Vol. 78, No. 1Cover stories

Police running down the street in downtown Ottawa.

Live-tweeting a terrorist attack

How the public's posts can help in an emergency

By using specific hashtags and geolocation tools, analysts were able to build a rough picture of what was happening in downtown Ottawa during the Oct. 22, 2014, terrorist attack. Credit: Reuters/Chris Wattie


When she heard about the shooting, Cpl. Wendy Stewart wanted to be on Parliament Hill. She wanted to protect her colleagues, her friends and her city. Like many RCMP members in Ottawa on Oct. 22, 2014, her first thought was to rush downtown.

Instead, she got to work.

Minutes earlier, the nation's capital had been peaceful. At the National War Memorial, three sentries from the Ceremonial Guard stood watch nearby — among them, 24-year-old Cpl. Nathan Cirillo.

The calm was broken with the thunder of bullets. Michael Zehaf-Bibeau, a 32-year-old seeking retaliation for Canada's military involvement in Afghanistan and Iraq, approached Cirillo and fatally shot him twice in the back.

Zehaf-Bibeau fled to the Hill only blocks away and ran inside Centre Block, where he exchanged fire with RCMP regular members and former House of Commons Protective Service members (now the Parliamentary Protective Service) and the Sergeant-at-Arms of Parliament. Moments later he was dead, ending the most vicious attack on Parliament in more than 50 years.

From start to finish, the entire attack lasted less than ten minutes.

Stewart's job was to wade through the information deluging social media, hoping to find any information that could help during the attack — watching what police call the open source, everything from Twitter to Instagram.

"As soon as we heard about the shooting, we were doing social media searches," says Stewart. "Immediately, we went on the sites to see what we could find — seeing if anyone was talking about it online. Immediately, we were finding information. Before it was on the news, we found it on Twitter."

Finding leads

Stewart and Cpl. Judy Montreuil spent hours together poring over the data at the RCMP's Protective Investigation Unit (PIU) — watching the shock and terror of those downtown, scanning through grainy cellphone footage, clicking through graphic images from the war memorial.

By using specific hashtags and geolocation tools, analysts were able to build a rough picture of what was happening downtown. Out of the Internet's noise and chaos, they managed to find a handful of important leads — crucial information for the members tasked with securing downtown.

"We were able to find pictures of the suspect before our members on the ground had pictures of him or confirmed his description," says Stewart. "Our photo helped clear the confusion and confirm what he looked like. We were also able to get pictures of his vehicle from social media and share the description to members on the ground."

Meanwhile, at the National Capital Regional Command Centre — a room holding the high-level officers and analysts coordinating the response to the attack — Sgt. Gilbert Sabourin, Stewart's commander, was relaying and filtering information from the PIU. Together with Cpl. Dawn Robitaille, he helped make sense of the flood of sometimes-conflicting information and get it to the people who needed it.

"How much information was out there on social media and how fast it spread was amazing," says Sabourin. "Corroboration of the information was the biggest problem for us that day — the overwhelming amount of information was so hard to sort through. We were reading about multiple shooters across the city and it created such a problem for us to determine that there definitely was only one shooter."

Separating truth from fiction

Both Stewart and Sabourin agree that the hardest part of monitoring social media — whether on the day of the attack or any other — is sorting out fact from fiction.

On Oct. 22, it was a hard job to get the right information to civilians and police across Ottawa, a job made harder by the spread of false reports. One panicked tweet about gunmen at the nearby Rideau Centre mall encouraged more, creating a cascading series of falsehoods spurred on by fear.

"We brought in the reports of the Rideau shooting," says Stewart. "Gilbert liaised with the Ottawa Police Service (OPS), and OPS was able to find that it was false from sending their members to actually check."

Social media provided a snapshot of the collective psyche of those caught up in the shooting, a mixture of fear and uncertainty and confusion. In one picture, a group of masked gunmen seemed to be attacking the Hill. In reality, they were OPS officers there to help defend Parliament, not attack it. In another, a scarf-wearing man was shown carrying a rifle — it was Zehaf-Bibeau, the analysts quickly realized.

Being able to find these moments of clarity amidst the noise made all the difference in the way events played out.

"We knew what was going on down on the ground," says Sabourin. "Everything you look at has to be verified or else it becomes a nightmare of information. You're not sure what is real and what isn't — it's social media chaos."

Corroboration, he says, is the only way to make sure information from social media is genuine. Information from the police in the field is more reliable, but it's also patchier. By combining the two streams of information, members can have a much more complete and accurate picture of what's happening in the field.

Reaching out

Brigitte Mineault, who heads communications at the RCMP's National Division in Ottawa, was also in the command centre on the day of the attack. Her job was

co-ordinating the RCMP's own social media response — mainly by informing the public through Twitter.

Barely a minute after the shooter reached Parliament, the RCMP began tweeting to warn the public to stay off rooftops and away from windows.

"During an unfolding event, this is the way to go," says Mineault. "It was astounding to see the power of it. We weren't emailing local media, we weren't posting on Facebook — it was Twitter, pure and simple, that we were using to communicate with the public."

Social media proved useful as more than just a conduit for information. It helped the RCMP to keep the public informed and safe during the wide-scale emergency and, later, to solicit tips from witnesses. It also provided a vital communication lifeline for the members of the media who were trapped inside Centre Block during the attack.

"We got a lot of retweets from the media," says Mineault. "The people who were stuck inside were good at giving updates, even though they were locked down."

Although a few journalists within Centre Block put themselves in danger to capture the events inside, the media proved to be a helpful ally in keeping the public safe outside the perimeter of barricades downtown and around Parliament Hill. They shared RCMP updates, respected security restrictions and helped calm the public by not reporting on the wild speculation that ran rampant on social media.

"At any big event, it's very useful to have any sort of public involvement. We need actual witnesses to come forward," says Stewart. "Share the information, but don't endanger yourself or the police just to be the person who got the picture. And if you don't know something, don't make it up."

The future

The importance of the Internet will only continue to grow, both for the people who use it and for the police who monitor it. Already, the flood of information from the public around any single event is becoming too much for only one or two to handle.

"Things move fast. I went to a training course last year in April and another one the following July, and things had completely changed," says Stewart. "Social media is ever-changing. Really, the way people live their daily lives is ever-changing. I'd encourage everyone to just be honest, and if you really do witness something, let us know."

The future, Sabourin says, is hard to predict. What's clear is that no matter the event, whether it's a demonstration, celebration or emergency, monitoring what the public posts on social media will remain a key component of operational awareness.

Corroboration, intuition and constant analysis are the only way to stay on top of the constantly shifting streams of information. We can't predict where social media will go next — all we can do is keep watch.

Date modified: