```

[House Hearing, 112 Congress]
[From the U.S. Government Publishing Office]

 
 DHS MONITORING OF SOCIAL NETWORKING AND MEDIA: ENHANCING INTELLIGENCE 
                     GATHERING AND ENSURING PRIVACY

=======================================================================

                                HEARING

                               before the

                    SUBCOMMITTEE ON COUNTERTERRORISM
                            AND INTELLIGENCE

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                      ONE HUNDRED TWELFTH CONGRESS

                             SECOND SESSION

                               __________

                           FEBRUARY 16, 2012

                               __________

                           Serial No. 112-68

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC] [TIFF OMITTED] CONGRESS.13

                                     

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________

                  U.S. GOVERNMENT PRINTING OFFICE
76-514                    WASHINGTON : 2012
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop IDCC, Washington, DC 
20402-0001

                     COMMITTEE ON HOMELAND SECURITY

                   Peter T. King, New York, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Daniel E. Lungren, California        Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Michael T. McCaul, Texas             Henry Cuellar, Texas
Gus M. Bilirakis, Florida            Yvette D. Clarke, New York
Paul C. Broun, Georgia               Laura Richardson, California
Candice S. Miller, Michigan          Danny K. Davis, Illinois
Tim Walberg, Michigan                Brian Higgins, New York
Chip Cravaack, Minnesota             Jackie Speier, California
Joe Walsh, Illinois                  Cedric L. Richmond, Louisiana
Patrick Meehan, Pennsylvania         Hansen Clarke, Michigan
Ben Quayle, Arizona                  William R. Keating, Massachusetts
Scott Rigell, Virginia               Kathleen C. Hochul, New York
Billy Long, Missouri                 Janice Hahn, California
Jeff Duncan, South Carolina
Tom Marino, Pennsylvania
Blake Farenthold, Texas
Robert L. Turner, New York
            Michael J. Russell, Staff Director/Chief Counsel
               Kerry Ann Watkins, Senior Policy Director
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director

                                 ------                                

           SUBCOMMITTEE ON COUNTERTERRORISM AND INTELLIGENCE

                 Patrick Meehan, Pennsylvania, Chairman
Paul C. Broun, Georgia, Vice Chair   Jackie Speier, California
Chip Cravaack, Minnesota             Loretta Sanchez, California
Joe Walsh, Illinois                  Brian Higgins, New York
Ben Quayle, Arizona                  Kathleen C. Hochul, New York
Scott Rigell, Virginia               Janice Hahn, California
Billy Long, Missouri                 Bennie G. Thompson, Mississippi 
Peter T. King, New York (Ex              (Ex Officio)
    Officio)
                    Kevin Gundersen, Staff Director
                   Zachary Harris, Subcommittee Clerk
               Hope Goins, Minority Subcommittee Director

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Patrick Meehan, a Representative in Congress From 
  the State of Pennsylvania, and Chairman, Subcommittee on 
  Counterterrorism and Intelligence..............................     1
The Honorable Jackie Speier, a Representative in Congress From 
  the State of California, and Ranking Member, Subcommittee on 
  Counterterrorism and Intelligence..............................     3
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security..............................................     4

                               Witnesses

Ms. Mary Ellen Callahan, Chief Privacy Officer, Department of 
  Homeland Security:
  Oral Statement.................................................    10
  Joint Prepared Statement.......................................    12
Mr. Richard Chavez, Director, Office of Operations Coordination 
  and Planning, Department of Homeland Security:
  Oral Statement.................................................    16
  Joint Prepared Statement.......................................    12

                             For the Record

The Honorable Patrick Meehan, a Representative in Congress From 
  the State of Pennsylvania, and Chairman, Subcommittee on 
  Counterterrorism and Intelligence:
  Statement of Marc Rotenberg, President, and Ginger McCall, 
    Staff Counsel, The Electronic Privacy Information Center 
    (EPIC).......................................................     6

                                Appendix

Letter Submitted to Chairman Patrick Meehan From Mary Ellen 
  Callahan and Richard Chavez....................................    39
Questions Submitted by Ranking Member Bennie G. Thompson for Mary 
  Ellen Callahan and Richard Chavez..............................    40

 DHS MONITORING OF SOCIAL NETWORKING AND MEDIA: ENHANCING INTELLIGENCE 
                     GATHERING AND ENSURING PRIVACY

                              ----------                              

                      Thursday, February 16, 2012

             U.S. House of Representatives,
                    Committee on Homeland Security,
         Subcommittee on Counterterrorism and Intelligence,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 10:04 a.m., in 
Room 311, Cannon House Office Building, Hon. Patrick Meehan 
[Chairman of the subcommittee] presiding.
    Present: Representatives Meehan, Cravaack, Quayle, Long, 
Speier, Thompson, and Hahn.
    Mr. Meehan. Good morning. I get to do this, which indicates 
that the Committee on Homeland Security's Subcommittee on 
Counterterrorism and Intelligence will come to order.
    The subcommittee is meeting today to hear testimony 
regarding tactics that are employed by the Department of 
Homeland Security to monitor social networking and media to 
enhance intelligence gathering, while at the same time 
protecting privacy. I would like to welcome everyone to today's 
hearing, and I look forward to hearing from today's witnesses 
on this very, very important issue.
    Over the last year, this subcommittee has had hearings on a 
multitude of terror-related threats, particularly focusing on 
those that have influence on the homeland, including those 
posed by Hezbollah, AQAP, and Boko Haram, to be specific. A 
common theme that has emerged among many of these is the 
groups' use of social media and networking to recruit, to plan, 
to plot attacks against the homeland or U.S. interests abroad. 
I emphasize that a lot of this was focused on foreign-based 
websites on which this activity was presumed to be taking 
place.
    In December, we held a hearing on the terrorists' use of 
social media. While there was disagreement among the witnesses 
on the effectiveness of that, we do know that terrorists use 
social media. All agreed that terrorist groups used these tools 
ultimately to their advantage.
    However, the use of social media isn't confined to 
terrorists. It is also a criminal issue and represents an 
entirely new operating space for all sorts of bad actors. I saw 
it as a Federal prosecutor. Social media is now used by 
individuals who share pictures with family and friends, but it 
is also used by terrorists or other kinds of criminals 
operating everything from frauds to other kinds of bad acts.
    I understand the importance of following leads wherever it 
may take investigators. So if there are leads on a social media 
or social network such as Twitter or Facebook, it may be 
appropriate to follow them, so long as the Government activity 
is consistent with the long-standing protections against 
improper intrusions into protected areas of personal privacy. 
Following leads means collecting intelligence, because, 
ultimately, no terrorism or criminal investigation can be 
effective without good intelligence. I understand and support 
intelligence collection within the rules of the law.
    In addition to following leads, social media provides a 
forum for the Government to have situational awareness of 
breaking events--something I know you spend a great deal of 
time--terrorist attacks, natural disasters--where the 
Department of Homeland Security is responsible for providing 
real-time situational awareness and information sharing across 
the Federal Government and down to the State and local 
enforcement level, to first responders as well, in the event of 
a terror attack or a natural disaster. For example, my good 
friend on the committee, Mr. Long, who experienced tornadoes in 
his district, may have an appreciation of the need for real-
time communication, sort of the virtual 9-1-1.
    But, conversely, the Government can use tools to 
communicate with people about disasters to enhance situational 
awareness among the citizenry. In these cases, intelligence 
collection and dissemination is a win-win for the Government 
and the people.
    But a few weeks ago, it was reported that the Department of 
Homeland Security has instituted a program, and I quote: ``to 
produce short reports about threats and hazards using publicly 
available information.'' As I said, I support that. However, in 
what I view as something that we have to determine whether it 
crosses the line, these reports also revealed that DHS has 
tasked analysts with collecting intelligence on any media 
reports, ``that reflect adversely on the U.S. Government and 
the Department of Homeland Security, including both positive 
and negative reports on FEMA, CBP, ICE, among others.''
    In one example, DHS used multiple social networking blogs, 
including Facebook and Twitter, three different blogs, and 
reader comments in newspapers to capture the reaction of 
residents to a possible plan to bring Guantanamo detainees to a 
local prison in Standish, Minnesota.
    In my view, collecting and analyzing, disseminating private 
citizens' comments could have a chilling effect on individuals' 
privacy rights and people's freedom of speech and dissent 
against their Government. I fully recognize that if an 
individual willingly uses Facebook, Twitter, or the comments 
section of a newspaper website, they, in effect, forfeit their 
right to an expectation of privacy. However, other private 
individuals reading your Facebook status updates is different 
than the Department of Homeland Security reading them, 
analyzing them, and possibly disseminating and collecting them 
for future purposes. My guess is that the average American has 
no problem with other private individuals reading their 
voluntary on-line writings and postings in open forums but may 
feel a bit of unease knowing the Federal Government may be 
doing the same.
    I fully recognize these are very complex and nuanced 
issues, and that is why we are holding today's hearing. I look 
forward to hearing from today's witnesses on how they are 
collecting intelligence to keep us safe and aware, yet also 
ensuring personal individual privacy.
    The Chair now recognizes the Ranking Minority Member of the 
subcommittee, the gentlewoman from California, Ms. Speier, for 
any comments that she may have.
    Ms. Speier. Thank you, Mr. Chairman. I would like to 
associate my comments with yours. I think that they were 
outstanding and really place a good frame on the discussion we 
are going to have today.
    I would also like to thank the witnesses who will be 
testifying today.
    You know, the explosion in the use of social media has 
changed communication as we know it. With just the touch of a 
button, millions of people can post and receive information 
through Twitter, Facebook, blogs, and text messaging in an 
instant. In just the short time that we have been sitting here 
in this hearing, there have been over 3 million comments that 
have been posted to Facebook and a half a million tweets that 
have been sent.
    Over the past year, we have seen the impact of using social 
media first-hand. Last year, the Arab Spring was driven by 
potesters who organized and communicated largely via social 
media. We have also seen the power of social media here in the 
United States over the past few months as protesters organize 
via Twitter and Facebook for the Occupy Wall Street movements 
throughout the country. We have seen bills before Congress 
stopped in their tracks by the power of social media.
