What Is Situational Awareness? A Crash Course For Intelligence Teams

“Analysts must absorb information with the thoroughness of historians, organize it wit the skill of librarians, and disseminate it with the zeal of journalists. They must embrace open-source, population-centric information as the lifeblood of their analytical work. They must open their doors to anyone who is willing to exchange information.”

Major General Michael T. Flynn

What is situational awareness?

Situational awareness is a key principle of threat intelligence, where one must be aware of what is happening around you, in terms of where you are, where you are supposed to be, and whether anyone or anything around you can be considered a risk.

Our knowledge, experience, and education enable us to understand what is going on around us, and help us to determine if our surroundings are safe. This means that any organization’s position is unique and can vary drastically. We all use our situational awareness to make decisions.

Security teams can use the SLAM technique to understand the basic elements of situational awareness:

• STOP and think before you act.
• LOOK at your situation.
• ANALYZE / ASSESS the situation.
• MANAGE your environment.

What does situational awareness mean in a security/intelligence context?

The definition of situational awareness can vary slightly depending on the context.

The United States Army Field Manual defines “Situational Awareness” as “Knowledge and understanding of the current situation which promotes timely, relevant and accurate assessment of friendly, enemy and other operations within the battlespace in order to facilitate decision making.”

The Homeland Security Act of 2002 defines the term “Situational Awareness” as “information gathered from a variety of sources that, when communicated to emergency managers and decision-makers, can form the basis for incident management decision-making.”

The concept of “understanding” in a military setting is the perception and interpretation of a specific situation in order to provide the context, insight, and foresight required for effective decision making. So in this milieu, situational awareness is gaining awareness of what is happening by gathering information from a variety of sources, but not necessarily knowing why it is happening. The analysis of situational awareness creates understanding – it provides greater insight into the problem, which will inform decisions on how to move forward.

“…the requirement to have a wider and more effective understanding of the Contemporary Operating Environment (COE) is dependent upon good intelligence, and ensuring that the commander gets the right information, to make decisions, at the right time.”

CDR Tristan Lovering ME, Royal Navy Intelligence Section Head Joint Warfare Centre

Traditional methods for achieving and maintaining situational awareness include land mobile radio, paper maps, landlines, email, cellular phones, satellite phones, mobile data (e.g., low-speed wireless data), computer-aided dispatch for incident and unit status, crisis management systems (e.g., E-Team, WebEOC), traffic cameras, amateur (HAM) radios, enhanced 911, reverse 911, mobile text alerts, global positioning services (GPS) for the location of response vehicles, geographic information systems (GIS) for visualization, windshield assessments, and traditional media (e.g., television, radio).

In the digital age, social media data is now necessary for real-time situational awareness and proactive response. For example:

• Less-regulated social networks, chan boards, and alt-tech have more lenient content policies than mainstream social media. For security and emergency operations centers, these sites can provide early alerts like manifestos and planning that may precipitate a critical event like a shooting or terrorist attack.

Paste sites and dark websites provide early data breach indicators to support cybersecurity functions in incident management. Leaks like doxing can also implicate physical security for high-profile personnel.

Why is situational awareness important for security and intelligence?

In a potentially dangerous situation, situational awareness is the ability to see what’s in the vicinity and anticipate what’s not — knowledge that can mean the difference between surviving or being killed, between operational success and failure. 

Most crimes and terrorist attacks rely heavily on the element of surprise. When a criminal or terrorist organization loses the element of surprise, they will often abandon their planned course of action. Situational awareness is a simple but effective art that minimizes the opportunity or element of surprise that criminals and terrorists rely upon.

Through ongoing engagement with the public via social media, organizations can “listen” for specific information or monitor for general situational awareness. If integrated with traditional data, social media can help decision-makers achieve and maintain situational awareness in real time. Research performed by the US Naval Postgraduate School showed that social media data, when combined with traditional polling methods, has a positive impact on analysis. The study concluded that intelligence analysts should conduct social media analysis and combine the results with polling analysis to support operational assessments. 

Scenarios where social data can improve situational awareness

When a national crisis or any incident involving physical security occurs, governments and organizations must make timely, informed decisions. Whether it’s a natural disaster, public health crisis, or terrorist attack, intelligence teams need to know how and where a crisis is occurring, and how to allocate resources in response.

Online spaces are often the earliest sources of information to provide this context—for example, social media users often post public updates and images from the scene of a crisis. Aligning this data with other feeds can help provide a faster and more informed response.

