They are then going to do the same
thing from a generational perspective. During the explanation/presentation period, the
presenting students are going to stand up and move to a different table, in order to get
students out of their comfort zones.
Before the activity

Make sure every student has a printed copy of the handout entitled Learning
Characteristics of Cops and Generations.
Print out, and then cut (or tear), five copies of the handout entitled Roles for Cops
Notecards. Each person from a group/table should get a different notecard, but not
right now. Tables with more than five can double up. Split up each table so that they
have an even number, as there will be table rotation in this activity.
Print out, and then cut (or tear), five copies of the handout entitled Roles for
Generations Notecards. Each person from a group/table should get a different
notecard, but not right now. Tables with more than five can double up. Split up each
table so that they have an even number, as there will be table rotation in this activity.
Teaching Cops and Generations ->

Hand out the notecards from the handout entitled Roles for Cops Notecards. Each
person at each table should have a different role.
Table of Contents
PG. 126

Owen Berger

Change your Perspective (Cops) ->
students time to work, usually 10-15 minutes, depending on how much research they
are doing. Try to get unrelated conversations back on point.
Pull up the third slide, Tell us how
you learn (Patrol) ->
Give the students their 2-3 minutes, and then switch slide, have the students rotate
appropriately (as denoted on the slide). Go through each of the following after 2-3
minute increments:
o Slide 3 - Tell us how you learn (Patrol)
o Slide 4 - Tell us how you learn (Detective/Investigator)
o Slide 5 - Tell us how you learn (Admin/Civilian)
o Slide 6 - Tell us how you learn (Specialized Gang/Vice/Narcotics)
o Slide 7 - Tell us how you learn (Supervisor)
Next, pull up slide eight of the
PowerPoint, Discussion Teaching
Cops ->
Lead a facilitated discussion based off of the questions on slide eight.
Table of Contents
PG. 127

Owen Berger

Hand out the notecards from the handout entitled Roles for Generations Notecards.
Each person at each table should have a different role.
Pull up the ninth slide of the
Change your Perspective
(Generations)
->
students time to work, usually 10-15 minutes, depending on how much research they
are doing. Try to get unrelated conversations back on point.
Pull up the tenth slide, Tell us how
you learn (Greatest/Mature/Silent) >
Give the students their 2-3 minutes, and then switch slide, have the students rotate
appropriately (as denoted on the slide). Go through each of the following after 2-3
minute increments:
o Slide 10 - Tell us how you learn (Greatest/Mature/Silent)
o Slide 11 - Tell us how you learn (Baby Boomers)
o Slide 12 - Tell us how you learn (Generation X)
o Slide 13 - Tell us how you learn (Generation Y/Millennials)
o Slide 14 - Tell us how you learn (Generation Z/Boomlets/Homeland)
Next, pull up slide fifteen of the
PowerPoint, Discussion Teaching
Generations ->
Lead a facilitated discussion based off of the questions on slide fifteen.
Table of Contents
PG. 128

Owen Berger
Understanding the differences between training different jobs/position of law

enforcement.
Understanding the differences between training to different generations.
Resources Needed:
-
One copy per student of the handout/worksheet entitled Learning Characteristics of
Cops and Generations Worksheet.
Flash-drive with back-up file for the PowerPoint presentation file entitled Teaching Cops
and Generations.
Several pieces of paper, or a notepad, and a writing implement, per student.
Time Required:
60 Minutes
Table of Contents
PG. 129

Learning Characteristics of Cops and Generations Worksheet
Teaching Cops
Key Learner Characteristics
Key Learner Characteristics
Patrol Officer
Greatest/Mature/Silent
Admin or Civilian Personnel
Baby Boomers
Detective/Investigator
Generation X
Specialized (Vice, Narco, Gangs)
Generation Y/Millennials
Supervisor
Generation Z/Boomlets/Homeland

Roles for Cops Notecards (for instructor use only)
Patrol Personnel
YOU ARE A PATROL OFFICER, ASSIGNED TO

HANDLE RADIO CALLS, ETC
Detective/Investigator
YOU ARE A DETECTIVE/INVESTIGATOR, ASSIGNED

TO INVESTIGATING CASES AND FILING CASES
WITH THE DA.
Specialized Personnel
YOU ARE A SPECIALIZED OFFICER, ASSIGNED TO

HANDLE VICE, NARCOTICS, AND GANGS.
Supervisor
YOU ARE A SUPERVISOR, ASSIGNED TO MANAGE

OVERSIGHT FOR LINE PERSONNEL, E.G. TAKE
COMPLAINTS, DOCUMENT USES OF FORCE, ETC...
Administrative or Civilian Personnel
YOU ARE ADMINISTRATIVE OR CIVILIAN

PERSONNEL, ASSIGNED TO CRIME ANALYSIS,
LIMITED INVESTIGATIVE ASSISTANCE, DATA
MANAGEMENT AND ENTRY, ETC.

Roles for Generations Notecards (for instructor use only)
Greatest/Mature/Silent
BORN 1927 - 1945 (AND BEFORE)
Baby Boomers
BORN 1946 - 1964
Generation X
BORN 1965 - 1980
Generation Y / Millennial
BORN 1981 - 2000
Generation Z / Boomlets / Homeland
AFTER 2001

Owen Berger
Learning Activity No. 2 Constraints and Resources

Purpose:
To have students understand the constraints and hurdles they will face in teaching technology,
and how to overcome those hurdles.
Description:
Preview
Students are going to brainstorm on different hurdles, constraints, and resource
limitations that they will face in teaching technology. Then, they are going to rotate tables and
strategize on how to overcome or mitigate the other groups constraints. Lastly, they will
discuss the strategies that the other group came up with for their own constraints.

Pull up the first slide of the PowerPoint
presentation entitled Constraints and
Resources ->
During the activity

PowerPoint presentation, entitled
Group/Table Work ->
students time to work, approximately 15 minutes. Try hard to keep the students on track,
this is the last module.
Table of Contents
PG. 133

Owen Berger
Pull up the third slide of the PowerPoint

presentation, entitled Stand and Deliver
->
students time to work, approximately 10-15 minutes. Again, try hard to keep the students
on track.
Pull up the last slide of the PowerPoint
presentation, entitled Discussion ->
students time to discuss, approximately 10-15 minutes. Walk around and try to facilitate
discussions where you can.
Students will understand some of the basic constraints and limitations of resources in
real-world teaching, specifically with technology and cyber-monitoring.
Students will understand strategies for overcoming basic technology teaching obstacles.
Students will understand what others think about constraints, and how different law
enforcement personnel face different impediments to teaching.
Resources Needed:
-
Table of Contents
PG. 134

Owen Berger

Flash-drive with back-up file for the PowerPoint presentation file entitled Teaching Cops
and Generations.
Time Required:
50 minutes
Table of Contents
PG. 135

Owen Berger
Learning Activity No. 3 Adult Learning: Critical Thinking and Activities

Purpose:
To have students create a learning activity focused around adult learning and critical thinking.
Description:
Preview
Students are going to research and design a short learning activity using the handout
entitled Critical Thinking and Adult Learning Worksheet. They will then explain and ask their
group to perform this activity. Afterwards, they will discuss the success, or failure, of the
activity and reasons for it.
Before the activity

Make sure every student has a printed copy of the handout entitled Critical Thinking
and Adult Learning Worksheet.
Adult Learning Critical Thinking
and Activities ->
During the activity

Pull up slide two of the PowerPoint
presentation, Read and Ask ->
Allow the students to read the slide, and answer any questions.
Table of Contents
PG. 136

Owen Berger
Pull up slide three of the PowerPoint

presentation, Create an Activity ->
Allow the students to read the slide, answer any questions and then give the students
time to work, about 20-30 minutes. Ensure that all of the students are staying on task
with their worksheets, and encourage really strong learning activities, pushing or
prompting students when needed.
Pull up slide four of the PowerPoint
presentation, Conduct, Compare and
Discuss ->
Make sure each students has their three minutes, and then ask for a discussion at each
table, answering the questions on the slide. Facilitate a broader class discussion when
needed.
Repeat the above step for each student, total of 3 minutes per student at tables with
five people is about 20-25 minutes (almost the rest of the hour).
Using any time remaining, facilitate a class discussion about any good activities, and why
they were effective.
Students will research and apply at least one adult learning model/concept.
Students will understand how to engage others in critical thinking.
Students will apply task or behavior oriented training.
Resources Needed:
-
Table of Contents
PG. 137

Owen Berger

One copy per student of the handout/worksheet entitled Critical Thinking and Adult
Learning Worksheet.
One copy per student of the handout/worksheet entitled Critical Thinking Standards
and Elements.
Flash-drive with back-up file for the PowerPoint presentation file entitled Adult Learning
Critical Thinking and Activities.
Time Required:
60 Minutes
Table of Contents
PG. 138

Critical Thinking and Adult Learning Worksheet

Your goal is to create a three-minute learning activity that makes sure your students critically think
about adult learning. Your activity must force them to use at least some aspect of critical thinking in
order grasp a concept or model of adult learning. Use the steps below to come up with your activity.
The results section will be filled out last.
Step 1: Choose your targeted Adult Learning Model/Concept:
Name/Acronym
Purpose
Possible Uses
Step 2: Choose your targeted aspects of Critical Thinking:

Intellectual Standard(s)
Element(s) of Thought
Step 3: Choose your expectation(s):

Expected/desired behavior(s)
Task(s) to be completed
Step 4: Fill out your activity summary/description:
Results:
How do we know they got it?

Clarity
Purpose
(goal, objective)
Question at issue
(problem, issue)
Elements of Thought
Information
(data, facts,
observations,
experiences)
Interpretation and
Inference
(conclusions,
solutions)
Concepts
(theories,
laws, principles,
models)
Assumptions
(presupposition,
taking for granted)
Implications and
Consequences
Point of View
perspective,
orientation)
Accuracy
Precision
Relevance
Depth
Breadth
Logic
Significance
Fairness

Owen Berger
Evaluated Activity No. 1 Learning Activities

Purpose:
To have students create a learning activity based on the course, Real-time Intelligence with
Social Media, and using tools gained from Module IV, Teaching Cyber-monitoring.
Description:
Preview
Working in their assigned groups, students are going create a learning activity, the goal
of which will be to have students learn something related to the course. The activity will be
evaluated by the Teaching Cyber-monitoring Grading Rubric.

Print out one copy of the document entitled Problem Children Notecards. Cut or tear
out each one of the five notecards. Save these notecards until the free design period
later. There are more instructions on this step below.
Ensure every student has a printed copy of the Teaching Cyber-monitoring Grading
Rubric.
evaluated activity PowerPoint
presentation entitled Learning
Activities ->
During the activity

Your Assignment ->
Ask the students if there are any questions, and then let them work for the three hours,
including lunch whenever they want to take it, but they must be back and ready to go at
1400 hours.
Table of Contents
PG. 141

Owen Berger
WAIT FOR AT LEAST ONE HOUR,

and at least until there are a couple
of students from every group, then
pull up slide three of the
presentation, one more thing ->
Explain that POST has mandated the groups training for a specific subset of law
enforcement, and so that is who the groups will be teaching.
Walk around and ensure that you are checking off the needed items on the grading
rubric as they are discussed.
IMPORTANT - Choose five mature students based on your experience in the class. At
some point during this three-hour planning phase of the activity, ask those students to
have a moment. Talk with them away from the other students. Ask them to participate
as a problem student and give them the associated notecard. Ask them to please read
the notecard, and when their group is targeted, have them do what is on the
notecard. Emphasize maturity and not going overboard. Let them know that they do
not have to make a scene, and to act as a reasonable person would depending on the
instructors actions. Thank them for helping.

PowerPoint, and then shut it down,
Lets Go! ->
Allow each group to go, and facilitate a discussion afterwards about each groups
presentation, how they modified it for their target audience, dealt with the problem
student, etc
Lastly, facilitate a discussion about the exercise as a whole and thank the students for
their cooperation.
Table of Contents
PG. 142

Owen Berger
Learning Objective:
The students will teach cyber-monitoring while working in small groups with a specified
audience type and lesson subject, as well as a time-limit of 120 minutes for preparation and 15
minutes for presentation, and must score a three (3) or higher on each category of the Teaching
Cyber-monitoring Rubric.
Resources Needed:
Flash-drive with back-up file for the Evaluated Activity 1 Learning Activities PowerPoint
presentation file
(1) Teaching Cyber-monitoring Rubric handout per student
One printed copy of the Problem Children Notecards document.
Time Required:
4 hours
Table of Contents
PG. 143

Problem Children Notecards (For Instructor Use Only)

Old, crusty, gnarly, detective
YOU ARE AN OLD AND CANTANKEROUS DETECTIVE WHO IS RETIRING IN ONE

YEAR AND DOES NOT WANT TO LEARN ANYTHING AT ALL ABOUT SOCIAL
MEDIA. GROAN, BE A PEST, ETC UNTIL SPOKEN TO OR DEALT WITH BY
THE INSTRUCTORS. DONT GO OVERBOARD.
Brand-spankin new academy recruit
YOU ARE AN EVER-READY RECRUIT WHO WILL NOT STOP ASKING QUESTIONS.
PLEASE DONT STOP ASKING UNTIL SPOKEN TO OR DEALT WITH BY THE
INSTRUCTORS. DONT GO OVERBOARD.
Hi-speed Lo-drag drop-holstered SWAT/Specialized personnel.
YOU ARE A TRUE BADASS WHO KNOWS THAT COMPUTER STUFF IS FOR
GRANDMOTHERS AND INFANTS. TALK ABOUT YOURSELF AND HOW MUCH
YOU DONT NEED COMPUTERS OR THE INTERNET UNTIL SPOKEN TO OR
DEALT WITH BY THE INSTRUCTORS. DONT GO OVERBOARD.
Internal Affairs investigator
COPS ARE GUILTY, SCUM-SUCKING CRIMINAL WHO KILL, RAPE, AND STEAL
WITHOUT AN OUNCE OF COMPASSION OR MERCY. PLEASE POLITELY STEER
THE LESSON TOWARDS HOW EVIL COPS ARE. DONT GO OVERBOARD.
Dorky Internet Guru
YOU ARE A DORKY INTERNET PERSON WHO KNOWS IT ALL. PLEASE CORRECT
OR INTERRUPT THE INSTRUCTORS AT SOME POINT UNTIL THEY HAVE SPOKEN
WITH OR DEALT WITH YOU. DONT GO OVERBOARD.

