US Immigration Services Effort to Identify Terrorism Threats - Is Social Media Intelligence (SOCMINT) The Next Tool

149 Pages·2019·1.851 MB·English

by  Erik M. Thompson

NAVAL
POSTGRADUATE
SCHOOL

MONTEREY, CALIFORNIA
THESIS

U.S. CITIZENSHIP AND IMMIGRATION SERVICES’ EFFORT
TO IDENTIFY TERRORISM THREATS: IS SOCIAL MEDIA
INTELLIGENCE (SOCMINT) THE NEXT TOOL?
by
Erik M. Thompson
December 2019
Co-Advisors: Erik J. Dahl
Lynda A. Peters (contractor)
Approved for public release. Distribution is unlimited.
THIS PAGE INTENTIONALLY LEFT BLANK
Form Appr oved OMB
REPORT DOCUMENTATION PAGE No. 0704-0188
Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing
instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of
information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions
for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson
Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project
(0704-0188) Washington, DC 20503.
1. AGENCY USE ONLY 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED
(Leave blank) December 2019 Master's thesis
4. TITLE AND SUBTITLE 5. FUNDING NUMBERS
U.S. CITIZENSHIP AND IMMIGRATION SERVICES’ EFFORT TO
IDENTIFY TERRORISM THREATS: IS SOCIAL MEDIA INTELLIGENCE
(SOCMINT) THE NEXT TOOL?
6. AUTHOR(S) Erik M. Thompson
7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING
Naval Postgraduate School ORGANIZATION REPORT
Monterey, CA 93943-5000 NUMBER
9. SPONSORING / MONITORING AGENCY NAME(S) AND 10. SPONSORING /
ADDRESS(ES) MONITORING AGENCY
N/A REPORT NUMBER
11. SUPPLEMENTARY NOTES The views expressed in this thesis are those of the author and do not reflect the
official policy or position of the Department of Defense or the U.S. Government.
12a. DISTRIBUTION / AVAILABILITY STATEMENT 12b. DISTRIBUTION CODE
Approved for public release. Distribution is unlimited. A
13. ABSTRACT (maximum 200 words)
Terrorists use the internet to facilitate every aspect of their nefarious activity. This use creates a novel
research question. To what degree can an open-source social media intelligence (SOCMINT) gathering and
analysis capability assist U.S. Citizenship and Immigration Services (USCIS) in accomplishing its homeland
security mission? The critics of SOCMINT argue it is an unnecessary, problematic, and ill-advised effort based on
efficacy, data management, and constitutional grounds. Therefore, the thesis explores the past efforts, necessity,
and efficacy of open-source SOCMINT in identifying potential fraud, public safety, and/or national security
concerns (threats) from immigrants seeking immigration benefits. The research consists of qualitatively examining
issue rhetoric—the debate and discussion—between the critics and supporters of SOCMINT. The Profiles of
Individual Radicalization in the United States dataset provides a quantitative, evidence-grounded means to gain
insight on radicalized immigrants’ use of the internet and social media in plotting attacks and the potential for
threat detection. The research demonstrates threats among immigration benefit seekers exist, and that SOCMINT
is a viable means to identify and mitigate the threats. The thesis concludes the propositions for SOCMINT are
valid and the critics’ objections should not impede the effort. The thesis recommends USCIS continue SOCMINT,
ensuring the endeavor observes a balance between security and liberty.
14. SUBJECT TERMS 15. NUMBER OF
social media, analysis, Department of Homeland Security, DHS, screening, vetting, Twitter, PAGES
Facebook, YouTube, threats, sentiment analyzer, law enforcement, big data analytics, 149
terrorist, terrorism, babel street, Open-Source Intelligence, OSINT, social media 16. PRICE CODE
intelligence, SOCMINT, Giant Oak, U.S. Citizenship and Immigration Services, USCIS,
Fraud Detection National Security, FDNS
17. SECURITY 18. SECURITY 19. SECURITY 20. LIMITATION OF
CLASSIFICATION OF CLASSIFICATION OF THIS CLASSIFICATION OF ABSTRACT
REPORT PAGE ABSTRACT
Unclassified Unclassified Unclassified UU
NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89)
Prescribed by ANSI Std. 239-18
i
THIS PAGE INTENTIONALLY LEFT BLANK
ii
Approved for public release. Distribution is unlimited.
U.S. CITIZENSHIP AND IMMIGRATION SERVICES’ EFFORT TO IDENTIFY
TERRORISM THREATS: IS SOCIAL MEDIA INTELLIGENCE (SOCMINT)
THE NEXT TOOL?
Erik M. Thompson
Immigration Officer, U. S. Citizenship and Immigration Services/Fraud Detection and
National Security, Department of Homeland Security
BS, Georgetown University, 2003
JD, University of Missouri -Kansas City, 2012
Submitted in partial fulfillment of the
requirements for the degree of
MASTER OF ARTS IN SECURITY STUDIES
(HOMELAND SECURITY AND DEFENSE)
from the
NAVAL POSTGRADUATE SCHOOL
December 2019
Approved by: Erik J. Dahl
Co-Advisor
Lynda A. Peters
Co-Advisor
Erik J. Dahl
Associate Professor, Department of National Security Affairs
iii
THIS PAGE INTENTIONALLY LEFT BLANK
iv
ABSTRACT
Terrorists use the internet to facilitate every aspect of their nefarious activity. This
use creates a novel research question: To what degree can an open-source social media
intelligence (SOCMINT) gathering and analysis capability assist U.S. Citizenship and
Immigration Services (USCIS) in accomplishing its homeland security mission? The critics
of SOCMINT argue it is an unnecessary, problematic, and ill-advised effort based on
efficacy, data management, and constitutional grounds. Therefore, the thesis explores the
past efforts, necessity, and efficacy of open-source SOCMINT in identifying potential
fraud, public safety, and/or national security concerns (threats) from immigrants seeking
immigration benefits. The research consists of qualitatively examining issue rhetoric—the
debate and discussion—between the critics and supporters of SOCMINT. The Profiles of
Individual Radicalization in the U.S. dataset provides a quantitative, evidence-grounded
means to gain insight on radicalized immigrants’ use of the internet and social media in
plotting attacks and the potential for threat detection. The research demonstrates threats
among immigration benefit seekers exist, and that SOCMINT is a viable means to identify
and mitigate the threats. The thesis concludes the propositions for SOCMINT are valid and
