For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional U.S. CITIZENSHIP AND IMMIGRATION SERVICES REVIEW OF THE DEFENSE ADVANCED RESEARCH PROJECTS AGENCY 2.0 SOCIAL MEDIA PILOT Fraud Detection and National Security Directorate June 2, 2016 1 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional !Screenin2 Review: The Defense Advanced Research Proiects Agencv 2.0 Pilot Overview In Fiscal Year (FY) 2015, the US. Citizenship and Immigration Services (USCIS) deployed multiple pilots in coordination with the Department of Homeland Security (DHS) Of?ce of Intelligence and Analysis the Intelligence Community (1C), and the De artment of Defense (DOD) to assess the feasibility of using social media to screen pplicants. I lDuring that initial test, USCIS encountered a number of challenges and limitations in using the tool, and determined it did not meet. USCIS social media screening needs at that time. I In FY 2016, USCIS initiated pilots, in coordination with DHS Science and Technolo malatform to screen two different population sets: USCIS sought to determine if reviewing the social media presence of these individuals could provide useful information for adjudicating their applications, and gauge how resource intensive this screening would be. Following a review of the results of th Ipilots, USCIS initiated a second pilot utilizing the revamped I3 atform to screen a new round of refugee applicants I I This paper captures the results of that pilot. In keeping with its previous approach to theEpilots, the USCIS Headquarters Fraud Detection and National Security Directorate pilot team took a two-fold approach: ?rst, determined if any of the applicants could be linked to derogatory information that negatively impacted their eligibility or admissibility; and second, evaluated theDool for social media screening requirements. Elicitation Pilot In April 2016' Iwere asked about then" scolal media accounts durin rocessmg 1 urmg the elicitation contractors asked applicants about their use of Facebook, Twitter, Instagram, andYouTube, and, when available, the applicants provided user names, handles, and Web addresses also known as URLs. The data collected during this pilot was uploaded to thel 1and given to DARPA in Excel format for ingestion. Additionally, the elicited data was manually vetted and evaluated. The results show that elicited data does not replace manual account identi?cation processes or produce major ef?ciencies. United States Digital Service (USDS) evaluated the pre?vetted data and came to similar conclusions.1 1 See Refugee Social Media Elicitation Pilot Summary Pre-Vetted for additional information. 2 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional las an Entity Identi?cation Resolution Tool is an open-source based social media screening tool, which uses personal identi?ers to comb Twitter, Instagram, and the deep and dark Webs for potential user accounts. mband all other social media tools) is unable to comb Facebook using personal identi?ers int IS same way due to restrictions Facebook has placed on its Application Programming Interface (API). Methodology This pilot focused cap olicants, predominantlyE divided into two sets. 0 Set 1: The first set referred to forElznhanced reV1ew. 0 Set 2: The second set containeDndividuals chosen for the USCIS Elicitation Pilot, led by the Department of State, USDS, and USCIS Refugee, Asylum, and International Operations Directorate. 4 were associated with 102 Elicitation Pilot cases. of th ndividuals participated in the elicitation. Those associated with the cases who id notparticipate in elicitation included a number of children who were not asked about social media due to their age. 3 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional The ?rst set of cases Eenhanced review referrals) was processed througli using a four- step process: 1 In conjunction with this rocess, FDNS of?cers also manually reviewed each social media account returnedb hrough the High Assurance Gateway (HAG) to assist with the account confirmation and derogatory resolution steps, and conducted independent searches through :to- identify other. potential social media accounts.5 Due to technical issues with the DARPA tool, the second set of cases (Elicitation Pilot) was not ingested byEin time for the cases to be processed accordin to the methodology described above. FDNS of?cers relied on manual searches usingjand the HAG to identify and vet social media accounts associated with applicants within this group. Following the completion of this ad hoc rocessi?I subsequently ingested all of the Elicitation Pilot cases, i whiEh-allowed DNS to evaluate the tool?s results against. the of?cers? manual Entity Identi?cation and Resolution Results Mirroring thE pilot?s conclusions, this pilot. underscored the popularity of Facebook as a social media platform, and highlighted the challenges posed by name-based social media searches and by individuals? privacy settings in conjunction with limited authorities. 4 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional Combining both sets of cases, totalin applicants referred to for enhanced review and bchosen for the . licitation Pilot), FDNS of?cers determined that: Dindividuals had con?rmed social media accounts which accounted metotal a_ccounts: Facebool InstagraITD Twitte' and YouTubeE 0 ?individuals hai ossible social media accounts, but due to privacy settings and _pl'atform restrictions these matches were unable to be con?rmed or disproven.6 Note: BecausDannot screen against Facebook or YouTube, FDNS of?cers used the HAG to manually review accounts identi?ed for each platform, where privacy settings allowed. Two of the social media accounts reviewed contained potentially derogatory information: Overall, th ool demonstrated signi?cant limitations identif in potential social media accounts. ielded many results that did not relate to the iapplicants. also failed to identify accounts that FDNS officers were able to identl Via manual methods. While it was dif?cult to determine the precise source of these shortfalls, DARPA developers have acknowledged tha] I iEnhanced Review Cases I Ireviewed) potential accounts, all of them on Twitter. FDNS of?cers determined that:? Approximateli Iof these accounts were No Match to the refugee applicant, based on a review of the information associated with the account, such as avatar photo, account descri tion, account postings, or username. Approximatelyl of the accounts were Potential Matches, which could not be con?rmed or disproven 1n the absence of further identifying information. 0 Approximately Iof the accounts were Con?rmed Matches.8 6 This total includes a signi?cant number of possible accounts returned which were associated with child- aged derivatives. In keeping with the team?s methodology for scoring accounts, they were scored as possible matches since they could not be con?rmed or disproven. 7 An account was considered Unknown when the of?cer was not able to review the account, either because they could not ?nd it or because privacy restrictions prevented them from viewing it. 5 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional Elicitation Cases reviewedi Refugee applicants participating in the Elicitation Pilot providechocial media accour?andles, including: {ouTube handles. 0 Twitter handles. 0 Instagram handles. 0 Facebook handles. 0 As noted abovei only searches against Twitter and Instagram. Of tEcombined Twitter and Ins :agram account handles provided via the Elicitation Pilot only foun uncoverecQadditional potential accounts in cases where the applicant was unable to remember eir account details, and therefore could not provide the account handle. 0 Through the manual review process, FDNS of?cers identi?edUadditional social media accounts potentially associated with the Elicitation Pilot participants I Many of theSe accounts were noted by the during their Elicitation Pilot interview but they were unable to remember examnt details. 0 Sound Iaccounts identi?ed through manual review. 0 FDNS officers found that, ofthel. who claimed to have no social media account?ndividuals actually did have accounts. Case Review Metrics Review Time Because the FDNS team used a similar methodology for identifying and vetting the social media accounts for each set of cases, the overall time required for reviewing each case was similar. The average review time in both set-s of cases at was less than a half hour. Please see the chart below for additional information. I IEnhanced Review Cases I Elicitation Pilot Cases Average Review Time, Per Case: 28 minutes Average Review Time, Per Case: 25 minutes Case Review Metrics Elicitation Method During the ?rst phase of the Elicitation Pilot, applicants wewked to log in to their Facebook accounts and provide their unique Facebook user ID to the? bontractor. During the second phase of the Elicitation Pilot, applicants were verbally asked to provide their Facebook full name, username, or user ID if they knew it. In both the log-in elicitation phase and the verbal 6 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive (b)(7)(e)For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional elicitation mam: provided Facebook identi?ers. manual review of the Elicitation Pilot cases indicated that it was equally challenging to identify and verify the accounts elicited in both phases. Please see the chart below for additional information. Phase 1 Log-In Elicitation Results - Phase 2 Verbal Elicitation Results Facebook FacebOolr acebook Identi iers acebook Identi iers Provided todSta? Provided to dfta? through Log-In through Verbal Elicitation Elicitation Account Identification Account Identification through FDNS Social through FDNS Social Media Review Media Review The high number of possible and unknown accounts identi?ed by FDNS from both phases re?ects the different levels of access provided to users who are logged in to a Facebook account, versus those who are not. The FDNS of?cers participating in this pilot 'Assessment I Although DARPA has improved thgtool since FDNS ?rst piloted it, it is not a viable option for semi-automated social me 1a screening at. this time. The manual review process used by FDNS of?cers proved to be more effective at identifying accounts, and thDool yielded no gains in ef?ciency or throughput. Among its positive attributes, theEtoOl: 0 Provided a useful "pro?le for each applicant, drawn from: data. 0 Presented an intuitive user interface and work?ow. 0 Offered, some capability for: although this was not tested during this pilot. 0 Contained a tailorable report function (also not tested during this pilot). 