The DHS's Social Media Monitoring Is Causing Collateral Damage, But Doesn't Seem To Be Making The Nation Safer

from the no-surprises-here dept

The DHS has made traveling in and out of the US an experience worth sharing. Not so much with your fellow travelers or friends and family back home, but with CBP officers and other DHS employees, who are demanding access to social media accounts under its "extreme vetting" program.

While DHS components have stepped up the intrusiveness of their border screenings, they haven't been able to show all these manhours and infringed rights are actually doing anything to keep the country safer. More and more information is being gathered, but it's either of little to no use, or the agencies engaging in these searches can't be bothered to tally up the wins and losses of the border security game.

The Brennan Center, however, has compiled a report on the DHS's screening programs and their various enhancements. It isn't just about what has been done by DHS components, but the side effects of these efforts. The Fourth Amendment might be the noticeable victim, but these programs -- especially the social media monitoring -- have adverse effects on other rights as well.

[S]ocial media monitoring — like other forms of surveillance — will impact what people say online, leading to self-censorship of people applying for visas as well as their family members and friends. The deleterious effect of surveillance on free speech has been well documented in empirical research; one recent study found that awareness or fear of government surveillance of the internet had a substantial chilling effect among both U.S. Muslims and broader U.S. samples of internet users. Even people who said they had nothing to hide were highly likely to self-censor online when they knew the government was watching. As Justice Sonia Sotomayor warned in a 2012 Supreme Court case challenging the warrantless use of GPS tracking technology, “[a]wareness that the Government may be watching chills associational and expressive freedoms. And the Government’s unrestrained power to assemble data that reveals private aspects of identity is susceptible to abuse.”

"Susceptible to abuse" is the DHS's middle name. Going beyond the dubious wisdom and Constitutionality of demanding travelers and visa applicants hand over passwords for social media accounts, there's the CBP's recent surveillance of journalists, immigration lawyers, and activists. The DHS wields a lot of power, but doesn't handle much of it responsibly.

The report [PDF] shows the DHS collects a lot of social media information but doesn't do a great job matching accounts to applicants and detainees. These social media-reliant searches act more like dragnets than targeted investigations, sweeping up information on friends, family members, and social media contacts who interact with targeted accounts. This excess info is often retained under the theory it may, someday, be "relevant" to an ongoing investigation.

These problems are made worse by the DHS's reliance on third-party analytic software and data harvesting. The tools may be great at collecting data, but they're of little use when it comes to making informed decisions about the risk level of travelers and visa applicants. As is the case with any analysis done at this scale, nuance and context are lost as analysts zero in on phrases and keywords, discarding relevant info that could lead to better risk assessments.

The DHS's haystacks -- gathered en masse with minimal restraints -- are then fed to law enforcement agencies across the US and around the world. What was gathered for the purpose of vetting immigrants and travelers can now be used for any purpose whatsoever by a number of government agencies.

Unfortunately, DHS programs generally have low standards for sharing highly personal information, such as that found on social media, and the standards do not differentiate between Americans’ information and that of people from other countries. This information can easily be shared with entities ranging from the Department of State, the FBI, and congressional offices to foreign governments and Interpol. For example, data obtained from CBP searches of travelers’ electronic devices at the border, which can include the full contents of these devices, can be shared with federal, state, tribal, local, or foreign governmental agencies or multilateral government organizations when CBP believes the information could assist enforcement of civil or criminal laws. ICE, too, can disseminate any device information “relating to national security” to law enforcement and intelligence agencies. Information from ICE’s LeadTrac system, which is used to vet and manage leads of suspected overstayers and status violators and includes social media information, can be shared with any law enforcement authorities engaged in collecting law enforcement intelligence “whether civil or criminal.”

Through its massive data-sharing program, the DHS could conceivably gain access to any information it has walled itself off from with internal policies. Since this sharing is usually two-way, other agencies could unwittingly (or wittingly) launder off-limits data for the DHS, sending it back in the form of "relevant" info for use in its vetting/investigations.

That's just the social media end of it. The Brennan Report also discusses the CBP's warrantless and suspicionless device searches, and the fact that the information pulled from devices can be stored for up to 75 years if it's related to an arrest, detention, or removal. If it isn't, the CBP will only hold onto it for 20 years. This includes everything pulled from social media accounts, much of which is fed to ICE, which has its own social media monitoring program.

ICE's monitoring program was going to be automated but that was shelved after the agency sustained some public and Congressional backlash. Instead, it has turned this over to contractors -- 180 people who keep an eye on social media posts from the 10,000 foreign visitors ICE has declared to be "high risk."

The DHS is awash in social media posts but hasn't shown it can do anything useful with all of this information. The only thing guaranteed is incursions on rights, self-censorship by those who've been targeting by this vetting, and a whole lot of people targeted solely because of their religion or national origin.

