DHS Social Media Monitoring FOIA Documents

Social Media Operational Use Templates

Social Media Operational Use Templates, or SMOUTs (pronounced “smoots”), are forms that DHS components fill out to describe their collection and use of potentially sensitive personally identifiable information (PII) from social media platforms for various purposes. The templates are mandated by a 2012 DHS Privacy Policy for the Operational Use of Social Media. These forms are submitted to the DHS Privacy Office for its review and approval before the component undertakes a new (or modified) effort to use or collect information from social media. To our knowledge, this is the first time that most, if not all, of these SMOUTs have been made publicly available. Each SMOUT consists of the following:

• A summary of the DHS component’s intended use of social media.
• A list of applicable authorities governing the data collection (such as departmental Privacy Impact Assessments (PIAs) and System of Records Notices (SORNs)).
• Information regarding the particulars of the collection, including whether the social media monitoring is ongoing; whether a department-specific set of Rules of Behavior governs the use or collection of social media; whether monitoring will be facilitated through fake accounts; to what extent there will be interaction with the public or collection of the public’s PII; and whether there will be documentation of the searches.
• Comments from the Privacy Office evaluating whether the intended use of social media is privacy-protective and authorized.

The Brennan Center received a total of 35 SMOUTs covering social media use by CBP, ICE, U.S. Citizenship and Immigration Services (USCIS), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Emergency Management Administration (FEMA), the U.S. Coast Guard, and a handful of other DHS components.

CBP SMOUTs governing:

• Use of social media through “overt research” (conducted without logging into an account) and “masked monitoring” (referring to use of a fake social media account to obscure users’ government affiliation). Reviewed by the Privacy Office on May 13, 2015.
• Checks conducted by CBP officers and Border Patrol agents on people they encounter at the border through social media, including to determine whether to admit the person into the country. The SMOUT contemplates that border officers will review social media at their discretion, and any information obtained may be retained in the Automated Targeting System Targeting Framework (ATS-TF), a part of CBP’s main database and analytical system. It also contemplates that CBP officers may access social media content that would usually be restricted from their computers, but the specific methods for doing so are redacted. Reviewed by the Privacy Office on December 17, 2015.
• Investigations into allegations of corruption or misconduct by CBP officers undertaken by the Office of Internal Affairs. The Privacy Office denied the SMOUT because the Office of Internal Affairs submitted incomplete compliance documentation. Reviewed by the Privacy Office on January 28, 2016.
• Use of social media by CBP intelligence research specialists, CBP officers, Border Patrol agents, and Air and Marine personnel, though the heavy redactions on this SMOUT obscure the activities it authorizes. Reviewed by the Privacy Office on May 13, 2015.
• Collection and analysis of information from social media by Border Patrol intelligence personnel. Social media collected pursuant to this SMOUT will be stored in CPB’s ATS-TF and Analytical Framework for Intelligence (AFI), which help to power opaque risk assessments and criminal enforcement at the border. Reviewed by the Privacy Office on November 27, 2017.
• Use of social media by analysts within the Cyber Threat Intelligence In its comments, the Privacy Office refers to this SMOUT as a privacy threshold analysis (PTA), which is a different type of document that we cover below. It is unclear if this was an error, or if some SMOUTs include an analysis conducted as part of PTAs. The Privacy Office also required CBP to draft a Privacy Impact Analysis to cover this use of social media, though none seems to have been published. Reviewed by the Privacy Office on April 26, 2019.
• Administrative investigations undertaken by the Office of Professional Responsibility (OPR) into allegations against CBP employees. Reviewed by the Privacy Office on February 12, 2018.
• Criminal investigations undertaken by OPR regarding allegations against CBP employees. Reviewed by the Privacy Office on February 21, 2018.
• Research undertaken by the Office of Trade’s Forced Labor Division. Though the SMOUT is largely redacted, it indicates that the division develops its cases through “open source searches,” including on social media. Reviewed by the Privacy Office on September 24, 2018.
• Background investigations for employees. Reviewed by the Privacy Office on May 16, 2018.