Many organizations leverage social media to enhance situational awareness and support operational decision-making, in conjunction with other sources such as HUMINT. An important aspect of social media monitoring is distinguishing ambiguous content about everyday mundane activity, from content that might impact public safety. When this is achieved, those managing and ensuring public safety can use this information to better manage a potentially harmful situation. 

Active threats (shooters, bomb threats, and etc.)

On the ground during a potentially dangerous situation, situational awareness is the ability to see what’s in the vicinity and anticipate what’s not — knowledge that can mean the difference between surviving or being killed. You also don’t want to overlook potential physical security risks by not having the tools to understand, predict, and investigate these types of attacks.

Online spaces are often the earliest sources of information to provide this context—for example, social media users often post public updates and images from the scene of a crisis. Aligning this data with other feeds can help provide a faster and more informed response.

In advance of situations like these, organizations can augment their physical security strategy by:

• Using location-based social search tools to find public social media posts suggesting a violent threat geotagged near critical locations. For example, at the 2016 Olympic Games in Rio De Janeiro, an executive security team used Flashpoint’s Echosec Platform to detect a potential threat to an athlete under their protection and were able to change the athlete’s travel plans to ensure the safety of their client.
• Monitoring social media sources and fringe online web spaces for mentions that could indicate violent intent or planning.

Disaster response (natural disasters)

Historically, the emergency response community has leveraged multiple data sources, including land mobile radios, maps, computer-aided dispatch, crisis management systems, traffic cameras, geographic information systems, and windshield assessments to collect information. Now, responders can leverage social media as well, both to communicate and to gather and share real-time, dynamic information to enhance situational awareness and assist in decision-making. 

Content shared on social media during a natural disaster—including real-time photos and observations from distributed people across an impacted area—can be a valuable resource for both emergency responders and affected populations. From another angle, disaster events often catalyze online convergence, where people all over the world come together to, among other things, collectively process the event and try to contribute to response efforts

Real-time social media data, combined with information gleaned from more traditional sources, can help emergency responders gain and maintain situational awareness, and assist with decision-making, planning, and resource allocation. During response efforts following natural disasters, government officials now utilize social media to share information and connect with citizens through all phases of a crisis.

• In a disaster response situation, an organization could use keyword searches and general monitoring to identify community needs. 
• Social media tools can help Aid groups, agencies and organizations advise the public about available resources during an emergency. 

Supply chain security

The goal of any supply chain is to source and receive intact goods on schedule and at a minimal cost. According to a 2017 Deloitte report on supply chain technology, “most companies fail when trying to find a way to have reliable visibility over their entire supply chains while limiting the dependence on one or several stakeholders.”

Every link in a global supply chain—from sourcing materials, manufacturing, transport, and end-user delivery—is highly interconnected. Staying alerted to disruptions at any stage of the chain is critical to a retailer’s timely response as crises, big and small, unfold around the world.

Retailers have used smart technologies to monitor supply chain operations for years. However, in the context of a global crisis like a pandemic, weather catastrophe, or political instability, existing technologies can leave critical gaps in a retailer’s supply chain awareness.

On-the-ground data relevant to supply chain locations, including text, image, and video content, often reaches social media faster than any other source. This information keeps supply chain managers more informed in the event of a natural disaster, disease outbreak, or violent situation near a warehouse, factory, or other critical location anywhere in the world. 

Advanced web monitoring platforms allow supply chain managers to aggregate and search multiple social media sources to find gaps in their situational awareness—especially during global crises. Accessing this information as quickly and easily as possible helps retailers better predict and understand unfolding events impacting their supply chains, enabling faster and more effective responses.

Geopolitical situations

The threat landscape is becoming more complex and unpredictable as several events—from social unrest to supply chain disruptions—have changed security risk factors. For an organization without access to the right data at the right time, a slow or misinformed response to any geopolitical event could mean physical harm to assets and people, eroded reputation, and financial costs. 

Social data supports situational awareness for the management of geopolitical risk in a number of ways. 

• As bystanders capture or report an event, social media sites and online discussion forums are often the earliest sources of ground-truth information. Authors on some of these sites can also geotag their location, which is valuable for finding threats near locations relevant to an organization’s assets.

For organizations whose facilities or personnel span the globe, access to localized news and social networks may be beyond the scope of a standard Google search. Specialized information-gathering tools can automatically detect critical events on multilingual and region-specific sites that may be otherwise difficult to find.

How can web monitoring software improve situational awareness and enable a faster response?