Owen Berger
Note This is only a view of the Teaching Cyber-monitoring Rubric for Module IV. The full
version (better for printing) can be downloaded here (in Word format or PDF format):
Teaching Cyber-monitoring Rubric for Module IV

This rubric is designed to give guidelines on how to rate the student groups during the evaluated
activity section of Module IV Teaching Cyber-monitoring. The final score is a pass/fail rating, where
each group must score a 3 or higher on ALL categories to pass. A 1 in any category is an
automatic fail and requires remediation.
Student:
Evaluator:
Date:
1-Not
acceptable
The students
lesson did not
take into
account the
generational
learning
characteristics
of their target
audience.
Category Generational Consideration

2-Not acceptable
3-Competent
The students
lesson took into
account one or
two
generational
learning
characteristics,
but not of their
target
audience.
The students lesson

took into account the
generational learning
characteristics of their
target audience. There
was at least one specific
examples during the
students lesson that
demonstrated tailoring
of the lesson to the
target audiences
generation (or
generations).
4-Outstanding
Score
The students lesson

took into account the
generational learning
characteristics of their
target audience. There
were at least two
specific examples
during the students
lesson that
demonstrated tailoring
of the lesson to the
target audiences
generation (or
generations).
Comments:
Table of Contents
PG. 145

Owen Berger
Category Activity
1-Not
acceptable
2-Not acceptable
The students
lesson did not
contain an
activity, or the
activity was
less than one
third of the
lesson, or the
activity was
unrelated to
the subject
matter.
The students lesson

contained one activity,
and the activity lasted
for at least half of the
lesson. However, the
activity was not
directly related to the
subject matter, or did
not bring out student
knowledge, either
verbally or in the form
of work product.
4-Outstanding
Score
3-Competent
The students lesson

and the activity lasted
for at least half of the
lesson. The activity was
directly related to the
subject matter, and
brought out student
knowledge, either
verbally or in the form
of work product.
The students lesson

and the activity lasted for
at least three quarters of
the lesson. The activity
was directly related to the
subject matter, and
brought out student
knowledge, either
verbally or in the form of
work product.
Comments:
1-Not acceptable
The students lesson

did not demonstrate
an understanding of
their target audiences
positions/duties.
There were no
components or
strategies that were
tailored specifically to
the target audience
and their specified
positions/duties.
Category Positions / Duties

2-Not acceptable
3-Competent
The students lesson

did not demonstrate an
understanding of their
target audiences
positions/duties.
There were
components or
the incorrect target
audience and their
specified
positions/duties.
The students lesson

demonstrated an
target audiences
positions/duties by
incorporating at least
one components or
the target audience
and their specified
positions/duties.
4-Outstanding
The students lesson

demonstrated an
target audiences
positions/duties by
incorporating at least
two components or
the target audience
and their specified
positions/duties.
Comments:
Table of Contents
PG. 146
Score

Owen Berger
Category Constraints
1-Not
acceptable
2-Not acceptable
The
students
lesson
planning
session
included no
discussions
about
lesson
constraints.
The students lesson

planning session
included at least one
discussion about
lesson constraints.
This discussion did
not included talking
about the constraint
as well strategies to
mitigate that
constraint. Examples
of such constraints
could be time
management, difficult
target audience, etc
4-Outstanding
Score
3-Competent
The students lesson

planning session
included at least one
discussion about
lesson constraints.
This discussion
included talking
about the constraint
as well strategies to
mitigate that
constraint. Examples
of such constraints
could be time
management,
difficult target
audience, etc
The students lesson

planning session
included at least two
discussions about
lesson constraints.
This discussion, or
discussions, included
talking about the
constraint as well
strategies to mitigate
that constraint.
Examples of such
constraints could be
time management,
difficult target
audience, etc
Comments:
Table of Contents
PG. 147

Owen Berger
1-Not acceptable
If applicable, the
group did not
demonstrate
the ability to
overcome
resistant
students. The
group did not
consider this
resistance
beforehand.
Additionally the
students
strategy, or lack
thereof, to
overcome
resistance was
not successful,
and distracted
from the lesson
for more than
one minute.
Category Overcoming Resistance

2-Not acceptable
3-Competent
If applicable, the
group demonstrated
the ability to
overcome resistant
students. Either the
group considered
this resistance
beforehand at least
once and developed
strategies
accordingly, or were
able to do so on
the fly during the
lesson. Whether
developed prior to
or during the lesson,
the students
strategy to
overcome resistance
was successful, but
took more than one
minute of extra
time to deal with.
If applicable, the
group demonstrated
the ability to
overcome resistant
group considered
this resistance
beforehand at least
once and developed
strategies
able to do so on the
fly during the
lesson. Whether
developed prior to
the students
strategy to
overcome resistance
was successful, and
did not distract from
the lesson or take
more than one
minute of extra time
to deal with.
4-Outstanding
Score
If applicable, the
group demonstrated
the ability to
overcome resistant
group considered
this resistance
beforehand at least
once and developed
strategies
able to do so on
the fly during the
lesson. Whether
developed prior to
the students
strategy to
overcome resistance
was successful, and
did not distract from
the lesson or take
more than one
minute of extra time
to deal with.
Comments:
Table of Contents
PG. 148

Owen Berger
Category Critical Thinking

1-Not
acceptable
2-Not acceptable
The students
lesson did not
incorporate
any elements
of critical
thinking,
either implicit
or explicit.
The students lesson

incorporated at least
one elements of
critical thinking, either
implicit or explicit.
The critical thinking
component(s) were
not directly related to
the subject matter.
4-Outstanding
Score
3-Competent
The students lesson

incorporated at least
one element of critical
thinking, either implicit
or explicit. The critical
thinking component(s)
were directly related to
the subject matter.
The students lesson

incorporated at least two
elements of critical thinking,
either implicit or explicit. The
critical thinking components
were directly related to the
subject matter.
Comments:
1-Not acceptable
The lesson appeared to

have parts removed or
added during the actual
lesson to modify the
timed lesson length.
The lesson was more
than 45 seconds over or
under 15 minute
length. Students did
not appear to be
conscious of the time
on their own and
needed instructor
prompting for when to
end the lesson.

2-Not acceptable
3-Competent
The lesson was

within 45
seconds of the
overall 15
minute length.
Students did not
appear to be
conscious of the
time on their
own and needed
instructor
prompting for
when to end the
lesson.
The lesson flowed

smoothly and there were
no apparent parts
removed or added
during the actual lesson
to modify the timed
lesson length. The
lesson was within 30
seconds of the overall 15
minute length. Students
appeared to be
conscious of the time on
their own and did not
need any instructor
prompting for when to
end the lesson.
4-Outstanding
Score
The lesson flowed

smoothly and there were
no apparent parts
removed or added during
the actual lesson to modify
the timed lesson length.
The lesson was within 15
seconds of the overall 15
minute length. Students
appeared to be conscious
of the time on their own
and did not need any
instructor prompting for
when to end the lesson.
Comments:
Table of Contents
PG. 149

Owen Berger
score.
Table of Contents
PG. 150

Owen Berger
Evaluation Instruments
Expected Impact Analysis Profile Worksheet
1) What agencies are represented by the class attendees? (Use back of this page if
necessary)
2) Are most of these agencies local, state, or federal? In what distribution?

Local [ ]
State [ ]
Federal [ ]
Other [ ]
3) What are the primary positions (or duties) of the attendees? Enter the total number of
attendees from each position/duty in the box.
Investigators
Specialized Personnel
Patrol Personnel
Supervisors
Administrative Staff
Special Event Staff
Command Staff
Civilians
4) What recent major events are going to impact this course and the material presented?
5) What do you think the three largest impacts of this course should be on these students?
Please be as specific as possible using the data you collected above. Example Due to
recent school shootings, I expect the high number of investigators in this course to be
able to monitor ongoing shooting situations for evidence, with a system already in place
for storing that evidence.
(1)
(2)
(3)
Table of Contents
PG. 151

Owen Berger
Student Impact Analysis Questionnaire, Page 1 of 2

1) On a scale of one to ten, how would you rate yourself at the following tasks? Please
note that there are ratings for both before and after this training.
Cyber-monitoring (monitoring Social Media and the Internet)
Competency before this training:
1 2 3 4 5 6 7 8 9 10 (Please circle)
Competency after this training:
1 2 3 4 5 6 7 8 9 10
If applicable, why did your score change? What were the most important factors to
changing this score?
Designing Intelligence Systems

1 2 3 4 5 6 7 8 9 10
1 2 3 4 5 6 7 8 9 10
Developing Social Media Policy

1 2 3 4 5 6 7 8 9 10
1 2 3 4 5 6 7 8 9 10
Teaching Others Cyber-monitoring

1 2 3 4 5 6 7 8 9 10
1 2 3 4 5 6 7 8 9 10
Table of Contents
PG. 152

Owen Berger
Student Impact Analysis Questionnaire, Page 2 of 2

2) How do you expect to incorporate this training into your current duties?
3) Which pieces of the training are most pertinent to your duties? Why?
4) What are the most important things you learned during this training, why?
5) Who whom in your organization will you share or teach the information from this
course? Will it be in a formal or informal setting?
Please enter the following information. This information will be securely stored by the course
presenter and will never be distributed or shared, even with your own organization/agency.
Full Name:
Work e-mail address:
Work phone number:
Optional I do not wish to be contacted regarding my survey for personal reasons. Initials [ ]
Table of Contents
PG. 153

Owen Berger
Instructor Assessment Survey, Page 1 of 2

Name of Instructor:
Name of Training Course: Real-time Intelligence with Social Media
Date(s) of Training Course:
Note Please use the grades in the assessment key below to grade each statement about the
instructor and the course below. Please enter any comments that will assist course
administrators in evaluating the instructors in the spaces provided below each evaluation
statement.
Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Classroom Assessments
The room was clean, well set-up, and organized.
The room was comfortable and it was safe to move around.
The course location made it easy to use the restroom, and find food, beverages, and other
amenities.
[
Instructor Assessments
The instructor had a professional demeanor and appearance.
The instructor was on-time and maintained a professional classroom environment.
The instructor was available for questions and personalized help, if needed.
Table of Contents
PG. 154

Owen Berger
Instructor Assessment Survey, Page 2 of 2

Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Instructor Assessments, Continued

The instructor was able to satisfactorily answer students questions and concerns.
The instructor spoke professionally, politely, and only questioned students actions when
necessary.
[
The instructor was knowledgeable about the course material.
The instructor was interested in student learning.
Other Comments:
Table of Contents
PG. 155

Owen Berger
Individual Module Assessment

Module I - Gathering Intelligence with Social Media and the Internet
Name of Instructor(s):
Name of Module: Gathering Intelligence with Social Media and the Internet
Date of Training Course Module:
module below. Please enter any comments that will assist course administrators in evaluating
the individual modules in the spaces provided below each evaluation statement.
Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Module Assessments
The instructor gave comprehensive coverage to this module (i.e. the instructor did not appear
to give less credence to this module than others without explanation).
[
]
The instructor seemed knowledgeable about the information contained in this module. [
This module was presented in a prepared, professional, and organized manner.
The instructor was clear about expectations of learning goals for this module.
The instructor was fair when evaluating student performance with the end-of-module
presentation rubric.
Table of Contents
PG. 156

Owen Berger
The learning activities were clearly explained and learning goals for each activity were given up
front (unless by design).
[
]
The learning activities in this module were directly related to the course content and facilitated
learning of the course material.
[
]
Other Comments:
Table of Contents
PG. 157

Owen Berger

Module II - Real-time Intelligence Systems: Design and Implementation
Name of Module: Real-time Intelligence Systems: Design and Implementation
Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Module Assessments
[
]
Table of Contents
PG. 158

Owen Berger
[
]
[
]
Other Comments:
Table of Contents
PG. 159

Owen Berger

Module III - Real-time Intelligence Systems: Policy Development
Name of Module: Real-time Intelligence Systems: Design, Policy, and Implementation
Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Module Assessments
[
]
Table of Contents
PG. 160

Owen Berger
[
]
[
]
Other Comments:
Table of Contents
PG. 161

Owen Berger

Module IV - Teaching Cyber-monitoring
Name of Module: Teaching Cyber-monitoring
Assessment Key
A Excellent
B - Good
C Average
D Bad
F - Horrible
Module Assessments
[
]
Table of Contents
PG. 162

Owen Berger
[
]
[
]
Other Comments:
Table of Contents
PG. 163

Owen Berger
Success Case Interview Guide
According to the Student Impact Analysis Questionnaire, you noted a significant

increase in your knowledge for Module X [insert module name here]. To what do you
attribute that gain? What were the primary factors to that gain, and can you please
rank them from most to least important?
What changes could have been made to make your learning increase even more during
the course?
How have you used what you learned during the course in your current duties?
Who have you shared your knowledge with after the course? In what type of setting
was this knowledge exchange, formal or informal, etc?
If you were going to give training on the subject matter, what learning activities would
you use from the course? What new activities have thought about designing to impart
this knowledge?
What did the instructors do correctly that helped facilitate your understanding of the
subject matter? What did they do incorrectly?
What about the classroom environment or set-up helped you to learn the course
material? What about the classroom environment negatively affected your learning?
What real-world considerations need to be further examined by the course designer?
What real-world limitations have you confronted when using the skills and knowledge
gained from this course? Can you please describe those limitations? Which of those
limitations affect you the most? The least?
Table of Contents
PG. 164

Owen Berger
POST Certification Package

Hourly Distribution
166
167
Instructor Resumes
168
Owen Berger
168
Chris Bouse
171
Budget
174
179
Module I
179
Module II
194
Module III
203
Module IV
213
Roster
223
Safety Plan
225
POST Certification Package | Table of Contents

PG. 165

Owen Berger
Hourly Distribution
Time
0800 0830
0830 0900
0900 0930
0930 1030
1030 1130
1130 1230
1230 1330
1330 1430
1430 1630
1630 1700
Day 1, Module I Gathering Intelligence with Social Media and the Internet
Subject/Topic
Instructors
Introductions, Safety Brief, and Arrangements
Bouse / Berger
Types of Cyber-monitoring and Terminology
Bouse / Berger
Creating Search Plans
Bouse / Berger
Critically Thinking About Searches
Bouse / Berger
Twitter and Criminal Searches
Bouse / Berger
Lunch/Break
Bouse / Berger
Facebook and Event Searches
Bouse / Berger
Other Sites and Situational Awareness
Bouse / Berger
Event Monitoring (Module Evaluation)
Bouse / Berger
Evaluation Assessment and Recapitulation
Bouse / Berger
Day 2, Module II Real-time Intelligence Systems: Design and Implementation

Time
Subject/Topic
Instructors
0800 0815 Definitions and Overview
Bouse / Berger
0815 0900 Current Systems and Legal Analysis
Bouse / Berger
0900 1000 System Elements
Bouse / Berger
1000 1100 System Design Preparation
Bouse / Berger
1100 1200 System Presentations (Module Evaluation) and Recapitulation
Bouse / Berger
1200 1300 Lunch/Break
Bouse / Berger
Day 2, Module III Real-time Intelligence Systems: Policy Development
1300 1400 Legal Research and Arguments
Bouse / Berger
1400 1500 Policy Elements with Critical Thinking
Bouse / Berger
1500 1600 Policy Development
Bouse / Berger
1600 1700 Policy Presentations (Module Evaluation) and Recapitulation
Bouse / Berger
Time
0800 0835
0835 0910
0910 1000
1000 1055
1055 1100
1100 1200
1200 1400
1400 1600
1600 1630
1630 1700
Day 3, Module IV Teaching Cyber-monitoring

Subject/Topic
Teaching Cops
Constraints and Resources
Adult Learning, Critical Thinking, and Learning Activities
Evaluated Activity Introduction and Overview
Lunch/Break (Combined with Activity Preparation)
Student-Generated Learning Activity Preparation
Student-Led Learning Activities (Module Evaluation)
Evaluation Assessment and Recapitulation
Certificates and Clean-up
Instructors
Bouse / Berger
Bouse / Berger
Bouse / Berger
Bouse / Berger
Bouse / Berger
Bouse / Berger
Bouse / Berger
Bouse / Berger
Bouse / Berger
Bouse / Berger

PG. 166

Owen Berger
Pending.

