FBI Surveillance Proposal Sets Up Clash With Facebook
Agency solicits vendor proposals to collect data from Facebook, other social media to head off safety threats
By Jeff Horwitz and Dustin Volz
Aug. 8, 2019
An effort by the FBI to more aggressively monitor social media for threats sets up a clash with Facebook Inc.'s privacy policies and possibly its attempts to comply with a record $5 billion settlement [1] with the U.S. government reached last month.
The Federal Bureau of Investigation is soliciting proposals [2] from outside vendors for a contract to pull vast quantities of public data from Facebook, Twitter Inc. and other social media "to proactively identify and reactively monitor threats to the United States and its interests." The request was posted last month, weeks before a series of mass murders [3] shook the country and led President Trump to call for social-media platforms to do more to detect potential shooters before they act. The deadline for bids is Aug. 27.
As described in the solicitation, it appears that the service would violate Facebook's ban [4] against the use of its data for surveillance purposes, according to the company's user agreements and people familiar with how it seeks to enforce them.
The FBI declined to comment about the potential program, citing standard practice to not comment on pending procurements. It states in its contracting request, which is posted on the agency's website, that it believes the data can be collected "while ensuring all privacy and civil liberties compliance requirements are met."
A Facebook spokeswoman declined to comment on the proposal, including whether the company has contacted the FBI to discuss the matter.
A Twitter spokeswoman cited the company's policy prohibiting the use of its data "by any entity for surveillance purposes, or in any other way that would be inconsistent with our users' reasonable expectations of privacy. Period."
The FBI contract seeks to gather publicly available data. That wouldn't include private messages and posts but would allow the agency to collect information such as people's names, user IDs and photos, which privacy experts said could be utilized in combination with outside data sources to build detailed profiles of users and track their social lives.
The FBI and other law-enforcement agencies are under increasing pressure to confront the challenges of mass violence and domestic terrorism. Many of the recent attacks were perpetrated by men who discussed their hateful ideologies on message boards [5] and social media, and in some cases displayed warning signs ahead of time.
Meanwhile, Facebook, in particular, is being pushed to better safeguard user data after a series of privacy-related missteps over the past few years, and now potentially finds itself caught between competing imperatives from different arms of the government.
Facebook routinely cooperates with warrants, subpoenas and emergency requests from law-enforcement agencies for information about user accounts, and it reports child abuse, suicide attempts and other major public-safety threats to the police when its staff or users flag them.
The company draws a line at the collection of large amounts of user data by law enforcement that can be analyzed without permission from the company or its users. Facebook has tightened access to user data in recent years in an effort to prevent abuse of user privacy, along with other steps to better police its platform.
The potential for unauthorized surveillance on Facebook's platforms is an especially sensitive matter for the company because of its recent privacy settlement with the Federal Trade Commission, which resolved an investigation into a series of privacy violations and breaches involving the company. The deal requires the company to adhere to a "comprehensive data security program." That includes preventing the misuse of even publicly viewable data of the sort that the FBI wants to capture from Facebook, Instagram and Twitter.
An FTC spokesman said that Facebook's consent decree requires it to prevent that type of data from being gathered without its users' authorization and that the agreement isn't limited to information "that is subject to a privacy setting or that is set to be nonpublic."
The FBI proposal ratchets up a long-running feud between law enforcement and civil-liberties advocates over how social media should be used to detect and investigate potential criminal activity.
In late 2016, following an investigation [6] by the American Civil Liberties Union into social-media monitoring done by outside developers on behalf of law enforcement, Facebook and Twitter cracked down on those services and explicitly banned the use of their data for surveillance purposes, according to a recent research paper by Rachel Levinson-Waldman of the Brennan Center for Justice's Liberty and National Security Program.
Facebook's ban allowed law-enforcement agencies to look at public profiles manually but not use software designed for large-scale collection and analysis of user data. Many of the companies providing such services shut down as a result, she said.
