The MIRROR system is designed from the beginning as a tool to be used in the field of migration by border security practitioners and humanitarian organisations. This is reflected in all the system’s functionalities and in the data sets, it employs.
At a general level, MIRROR can aid threat analysis focused on irregular migration and associated threats in the following ways:
- source validation – The system provides information on the location of the source, the source type, language employed and locations mentioned in the source – elements which can be employed to assist in the source validation process. It also has a ‘bot detector’ functionality, which flags content that it thinks may have been shared by bots. Moreover, the system also provides users with a link to the original source, which can be employed by analysts when seeking to assess the validity of a source;
- creating timelines –The system provides the option to filter information in accordance with a certain time range which can be employed in order to create timelines on a particular subject;
- filtering information in different formats (e.g. text, audio/video) – The system provides users with multiple filtering options (designed specifically for the field of migration), which can assist the users in searching for relevant information. The options are: free text (explicit mentions of that concept in the text of the media item); geo origin (searching for results from a particular geographical area); source type (searching for a particular type of content); language (searching for content in a particular language); migration-related concepts (concepts identified by MIRROR partners as being relevant – system analyses images associated with these concepts); sentiment; named entities (search for references to particular entities, such as a person, object, place, named event, organisation); countries (search for references to particular countries); topics (search for references to particular topics); visual concepts (search for various concepts in images);
- organize and share information collected – The ‘Situation’ option enables users to create spaces for collecting, organizing and sharing open source information, which can be very useful especially in the context of large volumes of data. This functionality is also important to save results, thus enabling analysts to access them at a later time (irrespective of whether the content has been deleted in the meantime);
- translation of information – When searching in English, users will find results in English, German and Arabic. When searching in any other language than English, users will only receive results in that language (when such results are available);
- faster selection and processing of information – There are several functionalities which aid this goal, among which text summarization (e.g. reducing the time analysts must spend going through large amounts of text); automatic speech recognition (e.g. which provides analysts with a written transcription of the spoken content in audio and multimedia files).
Types of analysis that MIRROR can aid in
A. Collecting general/context information for Threat Analysis
CIRAM Framework
Use of MIRROR System
Collecting information on the different components of threat analysis:
- modus operandi (e.g. using the visual concept functionality to search for different types of means of transport associated with reports of irregular migration);
- who, when where (e.g. extracting references to locations from media items to build a map of arrival points of irregular migrants);
- trends and predictions (e.g. use the named entities trend analysis to detect migration-related events and analyse the conversations taking place online regarding those events);
- push factors (e.g. use the MRSCs to filter relevant media terms as the collection of MRSCs has been built keeping push/pull factors in mind)
B. Using system in the analysis process
It is important to remember that the main objective of the MIRROR prototype is to assist security practitioners in analysing perceptions from open source information. Therefore, the analytical modules available within the system are mainly targeted toward this goal. In this section, we will provide some further examples of the types of analyses that can be carried out with open source (and specifically social media content) in a threat analysis context and the ways in which the MIRROR prototype cam be employed to assist this process.
- Social Network Analysis – Social network analysis is employed to explain the relations between different actors. It is based on the following principles:
- actors are interdependent, not autonomous;
- relational ties between actors are channels for the transfer of resources (material and/or nonmaterial);
- network models view the structural environment as providing opportunities for or constraints on individual actions;
- network models conceptualize structure as lasting patterns of social interaction
General example of application
Analysing fake news – Identifying relationships between social media entities and checking for potential anomalies in these relationships. A study done by TrendMicro used this method to analyse social network interactions and identify what they call the ‘guru-follower pattern.’ The guru-follower behaviour can be seen with social media bots, which are employed to promote content. The behaviour is employed to amplify messages posted by the guru’s account, thus increasing the messages’ chances of reaching regular social media users.
MIRROR system application
In the context of the MIRROR system, one application of social network analysis has been community detection. The community detection process aims at finding cohesive groups (clusters) in complex network structures. In our component, there are a particular set of attributes that can help to represent the source characteristics. To minimize the data requirements at the personal level, we focus on pseudo‐relationships (based on shared sentiments and attention toward the observed topics). We calculate several similarities between each pair of sources (based on attention and polarity to topics, entities, countries, MRSC). Each similarity matrix is then normalized and then we combine them into a single aggregated similarity.
In the field of OSINT, this is of particular importance when trying to understand how a particular topic is reflected in the media. The MIRROR system enables users to identify the communities of entities reporting on a subject of interest (e.g. migration routes on the Mediterranean) and see which are the most influential sources within those communities. This coupled with information from other sources can assist analysts in gaining important insight in: (a) the type of information that some governments may be interested in promoting in relation to a certain topic, such as irregular migration; (b) the type of information that could reach migrants and hence influence their attitudes; (c) in the case of misinformation campaigns, it can be employed to identify the main promoters.
- Sentiment analysis – Sentiment analysis classified content shared online as expressing a positive, negative or neutral attitude. It is important to note that many researchers caution that analysis should not rely too much on sentiment analysis as often social media content is not representative of the society at large, but just represents a percentage of a given population that is online and engaged in a specific topic
General example of application
Analysis of official narratives (especially in countries with media-controlled regimes) – An example in this respect is the FOCUSdata project which employs sentiment analysis on media articles to analyse Russia’s and Iran’s reactions to US policies and events and NGO human rights campaigns. Evaluating countries’ official narratives improves understanding of government signals to outside actors, reactions to crises and foreign policy tools, and interests regarding (un)favourable developments.
MIRROR system application
In the MIRROR system, the SA component applies to both text and images. Different levels of analysis, from phrases to complete documents as well as the possibility to combine positive and negative aspects into a mixed class (with a 4th class, neutral in case neither of these is detected) characterize the Sentiment Analysis component.
