ICE's Social Media Monitoring

Immigration and Customs Enforcement is making significant investments in social media monitoring. Information gleaned from social media sources will be integrated into existing databases to allow investigators increased visibility into individuals being scrutinized and provide additional information to identify potential targets. While these tools are initially being developed to focus on residents who lack legal status to remain in the U.S., there is an obvious danger that they may eventually be used to surveil U.S. citizens as well. These systems provide an additional weapon for an increasingly pervasive surveillance state.

The heart of ICE's data analysis system is its Investigative Case Management (ICM) system provided by Palantir. As Wired reports, this system combines "disparate streams of data into a single investigative platform." The system "lets agents search people using hundreds of categories, from immigration status and country of origin to scars, tattoos, and license-plate reader data." According to a 2016 Privacy Impact Assessment of ICM, "ICE collects information from a wide variety of internal and external sources". Such sources include reports generated from information provided by ICE agents and other individuals; tracking information provided by cellular services, surveillance cameras, and license plate readers; and other federal databases including the Student and Exchange Visitor Information System (SEVIS), the Federal Bureau of Investigation’s National Crime Information Center (NCIC) System, and several Customs and Border Patrol databases. Users of the system may also add data from commercially available databases. Essentially, ICM has combined as much information about individuals as the government has been able to obtain into one system. The online publication 404 Media reported on ICM last April and said:

404 Media saw a recent version of the database, which allows filtering according to hundreds of different categories, which include things like resident status and entry status (“refugee,” “border crossing card,” “nonimmigrant alien refused admission,” “temporary protective status alien,” “nonimmigrant alien transiting without visa,” “undocumented alien,”); “unique physical characteristics (e.g. scars, marks, tattoos)”; “criminal affiliation”; location data; license plate reader data; country of origin; hair and eye color; race; social security number; birthplace; place of employment; driver’s license status; bankruptcy filings, and hundreds more. A source familiar with the database told 404 Media that it is made up of “tables upon tables” of data and that it can build reports that show, for example, people who are on a specific type of visa who came into the country at a specific port of entry, who came from a specific country, and who have a specific hair color (or any number of hundreds of data points).

Now, ICE wants to add data collected from social media to this system.

Last week, Wired reported on plans by ICE to "Scour Facebook, TikTok, Instagram, YouTube, and other platforms, converting posts and profiles into fresh leads for enforcement raids." Wired reviewed a Request for Information that outlined a project that "plans to hire nearly 30 contractors to sift through posts, photos, and messages—raw material to be transformed into intelligence for deportation raids and arrests." The reporter, Dell Cameron, also writes that:

They would also be armed with powerful commercial databases such as LexisNexis Accurint and Thomson Reuters CLEAR, which knit together property records, phone bills, utilities, vehicle registrations, and other personal details into searchable files.

The question that immediately came to my mind was how a mere 30 contractors could keep track of such a large number of social media sources. This is not clearly spelled out in the Wired article. The implication, however, is that the task of collecting information from social media will be left to others and, likely, automated. According to Cameron, "The agency has also set aside more than a million dollars a year to arm analysts with the latest surveillance tools." The individuals proposed to be hired for this contract will apparently analyze social media data that has already been collected in databases and use other information sources, including social media, to supplement or verify that data.

The answer to my question about collection may lie in another article published by 404 Media, this one titled, "The 200+ Sites an ICE Surveillance Contractor is Monitoring". According to the article:

A contractor for Immigration and Customs Enforcement (ICE) and many other U.S. government agencies has developed a tool that lets analysts more easily pull a target individual’s publicly available data from a wide array of sites, social networks, apps, and services across the web at once, including Bluesky, OnlyFans, and various Meta platforms...

The article also reports that "the contractor, called ShadowDragon, pulls data from and makes available to its government clients". The complete list can be found here. It is a strange mixture of sites, including obvious candidates such as 4chan, but also some strange entries such as AudiUSA. I thought that maybe buyers of German automobiles might need to be watched closely, but then I noticed that MySubaru, NissanUSA, and GeneralMotors are all there. So, maybe car buyers as a whole are a suspicious bunch. While BabyCenter is being monitored, DCUM doesn't appear to have been deemed worthy. I am not sure whether I should feel relieved or insulted.

Earlier this year, The Intercept reported on another ICE project aimed at monitoring social media. According to that report, ICE "plans to monitor and locate 'negative' social media discussions about the agency and its top officials". According to a statement of objectives on which The Intercept reported, social media monitoring will be used for two distinct objectives. The first is to conduct vulnerability assessments. Analysts will use a variety of information sources, including social media, to determine the exposure of ICE leadership and facilities to potential threats. The second task is to proactively monitor threats. The contractor selected for this project will be required to utilize a number of data sources which include "Dark Web Content," "IRC/Chat," "Message Boards," "Social Media Sites,” and "Web Blogs". For some reason, "USEnet Data" is included. While I personally was once an avid Usenet user, as far as I know, the platform has been dead for more than a decade. Another paragraph listed the required social media sites which included most of the big names but, strangely, left out Discord. Also left out were all the right-wing social media sites (except X which was listed as "Twitter"). There is no Gab, no Truth Social, no Parler, and so on. Therefore, if you plan on posting a threat to an ICE official on social media, you are advised to do it on a right-wing platform.

404 Media has also reported on still another ICE tool for monitoring social media. This one is called "Giant Oak Search Technology (GOST)" and is used to "help the agency scrutinize social media posts, determine if they are ‘derogatory’ to the U.S., and then use that information as part of immigration enforcement". 404 Media obtained documents related to GHOST thanks to a Freedom of Information Act lawsuit filed by the ACLU's National Security Project. According to the article:

GOST’s catchphrase included in one document is “We see the people behind the data.” A GOST user guide included in the documents says GOST is “capable of providing behavioral-based internet search capabilities.” Screenshots show analysts can search the system with identifiers such as name, address, email address, and country of citizenship. After a search, GOST provides a “ranking” from zero to 100 on what it thinks is relevant to the user’s specific mission.

With all of this monitoring going on, there must be really intensive web scraping occurring. Between advertisers doing brand protection scraping, search engines, various research projects, and, apparently, the government, I wonder if web scrapers are actually responsible for more traffic than legitimate users? It is also not clear how effective these tools turn out to be. ICE in particular has been especially bumbling in many of its activities. Despite the high-tech tools at its disposal, the agency still relies on error-prone tattoo identification to determine who might be a gang member. The web tools were apparently effective in identifying a migrant with a tattoo, but they just were not successful in informing the agent that the tattoo was the logo of a Spanish soccer team or a tribute to a sibling who has autism. Hence, two innocent men were sent to El Salvador.

The danger of these tools is that they will eventually be used to go beyond ICE's immigration-related mandate. Most are already likely capable of being used to investigate U.S. citizens. Moreover, mandates have been known to grow. For instance, using the social media monitoring tools to identify someone who may have made a threat to an ICE facility could easily lead to the tools being used to investigate everyone connected to that individual on social media, as well as any organizations with which the individual has interacted. Given the autocratic tendencies of cult leader, convicted felon, and failed President Donald Trump and world-class hater Stephen Miller, these tools could easily serve their goals. More simply, when all you have is a hammer, everything looks like a nail. Therefore, all Americans may eventually fall into a category that ICE can justify investigating with these tools.