    This growing universe of social networking presents great 
challenges and opportunities to the mission at the Department 
of Homeland Security as it works to keep our Nation safe. 
Through this hearing, we hope to learn how the Department of 
Homeland Security is harnessing the power of social media. Is 
it possible that DHS could use social media to communicate 
emergency recovery and response information to the general 
public? Can this information be generated quickly? How would 
such technology have improved the response to disasters like 
Hurricane Katrina? What about the case of a man-made disaster 
or a mass evacuation like we saw last year in the nuclear 
meltdown in Japan? Could Twitter and instant messaging be used 
to let people know where to evacuate and what to avoid?
    The vast amounts of publicly available data also present a 
potentially great resource for open-source information 
collection. In 2010, we saw alert citizens report suspicious 
activities in Times Square that led to the arrest of Faisal 
Shahzad. Could similar public reporting be done using social 
media? How can DHS fully exploit the benefits and opportunities 
of social media without impeding on the civil rights and civil 
liberties of those who choose to use social media? Can DHS 
actively and effectively monitor social media in an open and 
above-board way without being accused of spying on lawful 
activities?
    Last month, the press reported widely on a case where a 
couple from England was prevented from entering the United 
States because of a tweet. Was this an overreaction? Could or 
should a mere tweet or posting prevent a person from boarding a 
plane or entering the United States?
    I am looking forward to learning from the witnesses exactly 
how DHS uses social media and what DHS is doing to make sure 
that in its use of social media it is not being perceived as 
being a Big Brother. I want to learn from the witnesses what 
privacy protections are in place with regard to DHS's using 
social media and how the individual components are being 
trained on these protections.
    Further, I am very interested to find out today how the 
Department can even handle the sheer volume of open-source 
postings that may be found on any of the various social 
networking websites. Further, if the Department begins to use 
social media as open-source tools, as the Office of 
Intelligence and Analysis Under Secretary has indicated, how 
will its analysts be trained to continue to respect the civil 
liberties of those that choose to use social media?
    Social media could possibly be an integral tool in 
recognizing and preventing emerging threats. However, there has 
to be some specific systems in place that can manage this 
information while continuing to respect civil rights and civil 
liberties. I look forward to hearing what steps are being taken 
in this area.
    I yield back.
    Mr. Meehan. Thank you, Ranking Member Speier, for your 
observations, which I, as well, share.
    We are also pleased to have in attendance the Ranking 
Member of the committee. The gentleman from Mississippi, Mr. 
Thompson, is with us. As is the custom of the subcommittee 
where there are moments when we are graced with the presence of 
those Ranking and senior members, we give to them the 
opportunity to make an opening statement if they wish. So, at 
this minute, the Chair would recognize Mr. Thompson for any 
comments that he might have.
    Mr. Thompson. Thank you very much, Mr. Chairman, for your 
gracious introduction. I would like to thank you and the 
Ranking Member for holding this hearing today. I would also 
like to thank the witnesses for their testimony also.
    Social media outlets provide the general public with new 
avenues of discovering, reading, and sharing news, information, 
and other forms of content. With an increasing number of people 
relying on this form of technology as a primary information-
gathering resource, social media has supplemented, and in some 
cases replaced, traditional media outlets as a source of news 
and information.
    Social media allows DHS to quickly and efficiently 
disseminate accurate and useful information to hundreds of 
thousands of people simultaneously. For instance, prior to a 
natural disaster such as a hurricane or a flood, State and 
local officials can use SMS to convey evacuation warnings and 
notices to people living in affected areas. After a disaster, 
the same means can be used to direct people to FEMA. Both the 
Majority and Minority of this committee have a Twitter page.
    I think we all agree that social media outlets are useful. 
However, usefulness alone is not the only criteria we value. 
Rapid deployment of accurate information, combined with the 
ability of the average citizen to interact with public 
officials, will ultimately increase DHS's trust and 
accountability. To ensure that accountability and trust are 
embraced as a value, DHS must employ proper safeguards, 
including guidelines on information-gathering activities and a 
clear policy on creating a profile or data-mining. If 
information-gathering activities should occur, clear protocols 
that adhere to the Constitution and the Privacy Act must be 
developed to direct such activities. The public must be 
confident that interacting with DHS on a website or blog or 
Facebook will not result in surveillance or a compromise of 
Constitutionally-protected rights.
    Further, the use of social media must not replace 
traditional methods of information distribution. When used 
appropriately, social media is an efficient and effective way 
to communicate with people. If used improperly by a Federal 
agency, public trust and confidence will be compromised or 
forever destroyed.
    Given the high stakes involved, DHS cannot afford to make a 
mistake. I trust that in your efforts to navigate the 
Department's journey in the world of social media, you will 
work closely with the committee and keep us informed of your 
activities. We look forward to being your GPS.
    With that, I yield back.
    Mr. Meehan. Thank you, Mr. Chairman, for that sense of 
direction.
    We will stop it there. Other Members of the committee are 
reminded that opening statements may be submitted for the 
record.
    We are pleased to have a distinguished panel of witnesses 
before us today on this very, very important topic.
    The first is Ms. Mary Ellen Callahan. She was appointed the 
chief privacy officer and the chief Freedom of Information Act 
officer by Department of Homeland Security Secretary Napolitano 
in March 2009.
    Created by Congress in 2002, the Department's privacy 
officer is the first statutorily mandated privacy office in any 
Federal agency, whose mission is to preserve and enhance 
privacy protections for all individuals, to promote the 
transparency of Homeland Security operations, and to serve as 
the leader in the Federal privacy community. Ms. Callahan is 
responsible for evaluating Department-wide programs, systems, 
and technologies, and rulemaking for potential privacy impacts, 
and for providing mitigation strategies to reduce any privacy 
impact.
    Prior to joining the Department, Ms. Callahan was a partner 
with the law firm of Hogan & Hartson, where she specialized in 
privacy and data security law. She serves as vice chair of the 
American Bar Association's Privacy and Information Security 
Committee of the Antitrust Division. Now as chief privacy 
officer, she co-chairs both the CIO Council's Privacy Committee 
and the Information-Sharing Environment Privacy Guidelines 
Committee.
    Thank you for being here today, Ms. Callahan.
    I would also like to recognize Mr. Richard Chavez, who is 
the director of Office of Operations Coordination and Planning 
at the Department of Homeland Security.
    He provides counsel directly to the Secretary of Homeland 
Security on a wide range of operational issues, to include 
prevention, protection, mitigation, response and recovery 
operations, continuity of operations, and planning. He leads an 
office of approximately 550 people who are responsible for 
monitoring the security of the United States on a daily basis 
and providing National situational awareness and developing the 
National common operating picture.
    His office provides vital decision support information to 
the Federal interagency, Governors, homeland security advisors, 
law enforcement, private-sector, and critical infrastructure 
operators in all States and territories and more than 50 urban 
major areas Nation-wide.
    Mr. Chavez has over 30 years of Government experience, 
serving with DHS and the Department of Defense as an Air Force 
officer and a senior civilian in the Office of the Under 
Secretary of Defense for Policy.
    Before I recognize you for your comments, I have before me 
on the table a report from the Electronic Privacy Information 
Center. I ask unanimous consent to insert in the record a 
statement from EPIC.
    Hearing no objection, so ordered.
    [The information follows:]
   Statement of Marc Rotenberg, President, and Ginger McCall, Staff 
       Counsel, The Electronic Privacy Information Center (EPIC)
    Thank you, Mr. Chairman, for the invitation to submit this 
statement for the record for this hearing on ``DHS Monitoring of Social 
Networking and Media: Enhancing Intelligence Gathering and Ensuring 
Privacy'' to be held on February 16, 2012 before the House Subcommittee 
on Counterterrorism and Intelligence. We ask that this statement be 
included in the hearing record.
    EPIC thanks you and Members of the subcommittee for your attention 
to this important issue. The DHS monitoring of social networks and 
media organizations is entirely without legal basis and threatens 
important free speech and expression rights. Your decision to hold this 
hearing will help protect important American rights.
    The Electronic Privacy Information Center (EPIC) is a non-partisan, 
public interest research organization established in 1994 to focus 
public attention on emerging privacy and civil liberties issues. EPIC 
works to promote Government accountability and transparency 
particularly with respect to activities that implicate Constitutional 
rights and fundamental freedoms. EPIC has been analyzing law 
enforcement monitoring of social networks and on-line media for several 
years. In early 2011, EPIC submitted comments to the Department of 
Homeland Security on the agency's proposal to undertake monitoring of 
social network and news organizations.\1\ EPIC has also pursued several 
Freedom of Information requests to obtain relevant documents so that 
the Members of your committee and the public would have the opportunity 
to meaningful assess the agency's activities.
---------------------------------------------------------------------------
    \1\ EPIC, Comments of the Electronic Privacy Information Center to 
the Department of Homeland Security ``Systems of Records Notice'' DHS-
2011-0003, March 3, 2011, available at: http://epic.org/privacy/
socialmedia/Comments%20on%20DHS-2011-0003-1.pdf.
---------------------------------------------------------------------------
   i. epic obtained documents that reveal that the dhs is monitoring 
social network and media organizations for dissent and criticism of the 
                                 agency
    In April 12, 2011, EPIC submitted a Freedom of Information Act 
(``FOIA'') request to the Department of Homeland Security (``DHS'') 
seeking agency records detailing the media monitoring program. The 
request sought the following documents:
   All contracts, proposals, and communications between the 
        Federal Government and third parties, including, but not 
        limited to, H.B. Gary Federal, Palantir Technologies, and/or 
        Berico Technologies, and/or parent or subsidiary companies, 
        that include provisions concerning the capability of social 
        media monitoring technology to capture, store, aggregate, 
        analyze, and/or match personally-identifiable information.
   All contracts, proposals, and communications between DHS and 
        any States, localities, Tribes, territories, and foreign 
        governments, and/or their agencies or subsidiaries, and/or any 
        corporate entities, including but not limited to H.B. Gary 
        Federal, Palantir Technologies, and/or Berico Technologies, 
        regarding the implementation of any social media monitoring 
        initiative.