ICE SMOUTs governing:

• Undercover investigative operations undertaken by ICE’s Office of Professional Responsibility (OPR) and Homeland Security Investigations (HSI), its powerful investigative arm. Though all of ICE’s SMOUTs (except the one covering general research) permit officers to use fake accounts on social media, only OPR and HSI are authorized to interact with people online undercover. Indeed, the SMOUT states “undercover operations often require[]” criminal investigators to “appear to be engaged in a criminal enterprise and to befriend or become business associates” with the targets of their investigation. Reviewed by the Privacy Office on November 6, 2012.
• Criminal and administrative immigration law enforcement activities. Reviewed by the Privacy Office on January 3, 2017. Additionally, we received an email indicating that this SMOUT may have been updated in 2019, but we did not obtain this more recent version. We also obtained an older version of this SMOUT reviewed by the Privacy Office on November 6, 2012.
• Administrative investigations regarding improper activity by ICE and CBP officers and contractors. Reviewed by the Privacy Office on November 6, 2012.
• Use for criminal law enforcement Reviewed by the Privacy Office on November 6, 2012.
• General research. Reviewed by the Privacy Office on November 1, 2012.

USCIS SMOUTs governing:

• Use of social media by the Fraud Detection and National Security Directorate (FDNS) to identify potential threats posed by those applying for immigration benefits. Notably, all of FDNS’s SMOUTs permit its officers to use fake accounts on social media after USCIS reversed its prohibition on the practice. According to the SMOUTs, this change occurred in 2017. Reviewed by the Privacy Office on August 9, 2019
• Online activities undertaken by FDNS to detect, pursue, and deter fraud in immigration requests. Reviewed by the Privacy Office on August 9, 2019.
• Identification and removal by FDNS of “systemic vulnerabilities” in the immigration system. Reviewed by the Privacy Office on August 9, 2019.
• Background checks and administrative investigations undertaken by FDNS into individuals with potential fraud, national security, and public safety concerns. Reviewed by the Privacy Office on September 24, 2018. We also obtained a version of this SMOUT reviewed by the Privacy Office on August 1, 2014.
• Investigations to support immigration benefit determinations and into alleged violations of immigration law. Reviewed by the Privacy Office on August 1, 2014.
• Investigations into threats against personnel. The Privacy Office did not approve this proposed use of social media because USCIS had not indicated where PII collected from social media would be stored and what authorities permit investigations into threats against USCIS officers. The Privacy Office also determined that USCIS would need to draft a PIA and SORN to cover this intended use of social media. Reviewed by the Privacy Office on March 15, 2015.
• Investigations into employee misconduct. Reviewed by the Privacy Office on August 1, 2014.
• Background checks for potential employees and contractors. Reviewed by the Privacy Office on August 1, 2014.
• Investigations into threats against USCIS’s network security. The Privacy Office denied the SMOUT because this use of social media was not covered by privacy documentation. Reviewed by the Privacy Office on March 15, 2015.

CISA SMOUTs governing:

• Online activities under the Countering Foreign Influence Task Force pilot, which includes an initiative in collaboration with Clemson University to collect and analyze social media posted between July 2015 and December 2017 to study the Russian Intelligence Agency’s influence efforts. Reviewed by the Privacy Office on September 30, 2019.
• Law enforcement and intelligence gathering activities by the National Protection Programs Directorate’s Federal Protective Service. Submitted to the Privacy Office on October 11, 2017. We also obtained a previous version of this SMOUT, reviewed by the DHS Privacy Office on November 7, 2012. The main difference between the two versions is that the 2017 version mentions that the Federal Protective Service will use “non-attribution services” like Anonymizer and Chameleon while conducting criminal investigations or undercover activities online to ensure that these activities cannot be traced back to DHS.
• Use of social media by the National Infrastructure Coordinating Center. Reviewed by the Privacy Office on April 12, 2018.
• Use of social media by the Office of Infrastructure Protection. Reviewed by the Privacy Office on January 6, 2013.
• Use of social media by the Office of Cyber and Infrastructure Analysis. Reviewed by the Privacy Office on October 18, 2017.

