The Biden administration is considering using outside firms to track extremist chatter by Americans online, an effort that would expand the government's ability to gather intelligence but could draw criticism over surveillance of US citizens.
The Department of Homeland Security is limited in how it can monitor citizens online without justification and is banned from activities like assuming false identities to gain access to private messaging apps used by extremist groups such as the Proud Boys or Oath Keepers.
Instead, federal authorities can only browse through unprotected information on social media sites like Twitter and Facebook and other open online platforms.
The plan being discussed inside DHS, according to multiple sources, would, in effect, allow the department to circumvent those limits. A source familiar with the effort said it is not about decrypting data but rather using outside entities who can legally access these private groups to gather large amounts of information that could help DHS identify key narratives as they emerge.
By partnering with research firms who have more visibility in this space, the DHS could produce information that would likely be beneficial to both it and the FBI, which can't monitor US citizens in this way without first getting a warrant or having the pretext of an ongoing investigation. The CIA and NSA are also limited on collecting intelligence domestically.
It would, however, involve empowering a unit at DHS that is already under fierce scrutiny for its bungled handling of the Portland riots last summer, an episode that included collecting intelligence reports on journalists and unmasking private citizens, according to a source familiar with a recent internal report on the matter.
That leaves the Biden administration with a key question: how to address mistakes made during the Trump administration while also finding ways to respond to what critics say were blatant failures by US intelligence agencies to act on warnings ahead of the January 6 attack on the US Capitol?
"There's a tension between wanting to empower [DHS's intelligence office] to do this kind of work around domestic terrorism on the one hand and then on the other hand the misuse of its capabilities during the summer of 2020, gives a lot of people on the Hill pause {when it comes to} potentially giving them new authorities, capabilities or resources," a Senate aide told CNN.
Acting US Capitol Police chief says intelligence failed to predict scope of January 6 attack
DHS officials are exploring ways to enhance the department's information gathering within the bounds of its current authorities, multiple sources told CNN. The department is coordinating with the National Security Council and FBI as part of the effort, sources added.
"There was only limited awareness before January 6 of what violent extremists were planning through social media," said Tom Warrick, a senior fellow at the Atlantic Council who served as DHS Deputy Assistant Secretary for Counterterrorism Policy from 2008 until 2019 and has decades of experience as a career government official at agencies including the State Department.
Warrick added he would expect DHS to "explore whether contractors could help them understand plots and trends" emerging online.
"Whatever gets approved and implemented has to comply with established laws," he said, noting that DHS can only use overt methods to gather information from social media or collect information that is publicly available.
Researchers who already monitor such activity online could act as middlemen to obtain the information. DHS officials maintain the materials provided would only consist of broad summaries or analysis of narratives that are emerging on these sites and would not be used to target specific individuals.
But some of the research firms and non-profit groups under consideration by the DHS periodically use covert identities to access private social media groups like Telegram, and others used by domestic extremist groups. That thrusts DHS into a potential legal gray area even as it plugs an intelligence gap that critics say contributed to the failure to predict the assault on the Capitol.
Tracking narratives
Much of the planning for the Capitol Hill riot appeared out in the open, on social media platforms and on encrypted apps available to anyone with an internet connection. The DHS is trying to get a better sense of "narratives" that might lead to violence as they emerge across those channels, according to two DHS officials.
But tracking those narratives, particularly in the wake of January 6, increasingly requires access to private groups on encrypted apps as extremist groups migrate from more forward-facing sites like Facebook.
By the time narratives are appearing on Facebook, it is usually too late, one DHS official told CNN.
"Domestic violent extremists are really adaptive and innovative. We see them not only moving to encrypted platforms, but obviously couching their language so they don't trigger any kind of red flag on any platforms," the official added.
Outsourcing some information gathering to outside firms would give DHS the benefit of tactics that it isn't legally able to do in-house, such as using false personas to gain access to private groups used by suspected extremists, sources say.
The department is also working to expand its ability to collect information from public-facing social media sites where users' posts offered clear warning signs about potential violence ahead of the January 6 attack, but were either ignored or underestimated by security officials prior to that date.