In the context of threat analysis, this is very important as it can assists analysts in monitoring and predicting disruptive events. For example, one can use the system to examine sentiment across different languages in respect to the same issue (e.g. security of the borders). Differences could indicate that different groups/countries may have different marked belief differences in respect to a certain topic which can lead to polarization and ultimately even violence (e.g. a good example of such an application can be the analysis of Polish and Belarus media in respect to migration in the 2021-2022 period). When it comes to policy-making, the MIRROR system (and namely the sentiment analysis functionality) can be employed to examine the way in which EU policies on asylum are being assessed in the media of the countries of origin of migrants.
The same applies to sentiment analysis on images, which is very important, especially in the case of actors who would avoid using text and instead would employ images to support a certain perspective (e.g. using showing images of migrants in peril/dead while trying to cross the Mediterranean in a boat as a means of discouraging other migrants from using the same method/route).
- Text analysis – is the process of extracting meaningful patterns and insights from unstructured text. In the field of security, this has multiple applications, among which: identify topics and subtopics (What topics are driving conversations? Who are the actors driving the conversation? How does a conversation on a certain topic change over time); identify trending topics; psychographic profiling (extract complex information from text such as the key personality traits and communication style preferences of the authors of the texts).
General example of application
Automated text analysis has been proposed by some experts as a way to off-load some of the selective and interpretative works from human intelligence analysts. Examples of such uses can be found in Guo et al. where entity extraction (organisations, locations, persons) from human-generated tactical reports was employed to support intelligence analysis and Razavi et al. on extracting information about risks in maritime operations. A more recent example is the work done by the Swedish Research Defence Agency on PhaseBrowser, a text analysis prototype tool designed to support analytical work by processing Twitter data. The aim of this tool is to provide analysts with several perspectives of the collected data through predefined themes, which would enable the tool to be used both for monitoring a subject or area of interest and for conducting research to answer specific questions.
MIRROR system application
The MIRROR system includes several functionalities related to text analysis: (a) named entity and concept recognition; (b) sentiment analysis; (c) EU-related news detection; and (d) text summarization. The applications for analysts are many, ranging from the ability to swift faster through results (e.g. by using the summarization component), filtering results based on a topic of interest (e.g. by using the entity detection); identifying the most relevant sources for their analysis (e.g. by using the EU-related news detection to classify those media items which are the most relevant for an EU‐related analysis).
- Bias detection – One of the key analytical challenges in employing open source information and specifically social media content is related to the problem of verification. Especially when seeking to understand the perception of a particular situation in a country and/or region, it is important to see how that situation is reflect in mass and social media channels. However, to avoid information overload, news outlets filter available news from foreign countries based on the expected interest of the target audience and/or in accordance with official narratives.
MIRROR system application
This component can be employed to detect differences in reporting on EU-related news between different countries (e.g. country of origin & country of destination). This can be employed by analysts to: (a) understand what is the main narrative on that particular topic in the country of origin (e.g. how the life of migrants in EU countries is portrayed); (b) understand what, if any, are the differences between how the same topic is portrayed in the country of destination. By assuming that such information may influence migrants’ attitudes and consequently behaviour this could be employed in forecasting potential trends.
The list of functionalities presented above is by no means comprehensive. The purpose of this section is just to select the ones which would be the most relevant for threat analysis and show how the MIRROR system could be employed in practice by analysts in the field of border security. A more detailed list of functionalities of the system and types of applications that can be done using the system can be found in D10.3 and D7.5.
Resources
Fisher, S. et al. (2022). FOCUSdata: Foreign Policy through Language and Sentiment. Foreign Policy Analysis. DOI: 10.1093/fpa/orac002.
Gundhus, H. (2017). Negotiating risks and threats: Securing borders through the lens of intelligence. European Border Communities. Available at: https://europeanbordercommunities.eu/blog/negotiating-risks-and-threats-securing-borders-through-the-lens-of-intelligence [accessed on 1 June 2022].
Guo, J.K., Van Brackle, D., LoFaso, N., Hofmann, M.O. (2015). Extracting meaningful entities from human-generated tactical reports. Procedia Comput. Sci. 61, pp. 72–79. DOI: 10.1016/j.procs.2015.09.153.
Symanto Psychology. Social Media Text Mining: How Does it Work?. Symanto.com. Available at: https://www.symanto.com/blog/social-media-text-mining-how-does-it-work/ [accessed on 2 June 2022].
TREND Micro. (2019). HUNTING THREATS ON TWITTER: How Social Media Can Be Used to Gather Actionable Threat Intelligence. TREND Micro. Available at: https://www.trendmicro.com/vinfo/de/security/news/cybercrime-and-digital-threats/hunting-threats-on-twitter [accessed on 2 June 2022].
Williams, H.J., Blum, I. (2018). Defining Second Generation Open Source Intelligence (OSINT) for the Defense Enterprise. Rand Corporation. Available at: https://www.rand.org/content/dam/rand/pubs/research_reports/RR1900/RR1964/RAND_RR1964.pdf [accessed on 2 June 2022].
Razavi,A.H., Inkpen, D., Falcon, R., Abielmona, R. (2014). Textual risk mining for maritime situational awareness, in Proceedings of the 2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support (CogSIMA). IEEE, Piscataway, pp. 167–173. DOI: 10.1109/CogSIMA.2014.6816558.
Varga, S., Brynielsson, J., Horndahl, A., Rosell, M. (2020). Automated Text Analysis for Intelligence Purposes: A Psychological Operations Case Study. In: Tayebi, M.A., Glässer, U., Skillicorn, D.B. (eds) Open Source Intelligence and Cyber Crime. Lecture Notes in Social Networks. Springer, Cham. DOI: 10.1007/978-3-030-41251-7_9.