FEMA SMOUTs governing:

• The use of Dataminr by the Office of Response and Recovery (ORR). This SMOUT expired on November 29, 2017, at which point FEMA was required to submit documentation for Dataminr through a Privacy Threshold Analysis template. This SMOUT revealed that FEMA was contracting with Dataminr to provide breaking news alerts based on keyword searches for any one of over 200 terms in 7 categories, including “cops,” “cloud,” “virus,” “sick,” “ice,” and “social media.” Reviewed by the Privacy Office on August 29, 2017.
• Information collection by ORR for situational awareness. Reviewed by the Privacy Office on March 7, 2018. We also obtained a previous version of this SMOUT from August 21, 2013.

Coast Guard SMOUTs governing:

• The Intelligence Service’s criminal investigations and law enforcement intelligence operations. The SMOUT also authorizes investigators’ use of fake social media accounts for undercover operations. Reviewed by the Privacy Office on August 13, 2019, and expired on August 13, 2022.
• The use of social media to receive distress calls surrounding the 2017 hurricane season. Reviewed by the Privacy Office on September 7, 2017, and expired on November 30, 2017.

Other components

• Office of Security: Insider Threat Operations Center. Reviewed by the Privacy Office on January 12, 2017.
• U.S. Secret Service: To identify threats to protectees. Reviewed by the Privacy Office on November 1, 2017.

Privacy Threshold Analyses

We also obtained privacy threshold analyses (PTAs), which DHS staff conduct to determine how a new or expanded program or system could impact privacy. The DHS Privacy Office then reviews the analysis to determine if further compliance documentation is required. These included PTAs for:

• A social media monitoring tool Giant Oak Search Technology (GOST), used by ICE’s Office of Professional Responsibility and HSI’s Counterterrorism and Criminal Exploitation Unit and Visa Security Program. Under the program approved by the PTA, HSI users upload “data schemas” containing some 30–50 data points on persons of interest, including Americans, from ICE’s LeadTrac database, a database for tracking potential immigration violations, into GOST. This information encompasses vehicle and license plate information, social security numbers, social media handles, biographical information, and more. GOST searches through this data and retrieves related information the tool has indexed from the internet, as well as information compiled by third party data brokers. The PTA does not provide a comprehensive list of the brokers to which GOST has access, but it offers LexisNexis, Thompson Reuters, and Transunion as examples. Giant Oak, the maker of GOST, was in the news during the Trump administration over concerns that its products were being used to track down non-violent immigrants and had insufficient guardrails in place.  Approved by the Privacy Office on June 12, 2019.
• A CBP pilot for a “secondary… social media vetting tool” to screen visa waiver applications submitted through the Electronic System Travel Authorization (ESTA) program. The PTA indicates that CBP will use this tool as part of its vetting of applications referred for manual review. The PTA also lists other circumstances where CBP may use this tool, but DHS redacted these. The Brennan Center and other organizations have submitted multiple comments challenging DHS’s collection and use of social media for ESTA. Approved by the Privacy Office on January 5, 2018.
• The expansion of the Electronic Visa Update System (EVUS) to collect social media identifiers from applicants to conduct screening, vetting, and law enforcement checks on visa applicants. In May 2023, DHS published a privacy impact analysis announcing that it would implement an optional field in the EVUS application to collect social media identifiers. Approved by the Privacy Office on March 14, 2017
• A pilot between CBP and MITRE, a nonprofit that runs federally funded research and development centers, to collect information from social media on behalf of DHS. The PTA states that any derogatory information collected during the pilot will be stored and retained in CBP’s Automated Targeting System, the main database and analytical system that CBP uses to screen and vet travelers as well as for some law enforcement functions. Approved by the Privacy Office on March 16, 2017.
• ICE’s Data Analysis System, an analytical database that ERO officers use to locate people who have committed a crime or can be deported. Approved by the DHS Privacy Office on July 5, 2019.
• A collaborative effort between CBP’s Office of Intelligence and Office of Professional Responsibility to collect information from social media. Because of the redactions, the purpose of the effort is unclear. However, in its comments, the Privacy Office emphasized that “CBP should understand the prohibitions surrounding collection of” First Amendment-protected “speech and activities, such as protest,” strongly suggesting that the effort focused in part on activities on social media related to protests. Furthermore, the Privacy Office stated that CBP would need to create a new Privacy Impact Assessment to cover the proposed collection of social media. Approved by the Privacy Office on July 2, 2018, and expired on September 2, 2018.

