NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS U.S. CITIZENSHIP AND IMMIGRATION SERVICES’ EFFORT TO IDENTIFY TERRORISM THREATS: IS SOCIAL MEDIA INTELLIGENCE (SOCMINT) THE NEXT TOOL? by Erik M. Thompson December 2019 Co-Advisors: Erik J. Dahl Lynda A. Peters (contractor) Approved for public release. Distribution is unlimited. THIS PAGE INTENTIONALLY LEFT BLANK Form Appr oved OMB REPORT DOCUMENTATION PAGE No. 0704-0188 Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington, DC 20503. 1. AGENCY USE ONLY 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED (Leave blank) December 2019 Master's thesis 4. TITLE AND SUBTITLE 5. FUNDING NUMBERS U.S. CITIZENSHIP AND IMMIGRATION SERVICES’ EFFORT TO IDENTIFY TERRORISM THREATS: IS SOCIAL MEDIA INTELLIGENCE (SOCMINT) THE NEXT TOOL? 6. AUTHOR(S) Erik M. Thompson 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING Naval Postgraduate School ORGANIZATION REPORT Monterey, CA 93943-5000 NUMBER 9. SPONSORING / MONITORING AGENCY NAME(S) AND 10. SPONSORING / ADDRESS(ES) MONITORING AGENCY N/A REPORT NUMBER 11. SUPPLEMENTARY NOTES The views expressed in this thesis are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. Government. 12a. DISTRIBUTION / AVAILABILITY STATEMENT 12b. DISTRIBUTION CODE Approved for public release. Distribution is unlimited. A 13. ABSTRACT (maximum 200 words) Terrorists use the internet to facilitate every aspect of their nefarious activity. This use creates a novel research question. To what degree can an open-source social media intelligence (SOCMINT) gathering and analysis capability assist U.S. Citizenship and Immigration Services (USCIS) in accomplishing its homeland security mission? The critics of SOCMINT argue it is an unnecessary, problematic, and ill-advised effort based on efficacy, data management, and constitutional grounds. Therefore, the thesis explores the past efforts, necessity, and efficacy of open-source SOCMINT in identifying potential fraud, public safety, and/or national security concerns (threats) from immigrants seeking immigration benefits. The research consists of qualitatively examining issue rhetoric—the debate and discussion—between the critics and supporters of SOCMINT. The Profiles of Individual Radicalization in the United States dataset provides a quantitative, evidence-grounded means to gain insight on radicalized immigrants’ use of the internet and social media in plotting attacks and the potential for threat detection. The research demonstrates threats among immigration benefit seekers exist, and that SOCMINT is a viable means to identify and mitigate the threats. The thesis concludes the propositions for SOCMINT are valid and the critics’ objections should not impede the effort. The thesis recommends USCIS continue SOCMINT, ensuring the endeavor observes a balance between security and liberty. 14. SUBJECT TERMS 15. NUMBER OF social media, analysis, Department of Homeland Security, DHS, screening, vetting, Twitter, PAGES Facebook, YouTube, threats, sentiment analyzer, law enforcement, big data analytics, 149 terrorist, terrorism, babel street, Open-Source Intelligence, OSINT, social media 16. PRICE CODE intelligence, SOCMINT, Giant Oak, U.S. Citizenship and Immigration Services, USCIS, Fraud Detection National Security, FDNS 17. SECURITY 18. SECURITY 19. SECURITY 20. LIMITATION OF CLASSIFICATION OF CLASSIFICATION OF THIS CLASSIFICATION OF ABSTRACT REPORT PAGE ABSTRACT Unclassified Unclassified Unclassified UU NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89) Prescribed by ANSI Std. 239-18 i THIS PAGE INTENTIONALLY LEFT BLANK ii Approved for public release. Distribution is unlimited. U.S. CITIZENSHIP AND IMMIGRATION SERVICES’ EFFORT TO IDENTIFY TERRORISM THREATS: IS SOCIAL MEDIA INTELLIGENCE (SOCMINT) THE NEXT TOOL? Erik M. Thompson Immigration Officer, U. S. Citizenship and Immigration Services/Fraud Detection and National Security, Department of Homeland Security BS, Georgetown University, 2003 JD, University of Missouri -Kansas City, 2012 Submitted in partial fulfillment of the requirements for the degree of MASTER OF ARTS IN SECURITY STUDIES (HOMELAND SECURITY AND DEFENSE) from the NAVAL POSTGRADUATE SCHOOL December 2019 Approved by: Erik J. Dahl Co-Advisor Lynda A. Peters Co-Advisor Erik J. Dahl Associate Professor, Department of National Security Affairs iii THIS PAGE INTENTIONALLY LEFT BLANK iv ABSTRACT Terrorists use the internet to facilitate every aspect of their nefarious activity. This use creates a novel research question: To what degree can an open-source social media intelligence (SOCMINT) gathering and analysis capability assist U.S. Citizenship and Immigration Services (USCIS) in accomplishing its homeland security mission? The critics of SOCMINT argue it is an unnecessary, problematic, and ill-advised effort based on efficacy, data management, and constitutional grounds. Therefore, the thesis explores the past efforts, necessity, and efficacy of open-source SOCMINT in identifying potential fraud, public safety, and/or national security concerns (threats) from immigrants seeking immigration benefits. The research consists of qualitatively examining issue rhetoric—the debate and discussion—between the critics and supporters of SOCMINT. The Profiles of Individual Radicalization in the U.S. dataset provides a quantitative, evidence-grounded means to gain insight on radicalized immigrants’ use of the internet and social media in plotting attacks and the potential for threat detection. The research demonstrates threats among immigration benefit seekers exist, and that SOCMINT is a viable means to identify and mitigate the threats. The thesis concludes the propositions for SOCMINT are valid and the critics’ objections should not impede the effort. The thesis recommends USCIS continue SOCMINT, ensuring the endeavor observes a balance between security and liberty. v THIS PAGE INTENTIONALLY LEFT BLANK vi TABLE OF CONTENTS I. INTRODUCTION ............................................................................................. 