Security Alerts' 5-Step Process

SECURITY ALERTS

OUR 5-STEP PROCESS

Security alerts - Sourcing and Verification

A real-life example from our Philadelphia team

Did you know International SOS protects 12 million lives every day with the help of our security analyst team? Our experts come from a diverse background of ex-government, NGO, police, rescue services, operational intelligence, corporate security, journalism, and more.

In 2023, we supported over 3.4 Million Assistance calls and published more than 11,800 security related alerts providing intelligence and actionable advice to our clients around the world. Our 11 Security Intelligence Centers are located in 29 countries and staffed by over 3,200 experts.

Our security analyst follow a five-step process, ensuring all security threats and risks are corroborated and sent to all relevant users providing information based on the proverbial five W’s: Who? What? Where? When? and Why?, instructions on how to respond, and updates when necessary.

Step one: Detection

Our 24/7 analyst team use a variety of scanning tools and platforms to monitor social media, news media and official resources (embassies/warden networks etc.) alongside input from local staff and contacts. Intelligence gathered through these methods is assessed for impact to our client base and analyzed against pre-established, and regularly evaluated, reporting thresholds.

On 4 November, the Philadelphia-based team were specifically monitoring protest activity in the US in the context of the presidential election.

Ahead of the election, the team had consolidated lists of keywords, locations, and lists of twitter handles and accounts to optimize input by their detection tools.

On that day, one of our analysts spotted at 6:46PM (local time) a tweet by a Portland-based journalist, who had been pre-identified as a reliable source, on ongoing demonstrations in downtown Portland. The analyst (who was not on duty) shared the tweet on the team’s group chat so the team on duty could immediately start the verification process.

Step two: Verification

Once it is deemed that a development meets our thresholds for reporting, the information must be corroborated. This is done through various means, including tracking official sources, analyzing video and photo imagery and in certain cases, contacting on-the-ground sources.

In this example, the initial tweet was followed at 07:01PM by tweets carrying videos of disturbances in downtown Portland, and shortly afterwards by a tweet by the Multnomah County Sheriff's Office - which is responsible for law enforcement in Portland - indicating that the protests were becoming violent. The sheriff’s tweet helped corroborate the existence of the unrest, while the amateur videos helped assess their magnitude and nature.

Step three: Drafting

The analyst then drafted a high-priority report based on those inputs. The alerts provided factual information based on the proverbial four W’s of information gathering: Who? What? Where? When?, and, importantly, advice for how those finding themselves in nearby areas should respond. The analyst assigns it a severity level (here: an Advisory) based on the urgency of communicating to clients and on how serious the situation is.

Step four: Editing

Once ready, the report is processed by our 24/7 team of editors. The duty editor checks the draft for typos, spelling mistakes but also verifies facts, sources and relevance, before publishing the alert with the correct tagging (including an impact radius), to maximise relevance to recipients. This constitutes another layer of verification. The Advisory alert was published at 07:16PM.

Step five: Further monitoring and follow-up

While the alert may be in the hands of our clients, the job is not over. The analyst team continues to monitor the incident and provide updates as necessary. Simultaneously, our operations team is made aware of the issue so that they can brief clients who engage directly with our Assistance Centers.

Take a look below at the events that triggered a security escalation from our Security Teams for the period FY 2021/2022

SEE IT IN ACTION

Portland – 4 November

On 4 November, our team of analysts detected chatter from local journalists in Portland regarding unruly protests in the downtown area. The team was already on alert for such disturbances given the election cycle and immediately began to investigate and draft a corresponding report. Soon after, additional imagery of the disturbances surfaced along with a corroborating statement from law enforcement. The team was well-positioned to promptly issue an alert to our client base advising them to avoid the area. Download here >>

OUR SECURITY CAPABILITIES