PG. 167

Owen Berger
Instructor Resumes
Owen Berger.
A raw copy of the first instructors resume can be found on the next page. However, there is
an updated electronic version kept in the administrative folder of this courses online
repository, which can be located by following the link below. The electronic version should be
printed and used when feasible as it will contain the most recent and accurate information.
You can also check this folder for recently added instructors.
Online Course Folder:

PG. 168
State of California Department of Justice
Commission on
Peace Officer Standards and Training (POST)
INSTRUCTOR RESUME WORKSHEET
1601 Alhambra Blvd
POST 2-112 (Rev 09/2011) Page 1 of 2
Sacramento, CA 95816-7083
INSTRUCTIONS DO NOT MAIL OR SUBMIT THIS WORKSHEET TO POST
This worksheet is to be completed by the Instructor.
The course presenter will submit the information into the POST EDI System.
If you have questions about your qualifications, contact the course presenter.
A separate Instructor Resume is required for each course taught by an instructor.
SECTION 1. PERSONAL INFORMATION

INSTRUCTOR NAME (FIRST, MI, LAST, SUFFIX)
CURRENT OCCUPATION
Owen K. Berger
Police Officer
BUSINESS MAILING ADDRESS (STREET/POB)

CITY
7600 S. Broadway
STATE COUNTRY (IF OUTSIDE U.S.) ZIP / MAIL CODE
Los Angeles
BUSINESS PHONE NUMBER
( 213 ) 485 - 4251
CURRENT EMPLOYER (PRIMARY)
BUSINESS FAX NUMBER
37319@lapd.lacity.org
Ext
HIGHEST DEGREE OBTAINED
YR OBTAINED (YYYY)
Bachelor of Arts (B.A.)
2003
90003
CA
BUSINESS EMAIL ADDRESS
MAJOR
EDUCATION/TEACHING CREDENTIAL
Economics / Computer Science
Yes
No
COLLEGE/UNIVERSITY GRANTING DEGREE
Name Claremont McKenna College
City Claremont
ST CA
LIST PROFESSIONAL LICENSES OR CERTIFICATES CHECK LICENSE(S) RELEVANT TO INSTRUCTING THIS COURSE
1)
POST IDI Basic Course (AICC)
2)
POST Field Training Officer
3)
LAPD Narcotics Investigations
4)
LAHIDTA Mexican Drug Cartels
5)
LEAPS Conference on Social Media 2011
6)
LAHIDTA Medical Marijuana Laws/Dispensary
7)
POST IDI, Level I, II, and III
8)
LAPD Surveillance School
9)
RIAA Property Theft and Music Piracy
10)
POST Advanced Certificate
11)
POST Intermediate Certificate
12)
POST Basic Certificate
LIST LAW ENFORCEMENT OR OTHER EXPERIENCE INCLUDING ANY DIRECTLY RELATED TO THIS INSTRUCTIONAL ASSIGNMENT
1) Los Angeles Police Department - Police Officer
NO. OF YEARS
10
2
2) LAPD Southeast Division Narcotics Enforcement Detail
3) LAPD Southeast Division Crime Suppression Detail

4) LAPD - Assisted with implementation of CCTV System for crime-reduction
2
2
5) POALAC - Co-Instructor, Computer investigations of websites

6) LAPD - Founding member of LAPD OSB Cyber Support Unit, specifically Social Media and Online investigations
7) San Diego Regional Training Center - Instructor for IP Tracing, Search Warrants, and Internet Resources
8) California Peace Officer's Association - Co-Instructor, Computer investigations of websites
2
2
2
1
9) POST - ICI Detective Symposium Presenter on Social Media

10)
SECTION 2. INSTRUCTOR EXPERIENCE (COURSES YOU HAVE TAUGHT)

1)
POALAC - Computer Investigations of Websites
2) LAPD - Social Media Investigations
3)
CPOA - Computer Investigations of Websites
4) LA School Police - Computer Investigations
5)
POST ICI - IP Tracing, Search Warrants, and Internet Resources
6) POST ICI Identity Theft
7)
2014 ICI Detective Symposium - Social Media in Investigations
8) California Gang Investigator's Conference - Social Media Inv.
9)
10) SDRTC - Computer Investigations of Websites

PG. 169
11)
11)
Instructor Name:
POST 2-112 (Rev 09/2011) Page 2 of 2
BERGER, OWEN K
SECTION 3. COURSE INFORMATION

LIST SUBJECTS INSTRUCTOR TEACHES IN THIS OR OTHER COURSES (e.g., FIREARMS, LEGAL UPDATE) CHECK SUBJECTS RELEVANT TO INSTRUCTOR IN THIS COURSE
1)
Social Media Investigations
2)
Using the Internet as a investigative tool
3)
Computer Investigations
4)
Social Media
5)
Email Headers
6)
Internet Searches
7)
Electronic Evidence
8)
Search Warrants
9)
IP Investigations
10)
Preservation Requests
11)
12)
SECTION 4. INSTRUCTOR DEVELOPMENT TRAINING

LIST INSTRUCTOR DEVELOPMENT INSTRUCTOR HAS RECEIVED INCLUDING THAT WHICH IS SPECIFIC TO THIS COURSE.
If this instructor teaches one or more Specialized Subjects listed in Commission Regulation 1070 (for example, Chemical Agents, Arrest & Control,
Firearms, etc.), check the box for 1070(b) or 1070(c) as appropriate.
Course Control Number.
(or Presenter name if not POST-certified)
Course Title
Total
Hours
Date Completed
(MM/DD/YYYY) 1070(b) 1070(c)
1) POST IDI Basic Course (AICC)
1850-21705-12-006
40
10/12/2012
2) POST IDI Level II
9070-21719-13-001
40
5/24/2013
3) POST IDI Level III Leadership/Mentoring/Coaching
9070-21722-12-005
24
8/15/2013
4) POST IDI Level III, Phases I and II
9070-21719-13-001 and 9070-21721-13-001
56
12/6/2013
5) POST ICI Instructor Course, Phases I and II
9070-26002-13-001 and 9070-26003-13-001
40
2/11/2014
6) POST Master Instructor Course - ONGOING

ACACDEMY INSTRUCTOR CERTIFICATION COURSE (AICC) CERTIFIED INSTRUCTOR
Regular Basic Course Instructors shall complete AICC, Regulation 1082 OR pass the AICC Equivalency Process, Regulation 1009(c)(4).
Completed AICC, Regulation 1082
Course Control Number 1850-21705-12-006
Date Completed (MM/DD/YYYY) 10/12/2012
Completed AICC Equivalency Process, Regulation 1009(c)(4)
Academy Name
Academy Director or Designee Name
Date Equivalency Granted (MM/DD/YYYY)
DO NOT MAIL OR SUBMIT THIS WORKSHEET TO POST

Owen Berger
Chris Bouse.
A raw copy of the second instructors resume can be found on the next page. However, there
is an updated electronic version kept in the administrative folder of this courses online
printed and used when feasible as it will contain the most recent and accurate information.
You can also check this folder for recently added instructors.

PG. 171
State of California Department of Justice
Commission on
Peace Officer Standards and Training (POST)
1601 Alhambra Blvd
POST 2-112 (Rev 09/2011) Page 1 of 2
Sacramento, CA 95816-7083
INSTRUCTIONS DO NOT MAIL OR SUBMIT THIS WORKSHEET TO POST
This worksheet is to be completed by the Instructor.
The course presenter will submit the information into the POST EDI System.
If you have questions about your qualifications, contact the course presenter.
A separate Instructor Resume is required for each course taught by an instructor.
SECTION 1. PERSONAL INFORMATION

INSTRUCTOR NAME (FIRST, MI, LAST, SUFFIX)
CURRENT OCCUPATION
Christopher A. Bouse
Police Officer
BUSINESS MAILING ADDRESS (STREET/POB)

CITY
7600 S. Broadway
STATE COUNTRY (IF OUTSIDE U.S.) ZIP / MAIL CODE
Los Angeles
BUSINESS PHONE NUMBER
( 951 ) 252 - 5636
CURRENT EMPLOYER (PRIMARY)
BUSINESS FAX NUMBER
36881@lapd.lacity.org
Ext
HIGHEST DEGREE OBTAINED
YR OBTAINED (YYYY)
MAJOR
1995
N/A
High School Diploma
90003
CA
BUSINESS EMAIL ADDRESS
EDUCATION/TEACHING CREDENTIAL
Yes
No
COLLEGE/UNIVERSITY GRANTING DEGREE
Name N/A
City N/A
ST
LIST PROFESSIONAL LICENSES OR CERTIFICATES CHECK LICENSE(S) RELEVANT TO INSTRUCTING THIS COURSE
1)
Master Instructor Certification Course
2)
POST IDI Level-3
3)
POST IDI Level-2
4)
POST ICI Instructor Course
5)
POST ICI Core Course
6)
POST Computer Investigation of Websites
7)
POST Identity Theft Course
8)
MCTFT Intercept of Secure Communications
9)
CJI Taggers & Graffiti Culture
10)
LA HIDTA Search and Seizure Survival
11)
DHS LE Intelligence Toolbox
12)
POST Basic Certificate
LIST LAW ENFORCEMENT OR OTHER EXPERIENCE INCLUDING ANY DIRECTLY RELATED TO THIS INSTRUCTIONAL ASSIGNMENT
NO. OF YEARS
1) Los Angeles Police Department - Police Officer
12
2) LAPD Criminal Gang Homicide Group - Created departments first internet investigative unit
2
3
3) LAPD 77th Division - Created online investigative unit

4) LAPD - Committee member for creating online and social media policy
5) POST - Committee member for social media investigations training DVD
6) San Diego Regional Training Center - Co-Instructor, Computer investigations of websites
7) California Peace Officers Association - Created & Taught Cyber Investigations Course
1
1
6
3
3
8) California Multi-Agency Support Services - Founder and President

9) LAPD - Creator of the Cyber Support Unit, The Departments First City-Wide Internet Investigative Unit
10)
SECTION 2. INSTRUCTOR EXPERIENCE (COURSES YOU HAVE TAUGHT)

1)
SDRTC - Computer Investigations of Websites
2) '11 Detective Symposium - Social Media Investigations
3)
CA District Attorneys Association - Social Media Investigations
4) LAPD - Social Media Investigations
5)
California Peace Officers Association - Internet Investigations
6) California Multi-Agency Support Services - Internet Investigation
7)
California Gang Investigator Association - Internet Investigation
8) Western Colorado Police Officers Assoc. - Internet Investigation
9)
10)
11)
11)
Instructor Name:
POST 2-112 (Rev 09/2011) Page 2 of 2
BOUSE, CHRISTOPHER A.
SECTION 3. COURSE INFORMATION

LIST SUBJECTS INSTRUCTOR TEACHES IN THIS OR OTHER COURSES (e.g., FIREARMS, LEGAL UPDATE) CHECK SUBJECTS RELEVANT TO INSTRUCTOR IN THIS COURSE
1)
Social Media Investigations
2)
Using the internet as a investigative tool
3)
Cyber Investigations
4)
IP Investigations
5)
Email Headers
6)
Mobile Devices
7)
Social Medai Websites
8)
Cyber-bullying
9)
Technical Investigations
10)
Electronic Evidence Preservation
Electronic Evidence Collection
11)
12)
Internet Searches
SECTION 4. INSTRUCTOR DEVELOPMENT TRAINING

LIST INSTRUCTOR DEVELOPMENT INSTRUCTOR HAS RECEIVED INCLUDING THAT WHICH IS SPECIFIC TO THIS COURSE.
If this instructor teaches one or more Specialized Subjects listed in Commission Regulation 1070 (for example, Chemical Agents, Arrest & Control,
Firearms, etc.), check the box for 1070(b) or 1070(c) as appropriate.
Course Control Number.
(or Presenter name if not POST-certified)
Course Title
Total
Hours
Date Completed
(MM/DD/YYYY) 1070(b) 1070(c)
1) POST Master Instructor Certification Course
San Diego Regional Training Center
152
11/14/2013
2) POST IDI-Level 3, Advanced Instructor Development
80
12/11/2012
3) POST IDI-Level 2, Intermediate Instructor Development
NAPA Valley Criminal Justice Training Center
80
1/16/2012
4) IDI Level-2 Critical Thinking & Instruction Technology
NAPA Valley Criminal Justice Training Center
32
1/18/2012
5) POST ICI Instructor Course
40
10/29/2012
6) POST ICI Core Course
San Diego Regioinal Training Center
80
12/12/2012
ACACDEMY INSTRUCTOR CERTIFICATION COURSE (AICC) CERTIFIED INSTRUCTOR
Regular Basic Course Instructors shall complete AICC, Regulation 1082 OR pass the AICC Equivalency Process, Regulation 1009(c)(4).
Completed AICC, Regulation 1082
Course Control Number
Date Completed (MM/DD/YYYY)
Completed AICC Equivalency Process, Regulation 1009(c)(4)
Academy Name
Academy Director or Designee Name
Date Equivalency Granted (MM/DD/YYYY)
DO NOT MAIL OR SUBMIT THIS WORKSHEET TO POST

