IE 11 is not supported. For an optimal experience visit our site on another browser.

Why did the FBI miss the threats about Jan. 6 on social media?

Current and former FBI officials say there is confusion within the bureau itself about the rules for monitoring what Americans say on social media.

WASHINGTON — A senator had a simple question for the FBI's counterterrorism chief at a hearing last week about the Capitol riot.

Didn't the FBI see all those postings by extremists on social media before the event, she asked Wednesday, including promises to "occupy the Capitol" and bring "revolution" to Washington?

"To my knowledge, no, ma'am," the counterterrorism chief, Jill Sanborn, responded, going on to explain that the FBI can't monitor "First Amendment-protected activities" without a tip or an open investigation that directs agents to a specific post.

The senator, Kyrsten Sinema, D-Ariz., kept pressing. "So the FBI does not monitor publicly available social media conversations?"

"Correct, ma'am," Sanborn replied. "It's not within our authorities."

Fact check: false. FBI agents have said in court records that they monitor public social media, and the bureau recently signed a $14 million contract with a "threat intelligence" company called ZeroFox "to proactively identify threats to the United States and its interests" on the internet. For years, the FBI has had a similar arrangement with DataMinr, which can flag social media postings of interest to its clients.

In a statement to NBC News, the FBI acknowledged that it can and does look at public social media information. An FBI official said Sanborn understood Sinema's question to be referring to "whether the FBI persistently and passively examines internet traffic and social media conversations, to include direct messages between two users." In fact, her question referred to comments made on public-facing social media services.

"The FBI may observe and collect information from open sources as long as the FBI activities are done for a valid law enforcement or national security purpose and in a manner that does not unduly infringe upon the speaker or author's ability to deliver his or her message," an FBI official said. "The authorized purpose must specifically be tied to federal criminal or national security purposes, usually to further an FBI assessment or ... investigation."

Current and former FBI officials and legal experts said Sanborn's misstatement points to a culture of caution — and confusion — within the FBI about the rules of the road regarding FBI monitoring of Twitter, Facebook, Instagram and other social media platforms. They say the bureau's scandalous history of domestic political spying under J. Edgar Hoover has left the FBI in a defensive crouch about any appearance that it is snooping on law-abiding Americans.

That may be part of the reason, they said, that the FBI appears to have missed so many signals that the Capitol was a potential target for violence on Jan. 6.

Sanborn rejected the assertion by many lawmakers that there had been a "massive and historic intelligence failure," in the words of Sen. Gary Peters, D-Mich., chair of the Homeland Security Committee. But neither her testimony nor that of FBI Director Christopher Wray on Tuesday shed much light on what information the bureau collected and analyzed before Jan. 6 — if any — from its sources inside militia groups and from other intelligence gathering, including reviews of social media posts.

The Senate Homeland Security Committee has asked the FBI to clarify its policies about collecting intelligence through social media, a committee aide said.

Peters said in a statement to NBC News: "Given the number of news reports and social media posts indicating violence ahead of Jan. 6, the FBI absolutely should have seen this attack coming and should have informed law enforcement to be ready. I will continue working to get to the bottom of the intelligence and security failures that led to the Capitol attack, and pushing the FBI, Department of Homeland Security and other national security officials to take the growing threat of domestic terrorism seriously."

The FBI was concerned enough about violence, Wray confirmed, that agents visited a number of extremists under investigation and dissuaded them from coming to Washington for Jan. 6. At the same time, Wray and Sanborn said no intelligence hinted at an invasion of the Capitol, even though that was the site of the Electoral Vote counting that was the focus of anger among Trump supporters.

Wray seemed to imply that the FBI had tried to glean intelligence from social media but that the problem was one of volume.

"The amount of angry, hateful, unspeakable, combative, violent even, rhetoric on social media exceeds what anybody in their worst imagination [thinks] is out there," he told the Senate Judiciary Committee on Tuesday.

"And so trying to figure out who is just saying, 'You know what we ought to do is X, or everybody ought to do X,' versus the person who is doing that and actually getting traction and then getting followers ... is one of the hardest things there is to do in today's world with the nature of the violent extremism threat we face."

It's not clear whether the bureau is seeking to use big data or artificial intelligence tools, as the National Security Agency does in sorting through the massive amounts of data it sucks in from abroad. Not only terrorism, but also school shootings, child pornography and foreign influence, could be detected through more aggressive social media monitoring by the FBI, experts say.

Civil liberties groups — which also opposed what they viewed as oppressive surveillance of American Muslims after the terrorist attacks of Sept. 11, 2001 — say the cost in chilling free speech would outweigh the gain.

Procurement documents don't shed much light on how the FBI has used DataMinr or ZeroFox, which analyze social media data for customers. But they suggest a fairly limited scope.

"Social media platforms are often used as the first means of alerting to various threats, natural disasters, and crimes; sometimes before the authorities are called," an FBI document in the ZeroFox procurement file said, adding that the bureau needed commercial software to "allow for the receipt of publicly available data from social media platforms."