   All documents used by DHS for internal training of staff and 
        personnel regarding social media monitoring, including any 
        correspondence and communications between DHS, internal staff 
        and personnel, and/or privacy officers, regarding the receipt, 
        use, and/or implementation of training and evaluation 
        documents.
   All documents detailing the technical specifications of 
        social media monitoring software and analytic tools, including 
        any security measures to protect records of collected 
        information and analysis.
   All documents concerning data breaches of records generated 
        by social media monitoring technology.\2\
---------------------------------------------------------------------------
    \2\ EPIC FOIA Request, Apr. 12, 2011, available at: http://
epic.org/privacy/socialnet/EPIC-FOIA-DHS-Social-Media-Monitoring-04-12-
11.pdf; see also Olivia Katrandjian, DHS Creates Accounts Solely to 
Monitor Social Networks, ABC News, Dec. 28, 2011, available at: http://
abcnews.go.com/US/dhs-creates-fake-accounts-monitor-social-networks/
story?id=15247533#.- 
TzvuuONSQ3o.
---------------------------------------------------------------------------
    When the agency failed to comply with FOIA's deadlines, EPIC filed 
suit on December 23, 2011. As a result of this lawsuit, DHS disclosed 
to EPIC 285 pages of documents, including statements of work, 
contracts, and other agency records related to social network and media 
monitoring.\3\
---------------------------------------------------------------------------
    \3\ DHS Social Media Monitoring Documents, available at: http://
epic.org/foia/epic-v-dhs-mediamonitoring/EPIC-FOIA-DHS-Media-
Monitoring-12-2012.pdf; see e.g. Charlie Savage, Federal Contractor 
Monitored Social Network Sites, The New York Times, Jan. 13, 2012, 
available at: http://www.nytimes.com/2012/01/14/us/federal-security-
program-monitored-public-opinion.html; Jaikumar Vijayan, DHS Media 
Monitoring Could Chill Public Dissent, EPIC Warns, Computerworld Jan. 
16, 2012, available at: http://www.computerworld.com/s/article/9223441/
DHS_media_monitoring_could_chill_public_dissent_EPIC_warns; Ellen 
Nakashima, DHS Monitoring of Social Media Concerns Civil Liberties 
Advocates, Washington Post, Jan. 13, 2012, available at: http://
www.washingtonpost.com/world/national-security/dhs-monitoring-of-
social-media-worries-civil-liberties-advocates/2012/01/13/
gIQANPO7wP_story.html.
---------------------------------------------------------------------------
    These documents reveal that the agency had paid over $11 million to 
an outside company, General Dynamics, to engage in monitoring of social 
networks and media organizations and to prepare summary reports for 
DHS.\4\ According to DHS documents, General Dynamics will ``Monitor 
public social communications on the internet,'' including the public 
comment sections of NYT, LA Times, Huff Po, Drudge, Wired's tech blogs, 
ABC News.\5\ DHS also requested monitoring of Wikipedia pages for 
changes \6\ and announced its plans to set up social network profiles 
to monitor social network users.\7\
---------------------------------------------------------------------------
    \4\ EPIC, DHS Social Media Monitoring Documents at 1.
    \5\ EPIC, DHS Social Media Monitoring Documents at 127, 135, 148, 
193.
    \6\ EPIC, DHS Social Media Monitoring Documents at 124, 191.
    \7\ EPIC, DHS Social Media Monitoring Documents at 128.
---------------------------------------------------------------------------
    DHS required General Dynamics to monitor not just ``potential 
threats and hazards,'' ``potential impact on DHS capability'' to 
accomplish its homeland security mission, and ``events with operational 
value,'' but also paid the company to ``Identify[] reports that reflect 
adversely on the U.S. Government, DHS, or prevent, protect, respond or 
recovery Government activities.''\8\
---------------------------------------------------------------------------
    \8\ Attachment 1; EPIC, DHS Social Media Monitoring Documents at 
51, 195.
---------------------------------------------------------------------------
    Within the documents, DHS clearly stated its intention to ``capture 
public reaction to major Government proposals.''\9\ DHS instructed the 
media monitoring company to generate summaries of media ``reports on 
DHS, Components, and other Federal Agencies: Positive and negative 
reports on FEMA, CIA, CBP, ICE, etc. as well as organizations outside 
the DHS.''\10\
---------------------------------------------------------------------------
    \9\ EPIC, DHS Social Media Monitoring Documents at 116.
    \10\ EPIC, DHS Social Media Monitoring Documents at 183, 198.
---------------------------------------------------------------------------
    In one DHS-authored document, titled ``Social Networking/Media 
Capability Analyst Handbook'' the agency presented examples of good 
summary reports and flawed summary reports. One report held up as an 
exemplar was titled ``Residents Voice Opposition Over Possible Plan to 
Bring Guantanamo Detainees to Local Prison-Standish MI.''\11\ This 
report summarizes dissent on blogs and social networking cites, quoting 
commenters who took issue with the Obama administration's plan to 
transfer detainees to the Standish Prison.
---------------------------------------------------------------------------
    \11\ EPIC, DHS Social Media Monitoring Documents at 118.
---------------------------------------------------------------------------
    These documents clearly show an agency program that aims to 
document legitimate on-line dissent and criticism. The agency has not 
established any legal basis for this program.
    News media reports indicate that the Department of Homeland 
Security is not the only agency engaging in this sort of monitoring. 
Recent news stories confirm that the Federal Bureau of Investigation 
has also been developing a similar social network and media monitoring 
program.\12\
---------------------------------------------------------------------------
    \12\ Marcus Wohlson, FBI Seeks Digital Tool to Mine Entire Universe 
of Social Media, Chicago Sun Times, Associated Press, Feb. 12, 2012, 
available at: http://www.usatoday.com/USCP/PNI/Nation/World/2012-0213-
PNI0213wir-FBI-social-media_ST_U.htm.
---------------------------------------------------------------------------
   ii. there is no legal basis for the dhs' social network and media 
                           monitoring program
    The agency has demonstrated no legal basis for its social network 
and media monitoring program, which threatens important free speech and 
expression rights.
    Law enforcement agency monitoring of on-line criticism and dissent 
chills legitimate criticism of the Government, and implicates the First 
Amendment. Freedom of Speech and Expression are at the core of civil 
liberties and have been strongly protected by the Constitution and the 
U.S. courts.\13\ Government programs that threaten important First 
Amendment rights are immediately suspect and should only be undertaken 
where the Government can demonstrate a compelling interest that cannot 
be satisfied in other way.\14\ Government programs that note and record 
on-line comments, dissent, and criticism for the purpose of subsequent 
investigation send a chilling message to on-line commenters, bloggers, 
and journalists--``You are being watched.'' This is truly what George 
Orwell described in 1984.
---------------------------------------------------------------------------
    \13\ See e.g. United States v. Stevens, 130 S. Ct. 1577, 1585, 176 
L. Ed. 2d 435 (2010) (holding that the ``First Amendment itself 
reflects a judgment by the American people that the benefits of its 
restrictions on the Government outweigh the costs'').
    \14\ See e.g. NAACP v. Button, 83 S.Ct. 328 (1963); Citizens United 
v. Fed. Election Comm'n, 130 S. Ct. 876 (2010).
---------------------------------------------------------------------------
    As EPIC has stated in prior comments to DHS, the agency's social 
network and media monitoring program would also violate the Privacy 
Act.\15\ The Privacy Act requires agencies to:
---------------------------------------------------------------------------
    \15\ EPIC, Comments of the Electronic Privacy Information Center to 
the Department of Homeland Security ``Systems of Records Notice'' DHS-
2011-0003, March 3, 2011, available at: http://epic.org/privacy/
socialmedia/Comments%20on%20DHS-2011-0003-1.pdf.

``establish appropriate administrative, technical, and physical 
safeguards to insure the security and confidentiality of records and to 
protect against any anticipated threats or hazards to their security or 
integrity which could result in substantial harm, embarrassment, 
inconvenience, or unfairness to any individual on whom information is 
maintained.''\16\
---------------------------------------------------------------------------
    \16\ 5 U.S.C.  552a(e)(10) (2010).

    The DHS program, as described in the agency's own documents, would 
involve collecting information, including Personally Identifiable 
Information (``PII''). While the agency acknowledges that PII are 
covered under the Privacy Act and seeks to limit some collection, the 
documents obtained by EPIC also reveal that there are several 
exceptions to the ``no PII'' rule, including allowances for collection 
of PII of anchors, newscasters, or on-scene reporters who . . . use 
traditional and/or social media.\17\ This would allow the agency to 
build files on bloggers and internet activists, in violation of the 
Privacy Act.
---------------------------------------------------------------------------
    \17\ DHS Social Media Monitoring Documents at 107.
---------------------------------------------------------------------------
    The Privacy Act imposes limitations on the dissemination of 
personal information collected by an agency. As EPIC has noted in its 
comments the DHS, the agency's social network and media monitoring 
program permits the collection and disclosure of information that 
contravenes the text and purpose of the Privacy Act.\18\ DHS has 
indicated that it plans to regularly relay the records to Federal, 
State, local, Tribal, territorial, foreign, or international government 
partners.\19\ The DHS Chief Privacy Officer (``CPO'') has stated that 
the records would be transferred both by ``email and telephone'' to 
contacts inside and outside of the agency.\20\ The CPO has also stated 
that ``[n]o procedures are in place'' to determine which users may 
access this system of records.\21\
---------------------------------------------------------------------------
    \18\ EPIC, Comments of the Electronic Privacy Information Center to 
the Department of Homeland Security ``Systems of Records Notice'' DHS-
2011-0003, March 3, 2011, available at: http://epic.org/privacy/
socialmedia/Comments%20on%20DHS-2011-0003-1.pdf.
    \19\ EPIC, Comments of the Electronic Privacy Information Center to 
the Department of Homeland Security ``Systems of Records Notice'' DHS-
2011-0003, March 3, 2011, available at: http://epic.org/privacy/
socialmedia/Comments%20on%20DHS-2011-0003-1.pdf; DHS Social Media 
Monitoring Documents at 139, 207.
