Skip to content

What Does Situational Awareness Mean For Today’s Intelligence Teams?

"Analysts must absorb information with the thoroughness of historians, organize it with the skill of librarians, and disseminate it with the zeal of journalists. They must embrace open-source, population-centric information as the lifeblood of their analytical work. They must open their doors to anyone who is willing to exchange information." - Major General Michael T. Flynn "Fixing Intel: A Blueprint of Making Intelligence Relevant in Afghanistan"


What is Situational Awareness?

The principle behind situational awareness is wide in scope, but simply put, it is knowing what is going on around you.

Situational awareness can generally be understood as being aware of what is happening around you in terms of where you are, where you are supposed to be, and whether anyone or anything around you may be a threat. Our knowledge, experience and education enables us to understand what is going on around us, and helps us to determine if our surroundings are safe. This means that everyone’s situational awareness is individual and potentially different. We all use our situational awareness to make decisions.

The SLAM technique illustrates the basic elements of situational awareness:

STOP and think before you act. 
LOOK at your situation.
ANALYZE/ASSESS the situation.
MANAGE your environment. 


How Real-Time Social Data is Transforming National Security

What does situational awareness mean in a security / intelligence setting?

The definition can vary slightly depending on the context.

The United States Army Field Manual defines “Situational Awareness” as “Knowledge and understanding of the current situation which promotes timely, relevant and accurate assessment of friendly, enemy and other operations within the battle space in order to facilitate decision making.”

The Homeland Security Act of 2002 defines the term “Situational Awareness” as “information gathered from a variety of sources that, when communicated to emergency managers and decision makers, can form the basis for incident management decision-making.”

The concept of “understanding” in a military setting is the perception and interpretation of a specific situation in order to provide the context, insight and foresight required for effective decision making. So in this milieu, situational awareness is gaining awareness of what is happening by gathering information from a variety of sources, but not necessarily knowing why it is happening. The analysis of situational awareness creates understanding - it provides greater insight into the problem, which will inform decisions on how to move forward.

Situational awareness

Source: The Three Swords Magazine 27/2014 


“... the requirement to have a wider and more effective understanding of the Contemporary Operating Environment (COE) is dependent upon good intelligence, and ensuring that the commander gets the right information, to make decisions, at the right time.” - CDR Tristan Lovering MBE, Royal Navy Intelligence Section Head Joint Warfare Centre

Traditional methods for achieving and maintaining situational awareness include land mobile radio, paper maps, landlines, email, cellular phones, satellite phones, mobile data (e.g., low-speed wireless data), computer-aided dispatch for incident and unit status, crisis management systems (e.g., E-Team, WebEOC), traffic cameras, amateur (HAM) radios, enhanced 911, reverse 911, mobile text alerts, global positioning services (GPS) for the location of response vehicles, geographic information systems (GIS) for visualization, windshield assessments, and traditional media (e.g., television, radio).

In the digital age, social media data is now necessary for real-time situational awareness and proactive response. For example:

  • Less-regulated social networks, chan boards, and alt-tech have more lenient content policies than mainstream social media. For security and emergency operations centers, these sites can provide early alerts like manifestos and planning that may precipitate a critical event like a shooting or terrorist attack.
  • Paste sites and dark websites provide early data breach indicators to support cybersecurity functions in incident management. Leaks like doxxing can also implicate physical security for high-profile personnel.

Why is situational awareness important for security and intelligence?

In a potentially dangerous situation, situational awareness is the ability to see what's in the vicinity and anticipate what's not — knowledge that can mean the difference between surviving or being killed, between operational success and failure. 

Most crimes and terrorist attacks rely heavily on the element of surprise. When a criminal or terrorist organization loses the element of surprise, they will often abandon their planned course of action. Situational awareness is a simple but effective art that minimizes the opportunity or element of surprise that criminals and terrorists rely upon.

New call-to-action

Through ongoing engagement with the public via social media, organizations can “listen” for specific information or monitor for general situational awareness. If integrated with traditional data, social media can help decision makers achieve and maintain situational awareness in real-time. Research performed by the US Naval Postgraduate School showed that social media data, when combined with traditional polling methods, has a positive impact on analysis. The study concluded that intelligence analysts should conduct social media analysis and combine the results with polling analysis to support operational assessments. 

Scenarios where social data can improve situational awareness

When a national crisis occurs, governments and organizations must make timely, informed decisions. Whether it’s a natural disaster, public health crisis, or terrorist attack, intelligence teams need to know how and where a crisis is occurring, and how to allocate resources in response. 

Online spaces are often the earliest sources of information to provide this context—for example, social media users often post public updates and images from the scene of a crisis. Aligning this data with other feeds can help provide a faster and more informed response.

Many organizations leverage social media to enhance situational awareness and support operational decision-making, in conjunction with other sources such as HUMINT. An important aspect of social media monitoring is distinguishing ambiguous content about everyday mundane activity, from content that might impact public safety. When this is achieved, those managing and ensuring public safety can use this information to better manage a potentially harmful situation. 


Active threats (shooter, bomb threat)

On the ground during a potentially dangerous situation, situational awareness is the ability to see what’s in the vicinity and anticipate what’s not — knowledge that can mean the difference between surviving or being killed. You also don’t want to overlook potential physical security risks by not having the tools to understand, predict, and investigate these types of attacks.

