## 2 Overview of Cyber Threats in EM
### Communication Media
#### 2.1.8 Social Media  
Emergency services have been using web-based community warning systems for several years [89], and many have recently implemented social media strategies in their emergency response plans. This typically involves the local authorities broadcasting alerts to the followers of their twitter or Facebook accounts [90]. During the flooding in central Europe in 2010, the population of a city in Poland used a forum to exchange information about localised flooding, which was more efficient than the official communications using more traditional methods [91]. Twitter messages can potentially provide geo-location information, which would be invaluable, although still not widely in use in emergencies [92].  
Most popular social networks rely exclusively on single login/password authentication. Their focus is primarily on privacy rather than security, despite the large number of high-profile incidents of hijacked accounts. Third party social media management applications are often used to improve on this security by providing differentiated permission levels and HTTPS for protecting from password sniffing on public wireless networks. However, there is no public study of their performance and effectiveness.  
_Open issues in security of Social Media used in EM_: Individual accounts of social network users are often compromised, with plenty of web sites, Youtube videos and research papers showing how. An example is [47], which has discussed a series of methods for taking over Facebook and twitter accounts and for performing social network relay attacks on Facebook. In a relay attack, the attacker gets access to the social network content shared by the victim, creates a new profile with the same name as the victim, and selectively adds, deletes or modifies messages that are then shared with the public. So, it would not be unrealistic to consider an attacker gaining control of an emergency service's social network account to broadcast false information. This could endanger the public and impede emergency response, perhaps by initiating flash mobs of misled volunteers at an ill-chosen time and place.  
In addition, there are currently projects piloted to allow the public to report emergencies using twitter and similar social networks instead of calling [93]. Thus, a second open issue has to do with the trustworthiness of information communicated by the public to the emergency services through social media. [PERSON] and [PERSON] [48] have provided a first discussion on how to assess and improve the trustworthiness of social media specifically for EM, but relevant technical research has not been provided to date.  
At the same time, it is unclear how an EM social network-based reporting system would cope with large numbers of maliciously-generated spam messages. A first large-scale and systematic attempt to detect and defend against twitter spam has been recently presented in [49], where a Random Forest classifier is used to tell whether a message has been sent from a human, a bot, a human-assisted bot or a bot-assisted human. The latter refers to users employing applications that automatically post periodic updates in their absence. The classifier involves an entropy component that evaluates periodicity of message timing, a spam text Bayesian classification component looking for known spam text and a component that looks for suspicious account properties, as evidenced by the frequency and type of external URLs in tweets, the followers-to-friends ratio and the input device. The specific approach was shown to work particularly well when differentiating between humans and bots, but was less effective for human-assisted bots or bot-assisted humans. In addition, some of the input features used, such as signatures of known spam text and frequency of external URLs, would not be relevant in the case of an attack that aims to flood an emergency service's account with illegitimate or misleading messages rather than to advertise external links.