Tags, Tweets, and Tethers

By: Dr. Dorothy E. Denning, U.S. Naval Postgraduate School


On 29 January 2007, I opened my e-mail to discover that a colleague and friend, Jim Gray, was feared to be lost at sea. A noted computer scientist and Turing Award2 winner, Gray had failed to return the day before from a solo trip aboard his 40-foot sailboat Tenacious to the Farallon Islands, which lie about 27 miles off the coast of San Francisco. Over the next several days, I observed a massive search effort spring into action. Not only did the U.S. Coast Guard search 40,000 square miles, but a large social network also emerged to assist in the effort. Sadly, Gray was never found, but the scale and energy put into the search itself was inspiring.

Since then, I have observed three other large-scale search operations, although none with life and death consequences. Indeed, all three were contests that offered prizes to the winners. The first of these, the Vanish competition, took place in 2009 with the goal of finding a person who intentionally tried to disappear under a new identity. The second, the Red Balloon Challenge, took place later that year with the objective of finding 10 red balloons that had been tethered to unspecified locations across the United States. Finally, the third, the Tag Challenge, took place in 2011 with the goal of finding five individuals in five cities of the world.

In all four of these cases, social networks emerged to assist with the search, leveraging communications and information technologies, especially social media, to mobilize, organize, coordinate, and share information. They are instances of what is sometimes called crowdsourcing, where a large network of people collectively performs some operation. The searches, especially the Gray search, also illustrate the concept of a "hastily formed network," where a network of people is established rapidly from different communities and works together in a shared conversation space in order to plan and execute an urgent mission.3 Social media can provide the shared conversation space. I take a broad view of social media, including not only media such as Facebook and Twitter that explicitly keep track of social connections like "friend" and "follower," but also the group use of communication media such as e-mail, chat, and blogs. Indeed, many social networks are organized around e-mail distribution lists and chat channels.

Cases of Large-Scale Search Operations

In this section, I briefly describe each of the four search operations and then draw on them to explore the role of social media in a large-scale search operation. I examine three areas where social media can contribute to a search: mobilization of persons and resources, data collection and dissemination, and verification of acquired data. For each of these areas, I offer principles for how social media and other technologies and strategies can facilitate large-scale search operations, using the four cases to illustrate.

The Search for Jim Gray

When news of Jim Gray's disappearance began to spread on 29 January 2007, a massive social network of colleagues and friends in different disciplines and industries emerged, offering funds, resources, and expertise to aid the effort. Eventually, the effort centered on acquiring and analyzing images from satellite and aerial sources, with most of the imagery coming from Digital Globe's QuickBird satellite.4

At the time of Gray's disappearance, Facebook had a modest 20 million users, and Twitter was less than two years old. Thus, it is not surprising that neither played a prominent role in the search. Instead, a core group of volunteers organized and coordinated their efforts through a "Friends of Jim" e-mail list and a blog called Tenacious Search, named after Gray's sloop. Although Gray was never found, the search operation showed how a social network could self-organize and deploy massive resources to aid the effort.5

Vanish Contest

The Vanish contest began on 15 August 2009, when Wired Magazine announced a $5,000 prize to anyone who could find author Evan Ratliff, say the password "fluke," and take his picture—all within 30 days. In cahoots with the magazine, Ratliff had vanished from his home in Northern California armed with business cards showing a fake identity, James Donald Gatz. His objective was not to go into isolation or even off the grid, but rather to see what it would be like to disappear for a month and assume a new identity.6

In addition to using a fake identity both online and off, Ratliff used prepaid phone cards, gift cards (paid for with cash), and cash to fund himself while in hiding. He concealed his presence on the internet by using free accounts set up with the fake identity, connecting through a computer that he set up in Las Vegas, and using the anonymity tool Tor to further obfuscate his location. But he took some risks, occasionally using his real ATM card and credit cards, or connecting directly to a website. As agreed, whenever he used his real identity, Wired's editor posted the transaction information online, presumably to provide enough clues to keep searchers interested in the hunt. Had Ratliff not taken these risks, he might not have been found before the deadline. As it was, Ratliff was found in New Orleans on 8 September, a week before the clock ran out.7

