DHS launches warning system to find domestic terror threats on social media

WASHINGTON — The Department of Homeland Security has begun implementing a strategy to gather and analyze intelligence about security threats from public social media posts, DHS officials said.

The goal is to build a warning system to detect the sort of posts that appeared to predict an attack on the U.S. Capitol on Jan. 6 but were missed or ignored by law enforcement and intelligence agencies, the officials said.

The focus is not on the identity of the posters but rather on gleaning insights about potential security threats based on emerging narratives and grievances. So far, DHS is using human beings, not computer algorithms, to make sense of the data, the officials said.

"We're not looking at who are the individual posters," said a senior official involved in the effort. "We are looking at what narratives are resonating and spreading across platforms. From there you may be able to determine what are the potential targets you need to protect."

The officials didn't describe what criteria or methods the analysts would use to parse the data. They said DHS officials have been consulting with social media companies, private companies and nonprofit groups that analyze open-source social media data.

"Domestic violent extremism poses the most lethal, persistent terrorism-related threat to our homeland today," said Sarah Peck, a DHS spokeswoman, adding that all DHS efforts against the threat "are carried out in close coordination with our privacy, civil rights and civil liberties experts and consistent with the law."

Law enforcement officers and intelligence analysts are legally entitled to examine — without warrants — what people say openly on Twitter, Facebook and other public social media forums, just as they can take in information from reading newspapers. But civil liberties groups generally oppose government monitoring of social media, arguing that it doesn't produce much intelligence and risks chilling free speech.

"Internal government reviews have repeatedly raised concerns about the usefulness of wide-ranging collection of social media information, but agencies keep barreling forward, wrongly assuming that its benefits must outweigh its costs," said Hugh Handeyside, a senior staff attorney with the American Civil Liberties Union in Washington.

"People say inflammatory stuff on social media, but as an empirical matter, that speech isn't a valid or reliable predictor of violent conduct," he said.

Handeyside pointed out that the White House budget office last July blocked a DHS proposal to collect social media information about visa applicants, saying the agency "has not adequately demonstrated the practical utility of collecting this information."

In terms of free speech, he said, "when people know that the government is watching, they self-censor."

"That leads to the suppression of ideas and discourse that might be deemed controversial," he said.

DHS officials say that the counterterrorism case for analyzing social media is strong and that they believe social media can be a useful predictor of threats.

Other experts agree. Concerns about government intrusion on free speech are legitimate, said Oren Segal, vice president of the Center on Extremism at the Anti-Defamation League, but the government can hardly ignore the main vector of extremist communication in the U.S.

"As a way to gauge potential threats, potential narratives that animate people to action, the online space is where that's at," he said. "This is why the insurrection was predictable from our point of view, because the planning and the organizing was happening in plain site. ... This is not an easy issue, but one thing we can all agree on is that in order to get ahead of the next threat, you need to go into the spaces in which the extremists are present."

Many social media posts are made anonymously, and in some cases warrants signed by judges would be required for the government to obtain records revealing the identities of the posters. DHS officials said that would be the responsibility of the FBI in a criminal investigation.

DHS' goal is to exploit social media for tips, leads and trends, officials say.

For example, the official involved in the social media effort said, in the weeks after the Jan. 6 riot, DHS and other agencies observed a large volume of social media chatter promising more violence at the Capitol and around the inauguration of President Joe Biden. That led authorities to expand and extend a massive security presence, including National Guard troops and fencing, that appears to have deterred would-be violent protesters.

In testimony late last month to the House Homeland Security subcommittee on counterterrorism, John Cohen, the assistant secretary of homeland security for counterterrorism, referred to the social media push.

He said DHS planned "increased analytic focus to more comprehensively assess how violent extremist actors and other perpetrators of targeted violence exploit and leverage social media and other online platforms and how those online activities are linked to real-world violence."

The goal, he said, is to "identify emerging narratives as early as possible and assess whether those narratives are likely to influence acts of violence and how fast they're spreading across multiple platforms."

The biggest terrorism threat comes not from abroad but from individuals and small groups in the U.S., fueled by racist and extremist conspiracy theories online, who believe violence is a valid way "to express their dissatisfaction with our nation or with their personal situation," Cohen said.

Cohen and John Godfrey, the State Department's acting coordinator for counterterrorism, testified that U.S. adversaries, including Russia and Iran, have been seeking to foment American extremism on social media.

For example, Cohen said, after former Minneapolis police Officer Derek Chauvin was convicted of murder in the death of George Floyd, DHS analysts saw similar posts alleging unfairness in the trial on forums associated with Russia, Iran and domestic extremists.

FBI officials have also acknowledged a foreign role in social media disinformation, but they have said the details are classified. The FBI has faced scrutiny about its social media policies after what some lawmakers have said was the bureau's intelligence failure in not anticipating the attack on the Capitol. Former FBI agents who worked domestic terrorism said they believe the FBI has been too reluctant to analyze public posts related to domestic extremism because it fears being seen as spying on Americans who are exercising their free speech rights.

As NBC News has reported, hundreds of public posts called for violence to stop the congressional counting of the electoral votes in Biden's victory, some of which included specific plans to assault the Capitol and arrest lawmakers. Yet FBI officials have said they had no intelligence that the Capitol was a target.

Officials at DHS — which also didn't foresee the Capitol attack — say they would pay more attention to those sorts of posts, such as one on a site called TheDonald.win by a user called CommunismSucks.

"Bring handcuffs and zipties to DC," the poster wrote. "No more tolerating 'elected' officials who hate our country. January 6th is the chance to restore this country. Barging into the Capitol through multiple entryways is the surest way to have our bases covered and apprehend these traitors."

It's not known whether that person traveled to the Capitol, but many people who did left similar digital trails, law enforcement officials say.

Rep. Adam Schiff, D-Calif., chairman of the Intelligence Committee, asked FBI Director Christopher Wray about the issue at last month's hearing on top national security threats.

"It appears that probably some of the best intelligence prior to Jan. 6 was open source," Schiff said. "It was discussion on social media [about] plans to attack the Capitol. This raises an important but very difficult question for the bureau. ... What is the bureau's policy in terms of your ability to review social media when it's appropriate to do it, when it's not appropriate to do it? Do you have a clear policy on that, and are there legal constraints, as well, that preclude you from getting the intelligence that you need?"

Wray said that without tips or some other impetus, the FBI didn't consider itself free to hunt for threats of violence or domestic terrorism plots on social media, even if the posts are public.

"We do not, as the FBI, simply patrol social media looking for problems," he said.

In a sense, DHS will now do just that, officials said — patrol public social media looking for intelligence pointing to threats.

DHS sparked outrage over its open-source intelligence collection last year when it emerged that analysts had been compiling dossiers about tweets by certain journalists covering border issues. The secretary of homeland security ordered analysts to stop collecting information about journalists, and the flap led to a pullback in all types of collection of public information, current and former DHS officials have said.

Officials say they are taking a careful approach.

"Our job is not to police thought and speech — our job is to prevent acts of violence," Cohen told lawmakers.

However, he said later, "We have to understand the close proximity between constitutionally protected speech ... and the threat of violence posed by individuals who use that speech or leverage that speech as a way to incite violence."