    \20\ Department of Homeland Security, Privacy Impact Assessment for 
the Office of Operations Coordination and Planning Publicly Available 
Social Media Monitoring and Situational Awareness Initiative, 8, Jan. 
6, 2011.
    \21\ Department of Homeland Security, Privacy Impact Assessment for 
the Office of Operations Coordination and Planning Publicly Available 
Social Media Monitoring and Situational Awareness Initiative, 10, June 
22, 2010, DHS Social Media Monitoring Documents at 156, 145.
---------------------------------------------------------------------------
    DHS' program also fails to comply with Privacy Act requirements 
that agencies make ``reasonable efforts to assure that records are 
accurate, complete, timely, and relevant for agency purposes'' prior to 
their dissemination outside of the Federal Government. DHS has readily 
admitted that its social media monitoring initiative explicitly relies 
on unverified sources of information to construct the records that DHS 
will then disseminate to State, local, Tribal, territorial, foreign, or 
international government partners. As the DHS CPO has stated, ``[u]sers 
may accidentally or purposefully generate inaccurate or erroneous 
information. There is no mechanism for correcting this.''\22\ The 
agency unlawfully shifts responsibility for verifying the agency's 
information onto the social media users the agency plans to follow: 
``the community is largely self-governing and erroneous information is 
normally expunged or debated rather quickly by others within the 
community with more accurate and/or truthful information.''\23\
---------------------------------------------------------------------------
    \22\ DHS Social Media Monitoring Documents at 156, 145.
    \23\ DHS Social Media Monitoring Documents at 156, 145.
---------------------------------------------------------------------------
    As EPIC has previously stated in comments to DHS, the collection of 
information about individuals obtained from social networks and the 
monitoring of media organizations falls outside of the agency's 
statutory authority. The agency has failed to cite any statutory 
provision that would indicate that Congress gave the DHS authority to 
engage in intelligence collection, let alone to violate the 
Constitutional rights of individuals using the internet to express 
criticisms of the agency or the U.S. Government. In fact, the one 
statutory provision cited by the agency only allows the DHS Secretary 
to ``access, receive, and analyze law enforcement information, 
intelligence information, and other information from agencies of the 
Federal Government, State and local government agencies and private 
sector entities.'' (Emphasis added). It does not authorize the agency 
to initiate a program to gather or collect that information itself. The 
only relevant provision that does mention gathering narrows the term to 
``incident management decision making.''
    Hence, DHS' monitoring and gathering of social network and media 
information is not within the agency's delegated duties. DHS monitoring 
of stories or individuals that ``report adversely'' on the agency (or 
the Government more broadly) is even further outside of its delegated 
duties. The agency has failed to establish any legal basis for this 
program.\24\
---------------------------------------------------------------------------
    \24\ The Attorney General has established elaborate Guidelines for 
domestic investigations. The Attorney General Guidelines for Domestic 
FBI Investigations, available at www.justice.gov/ag/readingroom/
guidelines.pdf. While EPIC does not necessarily endorse the standards 
set out in the DIOG, we note that they require at a minimum a predicate 
that justifies a Federal investigation. Expressing criticism of the 
Government or a particular Federal agency alone can simply never be the 
basis for a Federal investigation under the Attorney General 
Guidelines.
        Circumstances Warranting Investigation
        A predicated investigation may be initiated on the basis of any 
of the following circumstances:
            a. An activity constituting a Federal crime or a threat to 
the National security has or may have occurred, is or may be occurring, 
or will or may occur and the investigation may obtain information 
relating to the activity or the involvement or role of an individual, 
group, or organization in such activity.
            b. An individual, group, organization, entity, information, 
property, or activity is or may be a target of attack, victimization, 
acquisition, infiltration, or recruitment in connection with criminal 
activity in violation of Federal law or a threat to the National 
security and the investigation may obtain information that would help 
to protect against such activity or threat.
            c. The investigation may obtain foreign intelligence that 
is responsive to a foreign intelligence requirement.
    Id. at 21. See, generally, EPIC, ``The Attorney General 
Guidelines,'' available at http://epic.org/privacy/fbi/
---------------------------------------------------------------------------
                      iii. epic's recommendations
    The problems described above are significant and far-reaching. An 
agency that was established to help protect the United States against 
future foreign attacks is now deploying its significant resources to 
monitor political opposition and the work of journalists within the 
United States. It has no legal basis to do so, and in pursuing the 
monitoring of social networks and media organizations for activities 
that ``reflect adversely'' on the agency and the U.S. Government, it 
has transformed its purpose from protecting the American public to 
protecting simply itself.
    We specifically recommend that the subcommittee take the following 
steps to address the immediate risks to Constitutional liberty:
   Require that the DHS immediately and permanently cease the 
        practice of monitoring social networks and media organizations 
        for the purpose of identifying political and journalistic 
        activities that ``reflect adversely'' on the agency or the 
        Federal Government.
   Require that the DHS suspend the social network and media 
        organization monitoring program until safeguards are put into 
        place which will ensure oversight, including annual reporting 
        requirements.
   Require that other agencies, including the Federal Bureau of 
        Investigation, which have developed or are in the process of 
        developing similar programs provide publicly available, annual 
        reports to Congress that set out in the detail the legal 
        standard for this activity and describe how Constitutional 
        rights will be safeguarded.
                             iv. conclusion
    EPIC respectfully requests that the subcommittee take the steps 
outlined in this statement, including requiring the immediate and 
permanent end to DHS' practice of monitoring for dissent; adopting 
guidelines for greater oversight of the DHS' social network and media 
monitoring program, and imposing the same oversight requirements on 
similar social network and media monitoring programs at other agencies.
    Thank you for your consideration of our views. We would be pleased 
to provide any further information the Committee requests.

    Mr. Meehan. Now, for all panelists, I know you gave us some 
detailed testimony in written form. If you could do your best 
to summarize your submitted testimony, we would appreciate 
that.
    I now welcome back Ms. Callahan and recognize her first for 
her testimony.
    Thank you.

   STATEMENT OF MARY ELLEN CALLAHAN, CHIEF PRIVACY OFFICER, 
                DEPARTMENT OF HOMELAND SECURITY

    Ms. Callahan. Thank you very much, sir.
    Good morning. Chairman Meehan, Ranking Member Speier, 
Ranking Member Thompson, and Members of the committee, thank 
you for this opportunity to discuss the Department of Homeland 
Security's uses of social media and the privacy protections my 
office has embedded into all of these uses.
    As described in our written testimony, communications and 
social media provide important benefits to the American public 
and to the Department. With that said, as the Chairman and the 
Ranking Member acknowledged, there is a great deal of personal 
information that, although publicly available, is not necessary 
for the Department to see or use.
    Let me be clear: DHS recognizes the use of social media by 
Government actors must occur with appropriate privacy, civil 
rights, and civil liberties protections. For this reason, DHS 
has created Department-wide standards designed to protect 
privacy in each category of its use.
    There are essentially three uses of social media by the 
Department of Homeland Security: First, external communications 
and outreach between the Department and the public; second, 
awareness of breaking news and events and situations related to 
homeland security, known as situational awareness; and third, 
when DHS has the appropriate authorities to use social media 
for operational use such as law enforcement and investigations. 
In each category, the Department has established standards that 
are designed to incorporate privacy protections ex ante, to 
create uniform standards across the components and Department, 
and to be transparent about the scope of our activities.
    The Department utilizes the opportunity social networking 
presents to provide the public with robust information. For 
example, DHS has a presence on many of the major social 
networking platforms. FEMA, of course, is well-known for 
utilizing social media effectively for education and in 
emergencies.
    DHS established Department-wide standards for use of social 
media for communications and outreach purposes through the 
development and publication of two Privacy Impact Assessments, 
known as PIAs. All DHS profiles and communications via social 
media must adhere to these PIAs.
    As my colleague Mr. Chavez will describe, the Office of 
Operations Coordination and Planning has a statutory 
responsibility to provide situational awareness and establish a 
common operating picture for the Federal Government. The 
Privacy Office and Operations work together closely and develop 
detailed standards and procedures associated with reviewing 
social media, launched three pilots, and then did a privacy 
compliance review of those pilots. Together, the National 
Operations Center and the Privacy Office designed a holistic 
set of privacy protections to be implemented whenever social 
media is being reviewed for situational awareness, and then 
memorialized them in a publicly available PIA in June 2010.
    Several months later, as part of a mandated privacy 
compliance review, my office determined that the PIA should be 
updated to allow for the collection and dissemination of 
personally identifiable information in a very limited number of 
situations. After January 2011, limited personally identifiable 
information on a few categories of individuals may be collected 
only when it lends credibility to the report or facilitates 
coordination. The categories are essentially: Public figures 
who make public statements or are part of an event; or people 
who are in potential life-or-death circumstances.
    The first weekend that personally identifiable information 
was allowed to be collected and disseminated was the weekend 
that Congresswoman Giffords was shot in Arizona. Learning 
immediately who was the impacted Member of Congress was very 
useful for the Department, for the Federal Government, and 
facilitated rapid coordination.
    There may also be situations where particular programs 
within the Department or its components may need to access 
material on social media or individual profiles in support of 
authorized missions such as law enforcement. Given the breadth 
of the Department's mission and the fact that access, 
collection, and use of social media or other publicly available 
information is governed by specific legal authorities rather 
than Department-wide standards, the Department takes a 
different approach to embedding privacy protections into this 
type of social media, implementing privacy protections through 
a policy and management directive.
    The Department is finalizing a management directive for 
privacy protections in the operational use of social media, 
which will systematize the previous component policies, be 
enforceable throughout the Department, and will identify the 
authorities, restrictions, and privacy oversight related to the 
use of social media for operational purposes. The directive 
will also provide instructions on how to embed privacy 
protections into the operational use of social media and in 
each investigation performed by Departmental personnel. 
Essentially, the standard is, if you can't do it off-line, you 
can't do it on-line.
