POGO Urges DHS to Abandon Problematic Social Media Collection Plan

Bureau of Consular Affairs, Visa Office
U.S. Department of State
2201 C Street, N.W.
Washington, DC 20520

Department of State Desk Officer
Office of Information and Regulatory Affairs
Office of Management and Budget
725 17th Street, N.W.
Washington, DC 20503

Re: DS-160 and DS-156, Application for Nonimmigrant Visa, OMB Control No. 1405-0182; DS-260, Electronic Application for Immigrant Visa and Alien Registration, OMB Control No. 1405-185

Dear Sir or Madam:

The undersigned organizations write to urge the Department of State to withdraw the agency’s proposed information collection under Public Notices 10260 and 10261. By notices published March 30, 2018, the Department of State proposed to ask visa applicants to provide social media identifiers, telephone numbers, and email addresses used in the past five years, among other information.¹ Proposals by the federal government to use social media to make adverse visa determinations have been consistently opposed by privacy, civil liberties, civil rights, and other civil society groups.² And the government’s own studies have not produced evidence that social media screening programs work.³

Additionally, the current proposed revisions will undermine First Amendment rights of speech, expression, and association. The proposal, if implemented, will reveal private information about travelers that is irrelevant to their suitability for entry to the United States, and will expose data about their families, friends and business associates in the U.S. Further, the context in which these policies are being developed – and the methods used to examine what is collected – suggest that they will be implemented in ways that discriminate on the basis of national origin, religion, or ideology. Lastly, the data collection will facilitate the bulk mining and wide-ranging use of information about travelers and U.S. citizens, including for purposes beyond those articulated in the Public Notices, amplifying the concerns above. These drawbacks are in exchange for speculative national security benefits, especially considering the vanishingly small number of vetting failures that have permitted foreign-born persons to commit terrorist attacks on U.S. soil.

I. The Proposed Collection Excessively Burdens Visa Applicants for Speculative National Security Benefits

Social media communications have context-specific meanings that are notoriously difficult to interpret, and are more apt to raise false positives than to identify real security threats. Further, collecting social media data – platforms and identifiers – will have a deleterious impact on the speech and privacy of applicants as well as the Americans with whom they communicate.

a. Social Media Collection Will Capture Information That Is Difficult to Interpret

The Information Collection Request (ICR) assumes that the investigation of applicant-provided social media information will assist the department in uncovering potential terrorists applying for visas.⁴ This seems unlikely. As an initial matter, it is doubtful that an individual who promotes terrorism online will disclose information about the social media profile he is using to do so, or will retain postings that might get flagged as problematic.

Moreover, problems of interpretation – which manifest in both manual and computerized review, though the latter method’s deficiencies are further detailed in Section III – are guaranteed to plague any review of social media postings. One need only look at the 2012 experience of a British citizen who was turned back at the border because DHS agents misinterpreted his posting on Twitter that he was going to “destroy America” – slang for partying – and “dig up Marilyn Monroe’s grave” – a joke.⁵ In a similar vein, government agents and courts have erroneously interpreted tweets repeating American rap lyrics as threatening messages in several court cases, including high-stakes national security matters.⁶ Even greater difficulties are inevitable if the language used is not English.

This is to say nothing of the challenges posed by non-verbal communication on social media. On Facebook, for instance, users can react to a posting with a range of emojis. The actual meaning of these emojis is highly contextual. If a Facebook user posts an article about the FBI persuading young, isolated Muslims to make statements in support of ISIS,⁷ and another user “loves” the article, is he sending appreciation that the article was posted, signaling support for the FBI’s practices, or sending love to a friend whose family has been affected? Assuming it is even possible to decode the meaning, that could not be done without delving further into the user’s other online statements, interactions, and associations, as well as the postings of those with whom he or she communicates, a laborious, invasive, and error-riddled process. Indeed, such ambiguity is already affecting domestic criminal proceedings with dire consequences, including individuals put behind bars for their Facebook likes.⁸

This concern may be amplified for journalists, particularly those writing on conflict zones. Take the example of a foreign journalist who “favorites” a provocative tweet from an ISIS follower in order to find it again more easily for a piece of writing – will that be taken as support for the poster’s positions? If so, will he or she be called to account for every “heart” and “like”? Political scientists and other scholars who follow or interact with individuals with provocative or even reprehensible views for purposes of research and public education will face similar quandaries. In light of the multitude of possible interpretations of both speech and non-verbal communication, consular officers will be in a position to exercise enormous, unchecked discretion when it comes to assessing foreign residents’ suitability to enter the country, potentially quizzing them about the meaning and significance of a range of expression.

