technique of generalised mayhem without any particular direction

Over at Stable & Principled, I've been blogging about running out of policemen and how the Prime Minister doesn't seem to have any thoughts at all that weren't adequate-ish newspaper columns from about 2004. But how did we get to the stage of using up the Met and most of the wider police forces' reserves of manpower just like that? This isn't a "What does it all mean?" post, although inevitably we'll have one of them for you as well. It's more like a "How does it all work?" post.

In all, 2,347 people have been arrested nationally. This is only a rough lower bound on the numbers of people involved, as obviously not everyone got caught and some of the people arrested are innocent. At an arrest rate of one in 10, that would give a total of 23,000. 51% of the arrests were in London, or to be precise the Met's area of operations, which gives us the answer to one question at least - the police eventually quelled the riot by outnumbering the rioters, 16,000 cops versus an estimated 11,500 rioters. Obviously if you pick a different arrest rate fudge factor you'll get a different answer, but then at least we're using a model of sorts.

It's certainly interesting, though, that a fairly small crowd was able to exhaust the policing resources of most of the UK. If the 23,000 rioters had shown up in central London to march on Whitehall, even assuming they were willing to be as troublesome and violent as they were elsewhere, I think the Met would have handled it without breaking sweat and certainly without needing to summon the South Wales force as mutual aid. Even the most hayseed British police forces deal with crowds of 23,000 young men reputed to be ready for violence, every weekend, quite commonly several at the same time, without very much happening. They are lower division football matches. And to be frank, a 23,000 strong national demo is disappointing.

So what's up? One point is dispersion vs. concentration. Demonstrators want to occupy symbolic space and show their organisation by the very fact they could concentrate all these people. Casuals want to duff up the other mob. Therefore, the police problem is to either prevent them from getting to Parliament Square or the match, or else keep them segregated from other people while they are there. The police are on the tactical defensive, but the strategic offensive - if they stick it out they win.

Obviously, the demonstrators (or thugs) can't counter this by dispersing because that would defeat the point. They have to come to the Bill, and the Bill can then canalise them. Kettling is the ultimate expression of this thinking.

If the police have to look for the crowd, though, this is obviously going to be a much more labour-intensive exercise. You can't kettle several dozen groups of ten or so people spread over a dozen streets - the idea is absurd. You have to go looking for them. That in turn conditions what the crowd can do - it can't stage a classic mass demonstration - and favours people who are willing to just randomly destroy stuff that happens to be undefended, while the traditional mass demo favours a show of what you might call subversive respectability. The slow march of the Zulus, if you like.

Another important point was that there was no key identity-group here - it wasn't aligned with any one ethnic or religious group or geography and wasn't even totally young, and it didn't explicitly identify with a class either. Therefore, anyone who felt like it could join in, and did. This obviously helped it go national and also made a traditional (since the 80s) police tactic more difficult. How do you call community leaders to ask everyone to go home if you can't identify the community? From the other direction, how do you negotiate with authority if you can't identify a community?

(This is of course the final problem with the Big Society - its only organising principle is that it's a society and apparently it's big.)

I wonder if a lot of the violence was driven by the fact anyone could turn up, and therefore the only way to demonstrate that you really were one of the gang rather than a do-gooder or a fink or just some random spectator was to do something obviously illegal.

Also, did this kind of riot drop in between the classic modes of British policing? If someone commits a crime, there's investigative policing, if it's the right kind of crime and the right kind of victim. If the Chartists are marching on Westminster, line up on Westminster Bridge with shields and big sticks. And of course there's community policing if there's time between the other two for some cups of tea and old ladies, etc.

Investigation was rather irrelevant while it was going on, although of course it's not any more. And the heavy mob couldn't draw a shield wall around every shop in London. Neither could they find enough bodies to kettle every group of rioters, or find enough rioters in one place to kettle. It does look like the December 2010 student riots were a tactical learning-experience for a lot of people.

Finally, those BlackBerries. Not much to say here, except that the most important feature involved seems to have been the fact that BBM is multicast. You can message groups rather than only individuals. There are apps that let you emulate this with SMS, although the reply will only go to you.

As a general rule, BlackBerry Enterprise Server traffic should be hard to do anything to as the server, typically hosted by an organisation for its own purposes, generates its encryption keys when it's set up. It's not anything RIM or your operator has to know about. But this is of limited relevance - plenty of people run their own mail servers, but I've never heard of anyone who self hosts BlackBerry. The BlackBerry Internet Service, which is hosted by operators, certainly can be monitored by the operator as they own the server. UK operators would be covered by the Regulation of Investigatory Powers Act and might have to hand over logs from the BIS servers.

I don't know, however, if the BIS machine archives the content of what passes through it (which isn't required by RIPA anyway). Obviously, the traffic-analysis data of who messages who and when is potentially revealing.

From a network point of view, though, I doubt if snooping on the traffic in transit would be very useful. You'd know that someone was using a BlackBerry, as it would be opening Packet Data Profile connections through the network and querying the BlackBerry network DNS. But as they monitor messaging all the time, that isn't very useful information. Certainly nothing as useful as the BIS server log.