In addition to the SMOUTs and PTAs, the Brennan Center also received several forms, department policies, and guidance documents laying out best practices for DHS employees using social media for both law enforcement and non-law enforcement purposes.

Included among these documents are components’ specific Rules of Behavior that govern employees’ activities on social media for their official duties. These have minor differences from one another but are substantively similar. These Rules of Behavior are mandated by the 2012 Privacy Policy for Operational Use of Social Media. The Brennan Center received the following Rules of Behavior:

• Rules of Behavior for Operational Use of Social Media by Countering Foreign Influence Operations Task Force — Cybersecurity and Infrastructure Security Agency, National Protection and Programs Directorate.
• Rules of Behavior for Operational Use of Social Media by the Office of Cyber and Infrastructure Analysis — Cybersecurity and Infrastructure Security Agency, National Protection and Programs Directorate.
• Rules of Behavior for Operational Use of Social Media by CBP. Relatedly, we also obtained CBP’s Directive 5410–003, establishing the general rules of behavior for its personnel’s use of social media, dated January 2, 2015. The document includes information about CBP’s use of online aliases to conceal personnel’s government affiliation and to interact with people online through social media. We also obtained an interim standard operating procedure for CBP personnel’s access to social media, dated June 8, 2015, that implements directive 5410–003.
• Rules of Behavior for Operational Use of Social Media by the Open Source Team — Homeland Security Investigations, National Security Unit.

Lastly, the Brennan Center obtained other directives, including memoranda and presentations, that govern DHS personnel’s operational use of social media. These documents included:

• A memorandum from John Martin, then-director of ICE, regarding guidance to law enforcement personnel on the “acceptable use of online information” to conduct their duties. The memo outlines broad principles on contemplated uses for online information, including obtaining information from restricted and unrestricted sources and identifying information about users or networks. The principles also cover various investigative techniques, such as communicating undercover and engaging in undercover activities. (The only divisions within ICE with the authority to undertake undercover operations are Homeland Security Investigations and the Office of Professional Responsibility.) Notably, the principles permit “appropriating online identity,” meaning that ICE agents are permitted to “electronically communicate with others by deliberately assuming the known online identity (such as the username) of a real person, without obtaining that person’s consent.” (Dated June 28, 2012.)
• A memorandum from Gary Mead, executive associate director of Enforcement and Removal Operations (ERO), referring to Martin’s memorandum from June 28, 2012 and stating that ERO officers do not have the legal authority to conduct operations on social media undercover and therefore may not create fake accounts to surreptitiously interact with people online. (Dated November 7, 2012.)
• A memorandum from Matthew Albence directing ICE field office directors to ensure that employees can access social media analytics services provided through CLEAR, Thompson Reuter’s data brokerage service. The memo states that ICE users can “run queries and searches” on CLEAR “to assist in locating targeted aliens,” and that CLEAR provides “social media analytics by gathering data from blogs and social media websites (e.g., Facebook) and analyzing that data.” (Dated November 25, 2015.)
• A memorandum from an assistant general counsel within the DHS Office of the General Counsel providing legal guidance on the disclosure of personal information in light of an executive order from President Trump requiring agencies to exclude people who are not U.S. citizens or legal permanent residents from the protections of the Privacy Act regarding personally identifiable information. (Dated February 16, 2017).
• A memorandum from Erick K. Funn, executive director of the Office of Professional Responsibility’s Investigative Operations Division, providing guidance to the division’s special agents when they use social media as part of an investigation. (Dated February 15, 2018.)
• A memorandum from Matthew Albence, the executive director of ERO, requiring officers to attend a course regarding the proper collection, retention, use, and disposal of sensitive personal identifiable information — specifically, information that “can result in embarrassment, inconvenience, reputational harm, emotional harm, financial loss, unfairness, and in rare cases, a risk to personal safety.” The email also contains a handout from DHS providing guidance to safeguard sensitive personally identifiable information. (Dated April 17, 2018).
• An attachment to the DHS’s Sensitive Systems Handbook regarding social media, which provides guidance regarding official (work-related) and unofficial (personal) social media use whether occurring within or outside the Department network, the risks and attack techniques associated with social media, and best practices for social media use.” (Dated June 24, 2018.)
• An agreement that CTCEU analysts must sign before using an “unattributable computer” when conducting investigative activities online. (Dated March 7, 2019.)
• An undated presentation from ICE regarding “social media exploitation” that includes a brief section on the rules of behavior for ICE employees. We also obtained a presentation from ICE titled “Privacy Requirements for Operational Use of Social Media,” dated August 2019, as well as an older version from November 2013.