Indeed, the government can point to no evidence that social media screening works and is worth expanding. While no public audits have yet been released for State Department social media collection, a February 2017 Inspector General audit of DHS’s existing social media pilot programs found that insufficient metrics were in place to measure the programs’ effectiveness, and concluded that existing pilots had provided little value in guiding the rollout of a department-wide social media screening program.⁹ Documents evaluating these pilot programs show in further detail how they were expensive and time consuming but provided little useful information.¹⁰

b. Social Media Collection Will Chill Free Expression and Affect Third Parties, Including Americans

As a result of both the information requests and the ambiguity pervading interactions on social media, online speech – particularly of the political or religious variety – will inevitably be chilled. Visa applicants will surely sanitize their own postings and internet presence to ensure that nothing online would provide cause for further scrutiny or suspicion by a rushed consular officer, or an imprecise algorithm. The same caution will afflict people on American soil, including U.S. citizens and residents, who often correspond with those seeking entry into the United States and are protected by the First Amendment:¹¹ consider, for example, how an American citizen who wants her brother in Iraq to get a visa so he can visit or emigrate might think twice before sending out tweets criticizing U.S. policy towards that country.¹²

Though the supporting materials direct “[c]onsular staff…to take particular care to avoid collection of third-party information,”¹³ such collection and analysis will be inevitable. For instance, if the purpose of gathering social media data is in part to ascertain whether an applicant’s associations are relevant to her eligibility for a U.S. visa, consular staff will – at a minimum – view third-party information to ascertain whether she has sufficient links to her country of origin to overcome the statutory presumption that temporary visa applicants intend to immigrate to the U.S.,¹⁴ assess the nature of her relationships to Americans she has listed on her visa application, or determine whether her social media associations are of interest to the U.S. government.¹⁵ As such, reviews of travelers’ social media profiles will also likely reveal personal information not contained within any given account, including peoples’ connections to friends, relatives, and business associates in the U.S., potentially subjecting Americans to invasive scrutiny of their personal lives and constitutionally protected speech.

Even for travelers who might not have First Amendment rights before they arrive in the United States, a system that may penalize people for speech they engage in online and deprive their audience of the ability to hear it,¹⁶ is profoundly incompatible with core American constitutional values. It is also incongruent with the International Covenant on Civil and Political Rights, which the United States has ratified, and which guarantees “the right to freedom of expression,” including the “freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice.”¹⁷

Moreover, the assurances in the notices’ supporting statements that this collection of information will not be used to deny visas on grounds including religion or political views, while commendable, is insufficient.¹⁸ The point of the disclosure requirement is presumably for consular officers to view and assess the content of applicants’ postings, or for a computer program to serve that function in some capacity. It is hard to imagine that the religious and political views reflected in those postings will not in practice play a role in such assessments.

The above concerns are not hypothetical. For instance, in April, civil rights activist Shaun King was detained by U.S. Customs and Border Protection and interrogated about his online presence and involvement with Black Lives Matter.¹⁹ Though King was never accused of posing a security risk and, as an American citizen, was eventually allowed into the country, this case is among those that suggest enforcement authorities are attentive to the political views of those seeking entry to the U.S. ²⁰ Further, as explained in Section III below, automated vetting technologies will incorporate any biases driving policymaker preferences.

The collection of social media information will also undermine the right to communicate anonymously, a right that is protected by the First Amendment and was called a necessary condition of free expression by the U.N. Special Rapporteur on Freedom of Expression.²¹ Among other things, anonymity shields speakers from retribution for their viewpoints, and lets ideas stand on their own.²² As such, it is critical to free discourse: indeed, anonymity was used by the founding fathers – including Alexander Hamilton and James Madison – to debate the theories underpinning the U.S. Constitution.²³ Though consular officers are instructed to be “mindful that, unlike some other forms of personal information…social media identifiers may afford the user anonymity,” this actually implies that what must be disclosed – “each identifier used” – includes social media handles that an applicant does not wish to associate with her name.²⁴ No language suggests the contrary or affords the applicant discretion in what to list. Further, as mentioned in the second paragraph of this sub-section, the sum of information collected from applicants will yield more than its parts,²⁵ and so may also expose the identities of Americans who wish to remain nameless.

