US immigration officials sought to expand their abilities to monitor and surveil social media activity and allowed officers to create and use fake social media profiles in a wide range of operations, including covertly researching the online presence of people seeking immigration benefits, new documents show.
Authorities within several Department of Homeland Security (DHS) immigration agencies, including Customs and Border Protection (CBP) and Immigration and Customs Enforcement (Ice), have repeatedly discussed using “aliases”, or undercover online accounts for investigations, according to records obtained through an open records request by the civil rights non-profit Brennan Center for Justice and shared with the Guardian. Officials have also expressed concern about social media sites’ policies that prohibit the use of fake profiles and discussed bypassing those rules.
The records did not specify which online platforms officers were using, but for many, including Facebook, the use of aliases and fake profiles, including by government agencies, is a direct violation of its terms of service agreement. And the DHS’s practices were so concerning that a representative from the company contacted the agency warning of a potential breach in the social network’s rules, records revealed.
The revelations come amid growing privacy concerns about how law enforcement across the US monitors online activity and collects and shares people’s data, in some cases without a warrant or subpoena. In recent years, police have used fake accounts to spy on Black Lives Matter protesters; pose as ordinary citizens and post comments attacking law enforcement critics; and send Facebook friend requests to targets of their investigations and then gather personal information without a judge’s approval for the digital search. Facebook officials have publicly objected to the practice by the police departments of Los Angeles and Memphis, and the new records reveal a private rebuke of the DHS.
The DHS files, which date back several years, are likely to raise alarms from civil rights groups, given the agency already has a vast surveillance network that allows it to track migrants and at times US citizens, whether by accessing location data from tech companies, buying user information from data brokers or utilizing facial recognition.
One policy document uncovered in the requests says DHS officers, who work on fraud detection and are part of US Citizenship and Immigration Services (USCIS), can use fake accounts to research people “requesting immigration benefits”. The document provides additional detail about a practice USCIS first announced in 2019. Those officers – working for the agency that decides who gets green cards and citizenship – can gather a wide range of data, including physical addresses, relationship information, employment and education affiliations and any social media posts that are “contrary to information submitted by the applicant”, the policy said. Any information collected in these investigations must be “saved” in the individual’s file, even if it is found to be not “derogatory”, according to the document.
“What we see in these documents is just how widespread the use of undercover accounts is, with these attempts to hide their tracks while using social media,” said Rachel Levinson-Waldman, the managing director of the Brennan Center’s liberty and national security program, which provided the records to the Guardian. “It’s clearly going on with the full knowledge that it’s not in compliance with the policies of one of the major platforms.”
‘A powerful tool’
The DHS’s social media policies caught the attention of Facebook in March 2019, during the Trump administration, when a representative contacted the DHS concerned about CBP “expanding its use of social media platforms”. The Facebook official, whose name was redacted, cited a newly posted CBP privacy assessment of the agency’s social media policy that said in part: “Some CBP personnel … may conceal their identity when viewing social media for operational security purposes.”
A DHS cybersecurity and innovation expert responded that CBP employees could “create accounts” to view public information and “review the posts captured by the monitoring tools in order to determine whether they are relevant for situational awareness and threat monitoring”.
The Facebook representative responded that any user who pretended to be someone they were not on the platform was breaking its rules. “Our concern is [that] we receive quite a bit of outreach from governments, advocacy groups, and our users about our companies doing more to stop the fraudulent account creation by scammers and terrorist groups. As such, the creation of fake profiles by any sector, including law enforcement, violates our standards.”
It is unclear how the DHS ultimately addressed Facebook’s concerns, but later that year, officials continued to discuss using fake accounts. In August 2019, Ice’s Enforcement and Removal Operations (ERO), which tracks and jails people for deportation, expressed interest in using social media for “fugitive” and “detainee” operations, according to emails between DHS privacy officials.
“I’m mainly concerned with ERO’s authority to create a fake profile and how we would get around the terms of service of certain social media providers,” one DHS privacy officer wrote.
At about the same time, DHS officials wrote that the department’s Homeland Security Investigations (HSI) branch, which conducts criminal inquiries, was planning to soon use “aliases”. And one HSI policy document on social media use, written in 2012, said that “undercover operations” could require investigators to “befriend or become business associates with potential violators”.