Online spaces are often the earliest sources of information to provide this context—for example, social media users often post public updates and images from the scene of a crisis. Aligning this data with other feeds can help provide a faster and more informed response.

In advance of situations like these, organizations can augment their physical security strategy by:

  • Using location-based social search tools to find public social media posts suggesting a violent threat geotagged near critical locations. For example, at the 2016 Olympic Games in Rio De Janeiro an executive security team used the Echosec Systems Platform to detect a potential threat to an athlete under their protection, and were able to change the athlete’s travel plans to ensure the safety of their client.
  • Monitoring social media sources and fringe online web spaces for mentions that could indicate violent intent or planning.


Disaster response (natural disaster)

Historically, the emergency response community has leveraged multiple data sources, including land mobile radios, maps, computer-aided dispatch, crisis management systems, traffic cameras, geographic information systems, and windshield assessments to collect information. Now, responders can leverage social media as well, both to communicate and to gather and share real-time, dynamic information to enhance situational awareness and assist in decision-making. 

Content shared on social media during a natural disaster—including real-time photos and observations from distributed people across an impacted area—can be a valuable resource for both emergency responders and affected populations. From another angle, disaster events often catalyze online convergence, where people all over the world come together to, among other things, collectively process the event and try to contribute to response efforts

Real-time social media data, combined with information gleaned from more traditional sources, can help emergency responders gain and maintain situational awareness, and assist with decision-making, planning, and resource allocation. During response efforts following natural disasters, government officials now utilize social media to share information and connect with citizens through all phases of a crisis.

  • In a disaster response situation, an organization could use keyword searches and general monitoring to identify community needs. 
  • Social media tools can help Aid groups, agencies and organizations advise the public about available resources during an emergency. 


Supply chain security 

The goal of any supply chain is to source and receive intact goods on schedule and at a minimal cost. According to a 2017 Deloitte report on supply chain technology, “most companies fail when trying to find a way to have reliable visibility over their entire supply chains while limiting the dependence on one or several stakeholders.”


Supply Chain Monitoring: The Value of Social Media Data in a Crisis


Every link in a global supply chain—from sourcing materials, manufacturing, transport, and end-user delivery—is highly interconnected. Staying alerted to disruptions at any stage of the chain is critical to a retailer’s timely response as crises, big and small, unfold around the world.

Retailers have used smart technologies to monitor supply chain operations for years. However, in the context of a global crisis like a pandemic, weather catastrophe, or political instability, existing technologies can leave critical gaps in a retailer’s supply chain awareness.

On-the-ground data relevant to supply chain locations, including text, image, and video content, often reaches social media faster than any other source. This information keeps supply chain managers more informed in the event of a natural disaster, disease outbreak, or violent situation near a warehouse, factory, or other critical location anywhere in the world. 

Advanced web monitoring platforms allow supply chain managers to aggregate and search multiple social media sources to find gaps in their situational awareness—especially during global crises. Accessing this information as quickly and easily as possible helps retailers better predict and understand unfolding events impacting their supply chains, enabling faster and more effective response.

Geopolitical situations

The threat landscape is becoming more complex and unpredictable as several events—from social unrest to supply chain disruptions—have changed security risk factors. For an organization without access to the right data at the right time, a slow or misinformed response to any geopolitical event could mean physical harm to assets and people, eroded reputation, and financial costs. 

New call-to-action

Social data supports situational awareness for management of geopolitical risk in a number of ways. 

  • As bystanders capture or report an event, social media sites and online discussion forums are often the earliest sources of ground-truth information. Authors on some of these sites can also geotag their location, which is valuable for finding threats near locations relevant to an organization’s assets.

For organizations whose facilities or personnel span the globe, access to localized news and social networks may be beyond the scope of a standard Google search. Specialized information-gathering tools can automatically detect critical events on multilingual and region-specific sites that may be otherwise difficult to find.

How technology can gather and deliver access to social data to improve situational awareness and enable a more effective / faster response

Social data, including data from mainstream networks, alt-tech platforms, imageboards, and deep/dark web forums hold a wealth of information critical for counterterrorism/counter-extremism, geopolitical risk monitoring, and government intelligence. 

Intelligence teams need to know how and where an event or crisis is occurring, and how to allocate resources in response. Real-time social data, combined with information gleaned from more traditional sources, can help provide context for situational awareness. Leveraging real-time social data from diverse fringe online discussion channels can help organizations be better informed, and mitigate the impact of global situations on people, countries, and organizations.

Using a variety of global data sources is crucial to any intelligence team that needs to stay on top of an increasingly diverse internet threat landscape. For security and intelligence teams operating on a global scale, the most effective way to gather information from global social data sources is to use OSINT tools that aggregate a wide range of data in one intuitive interface. 

APIs in particular deliver direct access to online networks, and allow organizations to integrate and leverage this data within their own systems and tooling. The Echosec Systems API delivers streamlined access to this information in real-time and enriches data for enhanced security and intelligence to help identify threats faster, and develop timely, more informed risk response and investigation.

By investing in specialized information-gathering tools and ensuring adequate coverage, your organization can maintain situational awareness and stay one step ahead in even the most unpredictable threat landscape. Echosec Systems provides access to a wide range of social, news, deep, and dark websites in one platform to support early threat detection and situational awareness.