In sum, social media facilitates the free exchange of ideas that is a hallmark of an open democratic society. As Justice Anthony Kennedy put it last year in Packingham v. North Carolina:²⁶ “Social media allows users to gain access to information and communicate with one another on any subject that might come to mind…. [F]or many, [it is] the principal source[] for knowing current events, … speaking and listening in the modern public square, and otherwise exploring the vast realms of human thought and knowledge.” The State Department should carefully consider this vital role before adopting a policy that, in requiring about 15 million people a year to turn over their handles, could muzzle valuable discourse.

Practical considerations also counsel against this type of broad-ranging collection effort. If American universities are to be beacons of innovation, they need to be able to freely engage with people from across the globe; if America values economic growth, it needs to foster international business partnerships and science and technology learning. Moreover, many people around the world use social media – including Facebook, Twitter, and other platforms the State Department wants disclosed – to support democratic movements and to campaign for political reform.²⁷ It is credited with empowering the Arab Spring and allowing Egyptians to remove former President Hosni Mubarak from power,²⁸ played a pivotal role in the 2013 Gezi Park protests in Turkey, and facilitated the 2017 anti-Putin protests in Russia.²⁹ Mandating the disclosures proposed will concretely damage movements for self-governance and American cultural and economic dynamism, particularly if other countries follow U.S. precedent and impose similar requirements.³⁰

II. The Proposed Collection Will Primarily Burden Applicants on the Basis of National Origin, Religion, or Ideology

The burdens detailed above would be substantial regardless of who is targeted. However, the history of the vetting procedures suggests an intent to make national origin and religious-based distinctions among applicants, with a focus on Muslims. Indeed, documents supporting the collection justify it in part based on mandates from Executive Order 13780, second in a sequence of “Muslim ban” executive orders that tie national origin to a terror threat, and which were initially enjoined by federal courts for reflecting religious animus.³¹ While the documents supporting the Department of State’s notices state that “[t]he collection of social media platforms and identifiers will not be used to deny visas based on applicants’ race, religion, ethnicity, national origin, political views, gender or sexual orientation,”³² that assurance rings hollow, in light of the context in which this ICR arises and because it is part of the broader “extreme vetting” framework that appears aimed at Muslims. Moreover, even if visa denials do not rest on impermissible factors, circumstances suggest that certain applicants’ postings may be scrutinized more closely based on their religion or national origin.

Shortly after becoming the official Republican presidential nominee, Donald Trump rolled out a new plan: “extreme vetting” for Muslims entering the United States.³³ He proposed that the United States admit only those “who share our values and respect our people.”³⁴ One campaign official explained that people who have “attitudes about women or attitudes about Christians or gays that would be considered oppressive” would be barred.³⁵ Department of Homeland Security officials have indicated that visa applicants could be queried about honor killings, the role of women in society, and legitimate military targets.³⁶ It is difficult to see the connection between a visitor’s view of the role of women in society and terrorism, but the connection between such questions and criticisms of the rights of women in Muslim societies is plain.³⁷ As recently as January 2018, the Executive Order from which this collection stems was the basis for a report that mischaracterizes data on honor killings and forced marriages in immigrant communities, and alluded baselessly that natural-born U.S. citizens’ propensity for terrorism is linked to their parents’ country of citizenship.³⁸ Indeed, the statement supporting the revision of this collection with respect to immigrant visas includes a provision to include in the application form “a link…to an electronic pamphlet that covers the illegality of [female genital mutilation],”³⁹ a practice that is not especially Islamic but is framed as such by anti-Muslim voices who have considerable influence in this administration.⁴⁰

Such an approach is unlikely to make us safer. There is no evidence that an applicant’s national origin or religion reflects a propensity for terrorism. In fact, writing in opposition to Executive Order 13780, more than 40 national security experts from across the political spectrum argued that vetting should be responsive to “specific, credible threats based on individualized information,” not stereotypes of religions or countries.⁴¹ They also warned that banning nationals from Muslim countries would damage the “strategic and national security interests of the United States,” corrode relationships with allies and “[reinforce] the propaganda of ISIS.”⁴² An analysis by the Trump administration’s Department of Homeland Security found that citizenship was an unreliable indicator of terrorism threat,⁴³ an unsurprising finding in light of U.N. estimates that in 2015 about 244 million people were living outside of the countries in which they were born.⁴⁴ Decades of counterterrorism research has not been able to identify traits that could be used to identify people who have a propensity for terrorism.⁴⁵

Policies should be based on proof, not prejudice. And while no proof has been offered that the proposed collections will enhance national security, there is plenty of evidence that prejudice has played a role in this administration’s ratcheting up of visa vetting procedures. That runs contrary to the interests of the American public.

