WASHINGTON — The Department of Homeland Security, which was created after the Sept. 11, 2001, attacks to protect the country from international terrorism, is moving toward a sweeping set of policy changes to detect and stop what intelligence officials say is now a top threat: domestic violent extremism.
Two senior Biden administration officials said DHS, whose intelligence division did not publish a warning of potential violence before the Jan. 6 Capitol riot, is seeking to improve its ability to collect and analyze data about domestic terrorism — including the sorts of public social media posts that threatened an attack on the U.S. Capitol but were not deemed "actionable" by the FBI and other law enforcement agencies.
DHS plans to expand its relationships with companies that scour public data for intelligence, one of the senior officials said, as well as to better harness the vast trove of data it already collects about Americans, including travel and commercial data through Customs and Border Protection, or CBP, Immigration and Customs Enforcement, or ICE, the Coast Guard, the Secret Service and other DHS components.
The department is also contemplating changes to its terrorist watch listing process "to see if there are ways we can leverage it to take into account international and domestic travel of known violent extremists," the senior official said.
"The idea is to identify people who may through their social media behavior be prone to influence by toxic messaging spread by foreign governments, terrorists and domestic extremists," the official said. "We want to Identify the narratives that are emerging, assess which narratives are likely to incite violence, figure out what targets are likely and then take steps to mitigate the risk. We're going to do this in a very careful way that is mindful of privacy and civil liberties, because it's focusing on narratives, not people."
The officials stressed that the trigger for scrutiny would be plans for violence, not political ideology.
In a statement, a DHS spokesperson said: "Domestic violent extremism poses the most lethal, persistent terrorism-related threat to our homeland today. Under Secretary Mayorkas' leadership, DHS is working closely with federal, state, local, tribal, and non-government partners to address this threat, and all of our efforts are carried out in close coordination with our privacy, civil rights, and civil liberties experts."
Alejandro Mayorkas is the secretary of homeland security.
While law enforcement officials may legally examine public social media posts, any effort to do so using sophisticated computer analytical tools is likely to spark concerns among civil liberties activists. And while Americans have long been among those on the government's various watch lists, a move to restrict the travel of those deemed to be domestic violent extremists — without charging them with crimes — is also likely to be controversial.
"The story of DHS really is one of overreaching," said Rachel Levinson-Waldman, a fellow at the Brennan Center for Justice at New York University, who co-authored a 2019 report about how DHS uses social media in immigration enforcement. "And given the urgency of the moment, these periods don't necessarily lend themselves to really being careful and judicious about how information is collected and kept."
DHS officials say they plan to address the concerns by involving agency lawyers, outside advocates and the DHS privacy and civil liberties offices at every step of the process.
"We have to be incredibly careful," said the second senior official, who said the department is halfway through a 60-day examination of domestic violent extremism ordered by Mayorkas. "We're looking at what can we do versus what can't we do. If we're not doing something, is it because we don't have authorities, versus we can't because it would violate civil rights and civil liberties?
"It is premature to say how things will change, but it is not premature to say it will change," the second official said.
DHS and its component agencies have long mined public social media for intelligence, and the department was criticized in July after it emerged that officials had published intelligence reports about tweets and reporting by American journalists who published leaked documents related to violent protests in Portland, Oregon.
Chad Wolf, then the acting homeland security secretary, shut down the collection program and curbed other efforts to examine public social media, said one of the senior officials and another person familiar with the matter.
"It had this chilling effect, as it always does, and there was kind of a pulling back on open sourced intel review," said Elizabeth Neumann, who served under Wolf and other DHS secretaries in the Trump administration.
The 2019 Brennan Center report examined how ICE, CBP, the Transportation Security Administration and other components monitor social media. The report, written by civil liberties activists, concluded that "wholesale monitoring of social media creates serious risks to privacy and free speech. Moreover, despite the rush to implement these programs, there is scant evidence that they actually meet the goals for which they are deployed."
The report did not cover DHS' National Operations Center, which monitors certain public social media "to provide situational awareness and establish a common operating picture for the Federal Government, and for those state, local, and tribal governments."
The report said DHS has contracts with data companies, including Palantir, Babel Street, Pen-Link and Giant Oak, to help investigators make connections and find people.
ICE uses Giant Oak to "continuously monitor, aggregate, and analyze social media data" to help prioritize leads in the hunt for immigrants who overstay their visas, the report said.
Christopher Wall, a "solutions architect" at Giant Oak, said the technology used by his and other private companies can help the government hunt for domestic terrorism threats on public-facing social media.
"We screen and vet large amounts of data to find information of interest" using so-called machine learning techniques, which train computers about what to look for, he said. "Machine learning will improve your efficiency, but you still have to have a human analyst" looking at the data, he said.
"Rather than dedicating your resources to being intrusive, why not dedicate them to finding the people who are actually posing a risk?" Wall said.
He acknowledged that "there's a lot of hesitation about what this technology can do" and "a lot of fear of overstepping," but he noted that tech companies already collect, buy and sell large amounts of data about private individuals.
"People worry about Big Brother, but we already exist in that world," he said.
Neumann, the former senior DHS official, said that while the government has the legal right to monitor public social media, she has observed a hesitance about the issue.
"There was a backsliding away from information-sharing between DHS and FBI," she said. "Almost like this lack of memory of all the changes post-9/11. I can't tell you when or why. But it's a cultural shift back to what they consider to be legally safer."
Paul Rosenzweig, who was DHS' deputy assistant secretary for policy in the George W. Bush administration, said that in the fight against international terrorism, the intelligence community has long targeted money, travel and communications. Doing that in the domestic context poses thorny constitutional issues, he said.
He said the Trump presidency shattered his confidence that the government can be trusted with intrusive surveillance authorities.
"I used to be much more sanguine about the bona fides of the executive branch, thinking that judicial and legislative oversight would constrain bad actors," he said. "The last four years have really eroded my confidence."
What is driving the changes at DHS is broad recognition, the officials said, that the federal government either did not see or did not act on widespread indications on social media that extremists were planning violence in Washington, D.C., on Jan. 6. The failure left the Capitol unprepared for an onslaught of Trump supporters, led by far-right militia members, who stormed the building to stop Congress from counting the electoral votes in the presidential election.
NBC News has reported that the FBI, which said it saw no actionable intelligence of potential violence at the Capitol, has been reluctant to use the full scope of its authorities in analyzing social media.
Social media monitoring is useful not just to stop organized political violence or domestic terrorism, the senior administration official said. Very often, mass shooters leave trails of social media posts that paint pictures of increasingly disturbed minds. Just as often, those posts are not seen by law enforcement until after the violence.
"People are dying," the official said. "We've had two targeted attacks in eight days — we have to do more. Yes, we need to make sure that anything we do is legal, ethical and constitutional. But we can't just sit here and say, 'Oh this is difficult, this is hard, we can't do it.' We have to act."