0 May have potential for bulk data ingestion.9 Among its negative attributes, air?TI tool: - Offered very low match con 1 ence, with of?cers having both to ?nd actual accounts and to review accounts that were not matched effectively. As part of its search algorithms, appears to match based on ?rst and last names, or a combination of initials and names leading to accounts that are entirely unrelated to the applicant. 9 DARPA believes it has identi?ed the source of the problem with ingestion and resolved it. They are currently in the process of stress-testing the system to con?rm this resolution. 7 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional Returned zero results for Instagram, likely indicating .a systemic problem with the tool?s search capabilities. 0 Failed to return the complete set of social media postings that were found during manual review of one of the cases for which potentially derogatory ?ndings emerged, which could indicate issues with other accounts. 0 Represented a static display of social media information, based on the time that the case was ingested and screened against social media. platforms, which meant that any subsequent social media posts would not be captured in the tool. 0 Could not be updated by an FDNS of?cer if an account was found manually. 0 Did not offer an option to ?ag cases/accounts/social media posts for linguist review. 0 Only worked in Google Chrome, making it incompatible with the HAG and forcing of?cers to manually enter information into Twitter for account review. 0 Provided mostly indecipherable machine translation. 0 Did not offer a uni?ed case list that indicated where every case was in the workflow process. 0 Returned the same accounts as potential matches to multiple people in the same family case leading to duplicative review. Lessons Learned The DARPA 2.0 Pilot continued the "exploration of social media initiated by the ilot and Pilot, conducted in conjunction with DHS Science and Technology, as well as previouDilots conducted in conjunction with DHS Intelligence and Analysis, the Intelligence Community, and the Department of Defense. The team of FDNS of?cers assigned to evaluateEused best practices and tradecraft expertise developed through previous pilots to conduct effective and ef?cient social media review processes. In addition to the new lessons learned through DARPA 2.0, many of the previous lessons learned have still held true. h-q . Optimal results come from richer and more re?ned data sets. Searching solely against people?s names is inef?cient due to the commonality of many names in populations. - Elicited data may assist-in con?rming accounts, but does not replace account identi?cation processes or produce major ef?ciencies. 2. Account restrictions inhibit success. 0 At the present time, FDNS of?cers are unable to log in to the various social media platforms and can only View what is publicly available, as set by the applicant and as available by a search in the platform for those not logged in. The team would more easily and accurately be able to con?rm accounts with access to the social media platforms through account creation. 0 Many of the Elicitation Pilot Facebook Iindicated that the page was not available to the FDNS of?cer or presented very imite mformation because the of?cer was not logged in to Facebook. 8 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional You have to choose the right social media platforms to search. Ehas access to Twitter, lnstagram, and the dee ark Web. However, only Twitter was encountered through review within th tool. More than just translations are needed for foreign language records. This pilot led to two potentially derogatory ?nding-s, one very signi?cant. In both cases, native Arabic language and subject matter expertise in regional culture, religion, and terrorism was needed to fully vet the information on the accounts. rovided some machine translation but was unable to translate text on images and had trouble with translating hashtags. can only provide translation for Arabic; other language populations would have to be added to the tool for any future caseloads. hel @opulation continues to present unique challenges. Based on initial analysis, manyEdo not appear to have social media accounts of any kind. From th nalysis, it was? suggested that eliciting social media accounts may assist in the social media screening process. Based on analysis in this pilot, elicitation may also encourage applicants to edit accounts, remove derogatory information, increase privacy settings, or abandon accounts altogether. While having elicited account information assisted in con?rming accounts, of?cers were still unable to review content in many of the elicitation cases. It is unclear if applicant privacy settings were changed as a result of the elicitation or if the accounts were always private. Timing xtr-acts is critical. The data from is a spreadsheet extracted to conduct Interagency Checks. The spreadsheet shou tweaked to meet the needs of social media queries, including the addition of pictures for each applicant, and the inclusion of ALL known email addresses, aliases, related phone numbers and addresses, and elicited social media handles, user names and URLs (if applicable). Given that thi Idata in?Iis a static, one-time extract, of?cers had to review Ewith every case to ensure they had the most up-to-date information. 9 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 7. HAG use has limitations. In order to fully evaluate an applicant?s social media, of?cers must Visit the social media platforms through the HAG to review the content. The HAG has a number of limitations: 0 It only uses the Internet Explorer Web browser, which prevented FDNS of?cers from using it in combination wit 0 It restricts the normal copy/paste function going into and out of the HAG. This requires users to manually enter information, such as complicated URLs, which can lead to mistakes. 0 Of?cers were occasionally identi?ed as potential bots-and were asked to con?rm CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) images in order to proceed with searches. 8. Tools matter. 0 Eattempts to automate the account identi?cation process proved largely unsuccessful. 0 Providing elicited data toEdid not incl rove outcomes in an wa . 0 Of?cers found reliable results usin? However ipublic search engine temporarily blocks out users who conduct repeated queries in a short period of time.? The HAG has limitations that were not experienced by the initial pilot team using DHS open network. idoes offer business solutions that may mitigate this challenge. 10 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive 10 For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional APPENDIX A :Platform Details Ehas a simple user interface with four main tabs: Dashboard, Online Persona Resolution, Derogatory Resolution, and Report. Dashboar_d Dashboard allows a user to search for all available cases that have been ingested by the too . I The Dashboard also has two lists of cases: My ln?Progress Cases and My Completed Cases. Any cases that have been recently manipulated will appear in the My In-Progress Cases side of the platform.12 Online Persona Resolution Once a user clicks on a case Imoves to the Online Persona Resolution page. This page has many features and presents a wealth of applicant information: 12 Due to a glitch in this tab during the pilot, FDNS of?cers noted that cases appeared as ?in progress,? even after the of?cers had reviewed all of the accounts and social media posts associated with the case. After FDNS informed the DARPA team, they added a. ?Completed Case? button that allowed of?cers to manually mark the case as completed. 13 FDNS of?cers were unable to utilize these links due to current USCIS policy and the inability to accesri iria Internet Explorer, which is the only search engine supported by the HAG. 11 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive 11 For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional Derogatory Resolution The Derogatory Resolution tab includes some of the same features of the Online Persona Resolution Tab as well as additional features: 12 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive 12 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional Although FDNS of?cers did not utilize the Report tab during this pilot, it represents the final step in theEwork?ow. It is acceSSed after a user scores (or ?resolves?) all of the social media posts attributed to the Potential Matches. Report The Report tab offers a number of features: The Report tab is a summary of the work completed in the prior tabs. At the present time, there is no function to export the results, or View the results in the aggregate. 13 DRAFT/Pre-Decisional For Of?cial Use Only Law Enforcement Sensitive 13 OFFICIAL USE ONLY DELIBERATIVE AND PREDECISIONAL DRAFT Social Media Elicitation Plan applicant Pilot Concept of Operations Tasking As requested by the National Security Council staff, United States Citizenship and Immigration Services (USCIS) and the Department of State (?State?l I have been asked to develo a 'oint Conce of Operations (CONOP) to pilot the elicitation of social media identi?ers ofl Iunder consideration for resettlement through the United State in an effort to include this additional data element as part of the inter-agency refugee screening process. Background There are Currently over 100 mobile social networking platforms that are active and known to USCIS and State. Additionally, these platforms may be collectively referenced interchangeably by various terms, such as: social media, blogging, .micro-blogging, photo-sharing, etc. For the purposes of this pilot, these platforms will be collectively referred to as ?social media.? As the pilot progresses and more information is learned about this Capability, this set of speci?c social media platforms may grow or shrink depending on utility identi?ed. During the pilot period, applicants will be asked to provide their username or ?handle? for these various social media platforms by the State contracted at the time of pre- screening. These additional data elements will be? captured and stored within State?s I These data points will be forwarded by State to various organizations that? support the for screening and vetting. The pilot "will focus on assessing: (1) standard procedures for collection; (2) the method for dissemination of collected data to the organizations using the data for screening and vetting; (3) the value of social media screening, including whether derogatory information is obtained; and (4) the time expended on collection and screening, to inform a workload analysis in the future. Outline