Red Balloon Challenge

On 5 December 2009, the Defense Advanced Research Projects Agency (DARPA) ran the DARPA Network Challenge, offering a $40,000 prize to the first person to report the correct locations of 10 tethered eight-foot red balloons that had been scattered throughout the United States. The challenge was announced on 29 October during a celebration of both the 40th anniversary of the internet and the first remote login to ARPANET, giving potential contestants over one month to prepare.8

The challenge was set up as an experiment in social network mobilization. DARPA wanted to "identify distributed mobilization strategies and demonstrate how quickly a challenging geolocation problem could be solved by crowdsourcing."9 Although the task was considered intractable by conventional intelligence methods, an approach built around social networking seemed promising. This was confirmed when a team from the Massachusetts Institute of Technology's Media Lab successfully mobilized a cross-country social network and reported the correct locations of all10 balloons in eight hours and 52 minutes.10

A team from Mercyhurst College's Department of Intelligence Studies approached the challenge from an intelligence analyst's perspective, applying the concept of intelligence preparation of the battlefield (IPB) to predict where the balloons might be located. They mapped the locations of all DARPA-funded sites, expecting the balloons to be nearby. Their strategy also included identifying lesser-known networks they could tap into, such as law enforcement intelligence analysts and interstate truckers. However, they started late and did not correctly report any balloons.11

Tag Challenge

Sponsored by the U.S. State Department, the Tag Challenge took place on 31 March 2012, with the goal of determining "whether and how social media can be used to accomplish a realistic, time-sensitive, international law enforcement goal."12 Specifically, contestants had to locate and photograph five "suspects" in five different cities of the world: Washington, D.C.; New York; London; Stockholm; and Bratislava, Slovakia. The suspects were described as jewel thieves who had "stolen a prized diamond" but were actually volunteers who had been instructed to follow a 12-hour itinerary designed to look like a normal day. The contest offered a prize of $5,000 to the first person who submitted verifiable pictures of the suspects within the allotted 12 hours for each city. Although the contest was announced two months in advance, officials waited until the day of the contest to post "mug shots" of the suspects, all wearing colorful T-shirts with the competition logo.13

Like the Red Balloon Challenge, the Tag Challenge tested the role of social networks and social media in a large-scale search operation. It was more difficult than its predecessor, however, spanning two continents and employing mobile targets that would be more difficult to spot than large red balloons. No team found all five suspects, but the team CrowdScanner, whose members came from five universities in the United States, United Kingdom, United Arab Emirates, and Australia, found the three suspects in Washington, New York, and Bratislava. None of the team's members resided in the target cities, but at least one had been part of the winning MIT Media Lab team in the balloon challenge.14

Social Network and Media Roles

This next part of the discussion turns to the role of social media in the mobilization of a large-scale search effort, in the dissemination and collection of information, and in the verification of acquired data.


In all four operations, social media played a key role in mobilization. However, the most successful efforts also benefited from the use of mass media, and two of these from the application of a recursive incentive structure as well. The following discussion elaborates on these findings.

Social Media Can Enhance Mobilization

Social media offer two advantages for mobilization. First, they encode existing social networks through such constructs as friends, followers, group memberships, and distribution lists, making it easy to spread information through these networks. Second, the technology facilitates the formation of new networks and the growth of existing ones.

All four operations made extensive use of social media to recruit participants in their search efforts, although the technologies they used varied somewhat. The search for Jim Gray, for example, was mobilized initially through various e-mail discussions among Gray's colleagues and friends. Recognizing the need to provide a central means of communication and coordination for everyone involved, the group set up the Tenacious Search blog. At first, the blog had open authorship rights, acting as a public forum and bulletin board.

