Event Security with OSINT

Event security is much more than security personnel walking around the site during the event. Security at events necessitates extensive planning, resources, and communication. Security teams routinely use equipment and technology to support the efforts of security personnel through measures such as CCTV, however, Open Source Intelligence (OSINT) is an often underutilized resource in event security that can transform an organization’s approach to security management.

OSINT enables event organizers to improve planning and resource allocation by exploiting publicly available information from the internet. Relevant sources of internet information for event security include social media, forums, the deep web, and the dark web. Automated solutions, like Skopenow, enable the seamless collection and analysis of information, assisting event security with minimizing disruption.

OSINT can be utilized within a number of different capabilities within event security, these include; Planning & Intelligence; Command, Control & Communication; Incident Response; Reassuring & Visible Security; and Cybersecurity. The benefits for each of these capabilities are outlined below:

Planning & Intelligence 

Effective planning enables security teams to access and utilize threat intelligence to prepare the event venue and staff, ensuring a positive event experience for customers, despite the customers never being aware of the efforts made. Event security teams prepare for peak periods of activity, including entry and exit to the event and breaks within the show. Customers may use many different entry points, resulting in the division of security personnel over a broad geographical area. Therefore, event security must utilize intelligence, enabling the security team to predict customer activity during the event. Monitoring social media can assist a security team with understanding the mindset of attendees before the event, which can enable them to detect any keywords that suggest any undesired activity, like planned violence or forced entry. Identifying plans like this early enables security teams to prepare and liaise with local law enforcement and government to ensure that sufficient resources are on hand for the event.

Command, Control & Communication 

Despite effective planning, incidents will occur during any event that will require resourcing. These incidents might include; missing children, violent incidents, or theft. Command and Control rooms enable event security to oversee activity in real-time, utilizing resources like CCTV and social media monitoring tools to assess activity on-site and enhance situational awareness, enabling effective communication throughout the venue to address incidents. Analysis of live social media data enables security teams to have real-time situational awareness, detecting violent incidents, unattended bags, or large build-ups of customers. Identifying these threats as they occur facilitates immediate response, enabling security personnel to adapt quickly and effectively. Utilizing social media monitoring tools, Command and Control teams can quickly identify issues enabling decision-making and communication with a birds-eye view of the situations. OSINT tools and real-time monitoring systems facilitate the prompt escalation of security breaches or incidents to security officers to minimize any risk to staff or event attendees. OSINT systems also enable the quick detection of offensive posts by event performers and any discussion of planned violence, types of digital activity that can escalate to violent situations or protests, enabling the heightening security to appropriate levels. Finally, social media monitoring tools enable Command and Control teams to set up automated alerts for posts containing threatening language against VIPs.

Incident Response

Scanning the internet for social media and forum posts relating to the event allows staff to respond quickly to incidents within the event venue while minimizing disruption and maintaining the smooth running of the event. Small-scale incidents have the potential to escalate quickly, leading to rapidly deteriorating conditions for security staff. Early intervention during incidents can prevent escalation and reduce the potential impact on security resources, protecting customers and event staff, and preventing serious violence and injury. Access to social media insights enables event security to map and react to crowd movements. The ability to pass this information and awareness to security officers, or where relevant the emergency services, enables the incident area to return to normal as quickly as possible and ensures that the event runs smoothly. Geofencing, creating a virtual perimeter around an event space to scan for social media posts containing geolocation tags, enables security teams to discover content originating from within and around an event perimeter. Security teams can monitor the geofenced area, setting alerts for specific keywords and images that indicate potential safety risks, such as ‘fight’ or ‘knife’. These alerts automatically filter the digital activity of attendees and highlight only those that matter to security teams, ensuring that only individuals identified as a risk are monitored. Geospatial systems also demonstrate where posts were published, enabling security to be directed directly to emerging incidents, such as fights or forced entry.

Reassuring & Visible Security

During events, security teams may deploy overt and covert personnel and technology to keep attendees safe. When done well, this ensures that visitors feel protected but not restricted by intrusive activity once the event begins. OSINT systems and techniques, such as geofencing the event location, are covert measures that support physical protection measures taken by event security. Geofences can highlight incidents such as broken turnstiles or forced open doors, enabling security personnel to quickly respond to and remedy physical security issues before the situation requires a large-scale security presence. This early intervention ensures that attendees continue to feel safe and the event venue’s reputation is undamaged. This combination of technology and physical security helps effectively maintain safety at an event. By isolating troublemakers and security breaches quickly, security incidents are less likely to escalate or result in further disruption. 

Cybersecurity 

Cybersecurity measures enable security teams to detect cyberattacks that are intended to disrupt the event. The management of large-scale events now relies upon complex information technology infrastructure and cybersecurity personnel, which are there to mitigate cyber-related risks. Prior to and during an event, OSINT systems can be utilized to scan for leaks, such as keywords like ‘ID badges’ or the content of an unannounced setlist. This enables cyber-risks to be identified in real-time, enabling insider risks to be detected and dealt with. Similarly, OSINT systems can be used to detect streaming. Scan the deep and dark web for mentions of illegal streams from attendees inside the event for physical intervention or pirate streams to electronic intervention. Finally, OSINT systems can be used to research identified offenders following the identification of cybersecurity breaches, such as data theft. 

Security risks to every event will be different, however, these risks will share similar themes and can be managed effectively with the correct investment in personnel and tools. OSINT tools can facilitate security management at events, enabling security teams to respond efficiently and effectively. OSINT systems can support physical officers, reducing costs and ensuring that attendees do not feel intimidated by a large-scale presence of security personnel. Using OSINT systems within the planning stage of an event enables security teams to access and utilize threat intelligence to prepare the event venue and staff, which means that the event runs smoothly and the minimal risk to customers. Within Command and Control rooms, OSINT analysis enables event security to oversee activity in real-time, utilizing this social media intelligence along with resources like CCTV, enhancing situational awareness. Geofencing streamlines the locating and analysis of live social media data providing security teams with digital information from all angles within the event location and minimizing disruption. Geofencing can enable an effective response to incidents by ensuring accurate communication throughout the venue, reacting quickly and proportionately to situations like unattended bags that may contain explosives or large build-ups of customers that could result in trampling. OSINT enables event security to have the appropriate combination of physical and technological security measures that reassures attendees but does not result in fear. OSINT systems can assist in detecting trespassing and break-ins, scanning social media for insecure or forced access to the site, or mentions of planned streaking. Finally, Cybersecurity teams can utilize OSINT systems to identify internal leaks, illegal steaming, and when investigating cybersecurity breaches, ensuring that digital and physical security measures work hand in hand to protect the event, venue, staff, and customers.  

Skopenow is an analytical search engine that uses social media, open web, deep web, and dark web data to generate actionable threat intelligence that can support event security. Security teams utilize Skopenow to enable informed risk-based decision-making, support VIP protection, and investigate disruptive individuals. Our platform utilizes computer vision and behavioral analytics to identify hidden connections, characteristics, and activities that can be instrumental to protecting your event location. Sign up for a 7-day free trial of Skopenow at: https://www.skopenow.com/try.