of Approach This CONOP provides the implementation details for launching this pilot, including: What is collected speci?c data elements); 0 Who collects the information; 0 Scope of the pilot; and 0 Where, how, and at what point in the process will the collected data be sent for screening. What to Collect: There are dozens of social media and platforms, and the social media landscape is constantly evolving and changing. However, for the purposes of the pilot, theEwill focus OFFICIAL USE ONLY DELIBERATIVE AND PREDECISIONAL DRAFT Page 1 of4 February 19, 2016 14 OFFICIAL USE ONLY DELIBERATIVE AND PREDECISIONAL DRAFT on collecting usemames and handles for a few commonly used platforms according to independent research and intelligence community reports: Facebook, Twitter, Instagram and YouTube. To aid collection, making a list of the social media platforms and symbols available to applicants during the collection process may assist in their understanding of the specific information being sought. This would give the appliCant the opportunity to be presented with the symbol of the platforms requested, allowing for a visual interpretation not just a verbal prompt. However, even with this assistance, it is important to note that in many cases individuals may need additional explanation/support that will lengthen pre-screening times. For example, in most cases applicants will not know their Facebook usemame identifier, and may need to either use their phone or help the caseworker locate the account on their computer in order to retrieve the information. Social Media Networks Facebook I 7' Twitter Instagram YouTube Who Collects the Data DStaff: The Z who has applied to 'be resettled in the United States is ?rst prescreened by thel: which consist of non?US. Government personnel funded by State. This prescreening includes the collection of biographic data, such as names, aliases, document numbers, contact information, and addresses. The benefits of having :staff collect social media identi?ers at the beginning of theEadmissions process include: Maintains consistency in the collection of applicant identifiers used for screening; Ensures information is collected at the earliest point in the process, allowing social media screening to occur simultaneously with other parts of the process; 0 Provides relevant information to the EOfficer for exploration at the time of the status interview; and - Provides opportunity fori to provide potentially exculpatory explanations, because theEOfficer could raise social media concerns at time of interview; In additionl :collection of the social media data at prescreening is likely to be perceived by the applicant as simply an intake of data, rather than a ?vetting? procedure. State with the assistance of USCIS will update any required guidance td :staff to collect information related to social media handles, ensuring thaC'staff accurately captures the OFFICIAL USE ONLY DELIBERATIVE AND PREDECISIONAL DRAFT Page20f4 7 8 February 19,2016 15 OFFICIAL USE ONLY DELIBERATIVE AND PREDECISIONAL DRAFT information of interest and is also prepared to provide reasonable explanations justifying this collection in the event applicants ask why such information is required and how it will be used. The collection of social media information at prescreening will extend the amount of time it takes for thDo interview the applicants. The pilot will include a plan to track the amount of time that the collection of social media information adds to the pre?screening stage and whether it impacts the number of cases that an Dcaseworker can interview per day. Additionally, it will be important to track the impact that the screening, translation, and analysis portion have on overall program ef?ciency. Pilot Scope: The pilot phase of this project will be focused on a discrete population and implemented in one processing location in order to identify best practices, understand workload implications, assess value, and ensure any appropriate modi?cations are made before a decision is made to apply the process to a broader population. As such, the pilot will take place during a one week period i" Based on the planned circuit ride schedule a one week sample will yield approximately ases and approximatel Idepending on case size. This sample will allow for a statistical representation from various nationalities to include high risk populations such as nationals. The Specific timing of the pilot is dependent on when technical changes to can be. completed. State estimates that these technical changes will take approximately 30 days; therefore, the pilot will likely beginthe beginning of Q3 at the latest. Pilot Logistics: During the pilot period, the will collect the user names and handles for each applicant and enter the information into Once the information is collected, PRM Will produce a report extract which includes the social media data, along with all the additional identifiers associated with the Interagency Check data. fields. Note that applicant information may need to be translated so that it can be entered into: which does not accept non? alphanumeric Characters such as Arabic. TheDwill keep track of how many of the cases prescreened during the week of the pilot presented social media. handles in Arabic that required transliteration. I IPRM will instruct th Ito place all cases in this pilot on hold pending receipt of results. USCIS and State are requesting that results be provided back to USCIS and State within 30 days of receipt of data affirming whether there is a positive match to possible derogatory social media information. Cases identified as not relating to information of concern would be released for normal processing, while those with potentially derogatory information would be reviewed closely to ensure accurate determinations are made on their ability to continued seeking admission to the United OFFICIAL USE ONLY DELIBERATIVE AND PREDECISIONAL DRAFT Page 3 of 4 February 19, 2016 16 OFFICIAL USE ONLY DELIBERATIVE AND PREDECISIONAL DRAFT States. There may be an additional resource need for translation of matches and results. This pilot may impact the number of cases presented to USCIS for interview in Q3 if there is a delay longer than 30 days in receiving responses for this pilot. Next Steps: - PRM will begin the technical changes to Eto collect the information - USCIS, in conjunction with DOS and its screening partners is developing guidance and procedures for the collection and transmission of data as well as communication of the results. These procedures will take into account any legal and polic issues to maintain consistency with the processes developed for the three previous ?social media pilots. - PRM and USCIS is working with screening partners to establish a process for transmitting data and communicating results, which for the pilot will likely be manual. - PRM and USCIS, in conjunction with USDS, will develop an assessment tool to record ?ndings, develop a workload analysis, and make recommendations for changes and future expansion, as appropriate. OFFICIAL USE ONLY DELIBERATIVE AND PREDECISIONAL DRAFT Page 4 of4 February 19, 2016 17 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional U.S. CITIZENSHIP AND IMMIGRATION SERVICES REVIEW OF SCREENING SOCIAL MEDIA PILOT Fraud Detection National Security Directorate 16 March 2016 18 For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 50-50 RevieW3 Pilot Overview The Department of Homeland Security (DHS) asked United States Citizenship and Immigration Services (USCIS) to examine the feasibility of using social media for screening applicants. USCIS sought to determine if reviewing the social media presence of these individuals could provide useful information for adjudicating their applications, and gauge .how resource intensive this screening could be. While USCIS had used social media in a limited capacity for the enhanced vetting of certain it does not have any experience in using it as a large scale screening tool. The agency therefore decided to approach this work as an open-ended-exploration with very ?exible research parameters. The team supporting this pilot utilized an adaptive approach to create, implement, and continually revise its social media screening procedures. as a Screening Platform Starting in December 2015, a team of USCIS personnel worked closely with DHS Science and Technology to establish a pilot leveraging a commercially available tool for social media screening. After reviewing more than 16 different companies and their existing data analysis capabilities, experts selectedEfor the pilot. worked with DHS OGC and to execute a I to support joint experimentation with social media analytics. selected thi IsOcial media analytics platform due to its coverage of al Of note, due to restrictions Facebook has placed on its Application Programming Interface (API) (and many other social media tools) is unable to screen social media content posted on that. platform. While other government agencies are usin Ino agency has evaluated its use for mass screening. Therefore, this pilot utilized an iterative approach that enabled the team to begin identifying technical limitations and 2 19 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional desired enhancements to tailoEto better ?t unique screening requirements. Additional enhancements to the tool were implemented on a weekly basis throughout the pilot. Methodology USCIS identi?ed applicants the 50'5.0 population) to serve as the focus of this pilot. These cases were processed throug using a three-step methodology: 1) Identify social media accounts; 2) Collect social media information using Data Streams;1 and 3) Review and analyze ?ltered results.2 Parts of the process were repeated as technical improvements and lessons learned were identi?ed and applied. Identify Clleot These results are referred to in this paper as social media documents (such as a. Twitter or lnstagram post). Each document is reviewed to determine whether it has any linkage to a member of the 50-50 population. 3 20 For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional Social Media Presence and Platform Utilization In Step 1, the identi?cation phase, Of?cers closely examined the overall social media presence of the 50-50 population. Of?cers determined that: thad con?rmed social media accounts, which accounted forDtotal accounts. 