After the blog attracted a large audience, however, these rights were restricted to a smaller group, while the core group of volunteers moved to a "Friends of Jim" e-mail distribution list to coordinate their search efforts. At the same time, the blog continued to support mobilization, with the blog administrator serving as a point of contact for outside persons offering tips and skills to aid the search. When the search was over, team leaders noted how "modern networked technologies enabled a group of acquaintances and strangers to quickly self-organize, coordinate, build complex working systems, and attack problems in a data-driven manner." They also recognized that "the process of coordinating diverse volunteer skills in an emerging crisis was quite difficult, and that there is significant room for improvement over standard email and blogging tools."15

By the time of the other three search operations, both Twitter and Facebook were more popular, and both played a role in mobilization. In the Vanish contest, the Twitter hashtag #vanish drew 600 posts a day, while the "Search for Evan Ratliff" Facebook group attracted over 1,000 members.16 In the Red Balloon Challenge, hacker George Hotz found eight balloons, in part by leveraging his existing Twitter network of almost 50,000 followers. Another team, Nerdfighters, tapped into its network of 5,000 followers of the Brotherhood 2.0 vlog (video blog) and created a video that went viral. Several teams used Facebook's friends structure to recruit, the result being that Facebook alone brought more referrals to the official challenge website than any of the search engines, including Google.17 The Mercyhurst team set up a Facebook group that grew to 447 members within 24 hours.18 Twitter and Facebook were used in the Tag Challenge as well, with the winning team creating a Twitter account and Facebook page that people could follow and like, respectively. The team thought, however, that Twitter and Facebook might have played a larger role in increasing the credibility of the teams than in actual recruitment. One team tried, but failed, to create a bandwagon effect by creating a large number of fake Twitter followers.19

Social Media Should Be Augmented with Mass Media

All of the operations seemed to benefit from mass media exposure. This was especially apparent in the Red Balloon Challenge, where the top two teams garnered far greater media exposure than the other teams. The winning MIT Media Lab team made CNN Headline News on the day of the contest, while the Georgia Tech Research Institute team, which came in second with nine balloons, leveraged mass media coverage before the event. That coverage also helped to boost the search engine ranking for their team's website. In addition, both the MIT and Georgia Tech teams enjoyed the national name recognition that came with their schools, which may have contributed to their ability to recruit volunteers to work on their behalf.20

In its project report, DARPA observed that "mass media was more predictable than viral transmission for the diffusion of the [challenge]." It noted that diffusion eventually proceeded virally, but that "the inflection was not until the final days before the balloon launch and it followed the extensive media coverage of the final week."21

In the Tag Challenge, the winning CrowdScanner team also leveraged mass media and tried to generate attention on blogs and news sites. It was mentioned on CNET and ZDNet, as well as by its representative universities' press teams. Organizers noted that most of their competitors focused purely on social media, and on Twitter in particular. They observed that this narrower strategy was insufficient and led some searchers to be perceived as spammers.22

Although not usually considered either "social media" or "mass media," public websites, which serve primarily as means of disseminating information, also played a role in the Red Balloon Challenge and the Tag Challenge, and were used by the winning teams. Nevertheless, they too appeared insufficient by themselves as a means of mobilization. The Spot Big Red team in the balloon challenge, for example, went so far as to purchase the word "challenge" from Google, so that anyone searching for the word would see a click-through ad linking to their team website. But they had no external media coverage and drew few recruits.23

Of course, overall strategy also mattered. In the Red Balloon Challenge, a team from the Harvard Business School claimed almost two million "impressions," which included e-mails to their vast network of alumni, tweets and alumni re-tweets, and an ABCNews.com story featuring their team. Still, the team found no balloons, apparently because they spent too much effort on marketing rather than execution.24

Recursive Incentive Strategies Show Promise

The winning teams in the Red Balloon Challenge and Tag Challenge both used a recursive incentive structure to entice volunteers to work with their teams. In the Red Balloon Challenge, the $40,000 prize money was allocated in such a way that anyone who either found a balloon or was on the referral chain to the finder would be rewarded. Specifically, each balloon was worth $4,000, with the money partitioned as follows: the finder would receive $2,000, their referrer $1,000, the referrer's referrer $500, and so on, for the length of the chain. Any remaining moneys would go to charity.25 To support their reward structure, new recruits were given an individualized referral link that they could share on social networks.26