III. Information Collection May Facilitate Bulk Data Mining and Algorithmic Analysis Efforts that Amplify Privacy and Discrimination Concerns

The statements supporting the collection say that the “information obtained from applicants…is considered confidential and is to be used only [purposes related to] the immigration, nationality, and other laws of the United States, except that… it may be made available to a court or provided to a foreign government if the relevant requirements stated in INA…are satisfied” (emphasis added).⁴⁶ But given the breadth of those statutory prescriptions,⁴⁷ it does not say in concrete enough terms what those efforts will consist of or how the State Department will use, store, or share the data it obtains. Even setting aside the risks inherent in the mass transfer and storage of data,⁴⁸ will it be able to analyze such large amounts of data? If so, through what means, and based on what criteria? Presumably this information about visa applicants from around the world will be recorded in government databases; for what specific purposes will these databases be used? Exploiting this data for bulk mining or algorithmic analysis would further amplify many of the privacy and discrimination-oriented concerns highlighted above, especially given that about 15 million people yearly will have to disclose their data to enter the United States.

The sensitive applicant information collected would likely be shared with the Department of Homeland Security, potentially through the National Vetting Center, which is slated to coordinate the government’s vetting functions and consolidate data streams with the goal of identifying “known or suspected threat actors” using “relevant indicators that inform adjudications and determinations related to national security, border security, homeland security, or public safety.”⁴⁹ This is a mandate that is vague and sweeps far beyond visa decisions. As such, feeding data into the Center carries the risk of rationalizing discrimination – in light of evidence that such indicators have been linked to immigration status, religion, and national origin – and amplifying the civil liberties concerns so far described. Additionally, as noted above, social media is especially vulnerable to interpretive failures, which would be magnified to the extent secondary analysis of it is relied upon to make decisions.⁵⁰ For example, notes taken by a consular officer about a visa applicant’s social media profile – that might be imperfectly translated, include conclusions without disclosure of the source on which they are based, or are not accompanied by contextualizing information from the visa interview – might later be introduced against them in a removal proceeding without an opportunity for verification or cross-examination, with serious consequences for the person affected.⁵¹

Additionally, Immigration and Customs Enforcement (ICE) has explored using applicant data as an input into technological tools using machine learning to “establish an overarching vetting [system] that automates, centralizes and streamlines the current manual vetting process,” driven by the mandates in President Trump’s immigration Executive Orders, including Executive Order 13780.⁵² Though it has for now, due at least to cost and logistical constraints,⁵³ halted this specific effort, ICE has yet to acknowledge some of the inherent deficiencies with machine-based vetting or confirm that it will not continue to pursue the development of a program of the type reflected in disclosed procurement documents.⁵⁴ Further, ICE has not described precisely how this program’s replacement would work, other than saying that it will for now solicit a “labor contract” for manual monitoring of social media – a practice that would still raise the concerns outlined in Section I.⁵⁵ As such, and because Homeland Security has been known to test automated social media vetting tools,⁵⁶ we describe our objections to machine-based vetting programs below, using ICE’s proposed system as a platform for doing so.

That computerized system – the “Extreme Vetting Initiative,” or “Visa Lifecycle Vetting” – would have attempted to “continuous[ly] vet” visitors within the country using information including “media, blogs, public hearings, conferences, academic websites, social media websites…radio, television, press, geospatial sources, [and] internet sites.”⁵⁷ It would have been targeted at “evaluat[ing] an applicant’s probability of becoming a positively contributing member of society as well as their ability to contribute to national interests,”⁵⁸ and predicting whether those entering the U.S. intended to commit a crime or terrorist attack once they arrived here.⁵⁹

First, broad standards – like those measuring the likelihood that an applicant will “positively contribute” to society or to the national interest – are impossible to administer, given that computer analyses are only as good as their inputs. Recent efforts to employ predictive algorithms throughout the criminal justice system have been shown to reflect enduring prejudices, including those based on race and income, since they rely on historic crime data that integrates those prejudices.⁶⁰ Further, there is precedent from other law enforcement contexts for using social media monitoring software to surveil political movements, such as Black Lives Matter.⁶¹ Second, crimes and terror attacks occur too rarely to afford a computer sufficient data to make accurate predictions about who will commit them. Indeed, a group of over 50 scientists, engineers, mathematicians, and other experts in the field of machine learning wrote to then-Acting Secretary of Homeland Security Elaine Duke voicing these concerns and warning that such a system “would be inaccurate and biased.”⁶²