0 :had a likely social media account but due to privacy settings and platform restrictions this match was unable to be con?rmed. a :had possible accounts that could not be con?rmed because they did not clearly relate to the applicant, which accounted for?otal accounts. . : had no identi?ed social media accounts. Note: A subject could have multiple social media accounts, which could be determined as con?rmed, likely, or possible. In terms of actual confirmed social media accounts associated with the 50-50 population, Facebook was the most popular platform. See the table below for additional information about platforms associated with the 50-50 population. Con?rmed Likely but Uncon?rmed Possible but Uncon?rmed Note: As with the K-1 pilot, the 50-50 results do not incorporate social media osted on Facebook, due to limitations preventing third parties from collecting its Ionly collects on platforms that allow collection Results In keeping with the adaptive learning approach, USCIS ran the 50-50 population through the screening process multiple times to I This was aided by nature oi data collectlon and retention capabilities 1 IThis data may then be re-screened using to determine how it impacts the number of social media documents returned. 21 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional Round 1 Endin 3/3/16) Average Time, Step 1 97 mins. Average Time, Step 2: 3 days Average. Time, Step 3: 42 mins. Median Time, Step 5 mins. Round 2 (Endino 2/14/16) Average Time, Step I 45 mins. Average Time, Step 2: 5 days Average Time, Step 3: 22 mins. Analysis ofResalts Members of the 50-50 population had minimal presence on the U.S.-based social media platforms accessible throug Beyond that baseline ?nding, each round of screening yielded valuable insights to inform technical, policy, and programmatic decision- making. To help ensure consistency With the approach used in thel I pilot, Officers recorded the same metrics to evaluate each social media document associated with a member of the 50-50 population: 0 Filter Category 0 Social Media Platform 5 22 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 0 Translation Time Required (Where machine translation did not adequately translate into English) 0 Con?rmed Social Media Account Round 1 Round 1 identi?ed a number of key results: 0 No derogatory information was attributed to any member of the 50-50 population. 0 Onlyl Ihad a con?rmed social media account (lnstagram) that returned documents via: ?lters, though, as previously stated, this account was determined to not have derogatory information. Of the ocuments associated with this applicantJ I I The average review time for each document was: approximately 1 minute, 40 seconds. 0 One hundred and eighty documents required human translation. On average, these documents required 1 minute and 20 seconds to resolve. I Iwho was very active on Instagram, was responsible for 141 of the 180 documents requiring translation. 0 The median number of documents per applicant was 1 (which would require 1 minute, and 40 seconds to review), with the average number of documents being 24 (Which would Round 1: Document require 40 minutes to review). bV Platform Nearly half Def the 50-50 returned no social media documents when ?ltered through the I '?5tagram The remainingDsubjects returne Twitter documents when ?ltered through th' the i Vimeo vast majority of which were not related or linked to Flickr the subject. Only one of the 50-50 subjects had a con?rmed social media. account that contained 5 6003'? material that matched filters. VK I El Web Approximately of social media documents Ll FI-as-hpoint ?ltered through th came from YouTube, followed by lnsta ram and Twitter Similar to the pilot result Round 2 The reduced set of I I coupled with improvements i API matching, led to a major reduction in social media documents returned during Round 2. Key results included: 23 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional Lessons Learned piloted the use oi: for over ten weeks testing capabilities, ?nding bugs, developing enhancements, learning about our'applicants? use of social media, searching for derogatory information, capturing metrics, and demonstrating use cases to decision makers. With each week, the Pilot team continued to improve its ability to utilizcl:to screen social media, Many of the lessons learned derived from the licable to the 50-50 population, includin In addition, a number of distinct lessons have been learned, which can shape What social media vetting can look like in this setting and in future scaled-up operations. 1. The Ipopulation presents unique challenges. 0 Based on the results of this pilot, theEpopulation may have a minimal footprint on common social media platforms. Those over age 60 and those under age 10 can be expected to have little social media presence, and the remainder may be active on platforms other than those collected by I Iremain the best elements of applicant data for identifying and con?rming social media accounts. Eliciting this information and speci?c social media account handles fro applicants should assist the social media screening process. 24 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2. Timin of EExtracts is Critical. [leiqspreadsheet should be tweaked to better facilitate social media screening of including the addition of pictures for each applicant, and the inclusion of all known I In at least two instances, Of?cers found new email addresses for applicants in a week or two after they had already screened the subject through timing of the extracts is critical. 3. Filtering for Relevant Information is Essential. for the 50-50 pilot. These were re?nedbetween rounds and yielded progressively better results. Based on lessons learned in previous pilots, Of?cers used custom-buil Conducting English?Ian ua bio raphic searches (First Name, Last Name) proved unhelpful for both thi iand 50?50 pilots. Biographic-based searches can be useful, however, if performed in the applicant?s native language, such as Arabic, since it returns more accurate results (The name Mohammed can be spelled dozens of ways in English, for example, but only one way in Arabic). For this pilot, that required a linguistic expert to enter each name in Arabic into the: 4. Social media screening bene?ts from of?cer continuit . Using the same Of?cer for each step of th brocess (Identify, Collect, and Review) is more effective and ef?cient versus having a different person be responsible for different elements of the process. By conducting Step 1, of?cers quickly become familiar with each individual?s personal information bio ra hical information, familial relationships, etc.), which enables them to build for collecting in Step 2. In order to accurately assess the results returned as part of Step 3, an of?cer. needs to be intimately familiar with the facts of the case. 25 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre?Decisional 2 26 5:15pm version U.S. CITIZENSHIP AND IMMIGRATION SERVICES REVIEW OFEIADJUSTMENT 0F STATUS SOCIAL MEDIA PILOTS 26 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version (7) Executlve Summary USCIS examined three techniques to screerl adjustments of status cases: manually searching social media sites; using a commercial application] Iscores to select cases for manual review; and using another commercial application:, to ?lter social media information, I through DHS USCIS has determined that neither of these techniques are ready for use in large scale social media screening. While the team using about social media and has become more ef?cient, I I USCIS recommends continuing research and development on and other services and tools to build the capabilities necessary for screening on the large scale envisioned and; until such capability is delivered; Other lessons learned: has learned many signi?cant lessons 0 Manual reviews take USCIS personnel about 1.5 hOurs. This time is contingent on the particular platforms to be reviewed and the type of identifying information available pertaining to the subject. I Emake it easier to locate social media accounts and may reduce processing time. 0 Social media screening requires dedicated, and preferably on-site, language support. 0 Close collaboration between SMEs, USCIS of?cers and: technicians led to rapid improvements in the technology and its use. 0 Photos contained in government systems also helped con?rm identities When photos on the social media site are available. 27 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version Derogatory information found in other government systems can provide a more complete picture of the applicant?s background and risk pro?le. Identifying potentially derogatory social media records is only one step in the adjudicative process. 0 USCIS must determine how evidence will be used to reach an adjudicative decision. 0 USCIS must determine how it can share the evidence that it collects with other internal DHS components, other federal agencies, and state and local law enforcement. Social media research on USCIS applicants falls into three discrete steps: 0 Use all available information to identify social media accounts pertaining to the applicant; 0 Collect content from the pertinent Social media platforms; and 0 Analysis the content to identify information that Will impact USCIS decisions or other actions. is a highly capable USCIS partner and can establish operationally relevant technical capabilities to address emergent requirements for operational organizations 0 Effective pilot operations can be created by combining and USCIS authorities coordinated Department level approvals for the pilot and rapidly established a Privacy Impact Assessment to complement USCIS privacy policies Within several days . made space, equipment, and expertise available to work with immigration officers and accommodate pilot operations in 2 days. 28 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre?Decisional 2 26 5:15pm version 29 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version Introduction The Department of Homeland. Security (DHS) asked United States Citizenship and Immigration Services (USCIS) to examine the feasibility of using social media to screen individuals in the United States who entered vial Ivisas and who are now seeking adjustment t4 status. USCIS sought to determine if reviewing the social media presence ofDWduld provide useful information for bene?t adjudication and how resource intensive the screening would be. While USCIS had used social media in a limited capacity for the enhanced vetting of certain :it did not have any experience in using it as a large scale screening tool. The agency therefore decided to approach this work as an open-ended exploration with very ?exible research parameters. USCIS identified a population of approximately eeking adjustment. Each of them Adjustment of Status pilots studied part of this population. The teams supporting each pilot were granted limited autonomy to create, implement, and continually revise their own social media screening procedures. 