A slightly different strategy was used in the Tag Challenge, but it too was designed to reward recruiters as well as finders. Here, $1,000 was allocated for each of the five suspects, with $500 for the finder and $100 for the referrer. In addition, recruiters were to receive $1 for each of the first 2,000 recruits.27 Although we cannot say with certainty that the recursive incentive strategy contributed to the success of the winning teams, it may have been a factor in the teams' attracting mass media publicity and then recruits. However, other teams that did not offer any direct monetary incentives at all also did well. The second-placed Georgia Tech team in the Red Balloon Challenge said that many balloon spotters chose that team because of its plan to donate the winnings to the American Red Cross.28

Collection and Dissemination of Information

This section describes the ways in which social media can be used both as a means of disseminating information and as a source of new information.

Social Media Can Facilitate Information Dissemination

Twitter has become a popular medium for live reporting of events, often with links to accompanying photos and videos. This use was evident in the Red Balloon Challenge, where several balloon sightings were reported on Twitter. George Hotz was able to locate four balloons just from reports on his Twitter network.

Twitter also played a prominent role in the Vanish contest, with users of the #vanish hashtag using the medium to share clues and theories. However, one frequent poster, a 16-year-old high school student named Jonathan Mäkelä, thought the conversation on Twitter was too public, because it enabled the hunted also to know what was going on. Mäkelä suggested that groups needed to go private to win; he then set up a private, passwordcontrolled chat room for those he was sure were not Ratliff. Jeff Reifman, a former Microsoft group program manager, developed a Facebook app called Vanish Team for information and discussions about Ratliff, but most of the intelligence swap took place on Twitter or in Mäkelä's chat room.29

In the Tag Challenge, the winning team posted its early successes on social media. Team members also built a mobile phone app that allowed people to see photos of the suspects and submit pictures of them if they were spotted. The team found, however, that those who actually spotted the suspects submitted their photos directly through e-mail.30

Social Media Can Be a Source for Intelligence Data

Because so much information is disseminated through social media, the media themselves provide a source for raw intelligence data. Again, this was apparent in the contests. In the Red Balloon Challenge, for example, the iSchools team, representing a consortium of five schools, mined publicly accessible internet sites, including Twitter feeds and competitor sites, for published reports of sightings. They found five balloons this way, but only one by drawing on their own social network.31

In the Vanish competition, Jeff Reifman combed through visitors to his Vanish team, thinking (correctly) that Ratliff might be among them. This led him to the profile for a James Donald Gatz and the "jdgatz" Facebook account that Ratliff had set up with his fake identity. Reifman then found three friends of Gatz, who were willing to keep him apprised of Gatz's private posts. After Gatz made his @jdgatz Twitter feed public, Reifman also started following it. Meanwhile, Mäkelä had triangulated Ratliff's IP address to New Orleans. Once Reifman saw that @jdgatz was following three New Orleans businesses on Twitter, he looked up one, Naked Pizza, on the Web and sent off an e-mail asking for help. Naked Pizza cofounder Jeff Leach agreed and was the person to say the password "fluke" when he spotted Ratliff outside a local bookstore.32


In any intelligence operation, it is important to know whether acquired data is accurate. Collectors can make mistakes, and adversaries can intentionally inject bogus data. Here I discuss two ways in which social media can contribute to data verification: first, through technologies associated with social media, and second, through crowdsourced verification.

Social Media–related Technologies Can Aid Verification

Some of the technologies used with social media can facilitate verification. Tweets from cell phones can reveal the geo-locations of the phones, as can photos taken by cell phones and tagged with location coordinates. In addition, IP addresses can be mapped to at least proximate geo-locations. All of these location-based technologies can be used to verify whether claimed locations match actual locations. For example, if someone tweets that they just found a balloon in Denver and includes a link to a picture taken with their cell phone, verifiers can compare the reported location against that supplied with the tweet or the photo if that information is available.