Owen Berger
Budget
A raw copy of the course budget can be found below. However, there is an updated electronic
version in Microsoft Excel format that is kept in the administrative folder of this courses online
printed, modified or used when feasible as it will contain the most recent and accurate
information.
COURSE BUDGET
1. AGENCY SUBMITTING COURSE BUDGET
State of California
Department of Justice
COMMISSION ON PEACE OFFICER STANDARDS AND TRAINING
2. COURSE CATEGORY
4. BUDGET SUMMARY COSTS
COST
SUBTOTAL
TOTAL
DIRECT COSTS
A. Services
(1) Instruction
$1,680.00
(2) Coordination
$580.00
(3) Clerical
$360.00
(4) Printing/Reproduction
$87.75
TOTAL SERVICES
$2,707.75
B. Supplies
(1) Books/Pamphlets/Handouts
$75.00
(2) Certificates
$25.00
(3) Notebooks
$475.00
(4) Paper/Office Supplies
$200.00
TOTAL SUPPLIES
$775.00

PG. 174

Owen Berger
C. Equipment
$160.00
D. Travel
(1) Coordinator
$0.00
(2) Instructors
$18.00
TOTAL TRAVEL
$18.00
E. Miscellaneous
$1,735.00
DIRECT COSTS
$5,235.75
Management Oversight (5% of Total Direct Cost)
$261.79
INDIRECT COSTS 20% of A 1,2 3, and D 1 and 2
$2,638.00
GRAND TOTAL
5. SUBVENTIONS
$527.60
$6,025.14
TOTAL SUBVENTIONS
$0.00
6. NAME OF PERSON SUBMITTING BUDGET AND DATE:

POST USE ONLY
Total
$6,025.14
Number of Students
25
Tuition per Student

$241.01
POST APPROVAL AND DATE
COURSE CERTIFICATION NUMBER
POST 2-106 (REV.7/88)

BUDGET DETAILS
COST
7. SERVICES
A. Instruction
Name
No. of Instructor Hours
Hourly Rate
Practitioner
12
$75.00
$900.00
Practitioner
12
$65.00
$780.00
TOTAL
$1,680.00
B. Coordination
Name
No. of Coordinator
Hours
Hourly Rate

PG. 175

Owen Berger
Coordinator - Presentation
24
Coordinator - General
$15.00
$360.00
$55.00
$220.00
TOTAL
$580.00
$15.00
$360.00
C. Clerical
Name
No. of Hours
Clerk
24
Hourly Rate
D. Printing/Reproduction
Volumes
Print Material (39 pages) x
25 students
Pages
Per
page
cost
975
$0.09
Cost
$87.75
SERVICES TOTAL
$87.75
$2,707.75
COST
8. SUPPLIES
A. Books, Pamphlets, Handouts
Item
Critical Thinking Guide
Quantity
Cost
25
$3.00
$75.00
$1.00
$25.00
$19.00
$475.00
$11.00
$275.00
B. Certificates
Item
Course completion
certificates
Quantity
Item
Three-ring Binder
Notebooks
Quantity
Item
Quantity
Cost
25
C. Notebooks
Cost
25
D. Office Supplies
Thumb drives, 4 gigs
25
Misc.
Expendable Items
$100.00
SUPPLIES TOTAL
$100.00
$950.00
POST 2-106 (REV. 7/88)

PG. 176

Owen Berger
BUDGET DETAILS
9. EQUIPMENT
COST
Item
Specific Cost
Karma 4g Hotspot with 5 GB Data
$
160.00
$160
EQUIPMENT TOTAL
10. TRAVEL
$160.00
COST
A. Coordinators
Name
Origin &Destination
Specific Costs
(e.g.
Transportation,
per diem, etc.)
B. Instructors
Specific Costs
Name
Origin &Destination
(e.g. Transportation
per diem, etc.)
Practitioner
Torrance to Burbank (20 * .56 * 3)
$34.00
$34.00
Practitioner
Temecula to Burbank (97 *.56 * 3)
$163.00
$163.00
Practitioner
Parking ($2 a day X 3 days)
$6.00
$6.00
Practitioner
$6.00
$6.00
Coordinator
$6.00
$6.00
$0.00
$0.00
$0.00
$0.00
$0.00
Instructor total
$0.00
$
18.00
TRAVEL TOTAL
$233.00
11. MISCELLANEOUS
Item
Classroom space $500/day X 3 days

Flip chart paper
Computer exercise supplies
Computer Tech support 9 hours @
$15/hour
Cost
$50.00
$1,500.00
$50.00
$50.00
$135.00
$135.00
MISC. TOTAL
$1,735.00
$1,500.00
$50.00

PG. 177

Owen Berger
12. SUBVENTIONS
Source of
Subventions
Type of
Subvention
Cash Value of Subvention
SUBVENTIONS TTL
$0.00
POST 2-106 (REV. 7/88)

PG. 178

Owen Berger

Course Real-time Intelligence with Social Media.
Course Goal. To teach students how to gather and disseminate real-time intelligence
with Social Media and the Internet.
Module I Gathering Intelligence with Social Media and the Internet.
Module Goal. To teach students how to monitor events with Social Media and the
Internet.
Learning Objective. The students will utilize cyber-monitoring while working on an
assigned event in small groups with internet access and a time-limit of 45 minutes for
preparation and 5 minutes for presentation, and must score a three (3) or higher on each
category of the Cyber-monitoring Grading Rubric.
I.
Gathering Intelligence with Social Media and the Internet

A. Types of cyber-monitoring
1. Criminal Investigations
a. Ongoing criminal investigation
b. Aftermath
c. Fugitive tracking
2. Planned Events
a. Demonstration
b. Protest
c. Rally
d. Celebration
e. Sit-in
3. Critical Events
a. Sniper Attack
b. Public shooting
c. Terrorist attack
4. Natural Disasters
a. Earthquakes
b. Fires
c. Floods
d. Snow
e. Rain
f. Tsunami
PG. 179

Owen Berger
g. Tornado
h. Hurricane
5. Monitoring for Intelligence vs Information
B. Searching the Internet
1. Internet Search Plans
a. Identify key points
1) Identify what information we are looking for
a) Purpose, purpose, purpose
b) Specific information
c) General information or survey
2) Distilling
a) Distill the information we want into words or search terms
(1) Different ways of saying the same thing
(2) Varying specificity
(3) Skewing results with our own words
b) Too much information after distillation
(1) Need for running multiple searches
(2) The need for multiple plans
(3) More research to determine other keywords
b. Implementation methods
1) Write plan down
2) Remember plan
3) E-mail plan
2. Safe searches with law enforcement
a. Protection
1) Anonymizers
a) HideMyAss
b) Firefox Plugins
c) Tor browser
2) Cold computers
a) Ease of use
b) IP Identifiers
(1) White supremacist example
(2) Arin.net
(3) Dawhois
(4) Others
c) Associated costs
3) Fake accounts
a) Legality of fake accounts

PG. 180

Owen Berger
Photos for profile use

Face vs no face
Other persons photos
False impersonation
Situations for fake accounts
b. Purpose will define protection
1) Again, purpose, purpose, purpose
2) Necessary protection v paranoia
3) Use cases
a) Apparent/overt
b) Discreet
c) Covert
c. Health
1) Environment
a) Chairs
b) Monitors
c) Desk
2) Take care of yourself
a) Stretch
b) 20 20 20 rule
c) Exercise
3. General Internet Searches
a. Search Engines
1) Google
a) Largest of the search engines
b) Tie results to logged in Google account
c) Ads will immediately result/respond
2) Bing
a) Microsoft-run
b) Tie results to Microsoft and Facebook accounts
c) Bing Social
3) Yahoo
4) Ask
b. Types of searches
1) Content
a) Informational
(1) Broad information request, usually for things
(2) Find out
b) Navigational
b)
c)
d)
e)
f)

PG. 181

Owen Berger
(1) A search to get somewhere on the Internet

(2) Finding a specific site, or persons page
c) Transactional
(1) Means youre looking to buy or sell or exchange something
(2) Brands product names
2) Geographical
a) Geo-tagging
b) Quantity of information actually geo-tagged
c) Use scenarios
(1) Protest areas
(2) Parties
(3) High-crime locations
c. Search Terms
1) Keywords
2) Names
3) Titles
4) Special Characters
a) Are they allowed, are they included
b) Cross-site Scripting (XSS)
d. Common search operators
1) Quotes
2) Minus sign 3) Plus sign +
4) OR
5) AND
6) Attitude
a) Reliability
b) Narrowing search results
7) Other operators
e. Utilize the elements of Critical Thinking
a) Clarity
b) Accuracy
c) Precision
d) Relevance
e) Depth
f) Breadth
g) Logic
h) Fairness

PG. 182

Owen Berger
a) Purpose/Goal/End
b) Question at issue/Problem to be solved
c) Assumptions
d) Point of View/Frame of reference
C. Cyber-monitoring and the law
1. Current case law
a. Konop v Hawaiian
b. Cromer v Lexington
1) What you do off-duty can affect your employment
2) Dont identify yourself off-duty
c. Garcetti v Ceballos
1) Make sure you know if you are acting as employee or citizen
2) Same goes for Social Media
1) Good search warrants are key
2) Read the terms of service
e. U.S. v Meregildo
1) Expectation of privacy does not equal privacy
2) Confidential Social Media informants?
2. Other legal questions
b. False personas
c. Purpose, purpose, purpose
3. 28 CFR Part 23 - https://it.ojp.gov/documents/28cfr_part_23.pdf
D. Useful sites and tools
1. Understanding Twitter
a. Twitter Accounts
1) Signing up for Twitter
a) Full Name
(1) Resistance to sign up
(2) Fake Name
(3) Work Name
b) E-mail Address
(1) Use your work e-mail

PG. 183

Owen Berger
(2) Use a throw-away e-mail

c) Password
(1) Password security
(a) Never write down passwords
(b) Ensure password is different for each account
(2) Consequences of poor password security
(a) Public embarrassment
(b) Loss of trust
d) Username
(1) Be descriptive
(2) Or not
(3) This is your Twitter handle
e) Keep me signed-in checkbox
(1) Stores a cookie in your browser
(2) Inherently safe, if only you are using the device
f) Tailor Twitter to my most recent websites checkbox
(1) They are storing your information for advertisements
(2) Dont check these boxes
(3) Its unclear how much information they store, and for how long
g) Terms of Service
b. Post sign-up operations
1) Follow five people
a) Not necessary to complete for this course
b) Only follow people you are actually interested in
c) As soon as you follow someone, that information is public
2) Complete profile
a) Uploading a photo
b) Entering background information
c) Entering a website
3) Find your friends
4) Confirm your e-mail address
a) Not necessary for this course
b) Common practice that ensures you own your e-mail address
c. Twitter terms and nomenclature
1) Users
a) Username
(1) The same thing as a Twitter handle
(2) Be descriptive
(3) Or not

PG. 184

Owen Berger
Profile
Profile picture
Profile background
Followers
(1) These are the people following you
(2) They can see all of your tweets, and re-tweet them
(3) You can restrict who is following you
f) Following
(1) These are the people you are following
(2) They can view your information
(3) They can disallow you to follow them
Tweets
a) Tweet
(1) 140 Character-limit
(2) Goes to all followers
(3) Is publicly searchable
(4) NEVER GOES AWAY
b) Re-tweet (RT)
(1) Twitter for lazy people
(2) This is how information goes viral
c) Modified Tweet (MT)
d) Link
(1) To picture/photo
(2) To website
(3) URL Shorteners
(a) Purpose
(b) Dangers of overuse
Hashtag
a) Groups content
b) Organic way to organize tweets
c) Large range from specific to general
d) No special characters
@-Mention
a) Tied to a username
b) Can be used to reply
c) Can draw attention to a Twitter profile.
Photos
a) Are attached to the Tweet
b) Can be linked to
b)
c)
d)
e)
2)
3)
4)
5)

PG. 185

Owen Berger
(1) Instagram
(2) Other websites
c) EXIF and META data
(1) Information stored with the photograph
(2) Included geo-location data
(3) Camera information
(4) Shutter speed, etc
(5) Sometimes its scrubbed
(6) Can be obtained via search warrant
(7) Command staff love pictures
6) Other
a) Direct Messages (DM)
(1) Only between your followers or people you are following
(2) Used the same as text messages
(3) Can be obtained via search warrant
b) Reach
(1) How does something go viral
(2) Multiple layers of re-tweets makes for a huge audience
c) Trending
d) Geo-location
(1) Uncommon
(2) Used in Twitter mapping software and applications.
2. Searching Twitter
1) Keywords
a) Autocomplete
b) Multiple types of returned information
(1) Hashtags
(2) Profiles
(3) General search terms
2) Hashtags
3) Profiles or @-mentions
4) Search operators (https://www.twitter.com/search-home for full list)
a) Quotes
b) Minus sign
c) OR
d) AND
e) Attitude
(1) Reliability

PG. 186

Owen Berger
(2) Narrowing search results
Other operators
5) Twitter search engines
a) Native Twitter search
b) Other Twitter search engines
(1) Bing Social
(2) Google (Twitter: )
(3) IceRocket
6) Twitter feeds (continuous searches) or Aggregators
a) Current Twitter feed/API issues
(1) Twitter has begun to disallow access to their data
(2) Several smaller twitter services have closed (Monitter)
b) Twitter feeds
(1) Most require a Twitter account
(2) Some have different refresh rates
(a) Refresh rates are how often the information is updated
(b) Important to know depending on how critical updated
information is to the task at hand
(3) Feed providers
(a) Tweetdeck
(b) Twitterfall
c) Multiple feed windows
(1) Advantages
(a) Helpful during most major events
(b) Can use multiple screens
(2) Disadvantages
(a) Bandwidth issues
(b) Eye-problems
(c) Practice the 20-20-20 rule
3. Events and Twitter
a. What Twitter provides (Advantages)
1) Real-time intelligence from anywhere people are
2) Location-centric data
a) Limitations of geo-tagging information
b) Small amount of people with geo-tagging turned on
3) Used the same as other intelligence
a) Multiple (difference) sources lend credibility
b) Intel must be independently verified for action to be taken
c) Twitter is a good starting point
f)

