Section 5: During the Disaster: Processes and Procedures


Your policy and plans will guide your actions and decision-making during the disaster. In this section, we will explore some processes and procedures for successfully identifying social media intelligence during disasters.

Illustration of a smartphone and a laptop, each with non-specific social media messages protruding from the screen.


Process: Collecting Data

In the context of this course, collecting data refers to collecting various kinds of information around specific events. The types of data to collect are driven by the scope, magnitude, complexity, and type of disaster. These factors in turn influence the types of data you or your organization may be assigned to collect.

Similarly, the approach you take to collect the data is also driven by the type of disaster and your specific data collection assignment. For example, you could be assigned to collect:

  • Static data—postal addresses, counties, states, phone numbers, points of contact at hospitals, or other generally constant information
    • Static data is usually collected using Internet resources
  • Dynamic data—operational statuses of facilities such as hospitals, road conditions, and other changing information
    • Dynamic data is usually collected via social media resources in addition to Internet resources (for example, news reports)

You can collect social media content:

  • Manually searching the social media platforms
  • Automatically with an available aggregation tool
  • Using a combination of these methods

Example: Hurricane Sandy

During Hurricane Sandy, many people were posting personal information on social media, such as:

  • Information about road closures, which is important for first responders to take alternate routes
  • Locations of people needing medical assistance and the kinds of injuries sustained
  • Damage to critical infrastructure, such as hospitals
  • Locations of open pharmacies

Collecting these types of data helped inform the disaster workforce, decision makers, and others throughout the disaster.

A disaster information specialist can use these approaches to gather social media posts and save the information to a data repository. This repository could be as simple as a word processing document or a spreadsheet, for example, or something more complex such as a commercial, off-the-shelf data aggregation tool.

Regardless of the method, the searches will retrieve a large quantity of unverified content. This collecting of data is the first step to social media intelligence.

Illustration of a social media page with about four non-specific posts. Two of the posts have been highlighted and pulled to the right with torn edges that indicate the messages have been extracted from this social media feed.


Process: Analyzing Data

You should analyze the source and data of the social media content you have collected with skepticism and discipline.

Authoritative vs. Non-authoritative Sources

Authoritative sources:

  • Official, verified organizations, including volunteer organizations
  • Sometimes the media
  • Influential and credible individual social media users

Non-authoritative sources:

  • Citizens who share text, pictures, videos, and other content


Illustration of a magnifying glass over two social media posts that have been pulled from a social media feed.

Authoritative Data

Authoritative data has been collected, analyzed, and verified for accuracy before disseminating to the public. Data from an authoritative source, especially one with which you have an established relationship, can usually be considered authoritative data.

Authoritative data may originate from non-authoritative sources. The key is accuracy, verification, and validation.

As illustrated in the following graphic, there are many more non-authoritative social media messages than authoritative. Additionally, there is less data integrity with non-authoritative messages than with authoritative messages.

Non-authoritative Social Media Data

Illustration of 26 speech bubbles with squiggly lines, intended to represent many messages with little data integrity.

More messages, less data integrity

Authoritative Social Media Data

Illustration of 10 speech bubbles with straight lines, intended to represent few messages with greater data integrity.

Fewer messages, greater data integrity


Information from the General Public or Unknown Sources

Sometimes, the information we find comes from the general public or from an unfamiliar source. When checking the validity of content from an unknown or non-authoritative source, ask yourself:

  • What do I know for certain about this source?
  • Was the source physically present at the disaster? Consider date and geolocation information.

Earlier in the course, we mentioned the "CRAP test," which can be used to evaluate your sources.

Refer to your content verification checklist, created in the planning phase.


Analysis Questions

Ask the following questions during analysis of the unverified social media content you have collected. These questions may look familiar. You will want to ask similar questions about unfamiliar sources.

  • Is the information from a reliable source (such as an emergency management agency)?
  • Does the content demonstrate situational awareness?
  • Is the content personal in nature?
  • Is the content subjective?
  • Is the information from an individual?
    • Is the individual sharing secondhand information, or is the individual a witness in the area affected by the disaster?
  • If the information is a retweet or share, do other sources corroborate it?
  • Does the information support your mission? For example, you might be tasked with health and medical needs and encounter posts specifically about transportation, which would not be relevant to your mission.
  • What is the time of the tweet or post? Is it current or obsolete?
Illustration of a clipboard containing three large question marks and several lines representing text. A magnifying glass is being held over the middle question mark.

In addition, check in with yourself and your team periodically to ensure you are being as productive as possible:

  • Are you capturing the variety of hashtags being used?
  • Do you have a list of Twitter handles that continuously provide valuable information?
  • Are you capturing what search strings you are using?


As discussed earlier in the course, we recommend maintaining a living document to record pertinent information and categories. One of the categories should be a list of all the sources you use in authenticating the validity of the social media content. This may be used in the future, for example in creating an After Action Report, holding a hot wash, or writing Executive Summaries.

The Challenges of Malicious Content

Malicious and/or false content is an unfortunate, yet inevitable reality when dealing with social media. As mentioned previously, even well-intentioned sources occasionally share misinformation.

Consider the following Twitter post, in which a user with established credibility and many followers chose to knowingly create and disseminate false information about Hurricane Sandy. There are at least three areas of potential concern that should cause us to question the validity of this social media content.


