This is part two of a two-part series on the human rights implications of law enforcement monitoring of social media content. Part one examined what social media monitoring is and why it threatens human rights.
Politicians and law enforcement in the U.S., E.U., and beyond are increasingly calling for more authority to monitor user-generated social media content, a practice that is inherently intrusive and ripe for abuse.
Just last week, the White House dispatched U.S. officials for a high-level meeting with leaders from technology companies to discuss ways to disrupt the Islamic State of Iraq and Syria (ISIS) online, and followed up by announcing the creation of a new task force called the Countering Violent Extremism Task Force. In his final State of the Union address last night, U.S. President Obama drew attention attention to the issue once more, stating that terrorists “use the internet to poison the minds of individuals inside our country.”
Below, we provide Access Now’s recommendations on appropriate limits to any contemplated government practices or program for monitoring social media.
Recommendations to limit government monitoring and increase transparency
Law enforcement has argued for some level of engagement with social media in order to carry out their jobs and keep the public safe in the digital age. However, because there is vast potential for social media monitoring to lead to abuse, it’s critical that any government program to collect or track content comply with human rights law and principles, including that it is strictly necessary and proportionate to the specific, legitimate purpose for the intrusion. The activity should also be subject to substantial oversight and transparency requirements. Otherwise, we risk serious human rights violations.
While we don’t make a judgment here on the validity of any particular program or activity, at a minimum any government program to monitor social media content needs to have in place the following foundational safeguards to protect our freedoms and fundamental rights:
1.) Collection and processing of digital communications must be limited in scope.
Any monitoring of social media must be limited to a specific, identified legitimate aim. There is potential for monitoring to extend far beyond, for instance, an item-by-item review of individual posts on matters related to national security. In the past, the Department of Homeland Security (DHS) procedures for monitoring U.S. citizen engagement on social media have incorporated the capture and retention of content and dialogue concerning “policy directives, debates, and implementations related to DHS.” Yet capture, retention, and analysis of these personal political views is not necessary for DHS to fulfill its mission. In any government social media monitoring program, it’s not appropriate for the government to collect, analyze, or retain any more information than is necessary for specifically and publicly identified law enforcement or national security purposes. These purposes cannot be over-broadly identified or secretly defined.
Retention and analysis of social media posts and data in bulk further opens the door to abuse. As the Obama administration has noted, “big data analytics have the potential to eclipse longstanding civil rights protections in how personal information is used in housing, credit, employment, health, education, and the marketplace.”
Law enforcement has already used existing police monitoring of social media networks to classify individuals into different groups, such as “suspected criminals” and “at-risk youths.” Using big-data algorithms to mark individuals with these kind of long-term status identifiers simply because they participate in First Amendment-protected activities on social media platforms is dangerous, and could prejudice that individual at a later date. Furthermore, such monitoring might then have a disparate impact, disproportionately impacting particular ethnic or religious groups. For these reasons, there must be a narrow focus and scope for government processing of social media content. This kind of surveillance must be conducted for a legitimate and compelling purpose, so as to not endanger the rights and freedoms of these at-risk groups and individuals.
2.) Use of social media content should respect existing legal and human rights protections.
In the United States, there is longstanding legislation, including the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act, to protect certain electronic communications from being accessed without a warrant or other legal process. Online communications, including user-generated social media content, are also protected under international human rights law, including the International Covenant on Civil and Political Rights, to which the U.S. is a party. Article 17 of the Covenant guarantees that “no one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence,” and Article 19 states that “everyone shall have the right to hold opinions without interference.” Government monitoring of social media, which can scoop up protected communications, chills speech and directly impacts these rights. It is imperative that any social media monitoring be implemented in a manner that respects existing legal and human rights laws and policies, including behavioral norms.
Fortunately, there is an internationally recognized framework to ensure that surveillance respects human rights. The International Principles on the Application of Human Rights to Communications Surveillance holds that legitimate surveillance must be consistent with 13 Principles. Chief among these are that surveillance must be necessary as the “only way to achieve a legitimate aim,” and that any surveillance practiced must be “proportionate to the aim pursued.” At a minimum, any social media monitoring program, foreign or domestic, must adhere to these principles in order to respect, and not infringe upon, human rights.
3.) Surveillance procedures should be subject to public review and transparently implemented.
Since the potential for significant abuse and threats to human rights is inherent in any program to monitor social media content, surveillance procedures must remain open to public scrutiny and regularly reviewed. Unfortunately, historically the U.S. has not been forthcoming about the extent to which it collects information through social media. It was only after a protracted battle by the Electronic Privacy Information Center to get information through Freedom of Information Act requests that existing DHS social media monitoring practices came to light. Any new legislation or procedures for monitoring social media must be implemented with predictability, and must be subject to public scrutiny, so that people understand how their social media activity could be monitored and used. Our existing procedures should meet the same standards, or be reformed.
Communications surveillance should not be carried out through deception. Otherwise, there is no transparency, and public confidence in the government suffers. This means that no government agency or law enforcement entity should attempt to gain access to private information by creating a fake profile to act as a lure. The DHS has already recognized this, prohibiting this strategy in its current Privacy Impact Assessment on social media monitoring. However, this has not stopped law enforcement agencies across government from creating profiles that mimic other people or companies in order to bypass legal protections and obtain access to personal data.
In order to ensure compliance with these safeguards, law enforcement officials must receive training and operate pursuant to formal procedures. A 2014 survey exploring law enforcement’s use of social media found that several branches of law enforcement currently monitor social media frequently for far-reaching purposes, including identifying suspects and gathering evidence. Yet over half of the agencies did not have a formal process for using social media in investigations. Additionally, only 9% of police respondents had received any formal training from their agency on how to engage in these activities. To prevent abuse, programs for monitoring social media cannot be implemented or carried out on this type of ad hoc basis. Instead, they must be tested and subject to rigorous review and scrutiny on a regular schedule. Agents conducting social media monitoring should be trained, and departments should produce reports on the use and efficacy of these programs. These programs should be subject to routine audits, and the final results should be made available for public review.
What’s next? Legal review
Politicians are paying a lot of attention now to surveillance practices and social media monitoring. It’s important for them to understand the extent to which law enforcement and other intelligence officers already engage in social media monitoring and what government policies currently exist to provide privacy protections and protections for other human rights. These activities should be subject to review, so that we can determine their scope and efficacy, as well as pinpoint existing protections for privacy and liberty — formal or informal.
For their part, social media platforms should transparently report any monitoring they assist with or become aware of, and ensure that Terms of Service, human rights commitments, and other relevant policies are enforced equitably.
We believe that a good first step is for the U.S. Congress, the European Parliament, and other local entities around the world to conduct inquiries and hearings on social media monitoring without delay.