    In light of the scope and availability of information, 
including personal information, found in social media, the 
Privacy Office intends to continue to monitor the Department's 
use of social media in all three categories. The Department has 
established a comprehensive compliance regime. It is every 
employee's responsibility to adhere to those standards, and the 
Privacy Office will seek to confirm that compliance in order to 
protect the public's trust in the Department's use of social 
media.
    Thank you, sir.
    [The joint statement of Ms. Callahan and Mr. Chavez 
follows:]
   Joint Prepared Statement of Mary Ellen Callahan and Richard Chavez
    Chairman Meehan, Ranking Member Speier, and Members of the 
subcommittee, we appreciate the opportunity to be here today to discuss 
the Department of Homeland Security's (DHS) use of social media, and 
the privacy protections the DHS Privacy Office has put into place.
    Social media are web-based and mobile technologies that turn 
communication into an interactive dialogue in a variety of on-line 
fora. It may be appropriate for the Government, including DHS, to use 
social media for a variety of reasons. The President has challenged his 
administration to use technology and tools to create a more efficient, 
effective, and transparent Government.\1\ DHS recognizes that the use 
of social media by Government actors must occur with appropriate 
privacy, civil rights, and civil liberties protections; whether DHS is 
disclosing its information and press releases via social media 
platforms like Twitter and Facebook, reviewing news feeds for 
situational awareness, or researching identified, discrete targets for 
legitimate investigatory purposes. Accordingly, DHS has created 
Department-wide standards designed to protect privacy, civil rights, 
and civil liberties in each category of its use.
---------------------------------------------------------------------------
    \1\ President Barack Obama, Memorandum on Transparency and Open 
Government (January 21, 2009), available at http://www.gpoaccess.gov/
presdocs/2009/DCPD200900010.pdf; OMB Memorandum M-10-06, Open 
Government Directive (December 8, 2009), available at http://
www.whitehouse.gov/omb/assets/memoranda_2010/m10-06.pdf.
---------------------------------------------------------------------------
    There are three general ways in which DHS utilizes social media, 
and each has associated privacy protections:
   External communications and outreach between the Department 
        and the public;
   Awareness of breaking news of events or situations related 
        to homeland security, known as ``situational awareness;'' and
   Operational use, when DHS has the appropriate authorities, 
        such as law enforcement and investigations.
    In each category, the Department has established and enforces 
standards that incorporate privacy protections ex ante, create uniform 
standards across the components and Department, and are transparent 
with regard to the scope of our activities.
                  external communications and outreach
    Consistent with the President's 2009 Memorandum on Transparency and 
Open Government, the Office of Management and Budget's (OMB) Open 
Government Directive \2\ and OMB's Memorandum M-10-23, Guidance for 
Agency Use of Third-Party Websites and Applications,\3\ the Department 
uses the social networking medium to provide the public with robust 
information through many channels. For example, DHS currently has a 
presence on many of the major social networking platforms, including 
Facebook, Twitter, and YouTube. In addition, FEMA launched a FEMA app 
for smartphones that contains preparedness information for different 
types of disasters. Similarly, the Transportation Security 
Administration has MyTSA Mobile Application, which enables the 
traveling public access to relevant TSA travel information, such as 
types of items that may be carried through TSA security checkpoints, or 
estimated wait times.
---------------------------------------------------------------------------
    \2\ See supra note 1.
    \3\ http://www.whitehouse.gov/sites/default/files/omb/assets/
memoranda_2010/m10-23.pdf.
---------------------------------------------------------------------------
    In 2009, the Department established a Social Media Advisory Group, 
with representatives from the Privacy Office; Office of General 
Counsel; Chief Information Security Officer; Office of Records 
Management; and Office of Public Affairs to ensure that a variety of 
compliance issues including privacy, legal, security, and records 
management issues are addressed as DHS uses social media. This group 
governs and provides guidance on social media initiatives related to 
external communications and public outreach by reviewing 
recommendations from Components and offices and evaluating Terms of 
Service agreements and Terms of Use policies. The group also developed 
a social media use plan, while working to ensure compliance issues are 
addressed and resolved before the first Department use of a particular 
application of social media.
    DHS also established Department-wide standards for use of social 
media for communications and outreach purposes through the creation, 
and development of, two Privacy Impact Assessments (PIAs). The PIAs 
address two types of uses of social media within the communications/
outreach category: (1) Interactive platforms where the Department has 
official identities, using those profiles to provide information about 
the Department and its services, while having the ability to interact 
with members of the public such as allowing them to post comments on 
the official Department page or profile;\4\ and (2) unidirectional 
social media applications encompassing a range of applications, often 
referred to as applets or widgets, that allow users to view relevant, 
real-time content from predetermined sources, such as podcasts, Short 
Message Service (SMS) texting, audio and video streams, and Really 
Simple Syndication (RSS) feeds.\5\
---------------------------------------------------------------------------
    \4\ http://www.dhs.gov/xlibrary/assets/privacy/privacy_pia-
dhs_socialnetworkinginter- 
actions.pdf.
    \5\ http://www.dhs.gov/xlibrary/assets/privacy/
privacy_pia_dhswide_unidirectionalsocial- media.pdf.
---------------------------------------------------------------------------
    The PIAs analyze the Department's use of social media and 
networking for communications purposes, if and how these interactions 
and applications could result in the Department receiving personally 
identifiable information (PII), and the privacy protections in place. 
The PIAs describe the information the Department may have access to, 
how it will use the information, what information is retained and 
shared, and how individuals can gain access to and correct their 
information. For example, official DHS accounts across social media and 
networking websites and applications must be identified by the 
component or Department seal as well as an anonymous, but easily 
identifiable user name account displaying a DHS presence, such as ``DHS 
John Q. Employee.'' Both the communications and outreach PIAs also 
include periodically-updated appendices that identify the specific 
Department-approved profiles and applications. In addition, the PIAs 
contain provisions that Department-approved profiles are subject to 
Privacy Compliance Reviews by the DHS Privacy Office.
                         situational awareness
    The Office of Operations Coordination and Planning (OPS), National 
Operations Center (NOC), has a statutory responsibility (Section 515 of 
the Homeland Security Act (6 U.S.C.  321d(b)(1))) to provide 
situational awareness and establish a common operating picture for the 
Federal Government, and for State, local, Tribal governments as 
appropriate, in the event of a natural disaster, act of terrorism, or 
other man-made disaster, and (2) ensure that critical terrorism and 
disaster-related information reaches Government decision-makers. 
Traditional media sources, and more recently social media sources, such 
as Twitter, Facebook, and a vast number of blogs, provide public 
reports on breaking events with a potential nexus to homeland security. 
By examining open-source traditional and social media information, 
comparing it with many other sources of information, and including it 
where appropriate into NOC reports, the NOC can provide a more 
comprehensive picture of breaking or evolving events. To fulfill its 
statutory responsibility to provide situational awareness and to access 
the potential value of the public information within the social media 
realm, in 2010, the NOC launched the first of three pilots using social 
media monitoring related to specific natural disasters and 
international events.
    Beginning with the pilots, the reason the NOC utilizes social media 
tools is to identify breaking or evolving incidents and events to 
provide timely situational awareness and establish a more complete 
common operating picture. The NOC views information from a variety of 
sources to include open-source reporting and a variety of public and 
Government sources. The NOC synthesizes these reports for inclusion in 
a single comprehensive report. These reports are then disseminated to 
DHS components, interagency partners, and State, local, Tribal, 
territorial, and private-sector partners with access to the NOC's 
common operating picture. The content of the reports may be related to 
standing critical information requirements, emerging events potentially 
affecting the homeland, or special events such as the Super Bowl or the 
United Nations General Assembly.
    Prior to implementing each social media pilot, the Privacy Office 
and the Office of Operations Coordination and Planning developed 
detailed standards and procedures associated with reviewing information 
on social media websites. These standards and procedures are documented 
through a series of pilot-specific PIAs.\6\
---------------------------------------------------------------------------
    \6\ The NOC and the Privacy Office developed three PIAs in the 
pilot stage of the NOC Media Monitoring Initiative: Haiti Social Media 
Disaster Monitoring Initiative, January 21, 2010, available at http://
www.dhs.gov/xlibrary/assets/privacy/privacy_pia_ops_haiti.pdf; 2010 
Winter Olympics Social Media Event Monitoring Initiative February 10, 
2010, available at http://www.dhs.gov/xlibrary/assets/privacy/
privacy_pia_ops_2010winterolympics.pdf; and April 2010 BP Oil Spill 
Response Social Media Event Monitoring Initiative, April 29, 2010, 
available at http://www.dhs.gov/xlibrary/assets/privacy/
privacy_pia_ops_bpoilspill.pdf.
---------------------------------------------------------------------------
    The NOC pilots occurred during the 2010 Haiti earthquake response, 
the 2010 Winter Olympics in Vancouver, British Columbia; and the 
response to the April 2010, Deepwater Horizon Gulf Coast oil spill. For 
each of these pilots, the NOC utilized internet-based platforms to 
provide situational awareness and develop a common operating picture 
directly related to the response, recovery, and rebuilding efforts in 
Haiti by reviewing information on publicly-available on-line fora, 
blogs, public websites, and message boards.
    Following the three discrete social media monitoring pilots by the 
NOC, the Privacy Office did a thorough (and public) Privacy Compliance 
Review of the NOC's implementation of the PIAs' privacy protections.\7\ 
The Privacy Office's review found that the NOC's social media 
monitoring activities did not collect PII, did not monitor or track 
individuals' comments, and complied with the stated privacy parameters 
set forth in the underlying PIAs.
---------------------------------------------------------------------------
    \7\ http://www.dhs.gov/xlibrary/assets/privacy/privacy-privcomrev-
ops-olympicsandhaiti.pdf. Three Privacy Compliance Reviews have been 
completed and published by the Privacy Office, available at: http://
www.dhs.gov/files/publications/gc_1284657535855.shtm.