Select each i icon in the example to see more about the cause for concern:

Screenshot of an actual Twitter message, posted by the user Comfortably Smug, using the handle @ComfortablySmug. The message text reads: BREAKING (in all caps): Confirmed flooding on NYSE. The trading floor is flooded under more than 3 feet of water. The message was posted at 6:04 PM on October 29, 2012. At the time of the screenshot, there had been 566 retweets and 32 likes. There are three information icons overlaying the tweet in the screenshot - one over the username Comfortably Smug, one next to the all-caps text 'BREAKING,' and one above the word 'Confirmed.' Each icon can be selected to learn more about it.

User name Confirmed Breaking

There are at least three areas of potential concern in this example:

  • The username, Comfortably Smug—is this an official news source?
  • Capitalization and use of the word "BREAKING"—this seems to be a means of drawing attention to the post and, given other potential issues with the example, makes this post questionable
  • The post states "Confirmed flooding"—who confirmed the flooding? The post doesn't say.

Verifying Authenticity of Images

Also during Hurricane Sandy, several other fictitious or falsified photos were widely disseminated on social media, both by naïve, well-intentioned users and those who did so knowingly, perhaps with a sense of humor. Consider these examples:

Photo of a subway station that has been manipulated to look like it was underwater

Example 1: Photo of a subway station that has been manipulated to look like it was underwater

Falsified photo intended to look like a screenshot of a live newsfeed of water rising above the Statue of Liberty

Example 2: Falsified photo intended to look like a screenshot of a live newsfeed of water rising above the Statue of Liberty

When it comes to image verification, you have two options:

  1. Seek out multiple sources to validate authenticity—seek corroboration online and, if possible, consult team members. If uncertainty remains, but there is a chance the image is legitimate, flag it for the team lead to review and decide.
  2. Discard—do not use the content.

Remember: skepticism and discipline are key.

There are tools that may help verify the validity of images. Some online tools have reverse image search capability, which helps identify when, where, and by whom an image has been previously shared.

Verifying First Hand Accounts/Witnesses as Sources

Practice what was described in the Planning section—that is, answer the questions: what, when, where, why, and how (Kovach and Rosenstiel, 2010).


Process: Periodic Assessments

Data Collection Process Development

Create, document, and share a data collection process early on. Team members come and go, especially volunteers, and this will save time.

Ensure that your data collection process has space for capturing lessons learned, and encourage the team to make notes in the moment. It is much more difficult to recall them after the incident.

Take a step back periodically, and assess if you:

  • Are following all reliable sources
  • Are following all relevant topics
  • Can improve your search terms and strings

Make adjustments accordingly. Enhance and tailor your search terms; fine-tune your list of sources. Consider adding previously unknown sources that have a heavy presence during the disaster and provide valuable, credible information. There is no perfect time to make this assessment and no required minimum or maximum number of assessments.

Illustration of a clipboard containing three large checkmarks and straight lines representing text. A magnifying glass is being held over the middle checkmark.

Process: Dissemination of the Analysis

The information gathered and analyzed is now disseminated. For the purposes of this course, the focus is on dissemination to the response efforts.

If you are providing assistance to an official agency, the information that has been analyzed and verified must be consolidated into a format from which the decision-maker can easily glean key information.

It is important to standardize information flows and formats (internal & external stakeholder) for both the collaborative working documents and the final product for the stakeholder. Build a common operating picture for your team showing the overall goals that includes team member comprehension as well as understanding for the projected mission assignment length.

Illustration of a social media site on a laptop computer, with four miscellaneous social media posts or messages protruding from the screen.

Dissemination of the analysis could be in the form of a situation report. For example, see the situation report that Humanity Road issued during Hurricane Irma, specific to Florida. Learn more about a variety of tools that were used to disseminate information.

Internal Communication

Internal communication is an important element in the process of social media situational awareness.

  • Team members must be able to divide the work to reduce redundancy of efforts.
  • The team should follow the hierarchy of the Incident Command System so that a unified message is being sent to the correct person(s) in the response efforts.
  • It can be beneficial to have a team member in the Emergency Operations Center or other physical location where they can observe conversations among response workers. They may note information needs that they can communicate to the digital communications team, who can try to answer that need.

Plan for a Post-Disaster Hot Wash

Typically, an after-action report, sometimes called a "hot wash" or "lessons learned," is generated through a process of reviewing records and consulting the key people involved. No response is ever perfect, and there is always something to learn (CDC, 2014).

See examples of Lessons Learned.

Activity: Knowledge Check


During the disaster, the first step in social media intelligence is to:


Which of these statements is not true about analyzing the data you have collected?


Key Points

In this section, we covered the following main points:

  • Social media intelligence begins with collecting content through manual searches, data aggregation tools, or both.
  • Analyze the gathered content to determine whether the sources and data are authoritative or non-authoritative.
    • For content that passes the analysis and you intend to keep, add the content to the living document and take other planned actions.
    • Eliminate any content that is determined to be invalid, inappropriate, or otherwise fail the analysis.
    • Mark any content that the team lead and/or other decision-maker needs to review.
  • Periodically assess your efforts and adjust as needed.
  • Maintain internal communication among the team.
  • After the incident, hold a hot wash to identify and document lessons learned and how to improve future efforts.