30 For Official Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version Manual Reviews and I at the National Bene?ts Center Manual Reviews The USCIS National Bene?ts Center (NBC) is a central hub for the processing and adjudication of many immigration bene?t requests, which includes the screening and vetting of the applicants. USCIS took advantage of this expertise and had the NBC Fraud Detection and National Security Immigration Of?cers (IOs), Supervisory IOs (SIDS), and an Intelli ence Research Specialist look for and review social media accounts related th med adjustment toD statusl. Using the High Assurance Gateway, the NBC used biographic information available in the A-file I Ito search Facebook, Twitter, and Google for social media accounts. NBC personnel started each search with nonimmigrants seeking I The NBC only detected social media accounts forEnonimmigrants. The NBC reviewed the parts of the social media accounts visible to the generalpublic (they did not ?friend? or ?direct message? anyone) and tried to ?nd records that could potentially impact the adjustment of status application. The personnel chose a very expansive approach to In addition, automated translation tools were not able to translate foreign language writing in picture and Video ?les nor spoken words in Video and audio ?les. Onl nonimmigrants that had social media accounts had potentially derogatory social media records related to national security or public safety despite the notably low threshold for being ?agged. 1 This pilot was ended afterDreviews because NBC personnel were using their own personally identifiable information to create accounts to log into Facebook. NBC personnel relied heavrly on biographic information pulled from the iollowmg forms: DS-156 (N Visa Application); DS-2054 (Medical Exam for Immigrant or Refugee); DS-230 (Application for Immigrant Visa and Alien Registration); 1?693 (Report of Medical Exam and Vaccination Record)?i and 1-94 (Arrival and Departure). 31 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version I I Manual reviews require a signi?cant time investment. USCIS staff at the NBC exploredE I Ito determine if it could be used to automatically detect which cases have social media accounts in order to avoid spending time investigating applicants with no social media presence. When searching for an individual, theEwill signal, on cale, the con?dence in having found the: right person and the recentness of the data. A Reliability score of? indicates high con?dence; a Reliability score o? indicates low con?dence. Likewise, a Relevance score 0 indicates high probability of current actionable information. For example, returning aEIscore ?would indicate successful entity resolution but out of date location information. A score 0 indicates high con?dence at identifying information on the entity of interest and recent social media information on that person. Cases wit scores should be less likely to have social media. than those with scores. Among the ases manually reviewed by the scores of Among these,D had scores 0d] andUhad scores 01?: 0 Among theEscores, upon manual review? 54%) had no detectable social media accounts and 15%) had potentially derogatory information. 0 Among the scores, upon manual reviewD(47%) had no detectable social media accounts an had potentially derogatory information. LIL While this is a very simple comparison, it suggested that USCIS will not be able to leverage _cores to meaningfully prioritize screening efforts without signi?cant changes to the technology. In anua 2016,. NBC reviewed an additionachases with Escores. NBC also reexamined the scores from an earlier review in December 2015, this means NBC personnel manually reviewed a totachases with 3 scores. - Among the scores, upon manual reviewD had no records had potentially derogatory information. The additional case reviews did not establish that] cores are a reliable indicator pointing toward a social media presence. Furthermore, NBC was often able to locate a social media presence fod:l scores. TheDscores andElscores had similar proportions of potentially derogatory information under the broad de?nition used at the NBC 32 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version USCIS language support. staff provided translations of social media records for some cases ?agged as potential national security concerns. Each translation took about 3 hours4. While the translations resolved some potential issues, most were not, as shown in the table below. If USCIS of?cers need to determine which social media records are potential national security concerns, and which are not, they will need training and clear guidance. Effect of Translations on Potentially Derogatory Information Final Steps The NBC will collect and review all necessary translations, work with partners in law enforcement and intelligence to determine if the social media records are still potentially derogatory, and then work with other USCIS stakeholders to determine how to resolve potentially derogatory social media records for adjudication. Lessons Learned 0 Of?cers took about 1.5 hours to locate and review social media accounts. 4 Social media records are an unusual workload for the language support staff and many documents Were dif?cult to read due to image quality. 33 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version Automatic foreign language translation was not suf?cient. Additionally, USCIS language support staff spent about 3 hours on each case that needed translation. Identity veri?cation is crucial. If USCIS cannot prove that an individual is the account owner, the evidence cannot be considered in adjudicative decisions. I scores are not ready to be used to prioritize manual reviews. The search parameters will need signi?cant changes in order to better identify social media accounts and to triage social media records for review. Of?cers will need clear guidance on What type of social media records are potentially derogatory and worth further investigation, and if determined to be derogatory, how to use that information. Derogatory information found in other government systems. can provide a more complete picture of the applicant?s background and risk pro?le. Of?cers will need clear guidance on. how to share potential concerns with colleagues in law enforcement. 34 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version I lPilot :as a Screening Platform Starting in December 2015, a team of USCIS Immigration Of?cers worked closely with DHS Science and Technology to establish pilot operations and begin to develop baseline requirements for social media screening, utilizing currently available social media data analysis capabilities. After reviewing more than 16 different companies and ca abilities, experts selecte or the pilot. worked with DHS OGC anbto execute a support joint experimentation with social media analytics. selected thel [social media analytics pl-athrm due to its instant coverage of a Data retention policies are automatically enforced and can be con?gured per data source or user. While other government agencies are usingl Ino agency has evaluated its use for mass screening. Therefore, this ilot utilized a cooperative, iterative approach that enabled the team to revampbto better ?t its unique screening requirements. Personnel from USCIS and identi?ed technical limitations and desired enhancements to :technicians, which were generally resolved or implemented. Additional enhancements to the tool continue to be implemented on a weekly basis as the joint pilot operations continue. According to: this process had the added bene?t of improving the platform for the law enforcement and intelligence community partners already using the tool. Methodology After a review of an initial population of approximatelyi Iad'ustment applicants against :resulted mg results, USCIS prioritize interview-ready cases from that population for review. Th cases were processed throughEusing a three step methodology: 1) Identify social media accounts; 2) Collect social media information; and 3) 10 35 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version Review and analyze ?ltered results. Because this pilot was breaking new ground, using an advanced social media analytics capability, the methodology was under constant re?nement. Parts of the process were repeated as technical improvements and lessons learned were identi?ed and applied. Step I ?Identijjz Step 2 Collect Step 3 Review 5 PresentlyErelies on the websiti to generate People Search results. is current identifying additional data sources to enhance 1 eop 'e Search function, including 11 36 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version Results In keeping with the iterative learning approach described above, USCIS ran the applicants through the screening process multiple times, primaril to an ethe impact of re?ning th I This was aided by the nature o?ata collection and retention capabilities once an initial collection is performed on a givenE This data may then be re-screened usin_to determine how it impacts the number of potential social media matches returned. Round 1 (Endin 1/21/16) Average Time, Step 1: 2 hours" Average Time, Step 2: 5 days Average im-e, Step 3: Round 2 Endin 2/13/16 Average Time, Step I I Average Time, Step 2: 12 hours9 I I 6 In this instance, due to a software error, the returnsl I 7 Officers were instructed to take no more than two hours for Step 1, although some cases took less time. 8 Officers relied on the Step 1 results for rounds 2-4. mere 12 37 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version Average Time, Step 3: 1.2 hours i Average Time, Step 1: Average Time, Step 2: 24 hours Average Time, Step 3: (Ending 2/13/16) Round 3 :is able to store results and rounds 2-4 rescreened these results using the smaller: thus the Step 2 times are artificially shorter for Rounds 2-4. 13 38 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version Round 4 (Ending 2/23/16) Average Time, Step 1: Average Time, Step 2: 12 hours Average Time, Step 3: 68 mins Median Time, Step 3: 28 mins Round 4 In Depth The dramatic reduction in social media matches retu Round 4 enabled Immigration Of?cers to essentially redo the Step 3 process for. the while capturing a number of critical metrics to aid in evaluating the pilot?s accomplishments. For each social media match, Immigration Of?cers recorded the following: 0 Filter Category Social Media Platform 0 Translation Time Required (where machine translation did not adequately translate into English) 0 Confirmed Social Media Account Round 4 identi?ed a number of key results: 0 No derogatory information was attributed to (i applicant10 or petitioner 0 Only enci? applicant social media account returned matches via :?lter. These matches were linked to innocuous Instagram posts that featured common words I I The average review time per potential match was two minutes. 