PG. 187

Owen Berger
4) Photographs can be a gold mine

a) Crowd estimates
b) Weather
c) Evidence
d) Piecing events together
e) Disaster breadth
b. What Twitter does not provide (Pitfalls)
1) 100% credible information
a) Believe it or not, people lie on Twitter
b) Invalid information can be as viral as true information
2) Not a replacement for deployed resources
a) Typically, the more resources, the less helpful Twitter is
b) Should not be used for major decisions
c. Using Twitter specifically for Events
(a) Every event is different
(b) Examples
i. Baseball game
ii. Awards show
iii. Gang funeral
iv. Slang
v. Emergencies
vi. Natural disasters
vii. #SMEM
(c) Research can help a lot
(d) Gang experts
(e) Fans
(f) Other news sites
(g) Slang
i. Helpful sites
ii. Transl8it
iii. UrbanDictionary
iv. Pay attention
b) Terms and hashtags are DYNAMIC
(a) Dynamic terminology
(b) Terms can change
i. Always be watchful for new hashtags & keywords
ii. Variations

PG. 188

Owen Berger
#occupy
#occupyla
#occupymay1
#occupylamayday
#buildingcollapse
(c) Hashtag hijacking
i. Context is important
ii. The person/entity tweeting can change the meaning
(d) Hashtags can pop up anywhere
(e) #ShuttleEndeavour5HoursLate
(f) #CrashGate7
(g) #TailgateNow
(h) #FlashMob711
4. Understanding Facebook
a. Facebook Accounts
1) Signing up for Facebook [9]
a) Initial Page
(1) First Name
(2) Last Name
(3) E-mail address
(4) Password
(5) Birthday
(6) Male/Female
(7) Phone number
b) Find Friends
c) Fill out Info
d) Profile Pic
2) Facebook terms and nomenclature
a) Page
b) Post
c) Profile
d) User
e) Username
f) Vanity URL
g) Banner
h) Profile ID
(1) Never changes
(2) JSON pathway
(a) Change www to graph
iii.
iv.
v.
vi.
vii.

PG. 189

Owen Berger
Status
Update
Timeline
Groups
Apps
Friends
(1) Friend Request
(2) How many friends should you have
o) Followers
p) Likes
q) Comments
r) Messages
s) Privacy
5. Searching Facebook
1) Keywords
a) Autocomplete
b) Multiple types of returned information
(1) Profiles
(2) Pages
(3) Events
(4) Photos
(5) Apps
(6) Games
(7) Groups
2) Profiles (People)
3) My Friends
4) Photos, movies, music, games I might like
5) Nearby Restaurants
6) Photos I have liked
b. Facebook Search Engines
1) Native Facebook Search
2) Other Facebook search engines
a) Bing Social
b) Google (Facebook: )
c) IceRocket
3) Graph search
a) Can replace www. With graph.
(1) JSON
i)
j)
k)
l)
m)
n)

PG. 190

Owen Berger
(2) Plain text representation of information

(3) What
b) Results different for everyone
c) What information is or is not shown
6. Events and Facebook
a. What Facebook provides (Advantages)
1) Real-time intelligence from anywhere people are
2) Some Location-centric data
a) Limitations of geo-tagging information
b) Small amount of people with geo-tagging turned on
c) Locations can be entered incorrectly or faked
3) Used the same as other intelligence
a) Multiple (different) sources lend credibility, links to other Facebook
b) Intel must be independently verified for action to be taken
c) Facebook is a good starting point, and has less fake pages than Twitter
4) Photographs and videos linked to accounts
a) Location can be deduced from photo OR account/page
b) Valuable information
(1) Crowd estimates
(2) Weather
(3) Evidence
(4) Piecing events together
b. What Facebook does not provide (Pitfalls)
1) Easy searches/Automation
a) Facebooks Graph API isnt great for law enforcement
b) Advertising drives results, not relevant information
2) Not as real-time as Twitter
a) Twitter offers more for ongoing events
b) Twitter offers less for upcoming events
c. Using Facebook specifically for Events
(1) Uniform page layout means most events have same setup
(2) Examples
(a) Parties
(b) Protests
(3) Slang
(a) Helpful sites
(b) Transl8it

PG. 191

Owen Berger
(c) UrbanDictionary
(d) Pay attention
b) Different searches, think in person terms, not keywords
(1) Names
(2) Phone Numbers
(3) Locations
(4) Groups
2) Respondents Who is coming?
a) Yes
b) No
c) Maybe
7. Preserving Digital Evidence
a. Preservation Requests
b. Preservation Letter
c. Search.org for contact information
d. Arin.net for IP Address Information
e. Facebook.com/records
f. Instagram Facebook.com/records
g. Otherwise look for e-mail or fax
8. Understanding Instagram
a. Instagram basics
1) Instagram is phone-only
2) Signing up requires your phone
3) Must download app
b. Instagram accounts
1) Profile/Username
2) Chosen at signup
3) No publicly available id
4) http://jelled.com/instagram/lookup-user-id
c. Instagram terms
1) Profile
2) Caption/Description
3) Title
4) Message
5) Like heart
6) Follow
7) Comment
8) Direct Send
d. Searching Instagram

PG. 192

Owen Berger
1) IconoSquare (used to be Statigram)

2) Hashtags from Twitter and Facebook work also
9. Other sites
a. Trending
b. New Technologies
c. Online Buy/Sell
1) Craigslist
2) Backpage
d. General searches
e. Fly-by-night aggregators
10. Commercial tools
a. Geofeedia
1) Geo-fencing
2) Stateful monitoring
b. LexisNexis/Accurint
c. Torch (Palantir)
d. Radian 6
e. SAS Social Media

PG. 193

Owen Berger
Module II - Real-time Intelligence Systems: Design and Implementation.

Module Goal. To teach students how to design and implement systems for gathering
and disseminating intelligence from Social Media and the Internet
Learning Objective. The students will create an intelligence system while working in
small groups with Internet access and a time-limit of 60 minutes for preparation and 6 minutes
for presentation, and must score a three (3) or higher on each category of the Systems Design
II. Designing Intelligence Systems
A. Definitions
1. Intelligence
a. Universal definition
b. Defining the term
1) Command staff
2) Multi-jurisdictional
3) Policy
c. Intelligence vs information
2. System
a. Systems Definition
1) System vs Policy
2) System vs Guideline
3) System vs Law
b. Breadth
1) Organization-wide
2) Division/Bureau wide
3) Unit-wide
B. Intelligence Systems and the Law
1. System legalities
a. System illegalities or pitfalls
1) Storage of information
2) Automation
a) Storing information
(1) Insecure
(2) Too long
(3) Outside of intended purpose
b) Sending information
c) Gathering information
3) Purpose, purpose, purpose

PG. 194

Owen Berger
a) Outside of mandate
b) Outside of jurisdiction
c) Outside of authority
b. Intended Use
1) Internal
a) Criminal Investigations
b) Facilitate information flow
2) External
a) Media Relations
b) Public Alerts
3) Both
a) Protests
b) Mass Demonstrations
2. Current case law
a. Konop v Hawaiian
1) Legally viewing a website
a) User
b) Administrator
c) Law enforcement
2) Defining a user
a) Login or free access
b) Terms of Service
(1) Authenticating the agreement
c) Determining actual Terms of Service
(1) Importance
(2) Invitation vs pre-subscribed
(3) Intentional recipient vs open subscription
a) Interception vs Reception vs Storage/Retrieval
b) Direct sending
d) Actively transmitting vs retrieval from storage
2) Two-prong tests
a) Determine who you are speaking as
(1) Employee
(a) Statements for work purposes

PG. 195

Owen Berger
Whistleblower laws
During work hours
At work location
Using work resources
Work Equipment
Work supplies
Work Technology
(2) Citizen
(a) On off-time (off-duty)
(b) Using private/personal equipment
(2) Normal situation arising out of work
(3) Right to know / Need to know
a) On-duty
(1) Acting as representative of your organization
(2) Must abide by all policies/procedures
(3) Can identify as law enforcement
(4) Can hide identity for certain operations
b) Off-duty
(1) Should not identify as law enforcement
(2) Behavior that can
(a) Affect your ability to work
(b) Affect your employers ability to function
(c) Affect reputation of you or your employer
2) Termination for off-duty behavior
a) It is possible
b) It is legal
c) Never identify yourself as law enforcement
(1) Use whistleblower protections if needed
(2) Use the proper channels for reporting misconduct
1) NY District Attorney used tweets from @destructuremal to prosecute
a) Wrote search warrant to Twitter
b) Harris opposed as a third party
c) Twitter withheld warrant until judgment was given
(b)
(c)
(d)
(e)
(f)
(g)
(h)

PG. 196

Owen Berger
d) Judge ruled in favor of NY DA, with time limits.

(1) Valid search warrant with probable cause was used
(b) Twitters Terms of Service specifically stated
i. All content sent to or via Twitter belongs to Twitter
ii. They can give information with valid L.E. request
(3) Search warrant is necessary for info within last 180 days.
e) Twitter gave warrant return back to NY DA.
2) Lessons
a) Valid search warrants usually trump other considerations
(1) Warrant scope
(a) Limited to only what is necessary
(b) No overreach
i. Information-wise, and
ii. Time-wise
(d) Specific and related, no fishing expeditions.
(2) Probably cause
(a) Good PC can articulate the level of information needed
(b) Dont ask for it if you shouldnt get it.
(c) Traverse and quash will eliminate all information from warrant
b) Terms of Service
e. U.S. v Meregildo
1) Communications were intended as private
a) However, after sending information
b) Recipient is free to do with information as they please
c) Social Medias expectation of privacy is narrowing
d) How do you know who you are sending information to?
2) Projection/amplification of Social Media
a) Sharing in one method can become several methods
(1) Linked accounts
(2) Using same e-mail as base account
b) Private accounts can link to non-private accounts.
c) Law enforcement should look at all avenues and accounts
C. Intelligence System Purpose
1. Types of information systems purposes
a. Correcting a deficiency

PG. 197

Owen Berger
1) Reasons for Deficiency

a) Too few resources
b) Too few personnel
c) Not enough training
d) Liability issues
2) Systemic vs particular/specific
a) Complete system redesign
b) Component redesign
b. Better, broader, or faster information flow
1) Getting information
a) To more people
b) To people faster or to a repository faster
c) More detailed, complete, accurate, or better information.
2) Modifying an existing system
a) to incorporate new technology
b) to incorporate new information sources
3) Create one system to supplement another, or several
a) Interfaces
b) Nodes
c) Storage methods
d) Repositories
c. Dealing with new technology
1) New system to incorporate technology into organization
2) Utilizing new technology for current intelligence
d. Dealing with new sources of information
1) Systems that gather and disseminate new types of information
2) Pulling information from a new site or place
3) Pulling information from a different information collector or aggregator
2. Continuity of Purpose
a. Narrowing the purpose
1) Multiple systems with one purpose
2) Overlap happens constantly
3) Bureaucracy breeds overlap
4) Overlap is the opposite of efficiency
b. Keep your systems DRY
1) Research is important
2) Talk with, though I hate to say it, stakeholders
3) Systems can interact, but shouldnt overlap
c. The same information in multiple places is DIFFERENT INFORMATION

PG. 198

Owen Berger
1) Game of Telephone
2) Information interpretation
a) Different viewpoints
b) Least distance principle
d. Is the purposed maintained from start to finish?
D. System Terminology
1. Nodes
2. Interfaces
3. Start point
4. End point
5. Information flow
6. User
7. Intelligence
8. Vetting
9. Validation
10. Target
11. Suspect
12. Target v Suspect
E. Real-world considerations
1. Information storage/repositories
a. Centralized
1) All information in same place
2) User can check at their leisure
3) Information is immutable except by originator
4) Central node
b. Distributed
1) Information lies with end user
2) Open to interpretation by user
3) Can be relayed multiple times
c. Types
1) E-mail
2) Website
3) Phones
4) Text messaging
5) Talking to someone in person (?)
2. Constraints
a. Human behavior
1) Checking sources:
a) Checking e-mail

PG. 199

Owen Berger
b) Checking phone messages

c) Checking text messages
d) Texting and driving
2) Do anything while driving other than driving
3) Fatigue, keep work-ups DRY
4) Necessary information only
a) Push vs pull
b) Best of both worlds
5) CREDIT IS NOT IMPORTANT
b. Nodes
1) Centralized node has to be able to handle the traffic
2) Do the nodes
a) Process information
b) Mutate information
c) Interpret information
c. Mandated checking of information source
1) Positives
a) Ensures right people get the information
b) Everyone gets the same information
c) Interpretation can be relayed to everyone
2) Negatives
a) Induces fatigue
b) Failure to cooperate
c) Different interpretations
F. Intelligence flow
1. Follow the path
a. Path of least resistance
b. As the crow flies
c. All necessary personnel are
1) Notified
2) Have access to the information
2. Static points or nodes
a. Points where information can be distorted
b. Places where interpretation or subjectivity can be injected
c. Dependent on node for transmittal
3. Importance of information
a. Tactical scale
1) Officer or Public safety
2) Possible safety issue

PG. 200

Owen Berger
3) Crime issue
4) Protest/demonstration
5) Natural Disaster
a) Earthquake
b) Flood
c) Tsunami
d) Fire
6) Emergency
a) Bridge collapse
b) Traffic-related
c) Building collapse
7) Etc
b. Should be designated prior (Hint, hint)
c. When and who needs to know
1) Designated beforehand
2) Who gets credit
a) Not important
b) Not important
c) Not important
d. Vetting and validation system should determine this
1) Interface or node
2) Automatic for all information?
4. Vetting and validating information
a. Consider the source
1) Reliable
2) Unreliable
3) Unknown
4) History of information
a) Good
b) Bad
c) Accurate
d) Poor
e) Exaggerated
5) Other sites/posts/messages/info from same source
b. Consider the actual information
1) Context
a) Fit/Doesnt fit
b) Tone
(1) Serious

PG. 201

Owen Berger
Threatening
Warning
Joking
Sarcasm
c) Location
2) Accuracy
a) Demonstrably false
b) Outnumbered by opposing information
c) Quantifiable
(2)
(3)
(4)
(5)

PG. 202

Owen Berger
Module III Real-time Intelligence Systems: Policy Development.