Machine bias can derive from data inputs, but it can also be linguistic. Existing Homeland Security programs that attempt to draw inferences about social media data to develop traveler risk profiles on the basis of “tone analysis” are prone to incorporating decontextualized judgments about entire communities or religions, raising questions about both its ostensible neutrality and its effectiveness.⁶³ Indeed, one of the primary findings of a November 2017 report was that “[d]ecisions based on automated social media content analysis risk further marginalizing and disproportionately censoring groups that already face discrimination,” citing low accuracy rates for non-English languages and vernaculars associated with minority groups.⁶⁴ Members of Congress have taken note: in March 2018, the Congressional Black Caucus wrote to DHS Secretary Kirstjen Nielsen opposing the Extreme Vetting Initiative and highlighting these issues.⁶⁵

In light of these concerns, collecting social media and other data for the purpose of vetting foreign travelers in order to subject it to algorithmic analysis seems highly unlikely to contribute measurably to domestic safety and security – instead, use of unproven vetting technologies may have the effect of facilitating religious, ideological, or cultural screening.⁶⁶

IV. There is No Evidence that Foreign Visitors Pose a Significant Threat to the U.S.

Lastly, empirical evidence shows that the risk of an attack on U.S. soil perpetrated by a foreign person who has been improperly vetted is infinitesimal. This is not surprising: the U.S. has one of the world’s most thorough visa vetting systems, built to identify national security threats. The government has had trouble showing otherwise. According to a federal court of appeals: “There is no finding that present vetting standards are inadequate, and no finding that absent the improved vetting procedures there likely will be harm to our national interests.”⁶⁷

A study examining broadly defined vetting failures found that from 2002 to 2016 the chance of being murdered in a terrorist attack attributable to a vetting failure was 1 in 328 million per year.⁶⁸ One of every 379 million visa or status approvals in that time period was for a terrorist, a reduction of almost 85 percent compared to the 15 years preceding September 11, when the U.S. immigration security infrastructure was overhauled.⁶⁹ Indeed, over the past ten years, Americans have been more than ten times as likely to drown in a bathtub or die in a lightning strike than to die in a terrorist attack perpetrated by a foreign-born terrorist on U.S. soil.⁷⁰ In short, the State Department’s expanded collection is a solution in search of a problem.

V. Conclusion

For the above reasons, we urge the Department of State to abandon this proposed information collection initiative. Please do not hesitate to let us know if we can provide any further information regarding our concerns. We may be reached at [email protected] (Faiza Patel: 646-292-8325), [email protected] (Rachel Levinson-Waldman: 202-249-7193), [email protected] (Harsha Panduranga: 646-925-8719), or [email protected] (Jeramie Scott: 202.483.1140 x108).

Sincerely,

18MillionRising.org

ACCESS

Access Now

American Friends Service Committee

American Immigration Lawyers Association

American-Arab Anti-Discrimination Committee

Americans United for Separation of Church and State

Amnesty International

Arab American Institute

Archivists Roundtable of Metropolitan New York (ART)

Asian Americans Advancing Justice

Asian Americans Advancing Justice - Atlanta

Association of Research Libraries

Brennan Center for Justice at NYU School of Law

Center for Democracy & Technology

Center for Security, Race and Rights

The Center on Privacy and Technology at Georgetown Law

Chhaya Community Development Corporation

Coalition for Humane Immigrant Rights (CHIRLA)

Concerned Archivists Alliance

Consumer Action

Council on American-Islamic Relations (CAIR)

Defending Rights & Dissent

Electronic Frontier Foundation

Electronic Privacy Information Center (EPIC)

Emgage Action

Free Press

Government Accountability Project

Government Information Watch

Human Rights First

Human Rights Watch

Immigrant Legal Resource Center

Iranian Alliances Across Borders (IAAB)

Media Freedom Foundation/Project Censored

Montgomery County Civil Rights Coalition

MPower Change

Muslim Justice League

Muslim Public Affairs Council

NAACP

NAFSA: Association of International Educators

National Asian Pacific American Women's Forum (NAPAWF)

National Hispanic Media Coalition

National Immigrant Justice Center

National Immigration Law Center

National Immigration Project of the NLG

National Network for Arab American Communities

New America's Open Technology Institute

New York Immigration Coalition

NIAC Action

Open MIC (Open Media and Information Companies Initiative)

Patient Privacy Rights

Privacy Times

Project on Government Oversight (POGO)

Sikh American Legal Defense and Education Fund

United We Dream

Veterans for American Ideals

World Privacy Forum