Meta, Facebook’s parent company, has repeatedly reinforced its authenticity policies to various law enforcement departments, including the DHS, said Roy L Austin, company vice-president and deputy general counsel for civil rights.
“We require everyone, including law enforcement authorities, to use their authentic name they go by in everyday life on Facebook and we make this policy clear in our community standards,” he wrote in an emailed statement to the Guardian.
“It is our intention to make sure that people can continue using our platforms free from unlawful surveillance by the government or agents acting in inauthentic ways.”
A Meta spokesperson, Ryan Brack, declined to comment on whether it had tracked continuing violations by the DHS.
DHS spokespeople declined to answer specific questions about the records or its practices on Facebook, but said in an email: “DHS uses various forms of technology in furtherance of its mission, including tools to support investigations related to, among other things, threats to infrastructure, illegal trafficking on the dark web, cross-border transnational crime, and terrorism. DHS leverages this technology in ways that are consistent with its authorities and the law.”
A DHS spokesperson confirmed that USCIS maintains the policy adopted by the Trump administration and continues to allow use of fake accounts to investigate people seeking immigration benefits, but said the agency “only collects publicly available social media information that is reasonably related to matters under USCIS consideration”.
CBP can engage in “masked monitoring” on social media while vetting, screening or conducting law-enforcement checks on applicants seeking to enter the US, according to the policy sent by the spokesperson, which says CBP can collect public information this way, but cannot “interact” with the targets of their reviews while “undercover”.
The spokesperson declined to clarify Ice’s practices, saying the agency “does not comment on investigative tactics, techniques, tools or ongoing investigations or operations”. One policy document the Brennan Center obtained says Ice officers can use a “fictitious identity” online if “procedures would authorize such communications in the physical world”.
The records do not reveal what the fake accounts might look like or how widely or frequently officers are deploying them. In 2019, Ice was caught creating fake profiles meant to look like they were affiliated with a university but which were actually set up as part of a sting to catch foreign students engaged in immigration fraud.
Meta has said that using “fake profiles” and software tools to scrape information from Facebook to aid with surveillance is a common tactic. A 2022 Meta report on the growth of the surveillance-for-hire industry said that for-profit firms employed for spying purposes could use hundreds of fake accounts to search and view the profiles of unknowing targets.
“The market has made it worth it for these companies to keep creating these undercover accounts and collecting reams of data,” said Levinson-Waldman, noting that social media information could easily be misinterpreted by police and data firms, and weaponized to criminalize people. “Fake accounts are really susceptible to misuse. They are a powerful tool that can be very intrusive.”
Additional documents released as part of the Brennan Center’s expansive request about the DHS’s social media surveillance suggest that the department works with a wide range of outside government entities and at times private companies, raising broader questions about where people’s data could end up.
Information obtained or collected by Ice could be shared with many entities, including other law enforcement departments, the documents suggest. In one case, Ice deportation officers shared information with a local police agency that said it was investigating a voter fraud claim. In another instance, Ice emailed with the Samoan government, which was requesting records on deportees. Those cases did not appear to involve specific requests for social media information, but suggest there was general communication.
Ice has also accessed a number of tools to facilitate its online monitoring. The documents show Ice and HSI had an agreement to use a service called Giant Oak Search Technology (Gost), which says it “can find negative news in chat rooms, social media and discussion websites, the deep web, and articles or sources in foreign languages”. Giant Oak’s chief executive said in an email it no longer worked with the DHS and that he was “proud of Gost and its ability to support those combating serious threats such as human trafficking and drug trafficking, while preserving privacy”.
Ice also sought to use a tool that would mask its employees’ IP addresses when doing “social media review”, the emails showed. And CBP recently announced plans to more broadly collect social media handles of current visa holders when they are traveling to and from the US – a proposal several digital privacy groups have opposed.
“There are just so many different mechanisms to find and track people and draw inferences about them,” Levinson-Waldman said, critiquing agencies like the DHS. “And these records show a repeated focus on a whole variety of methods to enable undercover use of social media.”