Module Goal. To teach students how to develop policies for gathering and
disseminating intelligence from Social Media and the Internet.
Learning Objective. The students will develop Social Media policy while working in
small groups with Internet access and a time-limit of 60 minutes for preparation and 6 minutes
for presentation, and must score a three (3) or higher on each category of the Policy
III. Social Media and Intelligence Policy
A. Policy and the Law
1. Current case law
a. Konop v Hawaiian
1) About
a) Konop made private website
(1) Restricted access to only other pilots
(2) Blogged about union and employer
(3) Critical of both union and employer
b) Airlines president used, with permission, other pilots logins
(1) Spoke with current union head
(2) Current union head called and threated Konop with lawsuit
c) Konop sued for violations of
(1) Wiretap act
(2) Railway Act
(3) Stored Communications Act
d) Ultimately there was suppression of union activity
2) Legally view a website - Roles
a) User
b) Administrator
c) Law enforcement
3) Definition of User
a) Login or open access
b) Terms of Service
(1) Authenticating the agreement
(2) TOS allow/disallow specific items
c) Determining the actual person
(1) Gleaning importance
(2) Invitation vs pre-subscribed

PG. 203

Owen Berger
(3) Intentional recipient vs open subscription

a) Interception vs Reception vs Storage/Retrieval
b) Direct sending
d) Actively transmitting vs retrieval from storage
2) Two-prong tests
a) Determine who you are speaking as
(1) Employee
(a) Statements for work purposes
(e) Using work resources
(f) Work Equipment
(g) Work supplies
(h) Work Technology
(2) Citizen
(a) On off-time (off-duty)
(b) Using private/personal equipment
(2) Normal situation arising out of work
(3) Right to know / Need to know
3) Punishment and Retaliation
a) Government has to function
b) Did the action impair that function
(1) Effect on the employees ability to continue working
(2) Effect on employers mandate or reputation
c) Punishment/retaliation
(1) Warranted
(2) Proportional
(3) Unusual
1) Cromer arrested John Michael Montgomery
a) DUI Arrest
(1) Popular Country/Western singer

PG. 204

Owen Berger
(2) Lawful arrest

(3) Led to misdemeanor plea-bargain
b) Posts on Myspace
(1) Posts and comments by Cromer
(2) Posts and comments by Myspace friends
c) Punishments
(1) Cromer put on leave
(2) Cromer dismissed/terminated
a) On-duty
(1) Acting as representative of your organization
(2) Must abide by all policies/procedures
(3) Can identify as law enforcement
(4) Can hide identity for certain operations
b) Off-duty
(1) Should not identify as law enforcement
(2) Can behavior
(a) Affect your ability to work
(b) Affect your employers ability to function
(c) Affect reputation of you or your employer
3) Termination for off-duty behavior
a) It is possible
b) It is legal
c) Never identify yourself as law enforcement
(1) Use whistleblower protections if needed
(2) Use the proper channels for reporting misconduct
1) Setting: Occupy Wall Street 2011-2012
a) @destructuremal (Malcolm Harris)
b) Assisted with organizing move to protest on bridge
c) Assembly was declared unlawful
d) Several arrested for civil disturbance, including Harris
2) NY District Attorney used tweets from @destructuremal to prosecute
a) Wrote search warrant to Twitter
b) Harris opposed as a third party
c) Twitter withheld warrant until judgment was given
d) Judge ruled in favor of NY DA, with time limits.
(1) Valid search warrant with probable cause was used

PG. 205

Owen Berger

(b) Twitters Terms of Service specifically stated
i. All content sent to or via Twitter belongs to Twitter
ii. They can give information with valid L.E. request
(3) Search warrant is necessary for info within last 180 days.
e) Twitter gave warrant return back to NY DA.
3) Lessons
a) Valid search warrants usually trump other considerations
(1) Warrant scope
(a) Limited to only what is necessary
(b) No overreach
i. Information-wise, and
ii. Time-wise
(d) Specific and related, no fishing expeditions.
(2) Probably cause
(a) Good PC can articulate the level of information needed
(b) Dont ask for it if you shouldnt get it.
(c) Traverse and quash will eliminate all information from warrant
b) Terms of Service
e. U.S. v Meregildo
1) Suspect Melvin Colon was involved in racketeering case
a) Sent evidence to Facebook friend, which indicated guilt.
b) Colon opposed the evidence
(1) Stated info was meant to be private
(2) Was confidential
(3) Sent to Facebook friend only
c) Facebook friend was a Confidential Information
2) Ruling found in favor of law enforcement
a) Communications were intended as private
b) However, after sending information
(1) Recipient is free to do with information as they please
(2) Social Medias expectation of privacy is narrowing
(3) How do you know who you are sending information to?
3) Projection/amplification of Social Media
a) Sharing in one method can become several methods
(1) Linked accounts
(2) Using same e-mail as base account

PG. 206

Owen Berger

b) Private accounts can link to non-private accounts.
c) Law enforcement should look at all avenues and accounts
2. Other legal considerations
1) Definition
2) Detrimental to law enforcement
a) Preventing overreach can become limiting to law enforcement
b) Public distrust becomes tangible
c) Information sources dry up
d) Public accounts become private
b. Law and ethics
1) Law vs ethics
2) Ethical behavior online
3) Sorry, but here it is, Netizen
4) The other persons shoes thing
a) Private citizen
b) Criminal
c) Law enforcement
c. What other laws govern the same behavior
1) Confidential informants
2) Privacy laws
3) On-duty vs off-duty snooping
B. Policy Purpose
1. Defining a purpose (Why?)
a. To correct a deficiency
1) Worthy of written policy
2) Methods to correct this deficiency
a) Training
(1) In-service
(2) Academy
(3) Online/Portal training
(4) Outside training if few enough personnel
(5) Outside training with train-the-trainer section
b) Background screening
c) Case law
d) New Laws
(1) Federal
(2) State

PG. 207

Owen Berger
(3) Local
b. Guidelines for new technology
1) Technology/issue requiring guidelines
a) More training
b) Liability issues surrounding technology
c) Impact of technology on
(1) Citizens
(2) Criminals
(3) Law enforcement
2) Technology policy coverage under different and existing policy
a) Use of force examples
(1) Taser
(2) Baton
(3) Bean bag shotgun
(4) CRCH
b) Media relations policy
c) Undercover/plainclothes policy
c. Guidelines for new issues
1) Requiring guidelines
2) Applicable under different and existing policy
3) Circumstances under which this issue arose
4) New laws to address this issue
a) Federal
b) State
c) Local (Municipal)
d. Prevent possible future lawsuits/legal action
1) Ramifications with and without policy
2) Policy that hinders law enforcement
3) Safety issues/concerns
e. Prevent abuse by law enforcement
1) Bad cop v deficiency in policy
2) Reactive case law
3) Cops are their own worst enemies
2. Defining a purpose
a. Write it down
1) On paper
2) During planning
3) In the actual policy
b. Is it

PG. 208

Owen Berger
1) Narrow
2) Specific
3) Necessary
c. Utilize the elements of Critical Thinking:
a) Clarity
b) Accuracy
c) Precision
d) Relevance
e) Depth
f) Breadth
g) Logic
h) Fairness
a) Purpose/Goal/End
b) Question at issue/Problem to be solved
c) Assumptions
d) Point of View/Frame of reference
d. Articulation
1) Proper English
2) Organized
3) On-target
C. Social Media and Internet Policy Elements
1. Purpose, Purpose, Purpose
a. Criminal Activity
b. Gather Intelligence/Information
c. Consistent with
1) Mandate
a) Agency
b) Division/Bureau
c) Unit
2) Authority
a) Agency
b) Division/Bureau
c) Unit

PG. 209

Owen Berger
2. Duty categories
a. Apparent/overt
1) No concealing
2) Privy to public
3) Identity is known
b. Discreet
1) Knowledge could hamper investigation
2) Covering tracks
3) Not giving identity
c. Covert
1) True identity cannot be revealed
2) Contact between law enforcement and target
3) False personas
d. Supervisor oversight increases up the scale
3. Information vetting/validation
a. Different than traditional methods
1) Often cannot be:
a) Verified
b) Validated
c) Corroborated
2) Is reaction
a) Necessary
b) Mandatory
c) Lawful
b. Types of vetting
1) Respond to or question source
2) Multiple sources
3) Radio call example
4) Target/user
a) Tone
b) History
c) Other accounts
c. Necessity
1) Validation
2) Demonstrations
3) Officer Threats
4) Public Threats
4. Tools and technologies
a. New source of information

PG. 210

Owen Berger
Covered by other policies

Time frame of use
Purpose
Authorization
Approval
Tracking
1) Formal
2) Informal
3) Case notes
4) Discoverability
h. Automation
1) Could expand use beyond purpose
2) Could inadvertently expose monitoring
3) Over-reliance
5. Information Storage and Documentation
a. 28 CFR Part 23
1) Policy guidelines for federally funded intelligence systems
2) Nexus to criminal activity
3) Belief that ones conduct may be criminal
b. Minimum amount of time possible
c. Secure storage and distribution
1) Attention Gmail users
2) Encryption
3) HTTPS
4) Law enforcement networks (monitored by civilians)
d. Rules of evidence apply
6. Use of resources is within all laws and guidelines
a. Federal
b. State
c. Local
d. Laws
e. Regulations
f. Policy
g. Guidelines
7. Off-duty considerations
a. Off-duty conduct
1) Personal Social Media for work
2) Personal Social Media affecting work
3) If related at all to work, should be covered under same policy
b.
c.
d.
e.
f.
g.

PG. 211

Owen Berger
b. Off-duty conduct under on-duty policy

c. Employees personal Social Media
1) Illegal to mandate viewing in CA for backgrounds
2) Circumstances that allow for employee snooping
a) Workers compensation claims
b) Alcohol/Drug abuse claims
3) Termination or firing
a) Cromer vs Lexington
b) Complete and utter separation of concerns
8. Information or Intelligence Dissemination
a. Encryption
b. HTTPS
c. Cold Computers
d. Department e-mail
e. Civilian Oversight
f. Content being sent
g. System in place

PG. 212

Owen Berger
Module IV Teaching Cyber-monitoring.

Module Goal. To teach students how to teach others how to gather and disseminate
real-time intelligence with Social Media and the Internet.
Learning Objective. The students will teach cyber-monitoring while working in small
groups with a specified audience type and lesson subject, as well as a time-limit of 120 minutes
for preparation and 15 minutes for presentation, and must score a three (3) or higher on each
category of the Teaching Cyber-monitoring Rubric.
IV. Teaching cyber-monitoring
A. Teaching cops
1. Positional
a. Types
1) Line personnel
a) Patrol
b) Specialized Units
(1) Gangs
(2) Narcotics
(3) Vice
c) Detectives/Investigators
(1) Divisional
(2) Homicide
(3) Force Investigation
(4) ICAC
(5) Terrorism
d) School Resource
e) Reserve
f) Traffic
(1) Motors
(2) Collision Inv.
(3) Traffic Enforcement
(4) Parking Enforcement
2) Non-line Specialized Personnel
a) SWAT
b) Bomb Squad
c) Force Investigation
d) Parole
e) Probation

PG. 213

Owen Berger
3) Administrative Personnel
a) Command Staff
b) Event staff
c) Audits
d) Community Relations
e) Internal Affairs
4) Civilian Personnel
a) Analysts
b) Service Representatives
c) Dispatchers
d) Reports
e) Jail
b. Strategies
1) Tactics
2) Clearing cases
3) Caseload Management
4) Crime prevention
5) Crime management
2. Duties
a. Types
1) Investigative
2) Reactive
3) Radio Calls
4) Special Orders
5) Audits
6) Community Relations
b. Strategies
1) Tailored Buy-in or WIIFM
2) Efficiency vs Accuracy
3) Strategy vs Tactical
4) Targeting
a) Criminals
b) Community-oriented
B. Generational
1. Types
1) 1927 1945
2) Conformists
3) Married for life

PG. 214

Owen Berger
Readers
Self-sacrifice
Debt-free
Radio
Flight
b. Baby Boomers
1) 1946 1964
2) Revolutionaries/Hippies
3) Yuppies
4) Buy now save later
5) First TV generation
6) Active in retirement
7) More Acceptance
a) Divorce
b) Homosexuals
c. Generation X
1) 1965 1980
2) Latch-key kids
3) Individualistic
4) Entrepreneurial
5) Feel misunderstood
6) Learners
7) Explorers
8) Drugs
9) Life/Work balance
10) Tolerant
11) Weary of authority
12) Weary of societal structure
13) Weary of company oversight/structure
1) 1981 2000
2) Nurtured
3) Respect Authority
4) Lower crime rates
5) Academically pressured
6) Great expectations
7) Want things immediately
8) Unlimited access to information
9) Teamwork, not individual
4)
5)
6)
7)
8)

PG. 215

Owen Berger
e. Generation Z / Boomlets / Homeland

1) After 2001
2) Majority have TVs
3) Always have had computers and cell phones
4) Eco-fatigue
5) KGOY kids growing older younger
6) Smith vs Rodriguez
2. Formative Events
1) 1927 1945
2) Great Depression
3) WWII
4) Korean War
5) Vietnam War
6) Rise of labor unions
7) The New Deal
b. Baby Boomers
1) 1946 1964
2) Vietnam War
3) Civil Rights
4) The Cold War
5) Woodstock
6) Kennedy Assassination
c. Generation X
1) 1965 1980
2) Latch-key kids
3) Fall of Berlin wall
4) Challenger explosion
5) PC Boom
6) MTV
7) AIDS
1) 1981 2000
2) Iraq
3) Afghanistan
4) Pakistan
5) The Internet
6) Columbine
7) 9/11