But any effort by the intelligence community to wade into the murky area of domestic spying is fraught with political risks, current and former officials say.
Gathering information on US citizens -- no matter how abhorrent their beliefs -- raises instant constitutional and legal challenges. Civil liberties advocates and privacy hawks have long criticized any efforts to collect even publicly available information on Americans in bulk as a violation of Americans' First and Fourth Amendment rights.
A legal work-around
If they can find willing external partners that would help provide access to private groups on these encrypted apps, DHS and its federal partners, including the FBI, would be able to legally identify potential domestic terrorists and access information that could inform investigative efforts, a source familiar with the effort told CNN.
FBI director Christopher Wray has been emphatic during recent public testimony that the bureau does not investigate ideologies or even conspiracy theories in and of themselves, but restricts its social media monitoring to cases where they believe a crime, or potential crime, was committed.
Investigators pursuing signs US Capitol riot was planned
But if the DHS could help provide a broad picture of who was perpetuating the "narratives" of concern, the FBI could theoretically use that pool of information to focus on specific individuals if there is enough evidence of a potential crime to legally do so, the source added, noting the two agencies are working closely with one another in this area.
"What do you do about ideology that's leading to violence? Do you have to wait until it leads to violence?" said one former senior intelligence official.
"We are exploring with our lawyers, civil rights, civil liberties and privacy colleagues, how we can make use of outside expertise," the DHS official added, referring to the department's efforts related to encrypted applications.
The problem with that, the source familiar with the effort acknowledged, is DHS would be operating in a space that would likely make civil liberties' advocates, not to mention conservatives', hair stand on end.
Privacy advocates on the Hill have already questioned the Defense Intelligence Agency's efforts to get around restrictions on collecting Americans' location data without a warrant by purchasing that data from commercially-available databases.
Problems in Portland
Even as the DHS eyes a more robust use of its intelligence authorities, it continues to face fierce scrutiny on Capitol Hill over its handling of the Portland protests last summer — raising the possibility that at least some lawmakers will push back on the effort.
The department -- then led by Trump appointees but staffed by career officials, some of whom remain on the job -- collected and disseminated open source reports on U.S. journalists who were publicly reporting on the protests. The department also sent analysts to Portland to question protesters, according to a public statement by House Intelligence Committee Chairman Adam Schiff, D-Calif. -- a tactic seen by some as a government intrusion on Americans' First Amendment right to protest. Schiff also revealed that the DHS that protects federal property had requested that analysts "extract data" from phones seized from protesters without a warrant, a request that went unfulfilled.
"There were a number of other reports that were issued that shouldn't have been issued," DHS' acting intelligence chief, Joseph Maher, told the committee in October.
DHS's general counsel conducted its own administrative review of the Portland collection practices, which it delivered to the Hill on January 6 -- purely coincidentally. In addition to the concerns about improper collection tradecraft and unmasking -- in which officials request to expose surveilled US citizens' identity internally, a sometimes-controversial request -- the review also found that department leaders created a command climate that created a false sense of urgency and sent untrained, inexperienced collectors to Portland, according to a source familiar with the contents of the report.
A DHS spokesperson said that "upon learning of alleged improper activities at the Office of Intelligence and Analysis (I&A), DHS took immediate action to review I&A activities, including to identify areas that needed resolution and ensure I&A leadership fosters a work environment that encourages diversity of thought and reinforces I&A's duty to preserve the civil rights, civil liberties, and privacy of all persons and communities."
The House Intelligence Committee, which is conducting an ongoing investigation of its own, has also expressed frustration that the department has failed to provide documents it has requested as part of the probe.
"Despite a subpoena from the Committee, the Department has not yet turned over most of the responsive documents," a committee official told CNN. "We look forward to the Department's cooperation with our investigation, so we can complete our work and make recommendations for necessary reforms."
The office is also the subject of a pair of unrelated inspector general probes, one related to possible failures leading up to January 6, and one related to alleged political interference with an intelligence notification.
I&A has long struggled to carve out a niche for itself within the intelligence community. When it comes to domestic terrorism, many of their authorities overlap with the National Counterterrorism Center -- raising questions about what I&A can do better than the more robust NCTC.
