DHS Misses the Mark in Attempts to Quell Public Concerns on the Gathering of Social Media Handles

Last month, CDT submitted comments to U.S. Customs and Border Protection (CBP) opposing its proposal to gather information about the online presence of foreign visitors from Visa Waiver Program countries. Since the original comment period, in which over 700 commenters expressed overwhelmingly negative opinions about the proposal, the Department of Homeland Security (DHS) and CBP have issued several new publications with information about the proposed information collection. These include an updated Privacy Impact Assessment (PIA) and a Supporting Statement that provides preliminary responses to arguments from CDT, other collation groups, and general public concerns. While the documents discuss oversight of the program and shed light on how the collected information will be processed, they do not adequately address the fundamental concerns raised in public comments.

In CDT’s public comment, we argued that collection of travelers’ social media identifiers would unduly burden individual liberty interests in three primary ways: it would invade individual privacy, hinder free expression, and expose traditionally marginalized groups to undue surveillance based on ethnicity and ideology. Our concerns were echoed by other advocacy organizations, including the thirty-two who joined us in our coalition statement, as well as hundreds of concerned citizens.

While the supporting documents from DHS note the apprehension of these commenters, the agency’s explanations fail to address many of the substantive concerns. Below, we highlight some of the public comments on these issues and discuss the concerns that persist even in light of DHS’s initial response.

Consequences To Applicant of Non-Disclosure

“Stating that it is only an optional field [is] no argument either. Anyone who refused to fill out this ‘optional’ field would instantly be placed under suspicion, as if they had something they wished to hide. There would be obvious pressure to fill out said ‘optional field’ that would make it far less optional than you make it out to be.” – Corey Cohen

In our comments, CDT expressed concern about the chilling effect for travelers to the U.S. Under the proposal, potential visitors will feel pressured to disclose this “optional” data rather than run the risk of being denied a waiver if they choose not to disclose or provide incomplete information. The PIA and the Supporting Statement reiterate a number of times that the collection of social media information is optional, without addressing the likely pressure many travelers will feel to provide complete information. DHS cited the optional nature of the collection in response to a variety of concerns, including:

1. The risk that applicants who don’t have an online identifier will input the social media account information of a family member or associate
2. The risk of inappropriate collection of First Amendment-protected information, as regulated by the Privacy Act
3. Public concern on the prospect of eventually changing this question field from optional to mandatory
4. Public concern that refusal to answer would lead to denial of an ESTA application
5. Concern that this proposal is an expansion of intelligence gathering

The PIA seeks to emphasize that a successful application is technically possible if an applicant does not provide information about his or her online presence, but identifies the privacy risk “that CBP will consider an applicant’s failure to complete this optional data field as indicative of potentially derogatory information.” The mitigation suggested in the PIA is simply that “the ESTA application contains language that the social media fields are optional” and that if a traveler declines to provide this information, “the individual will not be penalized.” It is not at all clear if an applicant is notified that CBP will not penalize the applicant. Additionally, it is unclear if these statements will assuage travelers’ concerns, or effectively ensure that CBP officials do not treat a traveler’s refusal to provide an online identifier as grounds for additional scrutiny.

Impact on Associational Rights

“The notion that my social media identifier should have anything to do with entering the country is a shockingly Nazi like rule. The only thing that this could facilitate anyway is trial by association – something that is known to ensnare innocent people, and not work.” – David Crawley

Both documents also failed to address the most likely harms toward U.S. citizens, namely getting drawn into a web of surveillance without notice. Simply commenting or “liking” content on an ESTA applicant’s social media page could put American citizens under the microscope of DHS scrutiny. CBP attempts to mitigate the invasiveness of this type of surveillance of a non-ESTA applicant by offering assurances that it will only retain information “relevant to making an ESTA determination” – potentially a very broad suite of online activity. CBP explicitly describes that, “through link-analysis, CBP may identify direct contacts (such as an ESTA applicants’ ‘friends,’ ‘followers,’ or ‘likes’), as well as secondary and tertiary contacts associated with the applicant”, but also confirms that the unsuspecting American potentially being surveilled won’t receive notice that they are under surveillance.

Expansion of Surveillance

“I think it sounds like the stuff of a totalitarian surveillance state.”- Kevin Breidenbach

“The scale and scope of this program would lead to a significant expansion of intelligence activity. All of the information collected through ESTA is shared, in bulk, with U.S. intelligence agencies and can be used to seed more intelligence surveillance unrelated to the applicant’s eligibility for a visa waiver.” Yolanda Rondon (American Arab Anti-Discrimination Committee)

As we discussed in our comments, CBP shares ESTA application information, in bulk, with U.S. intelligence agencies. The updated PIA notes “CBP will continue to share ESTA information in bulk with other federal Intelligence Community partners (e.g., the National Counterterrorism Center), and CBP may share ESTA data on a case-by-case basis to appropriate state, local, tribal, territorial, or international government agencies.” While the PIA notes that existing agreements about sharing ESTA information will be updated to include the additional category of social media identifier, there is no discussion of the protections or limitations that would need to be incorporated into these agreements to truly mitigate the downstream privacy risks presented by analysis of social media activity.

Further, DHS clouds the picture of what it intends to do with this data. In the Supporting Statement, DHS claims that “having an applicant’s social media identifier will provide an additional means by which DHS can contact an applicant if needed.” What’s more concerning than this weak explanation is the thought of DHS direct messaging an ESTA applicant on Instagram.

Costs

“[This] is a complete disregard for the effective use of taxpayer funds and government staff resources” – Peio Powieur

DHS’s supporting documents also disregard integral concerns for this expansion of the ESTA application process such as cost, reciprocal disclosures, and the harm this poses to American citizens. In the proposal, DHS provides estimates of the cost of implementing this social media collection. However, CDT and many members of the public remain skeptical that the projected costs correctly account for the amount of time needed to effectively sift through the quantity of information that makes up an individual’s “online presence.”

Reciprocity

“US leadership means that we should be prepared for any country in the world to institute similar policies to ours, including countries that are actively hostile to human rights and/or to US national interests. This is a troubling, un-American proposal – a phrase I do not use lightly.” – Nathalie Marechal

Additionally, DHS utterly failed to even begin to address the possibility that its adoption of the proposed rule would spur other nations to impose reciprocal social media requirements on Americans while traveling abroad. We noted the likelihood of this retaliation based on the tendency towards reciprocity in customs and immigration policy. In response to these legitimate concerns, the Supporting Statement offered no reassurance and simply noted that “all sovereign countries are within their authority to impose travel regulations and entry requirements.”

Conclusion

Despite the breadth of the CBP and DHS’s supporting documents, neither the PIA nor the Supporting Statement adequately addresses recurring concerns of individuals involved in this matter. These documents leave us with more questions than answers, and we strongly urge DHS to reject this proposed collection of social media identifiers from VPW applicants.