PG. 216

Owen Berger
8) Oklahoma City Bombing

e. Generation Z / Boomlets / Homeland
1) After 2001
2) 9/11
3) Facebook
4) Twitter
5) Cyberbullying
6) Texting
3. Learner Characteristics
a. Mature/Silent
1) 1927 1945
2) Loyal
3) Follows Orders
4) Structured
5) Set in their way
6) Logical
7) Appreciate Consistency
8) Read (need written materials)
b. Baby Boomers
1) 1946 1964
2) Workaholics
3) Needs Recognition
4) In to problem-solving
5) Interested in efficiency
c. Generation X
1) 1965 1980
2) Latch-key kids
3) Techno-literate
4) Self-starters
5) Individualistic
6) Skeptical
7) Dont need authority/structure
8) Learn by doing
1) 1981 2000
2) Goal-oriented
3) Collaborative
4) Achievement
5) Team-players

PG. 217

Owen Berger
Require supervision
Sociable
Possible cheating problems
Need feedback/attention
e. Generation Z / Boomlets
1) After 2001
2) Instant information gratification
3) Extreme technical know how
4) Will figure it out
C. Constraints
1. Time
a. To prepare
1) Specific Students
a) By duty
b) By generation
c) Other learner characteristics
2) Classroom location
a) Obtaining resources
b) Changing learning activities
c) Late Students
b. Management
1) Too much material, too little time
a) Priorities
b) End goal
c) Specific Behavior
d) Student
(1) Priorities
(2) Goals
(3) Limitations
2) Too little material, too much time
a) Possible?
b) Review
c) 7 times rule
3) Ending on time
a) Letting students out early
b) Breaks
c) 50 Minute attention span
2. Resources
a. Reliance on others
6)
7)
8)
9)

PG. 218

Owen Berger
1) Ensure you have backups

2) Dont rely on presenter or hotel
3) SPECIFY requirements in course flyer
b. Multiple ways to conduct same activity
1) Flip chart
2) Computer
3) Projector
4) Activity
5) Outside of classroom
c. Computer Investigations course with no Internet
d. Preparation
1) Test everything
2) Student safety is first
3) Arrive early
4) Be prepared
5) No peeks behind the scenes
3. Student constraints
a. Disabilities
b. Desire
c. Improper materials
d. Forced to go
e. Overcoming resistance (see later section)
f. Not prepared
g. Tired/Overworked
D. Learning Activities
1. Design considerations
a. Student-centered
1) Centered on students or on instructor expectations
2) Dynamic activity vs static scenario
3) Student Considerations
a) Generational
b) Positional
b. Empathetic
c. Safe
1) Physical safety
a) Leaving classroom
b) Crossing major streets
c) Equipment
d) Firearms?!

PG. 219

Owen Berger
e) Other weapons
f) Environment
(1) Construction
(2) Power cords
(3) Creating or building with materials
2) Other safety
a) Emotional (Trauma, PTSD, etc)
b) Hurt feelings
(1) Verbal boundaries
(2) Over-active participation
(3) Relative participation
(4) Duds
d. Interesting
1) Related to subject matter
2) WIIFM
3) Buy-in
4) Different than other activities
5) Flip-chart exhaustion
e. Appropriate
1) Student-screening
2) Self-screening
3) Role-playing
f. Realistic
2. Knowledge vs behavior
a. End goal
1) Knowledge-based
2) Behavior-based
b. Testing
1) Evaluated activities
2) Rubric Presentation
3) Prepared for evaluation/test
E. Overcoming Resistance
1. Problem Students
a. Types
1) Forced to be there
2) Outside of comfort zone
3) Other issues
a) Family
b) Work

PG. 220

Owen Berger
c) Time
4) Generally resistant (e.g. generational)
5) Disrespectful
a) Blatant disrespect
b) Passive disrespect
(1) Late, late from breaks
(2) Cell phones
6) No buy-in/WIIFM
b. Options
1) Direct approach
a) Side talk
b) In front of class
2) Student boundaries/enforcement
3) Asked to leave
2. Prevention Strategies
a. Student rules
1) Guided
2) Students become enforcers
3) Buy-in on following rules
b. Instructor expectations
1) Clear
2) Laid-out beforehand
3) Respectful
4) Realistic
c. List of classroom rules/expectations
1) In student flyer/preparation e-mail
2) Handout
3) PowerPoint Slide
F. Introduce Critical Thinking
1. Utilize the elements of Critical Thinking:
a. Intellectual Standards
1) Clarity
2) Accuracy
3) Precision
4) Relevance
5) Depth
6) Breadth
7) Logic
8) Fairness

PG. 221

Owen Berger
b. Elements of reasoning
1) Purpose/Goal/End
2) Question at issue/Problem to be solved
3) Assumptions
4) Point of View/Frame of reference
5) Facts/Data/Evidence
6) Theories/Concepts/Ideas
7) Inferences/Conclusions
8) Implications/Consequences
2. Critical thinking as applied to the subject matter
a. Define the central focus
1) Issue
2) Point
3) Problem
4) Concern
b. Apply critical thinking
1) Intellectual standards
2) Applied with sensitivity to
3) The elements of thought/reasoning
3. Critical Thinking in law enforcement
a. Time consideration
1) Instant reaction
2) Planning
3) Analysis
b. Used in
1) Policy-making
2) Current Duties
3) Investigations
4) Community relations

PG. 222

Owen Berger
Roster
A raw copy of the course roster can be found on the next page. However, there is an updated
electronic version kept in the administrative folder of this courses online repository, which can
be located by following the link below. The electronic version should be printed and used when
feasible as it will contain the most recent and accurate information.

PG. 223
ADDRESS WHERE TRAINING IS BEING CONDUCTED:
LOS ANGELES POLICE DEPARTMENT

POST-CERTIFIED COURSE ROSTER
Holiday Inn Burbank, 150 E Angeleno Ave, Burbank CA 92502
COURSE CONTROL NUMBER:
COURSE TITLE:
# OF COURSE HOURS: COURSE PRESENTATION DATE(S):
1850-
24
TRAINEE
(LAST NAME, FIRST)
SERIAL NUMBER
(PLEASE PRINT OR TYPE)
HOW DID YOU GET TO

THIS TRAINING? *
START TIME:
0800
# COURSE HOURS
COMPLETED
END TIME:
1700
LAPD DIVISION
POST ID NUMBER
(or OUTSIDE AGENCY)
If no POST ID Number, provide

full Social Security Number.
(LAPD, ONLY, COMPLETE ALL THAT APPLY) (NEEDED ONLY IF

CITY
VEHICLE
DRIVER
PERSONAL
VEHICLE
PASSENGER
ATTENDEE DID
NOT COMPLETE
COURSE)
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
INSTRUCTOR 1 NAME AND SERIAL #:
Owen Berger, Serial No. 37319
All students on this roster have met the Student Learning Outcomes for this course.
INSTRUCTOR 2 NAME AND SERIAL#:
Christopher Bouse, Serial No. 36881

COORDINATOR NAME:
COORDINATOR SERIAL #: DATE:
TELEPHONE:
Page
*In many cases, POST Sacramento reimburses LAPD training travel expenses. Therefore, means of transportation must be recorded. Trainees attending a class at their regular
workplace should check Personal Vehicle. Personnel with assigned vehicles and/or driving a City vehicle should check City Vehicle Driver.
of
POST Course Roster.doc
(Revised 6/2013)

Owen Berger
Safety Plan
Instructor Quick Reference.
Life-threatening or Serious Emergency:
Fire-related Emergency:
Police-related Emergency:
Dial 911.
Dial 911 or (818) 238-3473 (Burbank Fire).
Dial 911 or (818) 238-3333 (Burbank Police).
Purpose and Rules. The purpose of this Safety Plan is to assure student and staff safety
during the training program. All Department safety rules and injury reporting guidelines apply
during this training. All participants will be responsible to adhere to all rules in this policy.
Safety that applies to all training:
1. Anyone participating in the training, whether student, observer, or instructor, has the
authority to STOP the exercise if they observe an unsafe act or condition that may
cause imminent injury or death and/or damage to the facilities.
2. Students shall immediately notify an instructor(s) or the training staff of any injury
sustained during training, and use the following steps in the event of a serious injury.
3. Render first aid and obtain appropriate medical assistance. Notify the Fire Department
rescue ambulance via telephone, cellular phone, or police radio. Give specific directions
to the location of the incident.
4. In case of a serious injury, all Injury and Illness Prevention Plan (IIPP) notifications and
protocol shall be followed.
5. At each training location, there is a notebook containing the emergency plan that is in
place.
6. The supervisor will ensure that the necessary worker compensation forms (PDAS-43),
Employee injury (Form 1.66) and other reports (Employee Notification Form 15.7) are
completed in a timely manner.
7. Transport to the local hospital for all minor injury.
8. Request a Rescue Ambulance for all major injuries.
9. The training site shall be inspected for hazards prior to each use.
10. Instructors shall maintain an appropriate level of discipline over students at all times.
Safety Contact Information. The sites below are either the closest in proximity to the
training site, or they were chosen because they handle dispatch duties that would result in the
most rapid medical response to the training site.

PG. 225

Owen Berger
Training Site.
Holiday Inn Burbank Media Center (http://www.ihg.com/holidayinn)
150 East Angeleno Avenue, Burbank, CA 91502
(818) 841-4770
Nearby Hospitals.
Providence Saint Joseph Medical Center (2.1 miles from training site)
501 S Buena Vista St, Burbank, CA 91505
(818) 843-5111
Glendale Adventist Medical Center (6.4 miles from training site)
1509 Wilson Terrace, Glendale, California 91206
(818) 914-7546
Nearby Fire Department.
Burbank Fire Department HQ (0.3 miles from training site)
311 E Orange Grove Ave, Burbank, CA 91502
(818) 238-3473
Nearby Police Department.
Burbank Police Department (0.4 miles from training site)
200 North 3rd Street
Burbank, California 91502
(818) 238-3333
Table of Contents
PG. 226

Owen Berger
References
Arizona Counter-Terrorism Information Center. (2010, October 29). (U//LES) Arizona Fusion
Center Warning: Police Officers Targeted on Facebook. Retrieved March 7, 2014, from
https://publicintelligence.net: https://publicintelligence.net/ules-arizona-fusion-centerwarning-police-officers-targeted-on-facebook/
This document was published as a warning to law enforcement in the United States.
The warning outlines a traffic stop wherein digital evidence was found that contained
photographs of law enforcement personnel. All of the photographs were retrieved from
the Social Media site Facebook.com. The warning serves as a reminder of the dualnature of Social Media visibility for law enforcement. That is, just as law enforcement
can view criminal activity and profiles online, the criminal element can conduct the
same type of research on law enforcement. This report was used in this course to
demonstrate the real-world necessity for thinking on officer safety when using Social
Media.
Brinkerhoff, R. O., & Dressler, D. E. (2003). Using the Success Case Impact Evaluation Method to
Enhance Training Value & Impact. (p. 15). Portage, Michigan: The Learning Alliance.
Table of Contents
PG. 227

Owen Berger
Retrieved July 4, 2014, from

http://www.kenblanchard.com/img/pub/newsletter_brinkerhoff.pdf
This conference report is a summation of the Success Case Impact Evaluation Method
(SCM) for training that was first introduced by Robert Brinkerhoff. The method is used
to evaluate training, and was introduced primarily as a way to discover the efficiency of,
and improve, business-related training. This report gives summations and examples of
the SCM, and was presented at the American Society for Training and Development
International Conference and Exhibition 2003, in San Diego, California. This report was
used as the basis for a modified success case method in the Instructional System Design
(ISD), specifically in the Post-course Evaluation Plan, and the Evaluation Instruments
section of this Total Training Package (TTP).
Bureau of Justice Assistance, Office of Justice Programs, United States Department of Justice.
(2013). Developing a Policy on the Use of Social Media in Intelligence and Investigative
Actions, Guidance and Recommendations. United States Department of Justice, Bureau
of Justice Assistance, Office of Justice Programs. Global Information Sharing Initiative.
Retrieved April 21, 2014, from https://it.ojp.gov/docdownloader.aspx?ddid=1826
Table of Contents
PG. 228

Owen Berger
This jointly-produced report is aimed at guiding organizational policy regarding Social

Media use for intelligence and investigative actions. The report provides an overview of
how Social Media has become useful for law enforcement. The report then delves into
the reasons for proactive Social Media policy, including privacy, civil rights, and civil
liberties. The delivery strategy for this reports content is a list of seven necessary policy
elements, in paragraph format. The report concludes with an appendix that contains
several versions of current policies that 1) were referenced during the article, or 2) are
for the readers continued reference. This report was used as a basis for the formation
of course content, specifically some basic policy elements for the third course module,
developing Social Media policy.
California Peace Officer Standards and Training. (2014, August 6). California POST Requirements
for Course Budget. Retrieved August 6, 2014, from Commission on Peace Officer
Standards and Training: https://www.post.ca.gov/regulation-1054-requirements-forcourse-budget.aspx
This website contains a listing of information on budget items for California Peace
Officer Standards and Training (POST) courses. This site was used in preparing the
budget section of the POST Certification Package.
Table of Contents
PG. 229

Owen Berger
CNN (Cable News Network). (2011, May 5). American generations through the years. Retrieved
April 13, 2014, from www.cnn.com:
http://www.cnn.com/interactive/2011/05/living/infographic.boomer/
This website contains an infographic that shows, as the title states, a graph of
American generations across several decades. This infographic was used to correlate
the two primary yet different definitions of generational starting and ending years
introduced by the Pew Research Center, and Strauss and Howe.
Cromer v. Lexington/Fayette Urban County Government, 2008-CA-000698-MR (Commonwealth

of Kentucky Court of Appeals April 10, 2009).
In the Cromer v. Lexington/Fayette Urban County Government decision, a law

enforcement officer was terminated by the governing city council after the officer
posted inappropriate material on Social Media after self-identification as a law
enforcement officer. The original trial court ruling was upheld, and the termination was
found to be valid. This case was used in this course to show the blurred lines between
personal and professional Social Media for law enforcement. This case also shows the
possible employment repercussions of violating an employers misconduct rules,
whether intentional or not.
Table of Contents
PG. 230