Interspersed among the productions were emails between two or more members of DHS, often including at least one representative from DHS Privacy. The emails were heavily redacted, erratically placed in the production, frequently reproduced across releases, and often incomplete. In addition, because of their informal nature, they often included acronyms, shorthand, or references to real-life events or communications that contextualized the emails’ substance.

One common theme throughout the emails was the mention of a white paper about the potential use of a tool called Silo by DHS’s Combined Intelligence Unit (CIU) — an ICE division staffed by both HSI and ERO — though this white paper was not produced. Silo is a “managed attribution” software made by Authentic8 that manipulates identifiable features of the user’s digital footprint so that their online activity cannot be traced back to the user. Silo can also integrate a feature to automatically collect information from the internet. According to the emails, CIU wanted to obtain Silo to provide ERO field officers with “program accounts” (i.e., fake accounts) “to surveille [sic] publicly available social media sites” to prepare for interviews with ICE detainees and corroborate their answers. This intended use may be in tension with ERO’s internal guidance that its officers “do not have undercover authority [and] they may not create online identities in order to communicate with targets or other individuals, entities, or organizations.” Though this does not prohibit the use of a fake account to research or monitor people online without interacting with them, a privacy officer noted that they were “concerned with ERO’s authority to create a fake account and how [it] would get around the Terms of Service of certain social media providers.” Though it is unclear whether CIU ultimately obtained licenses to use Silo, it was evidently at the final stages of procuring licenses. According to public contracting information, ICE has purchased Silo licenses on multiple occasions, including one contract that is set to end in June 2024. (The email threads are dated July to November 2019.)

In one email thread, a Facebook employee reached out to a DHS Private Sector Office employee to express their concerns about CBP’s announcement that its personnel “may conceal their identity when viewing social media for operational security purposes,” reiterating that “the creation of fake profiles by any sector, including law enforcement, violates [Facebook’s] standards.” (Dated March 25–27, 2019.)

In an email thread that ICE produced, an intelligence research specialist from HSI sent an undisclosed recipient a draft of the Rules of Behavior for HSI’s Counterterrorism and Criminal Exploitation Unit to use masked accounts, as well as a draft section addressing the use of these accounts on Facebook. Neither of these drafts were produced. (Dated September 10, 2019.)

We also obtained an email thread from an official in HSI’s National Security Unit (NSU) regarding the Rules of Behavior and Standard Operating Procedure for an NSU “Open Source Project.” (Dated October 8, 2019.) In another email thread, an analyst from ICE’s Office of Information Governance and Privacy sent the final Rules of Behavior for the Open Source Project and offered to draft a SMOUT for the “WCH.” This appears to refer to the War Crimes Hunter program run by the HSI Human Rights Violators and War Crimes Unit, which “collects digital media depicting individuals engaged in war crimes and human rights violations.” The draft version of the Rules of Behavior attached to the email is completely redacted. (Dated October 28, 2019.)

The Brennan Center obtained several memoranda that DHS signed with other agencies in federal, state, and local government, as well as one nonprofit and one foreign government. These agreements provide DHS or the external agency with access to government databanks.