Filed Under: dhs, extreme vetting, national safety, social media, social media monitoring

ICE Drops Extreme Vetting Software Plan After Discovering No One Could Possibly Deliver What It Wants

from the we-have-seen-the-future-and-we-are-disappoint dept

It appears the concept of "extreme vetting" at our borders has been backburnered. The Washington Post is reporting ICE has scrapped plans to acquire software capable of strip-mining immigrants' social media accounts and converting this info into a RATE MY DANGEROUSNESS number. However, it does not appear the concept is being done away with entirely.

Immigration and Customs Enforcement officials told tech-industry contractors last summer they wanted a system for their “Extreme Vetting Initiative” that could automatically mine Facebook, Twitter and the broader Internet to determine whether a visitor might commit criminal or terrorist acts or was a “positively contributing member of society.”

But ICE quietly dropped the machine-learning requirement from its request in recent months, opting instead to hire a contractor that can provide training, management and human personnel who can do the job. Federal documents say the contract is expected to cost more than $100 million and be awarded by the end of the year.

No more one-click snooping on entrants. Instead, this job will be farmed out to vendors who will probably never accidentally leak the large amount of personal data they're collecting for the government. This isn't a case of ICE/DHS realizing this isn't just intrusive but unnecessary and quite possibly useless. Instead, this is a case of ICE not liking what vendors had to offer on the software front.

An ICE official briefed on the decision-making process said the agency found there was no “out-of-the-box” software that could deliver the quality of monitoring the agency wanted.

For the time being, it won't be AIs and algos doing the vetting. Instead, it will be a government contractor doing the work, presumably using some live humans. What ICE was seeking was a mythical piece of software. It wanted a rigorous vetting system that predetermines the risk levels of immigrants at a touch of a button -- all without troubling civil liberties and/or conflicting with numerous other databases ICE controls or has access to.

There's no doubt the government can acquire something that harvests massive amounts of data. The problem is making that data useful, something even our most experienced data harvesters in the NSA frequently have trouble doing. But ICE wanted it to be more than a database of past social media behavior. It wanted the program to hand it a thumbs up/down rating on visa applicants, something that's not really advisable, if even actually possible. And there doesn't appear to be anything that fits the description.

“Have they realized only that it doesn’t exist now, which is important in its own right, or have they also recognized that this really was an idea that was built on a complete fantasy?” said Rachel Levinson-Waldman, senior counsel at the Brennan Center for Justice, a left-leaning policy institute. “That you can somehow take these hugely disparate sources of information, in lots of different languages, and make a prediction about what somebody’s value and worth is?”

Content moderation, but for humans. That hasn't worked well anywhere. It usually leads to profiling, false positives, and wastes of the government's human resources, which are far more limited than its data-hauling capabilities. Extreme vetting isn't going away. It's just going be far more iterative than ICE would like, however. Visions of "Minority Report" (and for actual minorities!) have been dashed by the cold water of tech reality. Concerns about mass violations of privacy and civil liberties had nothing to do with this partial reversal of course.

Filed Under: extreme vetting, ice, social media, surveillance

Dozens Of Tech Experts Tell DHS & ICE That Its Social Media Surveillance And Extreme Vetting Should Be Stopped

from the bad-policies dept

Last week dozens of well known technologists sent a letter to Homeland Security arguing that Immigration & Customs Enforcement's (ICE) plans to use technology for "extreme vetting" is a really, really dumb idea.

According to its Statement of Objectives, the Extreme Vetting Initiative seeks to make “determinations via automation” about whether an individual will become a “positively contributing member of society” and will “contribute to the national interests.” As far as we are aware, neither the federal government nor anyone else has defined, much less attempted to quantify, these characteristics. Algorithms designed to predict these undefined qualities could be used to arbitrarily flag groups of immigrants under a veneer of objectivity.

Inevitably, because these characteristics are difficult (if not impossible) to define and measure, any algorithm will depend on “proxies” that are more easily observed and may bear little or no relationship to the characteristics of interest. For example, developers could stipulate that a Facebook post criticizing U.S. foreign policy would identify a visa applicant as a threat to national interests. They could also treat income as a proxy for a person’s contributions to society, despite the fact that financial compensation fails to adequately capture people’s roles in their communities or the economy.

The Extreme Vetting Initiative also aims to make automated determinations about whether an immigrant “intends to commit” terrorism or other crime. However, there is a wealth of literature demonstrating that even the “best” automated decisionmaking models generate an unacceptable number of errors when predicting rare events. On the scale of the American population and immigration rates, criminal acts are relatively rare, and terrorist acts are extremely rare. The frequency of individuals’ “contribut[ing] to national interests” is unknown. As a result, even the most accurate possible model would generate a very large number of false positives - innocent individuals falsely identified as presenting a risk of crime or terr

In short, this is the tech world telling DHS and ICE that its belief that there's a "nerd harder" solution to using computers and algorithms to sniff out terrorists is a load of pure hooey. It may be true, as Arthur C. Clarke once stated, that "any sufficiently advanced technology is indistinguishable from magic," but the corollary does not apply: not all magical solutions can be implemented in technology. It's kind of ridiculous that actual technologists were needed to explain this to DHS, but that's where things are these days.

Filed Under: automation, bots, dhs, extreme vetting, ice, immigration, social media