Owen Berger
Friesner, T. (2014, May 8). The Six Living Generations in America. Retrieved from
MarketingTeacher.com: http://www.marketingteacher.com/the-six-living-generationsin-america/
This website page is a list-style collection of information about current American

generations. The information about each generation includes year ranges, formative
events, and characteristics. This information was distilled into articulable generational
differences that were then used content in module four, Teaching Cyber-monitoring.
Garcetti et al. v. Ceballos, 547 U.S. 410 (2006) (Supreme Court of the United States May 30,
2006).
In the Garcetti et al. v. Ceballos decision, a deputy district attorney sued his employer
based on 1st and 14th Amendment issues. The deputy district attorney, Ceballos,
claimed that he had been retaliated against for writing a memo critical of a search
warrant that was being used in an ongoing case. In this case, the retaliation was reassignment of duties and transfer to a different courthouse.
The Supreme Court of the United States later ruled on appeal that Ceballos right to free
speech was not infringed upon as his comments were made during the course and
Table of Contents
PG. 231

Owen Berger
scope of his employment. Garcetti v. Ceballos was used in this course to clarify the role
of free speech in the course of law enforcement employment. This case expands upon
Pickering v. Board of Education, and will assist course attendees in determining their
specific role (citizen versus employee), and the possible consequences, when using
Social Media to disseminate information.
Ginsburg, D. B. (2014, June 19). Diane Ginsburg: Teaching Across Generations. Retrieved from
University of Utah College of Pharmacy:
http://pharmacy.utah.edu/pharmacotherapy/adjunct/pdf/Ginsburg_Generation_Precep
tor_Presentation_Utah.pdf
This website document is a presentation (in slide format) about the differences between
generations both in general and with regards to learner characteristics. The
presentation was used by this ISD to enumerate generalized (and perhaps simplified)
differences between the generations. This information was distilled into articulable
generational differences that were then used content in module four, Teaching Cybermonitoring.
Jr., R. G. (2011). Adapting Teaching to the Millennial Generation: A Case Study of a

Blended/Hybrid Course. International CHRIE Conference-Refereed Track, Paper 3 (p. 8).
Table of Contents
PG. 232

Owen Berger
Denver, CO: University of Massachusetts - Amherst. Retrieved from

http://scholarworks.umass.edu/refereed/ICHRIE_2011/Thursday/3
This case study report delves into the learner characteristics of the Millennial
generation. The report first lists generalized characteristics of Millennials, and then
describes how those characteristics were implemented into a course in Hospitality Sales,
which was subsequently taught many times using increasing amounts of technology and
learner characteristic-driven teaching methods. One key note of the report is that
Millennials need to feel special, and that even heavy use of technology cannot make
up for not catering to this learner characteristic.
Keenan, V. M., Diedrich, D., & Martin, B. (2013, June). Developing Policy on Using Social Media
for Intelligence and Investigations. PoliceChief Magazine (80), 28-30. Retrieved March 7,
2014, from
http://www.policechiefmagazine.org/magazine/index.cfm?fuseaction=display_arch&art
icle_id=2951&issue_id=62013
This article was written by several employees from the Georgia Bureau of Investigation,
and discusses policy development for law enforcement and its use of Social Media for
intelligence. The article gives examples of current policies, how they were formed, and
Table of Contents
PG. 233

Owen Berger
then discusses several key issues regarding policy development, including: policy
purpose, levels of use, reliability and validity of information and intelligence,
documentation, and off-duty conduct. The article was used as a basis for the formation
of course content, specifically policy elements for the third course module, developing
Konop vs Hawaiian Airlines, Inc., 236 F.3d 1035 (2001) (United States Ninth District Court of
Appeals January 8, 2001).
In Konop vs Hawaiian Airlines, Inc., the plaintiff (Konop) created a website critical of his
employer that was accessible only by other pilots and only by entering a username and
password and accepting the sites terms of service. A Hawaiian Airlines management
official accessed the website using a pilots login credentials (with permission) and later
disclosed website content. The 9th Circuit United States Appellate Court held, under
the Wiretap Act, that the airlines official was not authorized to view or intercept the
electronic communications. The court also held, under the Stored Communications Act,
that the login credentials used by the airlines official were not valid for third-party
permission as they had never been used by the original recipients.
Table of Contents
PG. 234

Owen Berger
This case, much like Garcetti v. Ceballos, helps to clarify what actions can and cannot be
undertaken by employees. Although this case deals with a private employers, it deals
specifically with an Internet site. One interesting aspect of this case is that it deals with
relatively old legislation to attempt to settle case law for newer technology and
employment issues arising out of that technology.
Lipp, K. (2013, October 28). How Police Use Social Media To Monitor, Respond to, and Prevent
Mass Gatherings. Retrieved March 7, 2014, from https://kennethlipp.wordpress.com:
http://kennethlipp.wordpress.com/2013/10/28/how-police-use-social-media-tomonitor-respond-to-and-prevent-mass-gatherings/
Found during an online search, this article is a focused look at law enforcements use of
Social Media to monitor special events. The articles uses photographs and real-life
examples to discuss tactical and policy considerations for law enforcement with regards
to the use of Social Media and the Internet for monitoring protest or protest-like events
and those people associated with the events. The article mainly follows the proceedings
at the 2013 International Association of Chiefs of Police conference, and was used to
gather anecdotal evidence of current trends in intelligence use by modern law
enforcement.
Table of Contents
PG. 235

Owen Berger
Merriam-Webster. (2014, June 18). Information - Definition and More from the Free MerriamWebster Dictionary. Retrieved June 18, 2014, from Dictionary and Thesaurus - MerriamWebster Online: http://www.merriam-webster.com/dictionary/information
This Internet page is from the online dictionary from Merriam-Webster. The definition
for the word information was used as the basis for a facilitated discussion during the
course on the varied definitions of intelligence and information.
Murphy, J. P., & Fonticella, A. (2013, April 3). Social Media Evidence in Government
Investigations and Criminal Proceedings: A Frontier of New Legal Issues. Richmond
Journal of Law & Technology, 19(3), 1-30. Retrieved March 7, 2014, from
http://jolt.richmond.edu/v19i3/article11.pdf
This article delves into the nuances of law enforcements use of Social Media and the
subsequent impact on criminal case law and proceedings. Among the topics discussed
are: digital evidence admissibility, the Stored Communications Act, criminal defense and
defendants rights, and the effect or impact on juries. The article gives many current
examples of case law, including several that were included in the related Training Needs
Assessments (TNA) Literature Review. This articles provided valuable insight from
private sector attorneys who practice in defense law. This point-of-view gives breadth
Table of Contents
PG. 236

Owen Berger
to not only the Literature Review, but to the course content by acknowledging concerns
of those in the criminal justice system who are not in law enforcement.
People of the State of New York v. Malcolm Harris, 2011NY080152 (New York Criminal Court
June 30, 2012).
People v. Malcolm Harris was a case that originated during the Occupy Wall Street
movement in New York during 2011 and 2012. The City of New Yorks District Attorney
subpoenaed the Twitter (a Social Media site) records for Harris, a protester during the
Occupy Wall Street movement. The District Attorney was seeking a charge of disorderly
conduct against Harris, the defendant. Harris attempted to quash the search warrant on
1st and 4th Amendment grounds. However, the courts ruled with the District Attorney
and the defendants Twitter records were eventually provided to the District Attorney.
This case is important to this course because it is settled case law on an aspect of exactly
what this course will be teaching students. That is, if students are to gather intelligence
and attempt to retrieve evidence, this case demonstrates how to verify who owns that
evidence or information. As far as course content, this case shows (1) the power of a
legal subpoena, and (2) the need for law enforcement to read and understand private
companies legal publications, such as Terms of Service or End User License Agreements.
Table of Contents
PG. 237

Owen Berger
Police Executive Research Forum (PERF) and the United States Department of Justice, Office of
Community Oriented Police Services. (2013). Social Media and Tactical Considerations
for Law Enforcement. Washington, DC: Office of Community Oriented Policing Services,
United States Department of Justice. Retrieved March 6, 2014, from
http://www.policeforum.org/assets/docs/Free_Online_Documents/Technology/social%
20media%20and%20tactical%20considerations%20for%20law%20enforcement%202013
.pdf
A joint effort of several organizations, this report was created as a reaction to the ability
of citizens to communicate rapidly through Social Media for the purposes of organizing,
protesting, and demonstrating. This rapid communication reality has consequences for
most things law enforcement, including public perception, crime-related information,
and data-mining pre- and post-event. The report focuses on several case studies that
come in the form of either a law enforcement organization that uses Social Media or a
tactical situation that necessitated the use of Social Media. These case studies (and this
report) were used to draw several conclusions that were necessary for course content.
Perhaps the most important of the conclusions drawn from this report was the need for
an intelligence system to be established prior to an event occurring.
Table of Contents
PG. 238

Owen Berger
Trottier, D. (2012). Social Media as Surveillance: Rethinking Visibility in a Converging World.

Farnham, Surrey, England: Ashgate Publishing Limited. Retrieved March 7, 2014, from
http://books.google.com/books?id=DOYjUNHs6yEC&pg=PT2&source=gbs_selected_pag
es&cad=3#v=onepage&q&f=false
This book is an extensive look at interpersonal communications via Social Media and
how people and organizations use these communications. It is a study on Social Media
and the intelligence gained with it from many of todays important perspectives. The
book starts with focus on the individual, then builds to institutional uses of Social Media
as surveillance, then delves into issues such as marketing and police uses. The last
chapter, entitled Policing Social Media, is what drew the attention of the researcher.
This book chapter was chosen for the research as an in-depth look at the subject matter,
written with an outside-of-law enforcement viewpoint by a Postdoctoral Fellow of
Social and Digital Media at Westminster Universitys Communication and Media
Research Institute. The key takeaway from this article was the limited-scope approach
that must be taken by law enforcement with regards to monitoring the public, leading
to purpose-driven course content.
Table of Contents
PG. 239

Owen Berger
United States of America v. Anthony Douglas Elonis, 12-3798 (United States Court of Appeals
for the Third Circuit June 14, 2013). Retrieved June 17, 2014, from
http://www2.ca3.uscourts.gov/opinarch/123798p.pdf
U.S. v. Elonis deals with the First Amendment and threats made online. Anthony Elonis
made specific sexual and threatening remarks against is estranged, then ex-, wife.
Elonis made the threats on Social Media, on Facebook.com. Elonis and his ex-wife were
not friends on Facebook, and this case seeks to determine when a threat online
becomes criminal. This case can be used in course content because it is ongoing and
shows the importance of law enforcement being aware of changes in laws and
legislation when monitoring Social Media and the Internet for intelligence.
United States of America v. Joshua Meregildo et al., 11 Cr. 576 (WHP) (United States District
Court - Southern District of New York August 10, 2012).
In the case of United States vs Meregildo, a defendant named Melvin Colon attempted
to suppress evidence against him that was obtained via the Social Media site Facebook.
The government gained access through a Facebook friend of Colons, who allowed the
government to view the Facebook posts made by Colon. The court ruled against Colon,
stating that although Colon has an expectation of privacy with regards to private posts,
Table of Contents
PG. 240

Owen Berger
that privacy does not extend to the Facebook friends who are free to do as they
please with the shared information.
U.S. v. Meregildo demonstrates, for the purposes of this course, how information flow
can determine the privacy of information. The case also demonstrates how information
can become part of the public domain despite the intentions of the content originator.
Law enforcement should be weary of where information comes from and its original
privacy attentions in order to avoid complications during criminal investigations or
proceedings.
Whelan, A., & Newall, M. (2013, November 9). Police probe website targeting crime witnesses.
Retrieved March 7, 2014, from http://www.philly.com: http://articles.philly.com/201311-09/news/43827173_1_witness-north-philadelphia-instagram
This news article covers the publication of witness information on an anonymous Social
Media account for the mobile application Instagram. The issue, as described by
Philadelphia police and prosecutors is the leaking of protected or private information
about police investigations in an attempt to intimidate witnesses in ongoing criminal
investigations. This article was used in this course to show how Social Media has
Table of Contents
PG. 241

Owen Berger
become so pervasive in modern society that it is even being used to facilitate criminal
activities such as witness intimidation.
Table of Contents
PG. 242

MICC8 TTP Notebook - Real-Time Intelligence With Social Media

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

MICC8 TTP Notebook - Real-Time Intelligence With Social Media

Загружено:

Авторское право:

Доступные форматы

MASTER INSTRUCTOR

Real-time Intelligence with Social Media,

:Los Angeles Police Department:

:Los Angeles Police Department:

:San Diego Regional Training Center:

POST Master Instructor Certification Course Class 8

POST Certification Package

Module I Lesson Plan

Module II Lesson Plan

Expanded Course Outline

Module III Lesson Plan

Module IV Lesson Plan

POST Master Instructor Certification Course Class 8

POST Master Instructor Certification Course Class 8

Lunch, 1130 - 1230

Lunch, 1100 - 1200

POST Master Instructor Certification Course Class 8

POST Master Instructor Certification Course Class 8

A. Types of cyber-monitoring [2]

[2] Facilitate Facilitate a discussion

POST Master Instructor Certification Course Class 8

visible to all students for the rest of the

B. Searching the Internet

are looking for

[3] Facilitate Write down the word

[4] Activity Learning Activity #1,

POST Master Instructor Certification Course Class 8

b) Too much information after

What are the potential

2. Safe searches with law enforcement

[5] Facilitate Facilitate a discussion

POST Master Instructor Certification Course Class 8

[6] Activity Learning Activity #2,

POST Master Instructor Certification Course Class 8

(1) A search to get

b. Please give a specific example of

POST Master Instructor Certification Course Class 8

C. Cyber-monitoring and the law [7] [7a]

affect your employment

acting as employee or citizen

[7] Facilitate Facilitate a discussion

POST Master Instructor Certification Course Class 8

D. Useful sites and tools [8]

[8] Individual work Give students

POST Master Instructor Certification Course Class 8

(2) Inherently safe, if only

you are using the device

[8a] Activity Learning Activity #3,

POST Master Instructor Certification Course Class 8

of twitter, including (groups with more

After the mini-presentations, each

POST Master Instructor Certification Course Class 8

b) Organic way to organize

b. If not, what would you change or

POST Master Instructor Certification Course Class 8

(2) Multiple layers of re-

tweets makes for a

so without using any of our Twitterspecific terms or nomenclature.

POST Master Instructor Certification Course Class 8

6) Twitter feeds (continuous

POST Master Instructor Certification Course Class 8

a. What Twitter provides

POST Master Instructor Certification Course Class 8