1 A. RESEARCH QUESTION ...................................................................... 1 B. PROBLEM STATEMENT .................................................................... 1 C. BACKGROUND .................................................................................... 4 D. LITERATURE REVIEW ...................................................................... 8 1. Technology Experts .................................................................... 9 2. Security Experts ........................................................................ 12 3. Critics ........................................................................................ 16 E. RESEARCH DESIGN.......................................................................... 19 F. CHAPTER OVERVIEW ..................................................................... 22 II. PROPOSITIONS FOR SOCMINT ................................................................. 25 A. MISSION .............................................................................................. 26 B. LEGAL AUTHORITIES ..................................................................... 28 C. TERRORISM ON SOCIAL MEDIA .................................................. 28 1. Propaganda ............................................................................... 29 2. Communication ......................................................................... 30 3. Recruiting.................................................................................. 30 4. Radicalization ........................................................................... 31 5. Plotting ...................................................................................... 31 6. Experts ...................................................................................... 32 7. Profiles of Individual Radicalization in the United States ...... 32 D. OPEN-SOURCE NECESSITY ............................................................ 47 E. LAW ENFORCEMENT SOCMINT USE .......................................... 48 F. SOCMINT SUCCESSES ..................................................................... 49 G. CONCLUSION..................................................................................... 50 III. SOCMINT PROBLEMATIC EFFORT AND NECESSITY CONCERNS..................................................................................................... 51 A. A PROBLEMATIC EFFORT ............................................................. 53 1. Office of the Inspector General Report.................................... 53 2. USCIS FOIA Documents .......................................................... 61 B. WE ARE SAFE ENOUGH .................................................................. 63 C. CONCLUSION..................................................................................... 67 IV. SOCMINT EFFICACY CONCERNS ............................................................ 69 A. YIELD .................................................................................................. 69 vii B. SCOPE AND SCALE ........................................................................... 72 C. LANGUAGE ........................................................................................ 73 D. CONTEXT ............................................................................................ 76 E. ENCRYPTION ..................................................................................... 79 F. IDENTITY RESOLUTION ................................................................. 82 G. CONCLUSION..................................................................................... 83 V. SOCMINT DATA AND CONSTITUTIONAL CONCERNS ........................ 85 A. DATA CONCERNS ............................................................................. 86 1. Data Retention .......................................................................... 86 2. Data Sharing ............................................................................. 88 3. Data Hacking Risk .................................................................... 89 B. CONSTITUTIONAL CONCERNS ..................................................... 90 1. Privacy ...................................................................................... 91 2. Free Speech ............................................................................... 96 3. Discrimination........................................................................... 97 C. CONCLUSION................................................................................... 100 VI. CONCLUSIONS AND RECOMMENDATIONS ........................................ 101 A. SUMMARY ........................................................................................ 101 1. Propositions for SOCMINT ................................................... 102 2. SOCMINT Problematic Effort and Necessity Concerns ....... 103 3. SOCMINT Efficacy Concerns ................................................ 103 4. SOCMINT Data and Constitutional Concerns ...................... 104 B. LIMITATIONS .................................................................................. 105 C. RECOMMENDATIONS ................................................................... 105 D. FUTURE RESEARCH ...................................................................... 108 E. CONCLUSION................................................................................... 109 APPENDIX. PROFILES OF INDIVIDUAL RADICALIZATION IN THE UNITED STATES ......................................................................................... 111 LIST OF REFERENCES .......................................................................................... 113 INITIAL DISTRIBUTION LIST ............................................................................. 127 viii