In an interview, Ms. Levinson-Waldman said the restrictions reflect a growing understanding that even information posted to a public social network can be misused when gathered in large quantities and paired with outside data sources.
"I could, if I had the time and inclination, scroll through someone's public Facebook posts," she said. "That's very different from a service that looks through everyone's social media to make determinations about who's associating with whom, who's friends with whom, or who's working together on organizing a protest."
Ms. Levinson-Waldman said the FBI's new request for proposals demonstrates the mixed message that the government is sending Facebook on the security of its users' data.
In its July 8 request for proposals, the FBI's wish list includes the ability to "obtain the full social media profile of persons-of-interest and their affiliation to any organization or groups," as well as monitor the social-media activity of people in specific neighborhoods and search for key words connected to potential illegal activity. The FBI also said in the proposal that it requires that its data gathering leave no trace, even to other federal agencies, and states that the government would "maintain sole ownership" of the data ingested into the monitoring system.
Federal contracting documents show the FBI began building its capacity to monitor social media at least as far back as 2012. It isn't clear how what the agency is seeking now would differ from its past and current capabilities. The FBI generally refuses to discuss its social-monitoring programs, and faces an ongoing public-records lawsuit from the ACLU for its refusal to release records pertaining to those efforts.
The possibility of an outside entity using public data to build detailed profiles of individuals contains echoes of the Cambridge Analytica controversy, in which the political-research firm illicitly purchased Facebook data [7] harvested from a personality quiz app. Much of the data collected by Cambridge Analytica was already viewable to other Facebook users, and even the information that some users protected with privacy settings--such as what they liked and what they shared with friends--wasn't deeply revealing when viewed on an account-by-account basis. That same material, collected on tens of millions of users, was used to build psychological profiles that were viewed by many as invasive and caused outrage in both the U.S. and U.K.
The Cambridge Analytica episode was the impetus for Facebook's landmark $5 billion settlement with the FTC.
Facebook has previously grappled with how much access to allow government entities to its platform. Last year, Facebook suspended social-media analytics firm Crimson Hexagon after The Wall Street Journal reported [8] that U.S. government agencies awarded more than 20 contracts to the firm, which also did work for a Russian nonprofit with ties to the Kremlin. Facebook hadn't approved the contracts in advance and at the time said it wasn't aware of them.
Crimson Hexagon, now a part of Brandwatch, was reinstated several weeks later. It said in a blog post that none of its clients had used Facebook data for surveillance purposes.
Clint Watts, a former FBI agent and now a senior fellow at the Foreign Policy Research Institute, said analysis of social-media activity is increasingly essential to preventing attacks and responding to them, even as the U.S. struggles to find the right balance between digital privacy and security.
" 'Protect us from everything before it happens but don't look at any of our information' is not going to be a successful strategy for stopping atrocities," Mr. Watts said. He added that law enforcement should seek proper authority, including search warrants, when seeking users' private data and communications.
Privacy experts contend that mass-violence events frequently prompt politicians and law-enforcement officials to call on social-media companies to help detect and prevent sudden outbursts of violence, but that there is scant evidence their platforms could predict such behavior.
--Deepa Seetharaman contributed to this article.
Write to Dustin Volzat dustin.volz@wsj.com and Jeff Horwitz at jeff.horwitz@wsj.com
[1] https://www.wsj.com/articles/ftc-approves-roughly-5-billion-facebook-settlement-11562960538
[2] https://www.fbo.gov/index?s=opportunity&mode=form&id=fe943e551236e0e62ee0843d5803781e
[3] https://www.wsj.com/articles/mass-shootings-in-el-paso-dayton-leave-29-dead-11564962534
[4] https://www.facebook.com/uspublicpolicy/posts/1617594498258356
[7] https://www.wsj.com/articles/ftc-probing-facebook-over-data-use-by-cambridge-analytica-1521561803
[8] https://www.wsj.com/articles/facebook-probing-how-analytics-firm-shares-public-user-data-1532104502