the critics’ objections should not impede the effort. The thesis recommends USCIS
continue SOCMINT, ensuring the endeavor observes a balance between security and
liberty.
v
THIS PAGE INTENTIONALLY LEFT BLANK
vi
TABLE OF CONTENTS
I. INTRODUCTION ............................................................................................. 1
A. RESEARCH QUESTION ...................................................................... 1
B. PROBLEM STATEMENT .................................................................... 1
C. BACKGROUND .................................................................................... 4
D. LITERATURE REVIEW ...................................................................... 8
1. Technology Experts .................................................................... 9
2. Security Experts ........................................................................ 12
3. Critics ........................................................................................ 16
E. RESEARCH DESIGN.......................................................................... 19
F. CHAPTER OVERVIEW ..................................................................... 22
II. PROPOSITIONS FOR SOCMINT ................................................................. 25
A. MISSION .............................................................................................. 26
B. LEGAL AUTHORITIES ..................................................................... 28
C. TERRORISM ON SOCIAL MEDIA .................................................. 28
1. Propaganda ............................................................................... 29
2. Communication ......................................................................... 30
3. Recruiting.................................................................................. 30
4. Radicalization ........................................................................... 31
5. Plotting ...................................................................................... 31
6. Experts ...................................................................................... 32
7. Profiles of Individual Radicalization in the United States ...... 32
D. OPEN-SOURCE NECESSITY ............................................................ 47
E. LAW ENFORCEMENT SOCMINT USE .......................................... 48
F. SOCMINT SUCCESSES ..................................................................... 49
G. CONCLUSION..................................................................................... 50
III. SOCMINT PROBLEMATIC EFFORT AND NECESSITY
CONCERNS..................................................................................................... 51
A. A PROBLEMATIC EFFORT ............................................................. 53
1. Office of the Inspector General Report.................................... 53
2. USCIS FOIA Documents .......................................................... 61
B. WE ARE SAFE ENOUGH .................................................................. 63
C. CONCLUSION..................................................................................... 67
IV. SOCMINT EFFICACY CONCERNS ............................................................ 69
A. YIELD .................................................................................................. 69
vii
B. SCOPE AND SCALE ........................................................................... 72
C. LANGUAGE ........................................................................................ 73
D. CONTEXT ............................................................................................ 76
E. ENCRYPTION ..................................................................................... 79
F. IDENTITY RESOLUTION ................................................................. 82
G. CONCLUSION..................................................................................... 83
V. SOCMINT DATA AND CONSTITUTIONAL CONCERNS ........................ 85
A. DATA CONCERNS ............................................................................. 86
1. Data Retention .......................................................................... 86
2. Data Sharing ............................................................................. 88
3. Data Hacking Risk .................................................................... 89
B. CONSTITUTIONAL CONCERNS ..................................................... 90
1. Privacy ...................................................................................... 91
2. Free Speech ............................................................................... 96
3. Discrimination........................................................................... 97
C. CONCLUSION................................................................................... 100
VI. CONCLUSIONS AND RECOMMENDATIONS ........................................ 101
A. SUMMARY ........................................................................................ 101
1. Propositions for SOCMINT ................................................... 102
2. SOCMINT Problematic Effort and Necessity Concerns ....... 103
3. SOCMINT Efficacy Concerns ................................................ 103
4. SOCMINT Data and Constitutional Concerns ...................... 104
B. LIMITATIONS .................................................................................. 105
C. RECOMMENDATIONS ................................................................... 105
D. FUTURE RESEARCH ...................................................................... 108
E. CONCLUSION................................................................................... 109
APPENDIX. PROFILES OF INDIVIDUAL RADICALIZATION IN THE
UNITED STATES ......................................................................................... 111
LIST OF REFERENCES .......................................................................................... 113
INITIAL DISTRIBUTION LIST ............................................................................. 127

viii