Social media forensics & Madeleine McCann

The disappearance of Madeleine McCann remains unresolved. The 3-year-old went missing from a holiday apartment in Praia da Luz in 2007. Since 2011 thirty Metropolitan Police Officers, headed by Detective Chief Inspector Andy Heywood, have been trawling through thousands of witness statements and documents at the cost of £5 million, hoping to unearth a vital clue that will resolve the case.

Last week we learned that phone records could hold the key, but let’s consider the role of social media. First, some clarity… Social media refers to the means of interactions among people in which they create, share, and exchange information and ideas in virtual communities and networks. Since 2007 the role of social media in both personal and professional circles has grown from strength to strength. Let’s take a look at three popular services –

Facebook™ is a networking service launched in February 2004 and provides a social media platform for over one billion active users. It is used for both personal and professional networking, with an increasing number of organisations using it as an important part of their outreach strategy to interact with customers. Half a petabyte of new content – from messaging to media – is uploaded every single day - equivalent to about 110,000 DVDs worth of data, so one can imagine the difficulties faced in harvesting and processing such information.

Tumblr™ is a micro-blogging platform and social networking website owned by Yahoo! The service allows users to upload text posts, images, video, quotes, or links to form a short-form blog (web log). Tumblr™ hosts over 110 million blogs and 80 million new posts are created every day.

Twitter™ is another microblogging service but primarily geared towards short text based "tweets" which are limited to 140 characters. The service is used to provide swift/concise updates, and has been popularised through the adoption by celebrities. Tweets can now include links to images or multi-media content. Nearly 400 million new tweets are posted online every single day.

How can this help with the investigation into the disappearance of Madeleine McCann?

Firstly the authorities could consider a complex data mining operation to look at historical social media records and potentially identify either clues or witnesses.

So where to begin?

Text based searches would be the obvious approach, to seek out content based on keywords. The degree of coverage of this incident in the international media would suggest that the keyword parameters would have to be carefully constructed so as to limit results to that which may be potentially relevant (e.g. instances where ‘mccann’, ‘evidence’, and ‘police’ occurred in the same message or sequence of messages). The potential for a huge number of false positives is of course the concern, but these could be limited by applying date range filters or mining only across accounts registered to users in Portugal (at the risk of missing tourists).

Most social media posts – from the humble tweet to a photograph uploaded to Facebook – can include location information. This is commonly known as a geotag and may be applied to the content by the camera device or the social media service. Such tags take the form of latitude/longitude co-ordinates – in the case of the Praia de Luz, this would be 37.0972° N, 8.7434° W. Combing through current or old social media records for such tags would help identify people who have been in the relevant area. Combine this with a filter for the date range of late April / early May 2007, and the results would suggest people in the right area at the right time to potentially assist with the investigation. It may be that these are parties who need to be excluded from the current investigation or perhaps they witnessed something they considered innocuous but could be vital in the wider context of the investigation.


Note: Law enforcement labs and members of prosecuting authorities are welcome to request free licences to the following toolkits: www.facebookforensics.com, www.tumblrinvestigator.com and www.twitterinvestigator.com