---------------------------------------------------------------------------
    Given the positive assessment of the three pilots, OPS and the 
Privacy Office designed a holistic set of privacy protections to be 
implemented whenever information made available through social media is 
being reviewed for situational awareness and establishing a common 
operating picture. In June 2010, the Department released its Publicly 
Available Social Media Monitoring and Situational Awareness Initiative 
PIA, incorporating these protections.\8\ This PIA describes how the NOC 
uses internet-based platforms that provide a variety of ways to review 
information accessible on publicly-available on-line fora, blogs, 
public websites, and message boards. Through the use of publicly-
available search engines and content aggregators, the NOC reviews 
information accessible on certain heavily-trafficked social media sites 
for information that the NOC can use to provide situational awareness 
and establish a common operating picture, all without monitoring or 
tracking individuals' comments or relying on the collection of PII, 
with very narrow exceptions, discussed below.
---------------------------------------------------------------------------
    \8\ http://www.dhs.gov/xlibrary/assets/privacy/
privacy_pia_ops_publiclyavailablesocial- media.pdf.
---------------------------------------------------------------------------
    The NOC does not: (1) Actively seek PII except for the narrow 
exceptions; (2) post any information on social media sites; (3) 
actively seek to connect with internal/external social media users; (4) 
accept internal/external personal users' invitations to connect; or (5) 
interact on social media sites. The NOC is, however, permitted to 
establish user names (consistent with the criteria established in the 
communications and outreach PIAs) and passwords to form profiles and 
follow relevant Government, media, and subject matter experts on social 
media sites as described in the June 2010 PIA; and to use search tools 
under established criteria and search terms that support situational 
awareness and establishing a common operating picture.
    As part of the publication of the June 2010 PIA, the Privacy Office 
mandates Privacy Compliance Reviews every 6 months. After conducting 
the second Privacy Compliance Review, the Privacy Office determined 
that this PIA should be updated to allow for the collection and 
dissemination of PII in a very limited number of situations in order to 
respond to the evolving operational needs of the NOC. After January 
2011, this PII on the following categories of individuals may be 
collected when it lends credibility to the report or facilitates 
coordination with Federal, State, local, Tribal, territorial, and 
foreign governments, or international law enforcement partners:
    (1) U.S. and foreign individuals in extremis, i.e., in situations 
        involving potential life or death circumstances;
    (2) Senior U.S. and foreign government officials who make public 
        statements or provide public updates;
    (3) U.S. and foreign government spokespersons who make public 
        statements or provide public updates;
    (4) U.S. and foreign private-sector officials and spokespersons who 
        make public statements or provide public updates;
    (5) Names of anchors, newscasters, or on-scene reporters who are 
        known or identified as reporters in their posts or articles, or 
        who use traditional and/or social media in real time to provide 
        their audience situational awareness and information;
    (6) Current and former public officials who are victims of 
        incidents or activities related to homeland security; and
    (7) Terrorists, drug cartel leaders, or other persons known to have 
        been involved in major crimes of homeland security interest, 
        (e.g., mass shooters such as those at Virginia Tech or Ft. 
        Hood) who are killed or found dead.\9\
---------------------------------------------------------------------------
    \9\ The most recent PIA update (authorizing these narrow PII 
categories collection) was finalized January 6, 2011, and is available 
at: http://www.dhs.gov/xlibrary/assets/privacy/
privacy_pia_ops_publiclyavailablesocialmedia_update.pdf.
---------------------------------------------------------------------------
    For this narrow category of individuals, DHS may only collect the 
full name, affiliation, position or title, and publicly-available user 
ID, when it lends credibility to the report. DHS determined that this 
information improves the efficacy and effectiveness of the social media 
monitoring initiative without an unwarranted invasion of privacy of 
individuals in each of these categories. For this narrow category of 
individuals the PII is only stored in the narrative report in which it 
is used, and is not tracked for any other reason. DHS published a 
System of Records Notice \10\ that describes the creation of these 
seven exceptions for the collection of PII and narrowly tailored, how 
much information can be collected, and how the information can be used. 
Furthermore, the Privacy Office is commencing its semi-annual Privacy 
Compliance Review in late February to ensure that the NOC continues to 
adhere to the privacy protections identified in the PIA.
---------------------------------------------------------------------------
    \10\ http://edocket.access.gpo.gov/2011/2011-2198.htm.
---------------------------------------------------------------------------
                            operational use
    There may be situations where particular programs within the 
Department or its components may need to access material on social 
media or individual profiles in support of authorized missions. Given 
the breadth of the Department's mission, and the fact that access, 
collection, and use of social media and other publicly-available 
information is governed by specific legal authorities, rather than 
Department-wide standards, the Department has taken a different 
approach in embedding privacy protections into Department use of social 
media for operational purposes, with authority-based requirements 
implemented through policy and Management Directives. For example, 
components of DHS such as U.S. Customs and Border Protection, U.S. 
Immigration and Customs Enforcement, Federal Protective Service, 
Federal Air Marshals Service, U.S. Coast Guard, and U.S. Secret Service 
have the authority to engage in law enforcement activities which may 
include the use of on-line and internet materials. Other DHS offices 
and components may be authorized to utilize social media for specific 
law enforcement purposes such as investigating fraud. The Office of 
Intelligence and Analysis also has some overt collection authorities 
for intelligence purposes which may include the use of on-line and 
internet materials.
    DHS has established objective criteria by which those investigatory 
components can access publicly-available information. DHS components 
cannot review individuals' information unless they have appropriate 
underlying authority and supervisory approval. Moreover, Office of 
Operations Coordination and Planning and Office of Intelligence and 
Analysis have additional specific policies on the use of social media 
for operational purposes. One of DHS' responsibilities is to confirm 
our work is being done under the appropriate legal framework for 
Federal law enforcement activities. However, with increased access to 
individuals' personal information posted on the internet and social 
media sites, these DHS components have been reminded that they must 
also be conscious of privacy considerations.
    At DHS, we work every day to strike a balance between our need to 
use open-source internet and social media information for all purposes, 
but particularly law enforcement and investigatory purposes to further 
our mission, while protecting First Amendment rights, Fourth Amendment 
rights, and privacy.
    In 1999, the Department of Justice issued guidelines for Federal 
law enforcement agents that outline on-line investigative principles 
that are applicable, but do not explicitly reference, social media. In 
2011, the Office of the Director of National Intelligence issued 
guidelines that outline how intelligence community professionals should 
use technology, including social media. Both guidelines address the 
following topics: Obtaining information from publicly-available media 
under the same conditions that apply to obtaining information from 
other sources generally open to the public; passively observing and 
logging real-time electronic communications on media open to the public 
under the same circumstances in which these activities could be 
undertaken when attending a public meeting; and retaining the contents 
of a stored electronic message, such as on-line traffic, if that 
information would have been retained had it been written on paper. 
Moreover, Federal law enforcement agents communicating on-line with 
witnesses, subjects, or victims must disclose their affiliation with 
law enforcement when DHS guidelines would require such disclosure if 
the communication were taking place in person or over the telephone--
they may communicate on-line under a non-identifying name or fictitious 
identity if DHS guidelines and procedures would authorize such 
communications in the physical world.\11\ Finally, Federal law 
enforcement agents may not access restricted on-line sources absent 
legal authority permitting entry into a private space. Until a 
Department-wide Management Directive on using social media for 
operational purposes is finalized, the Secretary has instructed all 
components to adhere to the DOJ or ODNI guidelines as appropriate.
---------------------------------------------------------------------------
    \11\ See, e.g., On-line Investigative Principles for Federal Law 
Enforcement Agents (Department of Justice, 1999) and Civil Liberties 
and Privacy Guidance for Intelligence Community Professionals: Properly 
Obtaining and Using Publicly Available Information (Office of the 
Director of National Intelligence, 2011).
---------------------------------------------------------------------------
    In light of the varying authorities and responsibilities within the 
Department, instead of having a Privacy Impact Assessment with general 
standards (such as for communications and situational awareness 
purposes), the Department is developing a Management Directive for 
Privacy Protections in Operational Use of Social Media. The Management 
Directive will be enforceable throughout the Department, and will 
identify the authorities, restrictions, and privacy oversight related 
to use of social media for operational purposes. The Management 
Directive will also provide instructions on how to embed privacy 
protections into the operational use of social media and each 
investigation performed by Department personnel. The Privacy Office has 
already investigated one component's use of social media for 
investigatory purposes; its conclusions are informing the Management 
Directive.
    Consistent with the Department's approach to embed privacy 
protections throughout the life cycle of Department activities, the 
Privacy Office will conduct a Privacy Compliance Review or assessment 
of the Department's adherence to the social media Management Directive 
approximately 6 months after the Directive is implemented.
                               conclusion
    In light of the scope and availability of information including PII 
found in social media venues, the Privacy Office intends to continue to 
monitor the Department's use of social media in all three categories--
communications and outreach, situational awareness, and operational 
use--to ensure privacy protections are built-in and followed.

    Mr. Meehan. Thank you, Ms. Callahan.
    Now I recognize Mr. Chavez for his testimony.

  STATEMENT OF RICHARD CHAVEZ, DIRECTOR, OFFICE OF OPERATIONS 
   COORDINATION AND PLANNING, DEPARTMENT OF HOMELAND SECURITY

    Mr. Chavez. Good morning, Chairman Meehan, Ranking Member 
Speier, and Members of the subcommittee. I also would like to 
thank you for inviting me here today to talk to you about the 
National Operations Center use of social media monitoring to 
provide real-time or near-real-time situational awareness of 
potential occurring events or incidents that may impact the 
safety, security, and resilience of the homeland.
    As stated in Section 515 of the Homeland Security Act, as 
amended, the National Operations Center is the principal 
operations center for the Department of Homeland Security and 
shall provide situational awareness and a common operating 
picture for the entire Federal Government and for State, local, 
and Tribal governments as appropriate in the event of a natural 
disaster, act of terrorism, or other man-made disaster, and 
ensure that critical terrorism and disaster-related information 
reaches Government decision-makers.
    In order to fulfill these statutory responsibilities, the 
National Operations Center, also known as the NOC, gathers 
reports from multiple sources, to include open-source media 
reporting. Media reporting is often the first indication of a 
potential incident. For this reason, the NOC utilizes and 
incorporates media reporting into its incident reports. The 
primary focus of our reporting is on what is happening, and not 
who is reporting the event.