Social data, including data from mainstream networks, alt-tech platforms, imageboards, and deep/dark web forums hold a wealth of information critical for counterterrorism/counter-extremism, geopolitical risk monitoring, and government intelligence. 

Intelligence teams need to know how and where an event or crisis is occurring, and how to allocate resources in response. Real-time social data, combined with information gleaned from more traditional sources, can help provide context for situational awareness. Leveraging real-time social data from diverse fringe online discussion channels can help organizations be better informed, and mitigate the impact of global situations on people, countries, and organizations.

Using a variety of global data sources is crucial to any intelligence team that needs to stay on top of an increasingly diverse internet threat landscape. For security and intelligence teams operating on a global scale, the most effective way to gather information from global social data sources is to use OSINT tools that aggregate a wide range of data in one intuitive interface. 

APIs in particular deliver direct access to online networks and allow organizations to integrate and leverage this data within their own systems and tooling. The Flashpoint/Echosec API delivers streamlined access to this information in real-time and enriches data for enhanced security and intelligence to help identify threats faster, and develop timely, more informed risk response and investigation.

By investing in specialized information-gathering tools and ensuring adequate coverage, your organization can maintain situational awareness and stay one step ahead in even the most unpredictable threat landscape. Flashpoint provides access to a wide range of social, news, deep, and dark websites in one platform to support early threat detection and situational awareness.

How social media improves military situational awareness

Put simply, military situational awareness is a soldier’s knowledge of what’s happening on the battlefield—a capability that enables effective decision-making and can make the difference between life and death.

Over the last decade, hardware technologies like throwable robots have improved battlefield awareness. Now, access to relevant public social media content is heightening this capability.

In modern warfare, widespread social media use means that anyone on the battlefield with a smartphone essentially becomes a sensor. When this content is public, it gives soldiers a more accurate perspective in real-time, especially in areas inaccessible to unmanned devices or human reconnaissance.

What is military situational awareness?

Military situational awareness is the ability to observe and anticipate on-the-ground activities in an area of interest. In simple terms, it’s the soldier’s knowledge of what is happening on the battlefield.

For military operations, situational awareness enables effective decision-making along the chain of command and can make the difference between life and death. 

The term situational awareness or advanced situational awareness (ASA) is also used to describe a trained skillset for military personnel. This involves honing perceptual senses and critical thinking skills within operational environments, which can be complex and overwhelming to assess without proper training.

But situational awareness goes beyond what soldiers can interpret with their bodies. In the modern world, it also includes analyzing and sharing data from non-human sources, like field sensors and open-source social media content. 

According to an article in FCW, “[s]ituational awareness is also the integrated web of networks, servers, storage devices, and analysis and management software that ingests data, makes it available for analysis, and then shares it anytime and anywhere, up and down the chain of command.”

Roadblocks to military situational awareness

Over the last decade, unmanned systems like throwable robots have improved military situational awareness, especially in environments that are challenging or dangerous to manage on foot. However, military personnel still face challenges with:

• Maintaining situational awareness in areas inaccessible to unmanned systems like drones
• Accessing real-time information, especially in areas with unreliable connectivity
• Streamlining efficient communication systems between information sources, warfighters, and decision-makers higher up the chain of command

According to CSIS, motivation to improve situational awareness is also rooted in the need to disrupt an adversary’s situational awareness capability—like those developed by Russia and China.

Social media and military situational awareness

New technologies are helping improve communication channels for military situational awareness. 

For example, ATAK is a free government app that gives users a real-time GPS view of red and blue team movements, terrain, weather, and other field elements. A dismounted situational awareness (DSA) tool is also being trialed by the British Army. The aim is to provide the real-time information-sharing capabilities of command centers to soldiers on the ground.

In recent years, digital transformation has meant that open-source data is now as valuable for intelligence operations as classified inputs like signals intelligence. This also applies to military situational awareness, which can use open-source intelligence (OSINT) to provide a more comprehensive battlefield view.

In modern warfare, widespread social media use means that anyone with a phone can essentially become a battlefield sensor. We’ve seen this at scale so far in the Russia-Ukraine war. OSINT analysts have leveraged social media extensively to verify Russian claims and monitor battlefield activity in real-time. 

With access to both mainstream social media and regional networks like VK and OK.ru, analysts can gather a relatively accurate perspective. This is valuable in areas that may be inaccessible to conventional intelligence-gathering methods for situational awareness, like drones or human reconnaissance.

Like DSA, advanced OSINT tools can use social media to quickly access and share relevant battlefield data as a part of a broader situational awareness strategy.