0 OnlyEmatches required human translation. On average, these matches required 1.5 minutes to resolve. One match, however, led to a social media account possibly linked "to Dapplicant, which contained numerousEvideos that required approximately two hours of translation. The median number of potential matches per applicant was 14 (which would require 28 minutes to review), with the highest number of potential matches being 198 (which would require 2 hours and 30 minutes to review) and the lowest number being 0. 10 This result is validated by the (non-social media) retrospectiveDeview conducted by NCTC that found no derogatory information. 14 39 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version Round 4 Social Media Pla?orms Somi Iof matches, the largest group, came from YouTube. Missing from this pie chart is Facebook, due to its corporate decision to prevent third parties from collecting on its API feed. only collects on platforms that allow collection Social Media Potential Matches To address this shortcoming, Immigration Of?cers used to identify potential Facebook accounts for th _applicants and their petitioners, and then manually reviewed each of them, where privacy settings allowed. By clicking on the cover photo of the account, Immigration Of?cers were occasionally able to review other photos, albums, and mobile uploads. Potentially derogatory information was discovered on one of meal applicants through this manual review I I I In addition to reviewing each potential match returned by data collection process, Immigration Of?cers also more closely examined the overall social media presence of thei YouTube a Instagram El Flickr [1 Twitter a Google+ 1 Pastebin El VK Web their petitioners (see igur-e J). Approximatel?f them or their petitioners, had con?rmed social media accounts A social media account ?is considered con?rmed when it contains Social Media Platform Accounts identi?ers that match Confirmed i Likely I Possible an applicant?s data, Some applicants have pro?le pictures Figure 1 of themselves, which facilitates this process. Others choose stock images or landscapes for their pro?le pictures, making it dif?cult to con?rm the account without substantial other evidence. ofthe? media accounts are found by using applicant informationl the account or veri?cation of the images. 15 :or their petitioners, had likely social media accounts. Likely social but privacy settings or platform restrictions prevent the of?cer from full con?rmation of 40 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version or more of thEor their petitioners, had possible social media accounts. Possible social media accounts are those where the applicant?s biographic information matches that of a social media account, but there are no other data points available to make an informed determination. of th?i :had no accounts identified by this process. The applicants may not use social media, or the applicant may have such a common name that con?dent identification of the account is too labor?intensive. Privacy settings set by the applicant may also impact whether social media accounts can be identified or con?rmed.11 Lessons Learned The Pilot Cell has been usin Ifor nine Weeks testing capabilities, ?nding bugs, developing enhancements, learning about our appliCants? use of social media, searching for derogatory information, capturing metrics, and demonstrating use cases to decision makers. During this time, a number of significant lessons have been learned, which can shape what social media vetting can look like in this setting and in future scaled-up operations. 0 Optimal results come from richer and more re?ned data sets. 0 US. government metrics and vernacular, such as a receipt number, are not useful for either identifying social media accounts, nor are they discussed on social media. 0 Common names and famous names are noisy. Richer data sets upfront reduce officer ?swivel chairing? between US. Government holdings and commercial databases for additional leads to identify accounts expediting Step 1 in the Babel Street process. 0 Filter management is key. 0 This pilot began with a data call to USCIS components forI I I Iwere collected, provided to and uploaded inth I The result was 2.4 million potential matches to the applicant pool, and it bogged down the accounts, exceeding the initial thresholds established for the pilot. 11 Restrictions on the Facebook API may have also affected the officers? ability to confirm accounts. 16 41 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version I I should aim to reduce potential matches and identify truly derogatory information. 0 Choosing Ithat generate false positive results (cg. social media matches with no actionable information or relevance to the applicant) may caus to miss truly derogatory information. 0 New ?lters with relevantI Itailored to the target population?s socio-cultural characteristics, will need to be tested and analyzed. 0 Account restrictions inhibit success. 0 At the present time, of?cers are unable to log-in to the various social media platforms, and can only see what: is 1) public, as set by the applicant and 2) public, as available by a search in the platform. 0 The team will be able to more easily and accurately confirm accounts with access to the social media platforms. 0 You have to choose the right social media platforms to search. 0 :has API feeds tDsocial media sites plus deep and dark web. 0 The team decided in the beginning to select ALL available platforms to screen our applicant information against. 0 Based on thistil'ot, Facebook is potentially a rich source of social media for USCIS a lic?ants. Barring changes to Facebook?s API restriction, however, land similar social media analyzers will not be able to provide an automated data collection capability for Facebook accounts. - More than just translations are needed for foreign language records. 0 WhilEhas machine translation capabilities, at times the translations are imperfect and require human review. Subject matter experts who can comprehend the essence of videos, postings, text, and other various media, and who understand cultural, religious, and colloquial terminology, must be available in either a reach-back capacity or onsite to facilitate this work. 0 Having said that, onlyDof :potential matches required additional human translation, and only one required extensive review. 17 42 For Of?cial Use Only Law Enforcement Sensitive DRAFT/Pre-Decisional 2 26 5:15pm version 0 Developing a list ofl I ay help reduce noise and find truly derogatory records. 0 Close Collaboration with technicians rapidly improved capabilities. The USCIS team has been in constant contact with experts an: technicians to develop new capabilities related to our unique mission and evolving use case. Of?cers have helped to develop ?user stories? an :has conducted testing and implemented changes to their platform. translated technical requirements and needs to :for implementation. This type of close collaboration in an open research environment is the main reason for the rapid reduction in social media record matches. 0 is working through automated interface standards so that: and other social media tools can interface directly with USCIS system. This work is advanced and will accelerate potential future implementation of automation for screening and vetting work?ows. The collaboration resulted in 17 major ?xes: and enhancements to: and another 23 are in progress, 18 43 For Official Use Only Law Enforcement Sensitive m- m- i US. Cit1zensh1p a and Immigration Services September 16, 2016 Brie?ng Paper/Way Forward Social Media Screening Source: US. Citizenship and Immigration Services? (U SCIS) Fraud Detection and National Security Directorate (FDNS) and Refugee, Asylum and International Operations Directorate (M10) Problem or Issue: . A case of interest has arisen related tol land social media screening. This document provides a high?level overview of the case, FDNS social media screening efforts to date, and the lessons learned from this case. It also charts the way forward with FDNS social media screening based on these lessons learned, taking into account USCIS resource and other constraints. -, For Of?cial Use Only Law Enforcement Sensitive more 1 For Of?cial Use Only Law Enforcement Sensitive Social Media Timeline: From late 2014 through June 2016,? participated in six pilot programs with interagency partners on the proof of concept of leveraging social media in the screening of Ebene?t populations. 0 On July 10, 2016, stood up a Social Media Branch to leverage the work of the pilots and incorporate social media cheeks into routine refugee screening for certain limited populations identi?ed as high risk. 0 Focus of Screenin RAIO and FDNS have collaborated to provide for enhanced review of certairbcases as well as who have had possible national security concerns identi?ed during or after initial interview. Challeng? es: Finding an account when the applicant does not provide all selectors is an intensely manual process, not well-suited to screening large volumes of applicants. A case like this one would have required For Of?cial Use Only Law Enforcement Sensitive more 2 45 For Of?cial Use Only Law Enforcement Sensitive Adding processes? hke this ?to the current screening revrew would likely move processing time up to an estimated three to four hours per case rather than the current rate of one hour per case. Restrictions on USCIS ?s use of social media impact our ability to search certain social media sites. USCIS uses a number of different ways to search relevant social media sites, but some sites block otherwise publicly available, relevant information from investigators, unless the investigator has an account. Facebook, in particular, only shows a limited amount of information and makes searches more dif?cult if the user is not logged into a Facebook account when searching. I I Carrertt social media review process is time? and. labor-intensive. While USCIS relies on an automated tool to identify social media activity, reviewing the social media information is a very manual process, even with the automated tool in use, and is different from most other screening conducted on immigrants. other screening processes those unrelated to social media) rely on records created by law enforcement or intelligence community partners in databases searchable on identifiers provided by applicants. Each record in those systems is created with the intention of notifying others in the law enforcement or screening communities (including of particular activities or other issues of concern. Social media information is created for very different purposes. When a user creates a Facebook post or Twitter message, it almost never takes a form naturally suited to screening purposes. As such, all information uncovered must be manually reviewed to determine how, if at all, it could impact adjudication. This manual review renders the social media review process a relatively time-intensive operation in terms of staff hours required to conduct reviews, and an expensive one in terms of salary and related costs. Based on current staf?ng projections for the immigration of?cers conducting the review, as well as the leadership and support staff required to support the team, the personnel costs are, on average, approximately $48.70 per person screened in social media.1 This includes costs associated with training and overhead, but does not include licensing costs for the automated software.2 If 1 By way of comparison, the average cost for an FBI Name Check is SIS/person, and an FBI Fingerprint Check currently costs $12.75/check. As of October I, 2016, FBI Fingerprint Check costs will decrease to $10/check. 