    As previously stated, the NOC gathers reports from a 
variety of sources and synthesizes them into one single 
comprehensive incident report that is distributed again to the 
DHS leadership, DHS components, and other Federal, State, 
local, Tribal, territorial, and non-governmental and private-
sector partners for action as appropriate.
    The after-action assessments relating to the Government's 
response during Hurricane Katrina highlighted the importance of 
real- and near-real-time information from media reporting to 
enable a more timely response during a dynamic catastrophic 
event. In 2006, following Hurricane Katrina, the NOC began 
assessing the incorporation of media reporting for major media 
networks into incident reports to provide responders with real-
time information. To date, incorporating media reporting into 
the NOC's incident reports has enabled our partners to have 
greater awareness during events and incidents.
    Here is a real-world example of how the NOC incorporates 
media reporting. In early January 2012, the media in Charlotte, 
North Carolina, was first on scene reporting damage after 
severe weather erupted across multiple counties near Charlotte. 
The media reports were combined with reporting from State and 
local sources. The end result, again, was a more timely 
incident report that provided specific and comprehensive 
information to our partners, enabling them to make informed 
decisions.
    The NOC incorporates media reporting into incidents across 
the full spectrum of Homeland Security operations: Prevent and 
protect, respond and recover.
    Another real-world example of how NOC incorporates media 
reporting into its incident reports also occurred in early 
January 2012. The incident occurred in Austin, Texas. The media 
in Austin posted incident information about evacuation of a 
high school after a suspicious device was seen in a vehicle on 
campus. The media reported that, according to county sheriff's 
office spokesmen, sheriff's deputies were responding to an 
explosive device in a car. Through additional Government 
reporting, the NOC learned that the scene was secured and that 
no explosive device was found by law enforcement officials.
    Again, I would like to emphasize that it is the ``what,'' 
not the ``who,'' that is relevant for NOC reporting purposes. 
The NOC adheres to strict enforcement of privacy guidelines 
with regard to media reports. The NOC, in coordination with the 
DHS Office of Privacy, evaluates processes and incident reports 
on a recurring basis to ensure our privacy guidelines are being 
complied with.
    Again, thank you for the opportunity to speak with you 
today, and I am happy to answer any questions you may have.
    Mr. Meehan. Well, thank you for your testimony, Mr. Chavez.
    As I said in my opening statement, I am concerned about 
some of the news reports and materials related to DHS 
monitoring of social media and the networks. So I will now 
recognize myself for a few minutes of questioning.
    The testimony has been revealing in the sense of giving us 
the overall perspective. I think all of us appreciate the 
ability for the Governmental entities to broadcast through the 
various pieces so people know about what you are doing.
    Mr. Chavez, you talked a lot about, sort of, media 
monitoring. There is an expectation on the part of many of 
those who are reporters and otherwise, they know they are 
putting their product out so that it can be reviewed. So I 
think we can go past those kinds of things.
    We also appreciate, as I said in my opening statement, 
about the opportunity to avail ourselves in real time of 
breaking information that can be communicated in certain ways 
that are now available so that there is the ability to keep 
those that need to make the decisions up on the latest 
information.
    But you are sensitive--we are here today because where we 
are trying to find is where that line is where the public 
citizen--it is not just the expectation of privacy, because we 
know they are communicating in public fora or even quasi-public 
fora. But we are talking now about monitoring on-line 
information in blogs, in websites, in message boards. Some of 
these have, you know, the indicia of, sort of, quasi-privacy 
communities, so to speak.
    So my real question for you is to help us understand what 
you are doing to assure that individual communication is not 
leading to individuals being identified by the Government and 
what you are doing to assure that we are not creating a 
chilling effect so that somebody in a community who is 
concerned about a particular issue will be more reluctant to 
write a letter to the editor, to post something on a blog.
    I will close my opening comments--and I know you have come 
prepared to answer these, but we are all very concerned about a 
couple of the circumstances that have happened. Most 
specifically, what looks as if it is a directive within the 
contract you have with a private contractor who is employed to 
help you disseminate or gather information. It is identifying 
media reports that reflect adversely on the U.S. Government, 
DHS, or prevent, protect, respond, or recovery activities. So, 
in effect, we are asking somebody to go out and let us know 
what people are saying that is negative about us. This appears 
to be what was asked for in the contract with General Dynamics.
    So I would like you to tell me what it is that we are doing 
to assure that private commentary is not being misused and what 
we can do to assure that the activities of monitoring are not 
going to create some kind of a chilling effect on individuals' 
willingness and readiness, not only to comment, but, frankly, 
to make comments which may be critical of the Government.
    Ms. Callahan.
    Ms. Callahan. Thank you, sir.
    With regard to the privacy protections that the Department 
has implemented specifically with regard to situational 
awareness, to be very clear, as Mr. Chavez said, it is the 
``what,'' not the ``who,'' that is being identified and that we 
are concerned with.
    As you are aware, my office not only mandated privacy 
compliance reviews every 6 months to make sure that indeed we 
are just focusing on the event, on the situation, to know what 
is going on, and not worried about the individual; in addition 
to that, the National Operations Center has very robust 
auditing capability, that they go and review both the sites 
that are being done, how long they are on it, and what 
information is being implemented into the report.
    We take these issues very seriously, sir. We absolutely 
understand and agree that these are----
    Mr. Meehan. Who is directing what is being monitored?
    Ms. Callahan. Mr. Chavez.
    Mr. Chavez. The key words, I guess, or the mechanism that 
we use to identify information that is coming across the media, 
whether it be social or the traditional media that is out 
there, again, these are key words associated with events that 
have happened in the past and also with the equities of the 
Department of Homeland Security, again, looking at the safety, 
security, and resilience missions that are out there.
    So, as you said in your opening statement, I believe, that 
there are any number of blogs going on at any one time and a 
plethora of information that is flowing through there, there is 
no way we could look at all of it. So we use the tools, again, 
with these keyword searches that are commercially available for 
looking at search items, particularly, again, keywords, that we 
can pull out of there and look at, again, what the situation is 
that is evolving.
    Mr. Meehan. But you are looking at keywords, but my 
question is, are there circumstances under which--who is the 
one that is waking up in this vast array of information out 
there? Because the limited number of people that you have 
working for you, unquestionably, without some sense of 
direction, they could be spending limitless time, in effect, 
floating on a sea without any kind of product that is produced.
    So there has to be some sense of direction. Where does the 
line get drawn with regard to overlooking, sort of, general 
words out there versus looking at specific incidents, specific 
issues, and identifying people, as happened in Michigan?
    Mr. Chavez. There are guidelines for sites that the 
individuals within the Media Monitoring Center can monitor. 
Again, those sites are submitted for approval through the 
Privacy Office, and they are strictly adhered to by the 
individuals who are actually looking at the information that is 
coming across there and gathering them for us.
    So there is a series of checks and balances.
    Ms. Callahan. If I can, sir, in order to be transparent 
about this, in the Privacy Impact Assessment we have a list of 
the representative keywords. The Privacy Office reviews that 
list every 6 months and makes sure that we stay within it. The 
list is ``disaster,'' it is, you know, ``flood,'' ``tornado,'' 
and things like that.
    With regard to individuals, as I indicated in my oral 
testimony, we don't collect information on individuals. We do 
not monitor them with regard to any First Amendment activity. 
But individuals may be the first person at the scene, and so 
they may go and report there has been a train derailment in 
Michigan. We do not then go and say that, ``Mary Ellen Callahan 
reported a train derailment.'' We then corroborate it with 
another source that is identified----
    Mr. Meehan. My time has expired, so I am hoping some others 
will pick this up.
    We know about the disasters. I don't think we are worried 
about the disasters. What we are worried about are the 
individual circumstances where there may be issues out there. I 
point back again to the Michigan circumstance where there was a 
controversial decision by the Government, and DHS played a role 
in assessing community response to that incident. That wasn't a 
natural disaster; that was an incident that was created by the 
Government, and the Government then was monitoring the 
community response.
    That is where I want to--who is going to make the 
decisions? Who is making the protections against circumstances 
under which the Government is playing a role in not just 
analyzing but filtering back, recording, and reporting about 
things that people in the community have said about 
Governmental activity?
    Ms. Callahan. I would be happy to answer the Standish 
question whenever the Members have given me the time to do so.
    Mr. Meehan. Thank you so much.
    I will turn it over to the Ranking Member, Ms. Speier.
    Ms. Speier. Thank you, Mr. Chairman.
    I am deeply troubled by the document that has just been put 
into the record by EPIC.org. While you have probably not had 
the opportunity yet to review it, Mr. Chairman, I would like to 
request that after they do review it, that they report back to 
this committee and provide us with answers to the questions 
raised. But I am going to start with a couple of them.
    They made a FOIA request back in April. DHS ignored it. 
Then EPIC filed a lawsuit on December 23, 2011, when the agency 
failed to comply with the FOIA deadlines. As a result of filing 
the lawsuit, DHS disclosed to EPIC 285 pages of documents.
    So I am just making note of that. You shouldn't stonewall. 
When a FOIA request is made, you should comply with it within 
the deadlines. No entity should be required then to file a 
lawsuit. So I am just putting you on notice about that.
    But what is interesting about what they have pointed out is 
that, while you say there is no personally identifiable 
information in this contract that General Dynamics has, in fact 
they point out that there are some exceptions to the no-PII 
rule. One of them allows for the collection of personally 
identifiable information of anchors, newscasters, or on-scene 
reporters who use traditional and/or social media. This would 
allow the agency to build files on bloggers and internet 
activists, in violation of the Privacy Act.
    I find that outrageous. I would like to ask you to amend 
the contract with General Dynamics to exempt that kind of 
information from being collected.
    Ms. Callahan. First, ma'am, with regard to the FOIA 
response, I completely agree. It did not meet my standards in 
terms of the timeliness of the response, and I have taken 
action to look into why it was delayed. That was unacceptable, 
and I completely concur with your statement.