The intent "is not to 'scrape' or otherwise monitor individual social media activity," the FBI document said. "Instead, the requirement seeks to identify an immediate alerting capability to better enable the FBI to quickly respond to ongoing national security and public safety-related incidents."

FBI agents have been taking action for decades based on newspaper and television news reports, but the bureau has been much more cautious in its approach to examining social media, current and former officials said.

"If you have an authorized purpose, you can look at anything that is public," said NBC News contributor Chuck Rosenberg, a former top FBI official.

But former bureau officials said there was widespread confusion in the FBI over what is and what is not an "authorized purpose." Even some in the FBI believe there has to be a full-blown criminal investigation, former officials said, but that isn't the case.

The Attorney General's Guidelines that govern the FBI make it clear that an "authorized purpose" includes any investigative effort to stop violence. The language directly refutes what Sanborn told the Senate committee; it actually urges the bureau to hunt for threats rather than wait for tips, especially in the context of terrorism.

"To carry out its central mission of preventing the commission of terrorist acts against the United States and its people, the FBI must proactively draw on available sources of information to identify terrorist threats and activities," the guidelines say. "It cannot be content to wait for leads to come in through the actions of others, but rather must be vigilant in detecting terrorist activities to the full extent permitted by law, with an eye towards early intervention and prevention of acts of terrorism before they occur."

When it comes to protecting major public events, the guidelines say, "the FBI is not constrained to wait until information is received indicating that a particular event, activity, or facility has drawn the attention of those who would threaten the national security. Rather, the FBI must take the initiative to secure and protect activities and entities whose character may make them attractive targets for terrorism or espionage."

The FBI may open its lowest level of inquiry, known as an "assessment," by "proactively surfing the Internet to find publicly accessible websites and services through which recruitment by terrorist organizations and promotion of terrorist crimes is openly taking place," the guidelines add.

The guidelines are a policy rulebook. The law is even more clear-cut, experts said. There was no legal impediment to the FBI's examining every public-facing social media post threatening violence Jan. 6.

"When speech is public, the general assumption is that the speaker has indicated an indifference to the confidentiality or privacy of what they are saying, and therefore the government or anyone else is free to read or to listen," said First Amendment expert Geoffrey Stone, a professor of law at the University of Chicago who has consulted with the federal government. "If you have a legal justification for doing it, the assumption at first blush would be that because this is public speech, the government can do this."

Stone said there is a legitimate concern, however, that posting on social media isn't the same as speaking on a street corner and that if Americans believed the government was conducting blanket monitoring of everything they said on Facebook, it could chill free speech.

As NBC News and other news organizations have documented, a flood of threat information on social media suggested that extremists intended to come to Washington to use violence to stop Congress from counting the electoral votes in what they believed was a fraudulent election.

Eric Feinberg, an internet sleuth who is vice president of a group called the Coalition for a Safer Web, said he saw a large volume of concerning posts on Facebook and other platforms, including a map touting a "wild protest" that included a route to the Capitol.

"If I can see this, why didn't they see it?" he said of the FBI and other agencies.

Court records show that FBI agents have used public social media statements in other situations to open criminal investigations and even to file charges. In June, NBC News reported on the cases of four people charged under an anti-riot statute based solely on social media posts in connection with the protests over the death of George Floyd in Minneapolis police custody.

IMAGE: A MAGA rally map
A MAGA rally map available online before the storming of the U.S. Capitol on Jan. 6.via Facebook

In one of the criminal complaints, FBI agent Ryan Monahan said that "in an effort to identify potential flashpoints for violence," he "and other investigators monitored social media activity for evidence of imminent acts of violence."

Critics said that the FBI is willing to push the envelope when it comes to Black Lives Matter activists or Muslim terrorism suspects but that it has been paralyzed in the face of a burgeoning terrorism threat from white supremacists and other right-wing extremists.

"White supremacists and far-right militants have been violent in public rallies over the last four years," said Mike German, a former FBI agent and expert at the Brennan Center for Justice, a think tank in New York, adding that the violence was all the justification the FBI needed to take investigative steps like monitoring social media.

"So this argument is more an attempt to shield the FBI from criticism than actually acknowledging how its failures have allowed these groups to gain strength and become more violent," he said.

The FBI responded that it is vigorously pursuing domestic terrorism. Wray told senators last week that the bureau has 2,000 open investigations, up from 1,000 when he arrived in 2017. Just last month, the FBI charged a neo-Nazi in Texas with illegal gun purchases after an investigation based in part on hateful social media posts, court records say.

In October, the FBI disrupted a right-wing plot to kidnap the governor of Michigan.

Some former FBI officials said they believe the bureau could stop more violence if it modernized its intelligence collection strategies.

A former senior FBI official said he recalls bureau officials' recently being questioned by members of Congress who assumed that the FBI was mining social media for intelligence. But they were wrong, he said.

"We just weren't doing that much," he said. "I was surprised that we didn't have a wholesale social media review process in connection with counterterrorism leads."

He added: "Half of America wants the bureau to do more, and the other half is afraid they are doing too much and wants them to stop. People want us to be able to detect and prevent violent acts, and they also don't want us spying on them. Well, you can't have it both ways."