In the Red Balloon Challenge, the MIT Media Lab team received more than 200 submissions, only 30 to 40 of which proved accurate. To weed out the false reports, humans reviewed the submissions. They found one bogus report where the reported location, Florida, did not match the location of the IP address associated with the submission, Los Angeles. They also found multiple bogus submissions reporting exactly the same geo-coordinates. These reports contrasted with the multiple submissions they received for actual sightings, where the reported coordinates varied slightly, owing to the spotters' being in somewhat different positions and small errors in location sensors. In addition, the photos submitted with bogus submissions tended to be fuzzier and lacked the DARPA banner. The iSchools team, which found five balloons on Twitter and other public media, gave a higher reliability assessment to tweets from established users with geo-tagged photos than to those from new accounts without followers.33 The Mercyhurst team used their IPB analysis to rank order reported sightings, giving priority to ones in areas where they expected the balloons to be deployed. For those they decided to investigate further, they used Google Earth to identify local restaurants and stores they could call for verification.34

Verification Can Be Crowdsourced through Social Media

Social media can provide an efficient means for crowdsourcing the verification process. In the Red Balloon Challenge, the Nerdfighters team compiled a cell phone and address list for 2,000 persons they could dispatch for balloon verification through targeted text messages. Their entire operation was coordinated by 10 individuals using Skype. Groundspeak Geocachers drew on their network of hundreds of thousands of members to effectively dispatch verifiers, and correctly reported seven of the balloons.35 The iSchools team dispatched verifiers from a list of pre-recruited observers, as well as people from their schools, family, and friends in the vicinities of the reported locations.36 The search for Jim Gray involved farming out satellite image tiles to human analysts in order to determine areas where Gray might be found. Initially, the team used Amazon Mechanical Turk to crowdsource the review process, but eventually turned to expert analysts, who were faster and more accurate than the novices tasked by Mechanical Turk. A cluster of these analysts were colocated at The Johns Hopkins University, allowing them to collaborate and coordinate their review. Promising images were then sent to experts in marine imagery in order to determine areas worthy of dispatching people for a closeup search.37


The four search operations described here demonstrate how social media and related technologies can facilitate a large-scale search for persons and things. They can aid the processes of mobilization, information collection and sharing, and verification of data acquired, as well as communication and coordination in general. However, the search operations also drew upon other technologies, including image processing, data mining, and geo-location and mapping technologies. In addition, they made use of on-site human intelligence; in all three contests, human spotters took photos and reported or verified sightings.

Although social media can in principle support large, distributed networks lacking any centralized command and control, all four of the operations described here were led by individuals and small teams of people who debated and developed strategy, initiated actions, and coordinated contributions to the search effort. At least in these cases, the media alone were insufficient without imposing some form of organizational structure on the network, even if that structure was self-organized.

The four search operations also demonstrate that many other factors can affect the success of a search effort, including the use of mass media, name recognition, incentives, and, of course, the nature of the search to begin with. Some persons, such as Jim Gray, may never be found, and actual fugitives and intelligence targets may work much harder to hide than did Ratliff in the Vanish contest and the volunteer suspects in the Tag Challenge. Social media are not a panacea, but neither should they be overlooked or discounted.

At least one company, Crowdfynd, has been formed to exploit social media technologies to help people locate missing items. Its mobile and Web-based application leverages the power of crowdsourcing to report crimes as well as found items, and to search for missing items by location and a photo display of found items.38 It will be interesting to see whether Crowdfynd catches on, and what else might emerge to support large-scale searches.