• Two MOAs between ICE and the sheriff’s departments in Culpeper County, VA and Craighead County, AR dated April 24, 2018, and February 5, 2019, respectively. The agreements authorize officers within the sheriff’s departments to perform immigration enforcement activities aimed at identifying and detaining undocumented residents of their respective counties. These MOAs are already publicly available.
• A memorandum of understanding between ICE and the Defense Advanced Research Projects Agency (DARPA) governing the agencies’ collaboration on projects such as DARPA XDATA, which was developed to analyze large sets of data for law enforcement and national security purposes. (Dated April 2015.)
• A memorandum of agreement (MOA) between DHS, the State Department, and the National Institutes of Health (NIH) governing the transmission of exchange visitor program participant data from the NIH Foreign National Information Sharing System to ICE’s Student and Exchange Visitor Information System. (Last signature dated November 18, 2014.)
• A letter of cooperation between DHS, the FBI, and the Kingdom of Brunei that is almost completely redacted. (Dated January 14, 2013.)
• An MOA permitting HSI to share information from the Student and Exchange Visitor Information Systems (SEVIS) with NCTC. (Dated June 23, 2011).
• An MOA between DHS and the Department of Defense (DOD) on information sharing related to identity verification and screening activities. The MOA covers six types of information exchanges, including biometric information, DOD’s Biometrically Enabled Watchlist, and Science and Technology management. (Dated March 3, 2011.) We also obtained two memoranda between officials at DHS and the DOD that make modifications to the MOA. The first amends the MOA to permit DHS to “export select categories of subjects of interest” in its Automated Biometric Information System (IDENT) to DOD. (Dated September 4, 2015.) Appendix H of the MOA, which governs this exchange, does not define who these subjects of interest are. The second memorializes DOD’s agreement with the first memorandum. (Dated January 11, 2016.)
• Two memoranda giving the FBI access to DHS’s Law Enforcement Information Sharing Service (LEIS) and giving DHS access to the FBI’s National Data Exchange (N-DEx) System. (Both dated October 2010.) We also obtained a User Agreement for the FBI’s Criminal Justice Information Services (CJIS) Systems. (Dated March 2004.)
• An MOA between DHS and the Hamptons Roads Law Enforcement Information Exchange (HRLINX). HRLINX operates the Law Enforcement Information Exchange (LINX), a databank for member law enforcement agencies throughout Virginia. This MOA allows both parties to access LINX and LEIS for official law enforcement and national security purposes as well as for background checks on prospective employees. (Dated October 2010.)
• An MOA between DHS and the National Counterterrorism Center (NCTC), agreeing to give the NCTC access to DHS’s Arrival and Departure Information System (ADIS). ADIS is a system for the storage and use of biographical, biometric, and encounter data on non-US citizens who have applied for entry or entered into, or departed from, the U.S. (Dated August 2010.) A similar MOA from 2013 governing NCTC’s access to the Advance Passenger Information System, which compiles information about travelers on aircraft, trains, buses, and sea carriers, is publicly available.
• An MOA between DHS and the International Justice & Public Safety Network (Nlets), a non-profit that operates a system used by law enforcement agencies in the US and Canada to exchange information. LEIS will sync with the Nlets information sharing network to permit queries from Nlets members and responses from DHS components. (Dated June 2010.)

The Brennan Center also received several documents that do not appear to be responsive to our request or fit neatly within the above categories. We have compiled those documents below.

• Multiple highly redacted issue papers regarding CBP’s collection of social media. Several of these papers are specifically about CBP’s implementation of an option for people applying for a visa waiver through the Electronic System for Travel Authorization (ESTA) to provide their social media handles. Others appear to discuss CBP’s collection of information more broadly and throughout its operational functions, but the redactions obscure additional details. (Dated between May and October 2016.)
• A memorandum from the DHS chief privacy officer to Alejandro Mayorkas, then director of USCIS, informing him of an investigation into FDNS’s operational use of social media that resulted in 15 recommendations to increase controls, implement auditing mechanisms, and ensure compliance. (Dated December 14, 2011.)
• A concept of operations for the DHS Watchlist Service, the unified mechanism through which DHS components access the FBI’s Terrorist Screening Database (TSDB), also known as the terrorist watchlist. (Dated September 9, 2009.)

Below are the compiled documents that DHS and its components produced to the Brennan Center from July 2020 to August 2022. DHS also lessened its redactions on several documents and reproduced them to the Brennan Center; these documents are compiled here. 

DHS productions

• July 2020
• August 2020
• September 2020
• November 2020
• December 2020
• January 2021
• May 2021
• September 2021
• January 2022

ICE productions

• July 2020
• August 2020
• September 2020
• April 2021 (Enforcement and Removal Operations)
• April 2021 (Information Governance and Privacy)
• December 2021

CBP productions

• September 2021