2 Social Media Branch comprises approximately twenty full time employees, including Immigration Of?cers, Supervisors, Intelligence Research Specialists, and Management and Program The annual yearly cost is approximately $3,000,000. For Of?cial Use Only Law Enforcement Sensitive 3 46 For Of?cial Use Only Law Enforcement Sensitive additional manual processes were added to the social media check, throughput would go down, and the costs of screening per person would rise. Options for Process and Systems Improvements: 1. Proposed Populations for Expansion:3 3 Note that we are currently 0 eratin under the assumption that we will have an admissions target 0 Inext year. inclusive of approximatelyi For Of?cial Use Only Law Enforcement Sensitive 4 l:I 47 For Of?cial Use Only Law Enforcement Sensitive 4 USCIS estimates an need for additional support staff at the following ratios to screeners: Management and Program 1:12 Intelligence Research Speeialiasts 1:12 Supervisory Immigration Of?cers 1:8 For Of?cial Use Only Law Enforcement Sensitive 5 48 Recommendation: For Of?cial Use Only Law Enforcement Sensitive For Of?cial Use Only Law Enforcement Sensitive 6 49 Fraud Detection and National Security USCIS Social Media Update Fraud Detection 81 National Security Directorate January 18, 2017 50 USCIS Pilots USCIS has been developing social media review for casework since FY2015 Diot1: _Denied Cases Di ot2: :Approvec or Denied ICases 3iot3:_ _Pending Cases 3foil: and Diot5szmarily Applicants erationalever Enhanced Reviewand:and 0 Pilot 1 lC, and/or DOD Pilot 2 istonce: IC, and/or DOD Pilot3 Pilot4 istonce: Commercial Tool PilotS 1 istonce:DARPA rational I I Unclassified ll FOUO (For Official Use Only) 2 51 USCIS Progress on We) Social Media Task Force Concept of Operations 1 Launch dates that are TBD are dependent on the implementation and experience with earlier phases. Estimatetalres into atcountsur rocessi inemmanlordan. mepected in a oneeweelt period. Controlled Applica ogram is anadolitional review process USCIS conducts on cases for which national securitv concerns are raised. ?ases evervowo weeks anticipated. Estimates based on historical percentages applied to F?f sols totals. Does NOT assume anv overlap among these individuals and the enhanced cases. This launch date assumed the Center of Excellence was established and operational in August Zillo. 5 Sample is approximatel Total Estimated Nominee of 0 a. 1 lL 1?1 the aunt: Ca?tegorv of Applicant Individuals Per Phase Jr Current Status Eh mere 2 weeks unless speci?ed! Phosel oscmbesors if], Completed Phosel April Milo CompletedT Phase3 rowers Completed August. 2016 {was oouo'ageatoulauuoh oi - CUE l0 3111313011}? Phased ActualLaunc?h: April 2M 7 Apdl 20 ll {capability developed uithiss USCIS Io unpleasant) TED woo: 5 (aootasgeot on launeh ol DOE ill?? or developed stepson? within ososs) Fetal-e Copelailfm Phase 6 (eontiageslt on leuaeh of CUE or developed eopacihr pitiful USCIS) Fofore Copadilitv Unclassified ll FOUO (For Official Use Only) 52 Axis Title Increased Casework Total Social Media Checks Total Cases Total Cases Received and Assessments Written Screened 180 Approx. People 160 Screened Ic?t a ii 140 l; 100 ?33! =G=Total Cases Received 80 mlmTotal SMAsWritten ?Log. (Total Cases Received5962 (jg/Q (ng 06' 06' 06' 06?? 08} $04 [$04 $04 $04 Unclassified ll FOUO (For Official Use Only) 4 53 Team Performance linemen P'meesaing Time Bil Week 1 i am +iliim'n5e Farms-Sing mean-[sal-i-almnnel il "x inn a [4.50 a insnnaae Hamming iimefl?i?nunnl?ilili'?] ?mn?g? Elailfl MEI Iii-Jill Blah." Hing Hep ilwepl?-mii?en Iii-Elli Erick Unclassified ll FOUO (For Official Use Only) 5 54 Three Examples Unclassified ll FOUO (For Official Use Only) 55 For Of?cial Use Only/Intemal Use Onlyl Draft and Deliberative S. Citizenship Updated on: March 2 2017 and Immigration USCIS Social Media Vetting: Overview and Efforts to Date Accomplishments USCIS has implemented a suite of social media checks for certain EpOpulations, establishing a team within Fraud Detection and National Security Directorate to oversee and conduct these checks. USCIS has worked with DHS Intelligence and Analysis Science and Technology as well as partners in the law enforcement, defense, and Intelligence Community to develop tools and techniques for social media research, and continues to improve use of social media for screening and vetting applicant-s. Pilots ilot 1: During Q1 of FY15, USCIS, in collaboration with DHS the Intelligence Community (IC), and/or the Department of Defense (DOD), implemented social media exploitation mm cases. ilot 2: Following the ?rst sample of cases, USCIS sent an additional batch I ases through DHS the IC, and/ or DOD. Pilot 3: USCIS tested the use of a social media tool created by the Defense Advanced Research Projects Agency to screen Pgainst Instagram, Twitter, and dee and dark web. USCIS screened ases (approximately? identi?ed for enhanced screening against the DARP-A tool in order to assess its capabilities. FDNS encountered a number of challenges, limitations, and inefficiencies with the tool and concluded that it does not meet USCIS needs for social media screening. IPilots 1, 2, and 3 Results Although applicant data was successfully used to identify some applicants? social media accounts, the For Of?cial Use Only/Internal Use Only Draft and Deliberative 56 For Official Use Only/Internal Use Onlyl Draft and Deliberative DPiIon Beginning in December 2015, USCIS conducted social media research or: cases in three ways: 1. A ximately Ecases 0D applicants for adjustment of status were reviewed using the ?ommercial social media screening applications under an ICE contract. 0 The sam cases were initially screened with the support of using of these cases that were pending an interview with a USCIS Field Of?ce were subsequently prioritized for analyst review and evaluation. 2. Staff at the I ati nal Bene?ts Center manually searched and reviewed. Twitter, acebook, and Google on djustment applicants. 0 As of June 22, 2016, no adjustment of status application has been denied for social media information. . The results of this vetting, including themreview, 'theEreview, and the manual review, were compiled in a final report at 1 enti 1ed a number of lessons learned and detailed the challenges in utilizing social media for screening purposes. Pilot 4: USCIS ran data from applicants and their family members through a commercial application calle ear January 2016, to screen for social media. The pilot found that this group of individuals had minimal presence on U.S.-based social media platforms accessible throug or other social media appliCations). An analysis of this pilot identi?ed a number of lessons earne . ilot 5: In April 2016, USCIS began another pilot with the applicants, drawn predominantly from th applications have been denied solely based on somal media media screening too to ve populations. As of June 22, 2016, no information found during the pilot. 0 Although the tool was improved from the previous iteration, USCIS determined DARPA 2.0 was not a viable option for semi-automated social media screening. An analysis of this pilot identi?ed a number of lessons learned. Operational Enhancement Semi-Automated Social Media Review: Beginning in FY16 Q1, FDNS instituted a manual Facebook search and review forl leases referred for Enhanced Review. FDNS is continuing this check fOr a1 ases referred for Enhanced Review. On August 2016, USCIS began conducting semi-automated checks of a number of social media sites for Enhanced Review cases and cases with national security concerns (CARRP cases). Since Januwmuai also conducted social media checks on all applicants bein? interviewed i regardless of country of origin. USCIS has screene oveIiE total: applicants with these social media checks. While at this time, 110' applications have been denied solely based on social media information found during ongoing social media review, USCIS Additional Populations: In January 2017, USCIS began exploring the expansion of social media checks to additional populations. FDNS is working with counterparts in the Refugee, Asylum, and International Operations Directorate to expand social media checks to Eapplicants, beginning with those For Official Use Only/Internal Use Only Draft and Deliberative 57 For Official Use Only/Internal Use Onlyl Draft and Deliberative individuals from certain countries of concern. Additionally, FDNS is working to expand social media vetting to certain cases with national security concerns. Each of these programs are planned to be in place by Q3 2017. Tool-Speci?c Limitations Despite the use of Twitter, Instagram, and deep/dark web data, additional foreign and domestic "social media platforms Facebook) are not available in the DARPA tool. offers over Ddifferent social media and dark/deep web searches, including several ut can return large volumes of data that has to be manually reviewed to determine Whether the information relates to the applicant or not. For the ARPA tool se rches can only be conducted based on th Iof the applicant. ?s able to searchl Irelated to an applicant and has some capability to identify social media account information based on th :appears to mitigate some (but not nearly all) of the language and social media platform