"It's perceived by some as just a resource suck that doesn't add tremendous value," said one former senior intelligence official.
The Department of Homeland Security is limited in how it can monitor citizens online without justification and is banned from activities like assuming false identities to gain access to private messaging apps used by extremist groups such as the Proud Boys or Oath Keepers.
Instead, federal authorities can only browse through unprotected information on social media sites like Twitter and Facebook and other open online platforms.
The plan being discussed inside DHS, according to multiple sources, would, in effect, allow the department to circumvent those limits. A source familiar with the effort said it is not about decrypting data but rather using outside entities who can legally access these private groups to gather large amounts of information that could help DHS identify key narratives as they emerge.
By partnering with research firms who have more visibility in this space, the DHS could produce information that would likely be beneficial to both it and the FBI, which can't monitor US citizens in this way without first getting a warrant or having the pretext of an ongoing investigation. The CIA and NSA are also limited on collecting intelligence domestically.
It would, however, involve empowering a unit at DHS that is already under fierce scrutiny for its bungled handling of the Portland riots last summer, an episode that included collecting intelligence reports on journalists and unmasking private citizens, according to a source familiar with a recent internal report on the matter.
That leaves the Biden administration with a key question: how to address mistakes made during the Trump administration while also finding ways to respond to what critics say were blatant failures by US intelligence agencies to act on warnings ahead of the January 6 attack on the US Capitol?
"There's a tension between wanting to empower [DHS's intelligence office] to do this kind of work around domestic terrorism on the one hand and then on the other hand the misuse of its capabilities during the summer of 2020, gives a lot of people on the Hill pause {when it comes to} potentially giving them new authorities, capabilities or resources," a Senate aide told CNN.
Acting US Capitol Police chief says intelligence failed to predict scope of January 6 attack
DHS officials are exploring ways to enhance the department's information gathering within the bounds of its current authorities, multiple sources told CNN. The department is coordinating with the National Security Council and FBI as part of the effort, sources added.
"There was only limited awareness before January 6 of what violent extremists were planning through social media," said Tom Warrick, a senior fellow at the Atlantic Council who served as DHS Deputy Assistant Secretary for Counterterrorism Policy from 2008 until 2019 and has decades of experience as a career government official at agencies including the State Department.
Warrick added he would expect DHS to "explore whether contractors could help them understand plots and trends" emerging online.
"Whatever gets approved and implemented has to comply with established laws," he said, noting that DHS can only use overt methods to gather information from social media or collect information that is publicly available.
Researchers who already monitor such activity online could act as middlemen to obtain the information. DHS officials maintain the materials provided would only consist of broad summaries or analysis of narratives that are emerging on these sites and would not be used to target specific individuals.
But some of the research firms and non-profit groups under consideration by the DHS periodically use covert identities to access private social media groups like Telegram, and others used by domestic extremist groups. That thrusts DHS into a potential legal gray area even as it plugs an intelligence gap that critics say contributed to the failure to predict the assault on the Capitol.
Tracking narratives
Much of the planning for the Capitol Hill riot appeared out in the open, on social media platforms and on encrypted apps available to anyone with an internet connection. The DHS is trying to get a better sense of "narratives" that might lead to violence as they emerge across those channels, according to two DHS officials.
But tracking those narratives, particularly in the wake of January 6, increasingly requires access to private groups on encrypted apps as extremist groups migrate from more forward-facing sites like Facebook.
By the time narratives are appearing on Facebook, it is usually too late, one DHS official told CNN.
"Domestic violent extremists are really adaptive and innovative. We see them not only moving to encrypted platforms, but obviously couching their language so they don't trigger any kind of red flag on any platforms," the official added.
Outsourcing some information gathering to outside firms would give DHS the benefit of tactics that it isn't legally able to do in-house, such as using false personas to gain access to private groups used by suspected extremists, sources say.
The department is also working to expand its ability to collect information from public-facing social media sites where users' posts offered clear warning signs about potential violence ahead of the January 6 attack, but were either ignored or underestimated by security officials prior to that date.
But any effort by the intelligence community to wade into the murky area of domestic spying is fraught with political risks, current and former officials say.
