Here’s How One Navy IT Team Is Teaching Sailors the Risks of Social Media

Islamic State uses it to compile lists of military members it wants followers to attack. Child predators use it to befriend potential victims. Most people just use it to update friends and family about the latest vacation or career move. 

Public social media is a potential safety threat to civilians and troops when individuals are not careful about the content they share. Now, some concerned Navy officers, who happen to be cyber pros, are helping defend their community against oversharing and online stalkers with a novel outreach approach.

Outside a Navy Exchange commissary in Spain, the IT team performed social media reconnaissance on -- willing -- sailors and relatives in front of their eyes.  

The Naval Computer and Telecommunications Area Master Station Atlantic, Detachment Rota held two such demonstrations last October, in honor of Cybersecurity Awareness Month, and has plans to engage the military base similarly this year.  

"The continued growth of ISIS kill lists, which are created from information gained in social media on military, other government and business leaders" underscores the need for Americans to be conscious of what they post online, Lt. Cmdr. Michael South, officer in charge at NCTL Detachment Rota, told Nextgov. 

"We don't want them to be a target at home -- on their computer -- because that could impact us at work," he added.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

Next to the grocery store entrance, the team stood behind a table covered with free sodas and a laptop. The browser tabs on the computer screen were open to Facebook, LinkedIn, Google+ and Twitter. Thirsty shoppers and onlookers curious about the small gathering would stop by and provide their first and last name. 

"And we would infer because we physically see them in Rota, Spain, that they have some affiliation with Rota, Spain," South said on a phone call from the Spanish town. "We're on a military base, so we would infer some affiliation with the Navy."

In a typical situation, he said, with merely the knowledge of your name, location and possible military background, the Naval officer on hand was able to search the social sites and tell you:

• The city and state where your parents live
• The name of your spouse 
• The number of sons and daughters you have
• The fact your son is a Cub Scouts member
• The types of duties you perform at work
• Whether you have a secret clearance
• Oh, and by the way, you patronize Starbucks every Saturday morning at this particular location at this specific time

"LinkedIn is probably one of the biggest double-edged swords" for troops who hold a security clearance, South said. 

As troops prepare to transition into the private sector, "you want to market yourself, you want to tell the world what you do in an unclassified manner," said South, who is retiring in the fall. While his LinkedIn profile displays many details, "if you are not going to get out, you need to keep [your profile] to the bare minimum." 

It is believed that ISIS and its supporters have been scouring social media sites to glean as much information as possible about service members and their spouses.

ISIS has distributed so-called kill lists, containing some of this public data, to militants for more than a year. Now, the Rolodexes are growing in size and have expanded in scope, from targeting dozens of military or government officials at a time to thousands of ordinary American citizens, The Wall Street Journal reported in recent days. 

In Spain, the people who chose to play the profiling game were shocked to see so much of their personal information out in the open, South said.

The focus of the events was not about making sure your antivirus software is up-to-date or locking down your social media account. U.S. citizens are so inundated with cybersecurity tips media reports about hacks that they become desensitized, South explained.

"Who cares if I get a virus on my computer? All it is couple of infected files. It’s not life-threatening," he said, articulating the popular feeling. "When you start showing them: ‘Here, these are your kids [on this post]…Hey, your parents live here,’ then they can see the actual, physical risk to them and their family. And that’s when they really get concerned, and say, 'I need to make this a priority, and it’s not just about making sure I have antivirus on my computer.'"

That said, technological protections are critical to preventing real-world and online threats, too.

Once the team captivated people with a one-on-one demonstration, that's when the troops handed out traditional training materials, like a Naval Criminal Investigative Service pamphlet illustrating how to keep private your Instagram pictures and create strong passwords.

Other Instagram and Facebook safety pointers:

1. Use caution when posting images of you or your family. Be aware of your surroundings, to include identifiable locations, military affiliations, and any other personal security vulnerabilities.
2. It’s highly discouraged to use geo-location tags.
3. Use secure browser settings when possible and monitor your browsing history to ensure you recognize all access points.

For passersby who serve, the experiment -- dubbed "The 5 Minute Challenge" -- reinforced the formal cyber awareness training troops undergo at least once a year, South said.

"We simply want to assist people protect their information, work and families regardless of who is looking or why," he said.

Along with the computer stunts, there were nearly 20 workshops held for kids -- the digital natives -- at the Defense Department's Dependents School’s elementary classes in Rota. The team also showered the community with traditional public awareness campaign materials, including emails, base newspaper articles and billboard announcements. 

In addition to South, the team consisted of Information Systems Technician 2nd Class Martin Gasca, who spearheaded the challenge; team lead David Rosinski, the station information systems security manager; and other cybersecurity teammates.

The team members were not required to do any of this and for their grassroots initiative, they have been recognized as a finalist for the annual U.S. Government Information Security Leadership Awards, which will be announced Thursday.