limitations, but is not currently capable of analyzing or producing reports on the results it generates. No commercial tool is currently able to provide meaningful automated content from Facebook posts, requiring Facebook checks to be conducted manually. Challenges Even when an automated tool is used to Search, all social media screening and vetting requires a manual review of information which is labor intensive and time consuming. Of?cers have to review information first to assess whether the social media accounts identified by the tool are associated with the applicant. If the officer determines the social media accounts belong to the applicant, the of?cer must then review the content of the social media postings to determine if any national security indicators are present. Most of the information derived from social media sites is written in languages other than English and requires translation su ort.:has some translation capabilities, and is currently working with thel Ifor additional ad hoc translation support. Policy and guidelines on the use of social media in adjudications is needed as well as policy and guidelines to define what constitutes a national security indicator in the context of social media. Preliminary Findings Analysis and evaluation of various tools is ongoing. However, tools and processes employed to date need to be improved in order to ensure a viable means of screening immigration applicants? social For Of?cial Use Only/Internal Use Only Draft and Deliberative 3 58 For Of?cial Use Only/Internal Use Onlyl Draft and Deliberative media on a Widespread basis in an ef?cient manner. Current tools and processes still require (e)signi?cant manual labor, even for the semi-automated checks. 0 Access to social media for immigration purposes is still new, with best practices under development. For Of?cial Use Only/Internal Use Only Draft and Deliberative DHS Secretary Briefing Binder Social Media Background USCIS use of social media is governed by DHS Directive 110?01, ?Privacy Policy for Operational Use of Social Media.? This policy requires USCIS to receive approval from the DHS Privacy Of?ce regarding the privacy implications of any planned operational use of social media. USCIS use of social media also requires authorization from senior agency leadership. A policy memo was signed by USCIS leadership on April 7, 2015, authorizing a small group of USCIS Fraud Detection and National Security Directorate (FDNS) of?cers to conduct social media research in theEvetting context. In early FY16, a team of FDNS of?cers, who received ecialized training in social media use, began conducting manual Facebook reviews for certai cases referred for enhanced review. FDNS currently conducts routine social me 1a screening or certairi applicants. FDNS, in collaboration with the USCIS Refugee, Asylum, and International Operations Directorate (RAIO) and the USCIS Field Operations Directorate (FOD), and DHS partners, including Science and Technology and the Of?ce of Intelligence and Analysis has conducted several ilots leveraging the use of social media in the screening and. vetting process for certairi nd certain applicants for adjustment of status. Pilot efforts to date include: 0 :Pilot 1: During Q1 of FYI 5, USCIS, in collaboration with DHS the Intelligence Co nity, and the Department of Defense (DOD), implemented social media review 0 denie cases. 0 Pilot 2: Following the ?rst sample of cases, USCIS sent an additional batch of approved and deniedl? cases through DHS the Intelligence . Community, and DOD. . ilot 3: USCIS tested the use of a social media tool created by the Defense Advanced Research Projects Agency (DARPA) to screen against Insta ram, Twitter, and the deep and dark webs. USCIS screenechending FY16 Ql?cases (approximatell identi?ed for enhanced screening through the DARPA tool in order to assess its capabilities. FDNS encountered a number of challenges, limitations, and inef?ciencies with the tool and concluded that it did not meet USCIS needs for social media screening. 0 :Pilots 2, and 3 Results: Although applicant data was successfully used to identijy some applicants social media accounts, the information in the accounts did not yield clear, articulable links to national security concerns, even for those applicants who were found to pose a potential national security threat based on other security screening results. . t: In January 2016, USCIS conducted social media research on certain: djustinent cases in three ways: ?4 60 fro Homeland DHS Secretary Briefing Binder Approximatelyl leases applicants for adjustment of status were reviewed using thel commercial social media screening applications under an ICE contract. 0 The sameEcases were initially screened with the support of DHS using 2 a commercial application. :of these cases that were pending an interview with a USCIS Field Office were subsequently prioritized for analyst review and evaluation. 0 Staff at the USCIS National Benef ts Center manually searched and reviewed Twitter, Facebook, and Google onl adjustment applicants. The results of this vetting, including theEreview, the Babel Street review, and the manual review, were compiled in a ?nal report that identi?ed a number of lessons learned and detailed the challenges in utilizing social media for screening purposes. 2016 in collaboration with DHS USCIS ran data from throng to review social media. The pilot found that this group of individuals had minimal presence on U.S.?based social media platforms accessible througlEor other social media applications). No derogatory information was identified or associated with'the pilot data set. 0 The results of this vetting were compiled in a ?nal report that identi?ed a number of lessons learned and detailed the challenges in utilizing social media for screening purposes. 0 DARPA 2.0 PiloEPilot 5: In April 2016i USCIS conducted. another pilot with the DARPA social media screening tool to ve applicants, drawn predominantly from the though the tool was improved from the previous iteration, USC. determined DARPA 2.0 did not meet USCIS needs and was not a viable option for semi-automated social media screening. 0 The results of this vetting were compiled in a ?nal report that identified a number of lessons learned and detailed the challenges in utilizing social media for screening purposes. 0 Two of the social media accounts reviewed containedpotentially derogatory in rmntinn 2/4 61 If?; Homeland DHS Secretary Brie?ng Binder Security Current Status In accordance with the Social Media Expansion Plan for Refugees Concept of Operations (CONOPS), FDNS continues to deploy a risk?based phased approach for the expansion of social media review for: Beginning in FY16 Q1, FDNS instituted a manual Facebook search and review fo ases referred for enhanced review. On August 1 2016 USCIS began conductmg semi-automated checks of a number of social media sites for: cases referred for enhanced review andl leases with national security concerns. As of November 4, 2016, USCIS has conducted social media screenin on approximately: cases or approximatel At this time, no?applications have been denied solely based on social media information. FDNS, a part of the DHS Social Media Task Force, continues to collaborate with partner components and agencies to explore semi?automated solutions. DHS is currently undergoing an acquisition process to evaluate a number of commercially-available tools to determine if any meet the operational requirements of USCIS and other DHS components that possess a need to access social media information for lawful purposes. USCIS, for both manual searches and semi?automated searches currently in operation, only seeks access to publically available social media information for the purposes of screening and vetting, in accordance with privacy, civil rights, and civil liberties oversight. As of November 4, 2016, no immigration benefits have been denied solely or primarily because of information uncovered through social media vetting. In a small number of cases, information discovered through social media screening had limited impact on the processing of those cases speci?cally in developing additional lines of inquiry. In cases of benefit denial, the denial was based on information found outside of social media, such as through routine security and background checks, or uncovered during an interview. Challenges 0 The process of social media screening and vetting necessitates a labor intensive, manual review in which officers must first attempt to assess whether the content relates to an individual with a pending immigration bene?t request. Even if information that de?nitively relates to such an individual is found. 1 [but may be helpful in developing additional lines of inquiry when adjudicating the bene?t request. 0 There are several technical challenges to semi?automated use and access of social media that DHS is working to overcome, such as employing and collating social media data for large numbers of applicants ef?ciently automating search algorithms; automated 3/4 62 ii 1"l HomEIand DHS Secretary Brie?ng Binder . language translation; and resolving a person?s online identity. In addition, there are further technical limitations. Speci?cally, USCIS cannot access messages in peer?to?peer messaging systems or the back-end data of social media platforms, nor does it seek to access this information. 0 The social media review that FDNS currently conducts is more limited than that conducted by other components, because FDNS does not have the same authorities as other components] I 0 Having FDNS personnel dedicated to mass social media screening diverts them away from conducting the more targeted enhanced vetting they are well trained and equipped to do. USCIS is working now on developing greater social media vetting capability on that kind of case-by-case referral basis. 0 Content obtained from social media is often in languages other than English and requires translation support. Milestones Future milestones related to the Social Media include: FDNS will continue a risk-based expansion of social media screening. FDNS is currently working to expand social media screening to all A pilot plan, coordinated by the Of?ce of Policy and Strategy, has been drafted and presented to USCIS senior leadership, which will expand use of social media for referral based vetting more broadly across USCIS. This pilot plan is undergoing ?nal review by senior leadership. Points of Contact Prepared by: Kevin Quinn, FDNS, Case Analysis and Vetting Division Chief, kevint.quinn@uscis.dhs.gov, 202-272-8414 Tara Matthews, FDNS, Immigration Of?cer, tara.matthews@uscis.dhs. gov, 202?272-9329 4/4 63