EFF: DEEP DIVE: EFF to DHS: Stop Mass Collection of Social Media Information

DEEP DIVE: EFF to DHS: Stop Mass Collection of Social Media Information

The Department of Homeland Security (DHS) recently released a proposed rule expanding the agency’s collection of social media information on key visa forms and immigration applications. Earlier this month, EFF joined over 40 civil society organizations that signed on to comments drafted by the Brennan Center for Justice. These comments identify the free speech and privacy risks the proposed rule poses to U.S. persons both directly, if they are required to fill out these forms, and indirectly, if they are connected via social media to friends, family, or associates required to fill out these forms.

DHS’s Proposed Rule

In the proposed rule, “Generic Clearance for the Collection of Social Media Information on Immigration and Foreign Travel Forms,” DHS claims that it has “identified the collection of social media user identifications . . . as important for identity verification, immigration and national security vetting.” The proposed rule identifies 12 forms adjudicated by DHS agencies U.S. Customs and Border Protection (CBP) and U.S. Citizenship and Immigration Services (USCIS) that will now collect social media handles and associated social media platforms for the last five years. The applications will not collect passwords. DHS will be able to only view information that the user publicly shares.

U.S. Customs and Border Protection

The proposed rule mandates social media collection on three CBP forms:

• Electronic System for Travel Authorization (ESTA, known as the visa waiver program)
• I-94W Nonimmigrant Visa Waiver Arrival/Departure Record
• Electronic Visa Update System (EVUS, the system used by Chinese nationals with 10-year visitor visas).

EFF previously highlighted the government’s proposals to collect social media information from visa waiver and EVUS applicants. In 2016, the government finalized CBP’s proposed rule to collect social media handles on the ESTA form as an optional question. Under DHS’s current proposed rule, this question would not longer be optional. DHS claims that this question is not “mandatory” in order to obtain or retain a benefit, such as a visa waiver, but it is mandatory to submit the ESTA and EVUS forms. Applicants may choose “none” or “other” as responses.

U.S. Citizenship and Immigration Services

The proposed rule mandates collection of social media handles on nine USCIS forms, including applications for citizenship, permanent residency (green card), asylum, refugee status, and refugee and asylum family petitions. The proposed rule marks the first time that USCIS has sought to collect social media information from individuals seeking an immigration benefit. 

USCIS claims that it is not “mandatory” to provide social media information on all of these forms. But, for both CBP and USCIS, the proposed rule states that “failure to provide the requested data may either delay or make it impossible for [the agency] to determine an individual’s ability for the requested benefit.” Thus, though the agency may still process forms without a response to the social media question, applicants risk being denied if they fail to provide the information.

Civil Liberties and Privacy Concerns

As we’ve previously argued, collection of social media handles and information in public posts raises a number of First Amendment concerns.

First, the proposed rule will chill the exercise of free speech and lead to self-censorship. As we argued in the comments, social media platforms have become the de facto town square, where people around the world share news and ideas and connect with others. If individuals know that the government is monitoring their social media pages, they are likely to self-censor. Indeed, studies have shown that fears about online government surveillance lead to a chilling effect among both U.S. Muslims and broader samples of Internet users. The proposed rule may cause individuals to delete their accounts, limit their postings, and maximize privacy settings when they otherwise may have shared their social media activity more freely.

Second, the proposed rule infringes upon anonymous speech. Under the proposed rule, individuals running anonymous social media accounts could be at risk of having their true identities unmasked, despite the Supreme Court’s ruling that anonymous speech is protected by the First Amendment. Given that the proposed rule states that “[n]o assurance of confidentiality is provided,” collection of anonymous social media handles tied to their real-world identities could present a dangerous situation for individuals living under oppressive regimes who use such accounts to criticize their government or advocate for the rights of minority communities.