Gathering information on US citizens -- no matter how abhorrent their beliefs -- raises instant constitutional and legal challenges. Civil liberties advocates and privacy hawks have long criticized any efforts to collect even publicly available information on Americans in bulk as a violation of Americans' First and Fourth Amendment rights.
A legal work-around
If they can find willing external partners that would help provide access to private groups on these encrypted apps, DHS and its federal partners, including the FBI, would be able to legally identify potential domestic terrorists and access information that could inform investigative efforts, a source familiar with the effort told CNN.
FBI director Christopher Wray has been emphatic during recent public testimony that the bureau does not investigate ideologies or even conspiracy theories in and of themselves, but restricts its social media monitoring to cases where they believe a crime, or potential crime, was committed.
Investigators pursuing signs US Capitol riot was planned
But if the DHS could help provide a broad picture of who was perpetuating the "narratives" of concern, the FBI could theoretically use that pool of information to focus on specific individuals if there is enough evidence of a potential crime to legally do so, the source added, noting the two agencies are working closely with one another in this area.
"What do you do about ideology that's leading to violence? Do you have to wait until it leads to violence?" said one former senior intelligence official.
"We are exploring with our lawyers, civil rights, civil liberties and privacy colleagues, how we can make use of outside expertise," the DHS official added, referring to the department's efforts related to encrypted applications.
The problem with that, the source familiar with the effort acknowledged, is DHS would be operating in a space that would likely make civil liberties' advocates, not to mention conservatives', hair stand on end.
Privacy advocates on the Hill have already questioned the Defense Intelligence Agency's efforts to get around restrictions on collecting Americans' location data without a warrant by purchasing that data from commercially-available databases.
Problems in Portland
Even as the DHS eyes a more robust use of its intelligence authorities, it continues to face fierce scrutiny on Capitol Hill over its handling of the Portland protests last summer — raising the possibility that at least some lawmakers will push back on the effort.
The department -- then led by Trump appointees but staffed by career officials, some of whom remain on the job -- collected and disseminated open source reports on U.S. journalists who were publicly reporting on the protests. The department also sent analysts to Portland to question protesters, according to a public statement by House Intelligence Committee Chairman Adam Schiff, D-Calif. -- a tactic seen by some as a government intrusion on Americans' First Amendment right to protest. Schiff also revealed that the DHS that protects federal property had requested that analysts "extract data" from phones seized from protesters without a warrant, a request that went unfulfilled.
"There were a number of other reports that were issued that shouldn't have been issued," DHS' acting intelligence chief, Joseph Maher, told the committee in October.
DHS's general counsel conducted its own administrative review of the Portland collection practices, which it delivered to the Hill on January 6 -- purely coincidentally. In addition to the concerns about improper collection tradecraft and unmasking -- in which officials request to expose surveilled US citizens' identity internally, a sometimes-controversial request -- the review also found that department leaders created a command climate that created a false sense of urgency and sent untrained, inexperienced collectors to Portland, according to a source familiar with the contents of the report.
A DHS spokesperson said that "upon learning of alleged improper activities at the Office of Intelligence and Analysis (I&A), DHS took immediate action to review I&A activities, including to identify areas that needed resolution and ensure I&A leadership fosters a work environment that encourages diversity of thought and reinforces I&A's duty to preserve the civil rights, civil liberties, and privacy of all persons and communities."
The House Intelligence Committee, which is conducting an ongoing investigation of its own, has also expressed frustration that the department has failed to provide documents it has requested as part of the probe.
"Despite a subpoena from the Committee, the Department has not yet turned over most of the responsive documents," a committee official told CNN. "We look forward to the Department's cooperation with our investigation, so we can complete our work and make recommendations for necessary reforms."
The office is also the subject of a pair of unrelated inspector general probes, one related to possible failures leading up to January 6, and one related to alleged political interference with an intelligence notification.
I&A has long struggled to carve out a niche for itself within the intelligence community. When it comes to domestic terrorism, many of their authorities overlap with the National Counterterrorism Center -- raising questions about what I&A can do better than the more robust NCTC.
"It's perceived by some as just a resource suck that doesn't add tremendous value," said one former senior intelligence official.