About the Author(s): Dr. Dorothy E. Denning is a Distinguished Professor of Defense Analysis at NPS, where her focus has been mainly in the area of cyber security and cyber conflict. She earned her doctorate from Purdue University, which later named her a Distinguished Science Alumnus. Dr. Denning is the author of Cryptography and Data Security (Addison-Wesley, 1982) and Information Warfare and Security (Addison-Wesley, 1998). She has received numerous awards, including the Ada Lovelace Award, the National Computer Systems Security Award, and the Harold F. Tipton Lifetime Achievement Award. In October 2012, she was


1. The views expressed in this article are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. government.

2. The A.M. Turing Award is given annually by the Association for Computing Machinery to individuals who make a substantial and lasting technical contribution to the field of computing. Gray received the prize in 1998.

3. Peter J. Denning, "Hastily Formed Networks," Communications of the ACM 49, no. 4 (April 2006): 15–20: http://denninginstitute.com/pjd/PUBS/CACMcols/cacmApr06.pdf

4. Joseph M. Hellerstein and David L. Tennenhouse, "Searching for Jim Gray: A Technical Overview," Communications of the ACM 54, no. 7 (July 2011): 77–87.

5. Ibid.

6. Evan Ratliff, "Writer Evan Ratliff Tried to Vanish: Here's What Happened," Wired 17, no. 12 (2009): http://www.wired.com/ vanish/2009/11/ff_vanish2/

7. Ibid.

8. ARPANET, the Advanced Research Projects Agency Network, was the original form of the internet created by the U.S. Defense Department and several universities. Defense Advanced Research Projects Agency (DARPA), "DARPA Network Challenge, Project Report," Arlington, Va., 16 February 2010, 2: http://www.eecs.harvard.edu/cs286r/courses/fall10/papers/ProjectReport.pdf

9. Ibid.

10. Ibid., 9.

11. Kristan J. Wheaton, "Lessons Learned: DARPA Balloon Challenge," Sources and Methods (blog), 6 December 2009: http://sourcesandmethods.blogspot.com/2009/12/lessonslearned-darpa-balloon-challenge.html

12. See the TAG Challenge website: http://www.tag-challenge.com/

13. Ibid.

14. Iyad Rahwan et al., "Global Manhunt Pushes the Limits of Social Mobilization," Computer 46, no. 4 (2013): 68–75.

15. Both quotes come from Hellerstein and Tennenhouse, "Searching for Jim Gray," 87.

16. Ratliff, "Writer Evan Ratliff Tried to Vanish."

17. DARPA, "DARPA Network Challenge," 13.

18. Wheaton, "Lessons Learned."

19. Rahwan et al., "Global Manhunt Pushes the Limits."

20. DARPA, "DARPA Network Challenge," 13.

21. Both quotes come from ibid.

22. Rahwan et al., "Global Manhunt Pushes the Limits."

23. DARPA, "DARPA Network Challenge," 12.

24. Ibid.

25. Ibid., 10–11.

26. "U.S. Government Sponsors High-Stakes Balloon Hunt," NPR, 11 December 2009: http://www.npr.org/programs/talk-of-the-nation/2009/12/11/121343437/

27. Rahwan et al., "Global Manhunt Pushes the Limits."

28. "I Spy a Red Balloon: Georgia Tech Team Wins Key Insights— and a Second-Place Finish—in DARPA Network Challenge," Georgia Tech Research Institute, n.d.: http://www.gtri.gatech.edu/casestudy/red-balloon-darpa-challenge

29. Ratliff, "Writer Evan Ratliff Tried to Vanish."

30. Rahwan et al., "Global Manhunt Pushes the Limits."

31. John C. Tang et al., "Reflecting on the DARPA Red Balloon Challenge," Communications of the ACM 54, no. 4 (April 2011): 78–85.

32. Ratliff, "Writer Evan Ratliff Tried to Vanish."

33. Tang et al., "Reflecting."

34. Wheaton, "Lessons Learned."

35. DARPA, "DARPA Network Challenge,"10, 17.

36. Tang et al., "Reflecting."

37. Hellerstein and Tennenhouse, "Searching for Jim Gray."

38. See the Crowdfynd website: https://www.crowdfynd.com/

Average (0 Votes)
The average rating is 0.0 stars out of 5.
No comments yet. Be the first.