Third, the proposed rule threatens freedom of association. Collection of social media information implicates not just an applicant for a visa or an immigration benefit, but also any person with whom that applicant engages with on social media, including U.S. citizens. This may lead to applicants disassociating from online connections for fear that others’ postings may endanger the applicant’s immigration benefit. Earlier this year, CBP cancelled a Palestinian Harvard student’s visa and deported him back to Lebanon, allegedly based on the social media postings of his online connections. And conversely, the proposed rule may lead to family and friends disassociating from applicants for fear of government social media surveillance.

In addition, the proposed rule raises issues around privacy. Often, people’s social media presence can reveal much more than they intend to share. A recent study demonstrated that using embedded geolocation data, researchers accurately predicted where Twitter users lived, worked, visited, and worshipped—information that many users hadn’t even known they had shared. The proposed rule’s collection of public social media information may allow the government to piece together and document users’ personal lives.

These civil liberties concerns are why EFF and other civil society organizations signed on to the Brennan Center’s comments urging DHS to rescind the proposed rule and abandon its initiative to collect social media information from over 33 million people.

New USCIS Policy on Fake Accounts

The release of the DHS proposed rule dovetailed with the release of a USCIS Privacy Impact Assessment (PIA) on the agency’s use of fake social media accounts to conduct social media surveillance. Under the PIA, the USCIS Fraud Detection and National Security Directorate (FDNS) can create fake social media accounts to view publicly available social media information to:

1. Identify individuals who may pose a threat to national security or public safety and are seeking an immigration benefit;
2. Detect and pursue cases when there is an indicator of potential fraud; or
3. Randomly select previously adjudicated cases for review to identify and remove systemic vulnerabilities.

Under the PIA, FDNS officers may use fake accounts only with supervisor approval. Officers can access only publicly available content and cannot engage on social media (for example, through “friending”).

This USCIS PIA and the DHS proposed rule together involve two separate units within USCIS that engage in social media surveillance: one through social media collection on forms and the other through fake accounts. In the first instance, the applicant is aware that USCIS may monitor their social media activity, while in the second, the applicant may not be aware that USCIS is engaging in such monitoring. The PIA also discusses reevaluation for previously adjudicated decisions, indicating that an applicant may be under a “review” process long after their case has been adjudicated.

The PIA is concerning for several reasons. To begin, the PIA’s authorization of use of fake accounts directly contradicts previous policy. Prior USCIS and DHS guidance required any officer using social media for government purposes to identify themselves with a government identifier. Moreover, as we’ve previously highlighted, the PIA’s authorization of fake accounts violates the terms of service of many social media platforms such as Facebook.

In addition, the PIA provides only vague justifications for why USCIS officers need to create fake accounts to engage in this type of immigration vetting. The PIA claims that using fake accounts is an operational security measure that protects USCIS employees and DHS information technology systems. This explanation provides little clarity, especially since officers are not allowed to engage with other social media users, whether through a government-identified profile or a fake profile. While the PIA claims that any risk to users is mitigated because users are allowed to control what content they make public, the use of fake accounts makes it harder for individuals to use the “block” feature effectively—a key user tool for content control, akin to a privacy setting. By hiding law enforcement’s identity, a user may not block accounts they otherwise might.

Finally, the PIA raises similar concerns as the proposed rule around First Amendment issues and privacy. In particular, the third category allows for social media review of someone who has already been granted an immigration benefit. This means that someone who is already a naturalized U.S. citizen or permanent resident would have to be on alert for the possibility of having their social media content reviewed—and even having their immigration benefit revoked—years after the immigration benefit is granted. The PIA also contemplates the collection of publicly available information from an associate of a person under investigation—for example, comments on a photo. These dual risks could result in the indefinite chilling of individuals’ speech online.

The DHS Privacy Office recommends three ways to limit USCIS’s use of fake social media profiles. First, the PIA states that fake accounts should not be the default, but rather should only be used when there is an “articulated need.” Second, the Privacy Office will initiate a Privacy Compliance Review within 12 months of the PIA’s publishing. Third, the Privacy Office recommends that FDNS implement an efficacy review. We hope that, at minimum, USCIS follows these recommendations. We further ask that USCIS explain why its position has changed from previous guidance prohibiting the use of fake accounts.