    With regard to the reporters, to clarify, the reporter's 
information is collected--and, as noted in my written 
testimony, the only information we collect on the reporters, if 
at all, is the name, their affiliation, their title, if any, 
and their publicly available identification. We are only 
collecting the information if it adds to the credibility of the 
report or allows coordination.
    So it is very rare that we actually collect any information 
about the reporters. But it could be a circumstance where you 
link to a reporter's blog who is at a news site. For example, 
in Michigan and the train derailment, if the person posted it 
on his personal blog, we may be authorized to link to it. We 
would not be authorized to collect it or use it for a 
personal--an individual, but only if the reporter is relevant 
and adds credibility to the report itself.
    Furthermore----
    Ms. Speier. I am----
    Ms. Callahan [continuing]. To clarify, ma'am, just to 
clarify, the reporter information is only stored in that 
report. We are not cutting across the different reports. We are 
not saying how many different reporters do it. It is 
information that is publicly available, and it is not 
associated with their opinions but instead with the situation 
or the event that is occurring.
    Ms. Speier. I am suggesting to you that it is irrelevant, 
you do not need it, and you should suspend that part of the 
contract.
    Now, this document also suggests that you are capturing 
public reaction to major Government proposals. Now, again, if 
this is, in fact, true, if this is part of the contract, I 
believe that should be suspended as well. This is not a 
political operation; it should not be a political operation. 
Capturing public reaction to major Government proposals is not 
something you should be doing.
    Ms. Callahan. I completely agree with you, ma'am. I 100 
percent agree with you, which is why the report that they point 
to on page 118 in the FOIA report actually was never a live 
report. It was never disseminated by the National Operations 
Center. It would not have met the privacy standards that are in 
the five publicly available Privacy Impact Assessments we have 
done. Furthermore, it is an example of an early August 2009 
example of what could be possible. We, together with the 
National Operations Center, agreed that that is well outside 
the scope.
    In fact, if you look at the document, it is within a very 
early, February 2010, training manual as an identification of a 
weekly report, because it is a compilation of other elements. 
If you look at the previous pages, you can see that they 
identify, like, ``This is not acceptable,'' ``This is not 
appropriate,'' ``Redact the personally identifiable 
information.''
    That Standish, Michigan, report is one that only appears--
actually, the only place it exists in the Department is in my 
files because of the privacy compliance review we did before 
launching the initiative. It is----
    Ms. Speier. All right. My time is about to expire, so let 
me suggest the following. EPIC makes three recommendations at 
the end of their report. They recommend you cease collecting 
information on journalists' activities, that you suspend the 
social network and media organization monitoring program until 
safeguards are put in place, and that you comply with providing 
Congress with an annual report that sets out in detail the 
legal standards for this activity. I, for one, wholeheartedly 
agree with their recommendations.
    Mr. Chairman, I actually think we should have EPIC and 
others in the privacy community come and testify. I am deeply 
troubled by what we have heard so far this morning.
    The fact that you agree with me but yet much of this 
conduct continues is deeply troubling.
    I yield back.
    Mr. Meehan. Thank you, Ranking Member Speier.
    At this point in time, I would like to turn it over to the 
gentleman from Mississippi, the Ranking Member of the 
committee, Mr. Thompson, for questions he may have.
    Mr. Thompson. Thank you very much, Mr. Chairman.
    Ms. Callahan, will you provide the committee with a copy of 
the FOIA information that you provided to EPIC?
    Ms. Callahan. Of course. Absolutely, sir.
    Mr. Thompson. Thank you.
    Also, will you provide us with your analysis of why the 
FOIA request went unresponded to and what did you do in that 
situation but also what will you do going forward so that other 
requests won't be treated so cavalierly?
    Ms. Callahan. Absolutely, sir.
    Mr. Thompson. Mr. Chavez, do we create log-ons to monitor 
individuals in this process?
    Mr. Chavez. Actually, we do not monitor individuals at all. 
What we are looking for, again, as I talked about, the 
keywords. Within the keywords you won't find anyone's name. 
Like, say, they are all verbs, those types of things that we 
are looking for. So, no, we don't create log-ins for 
individuals to do that, and we are not looking or monitoring 
individuals.
    Mr. Thompson. Are there any times that you take down names 
of individuals?
    Mr. Chavez. Again, given the seven criteria that we have 
for life-saving, those type of circumstances, are the only time 
that we would collect the names, use the PII.
    Mr. Thompson. Who makes that determination?
    Mr. Chavez. That is part of our training course that we do 
for the individuals who are doing the media monitoring. We look 
at those processes. Again, they are audited twice a year. The 
most recent one was just done in November.
    Mr. Thompson. Who is ``we'' doing the training?
    Mr. Chavez. Actually, the National Operations Center, in 
coordination with the Privacy Office.
    Mr. Thompson. All right. How does this interface with the 
General Dynamics contract?
    Mr. Chavez. Those are the individuals who are doing the 
media monitoring for us.
    Mr. Thompson. So let me get this straight. DHS is training 
a private contractor to do the media monitoring?
    Mr. Chavez. Part of it, yes, on their privacy rules and 
those types of things, indeed, we are.
    Mr. Thompson. Why are we training private contractors?
    Mr. Chavez. Well, to collect--their skill set, to collect 
the information we are. But what they don't come with is, 
again, the DHS guidance that we have to give them.
    Mr. Thompson. I thought private contractors generally had 
an expertise that we didn't have internally as an agency, and 
we would go outside to pick that capacity up. But now what you 
just said is for some reason we are training the outside people 
to do the internal work.
    Mr. Chavez. It is not overall training. Again, they do have 
those skill sets that they use. What we add from the 
Department, again, are those checks that we use to ensure, 
again, that the privacy guidelines are complied with. That is 
the part of the training that we do, and that is it.
    Mr. Thompson. Well, explain to me what skill sets General 
Dynamics, with an $11 million contract, would have outside of 
DHS's capabilities.
    Mr. Chavez. Well, what they offer, again, is the 24/7 
monitoring of those sites. They are skilled technicians in 
surfing the web and also doing an analysis of the information 
that they get when they do get hits on websites and producing 
synopsized reports that, again, comply with the privacy 
guidelines that are out there, and pushing those out to us so 
we can send those out to our partners.
    Mr. Thompson. So your testimony is we don't have the skill 
sets at DHS to monitor websites?
    Mr. Chavez. We do. Right now, again, we have that as part 
of one of our contracts that is out there.
    Mr. Thompson. Is it a sole source contract?
    Mr. Chavez. No, it is not.
    Mr. Thompson. Well, will you provide the committee with the 
procurement document? How long has it been out there?
    Mr. Chavez. I will get back with you on that. I will give 
you the full details on it.
    Mr. Thompson. Was the original contract for the $11 million 
a sole source contract?
    Mr. Chavez. I do not know. I will have to check on that for 
you, sir.
    Mr. Thompson. How long have you been working with the 
agency?
    Mr. Chavez. Two years.
    Mr. Thompson. How long has this General Dynamics contract?
    Mr. Chavez. In the 2 years I have been there.
    Mr. Thompson. So you inherited the General Dynamics 
contract?
    Mr. Chavez. Yes, sir.
    Mr. Thompson. All right. Well, please get it to me.
    The questions raised by the EPIC insertion, as well as what 
everyone has commented, raise significant issues around 
safeguards. Mr. Chairman, I think you would help a lot of 
people if at some point we could, as Ranking Member Speier 
suggested, maybe bring those individuals and others who might 
have an interest before the committee to talk about it.
    I yield back.
    Mr. Meehan. Thank you, Mr. Ranking Member. We appreciate 
your presence here today on the subcommittee.
    The Chairman now recognizes the gentleman from Minnesota, 
Mr. Cravaack.
    Mr. Cravaack. Thank you, Mr. Chairman.
    Thank you for coming here today and briefing us.
    I think what everybody is really concerned about here is 
our Constitutional rights. Because we in the United States, we 
have this great document called the Constitution, and we have 
to walk this fine line of data attainment to protect the United 
States but to, at the same time, make sure that we have 
safeguards in place that we have freedom of speech, which we 
value highly.
    So, with that said, what safeguards are in place that when 
the DHS does collect and distribute personally identifiable 
information, PIIs, outside a specific narrow event such as a 
life-or-death situation, can you kind of expand upon that a 
little bit?
    Then with that said, what would be the penalty associated 
with distributing that information illegally? Have there been 
any cases where that has occurred?
    Is there a report currently going from General Dynamics to 
you, to Congress that would also, when these people are 
identified, that Congress is aware of that?
    So, with that, Ms. Callahan, could you start off?
    Ms. Callahan. Absolutely, sir. Thank you very much for that 
question.
    As I have described and Mr. Chavez has described, the only 
personally identifiable information that can be collected are 
these seven very narrow categories: Public officials or in a 
public event or making a public statement or life-or-death, as 
you pointed out.
    As part of the review by the National Operations Center, 
every week they go and check to make sure no personally 
identifiable information is provided. I review each of the 
media monitoring that I receive as part of the ordinary course 
of business, just to see if they continue to comply with the 
privacy protections that we describe in our five publicly 
available Privacy Impact Assessments and privacy compliance 
reviews. We then do these semi-annual reviews of the entire 
system to look at all the processes therein.
    Prior to me authorizing any personally identifiable 
information, there were, to my recollection, two circumstances 
where public officials were named in the circumstance--for 
example, President Obama. There was no circumstance with regard 
to individuals who are not in a public capacity who have been 
named.
    Actually, that example of having a public official like the 
President is why we agreed to have those seven very narrow 
categories that could be disclosed. Again, identifying 
Gabrielle Giffords as the target of the attack in Arizona 
actually helped coordinate the response more quickly, because 
we had that authorization.
    With regard to the penalty, if, indeed, that had taken 
place, there would be significant penalties. There would be 
training and possibly taking them off the job if, indeed, there 
was a recidivist behavior. We have not yet seen that.
    With regard to a report from General Dynamics, I don't know 
of that, but I do know that we have been doing these semi-
annual privacy compliance reviews, which are available on our 
website, for exactly the reason that everyone has identified: 
To make sure that we are following the privacy protections that 
we have identified and that we are not monitoring, reviewing, 
or collecting First Amendment-protected speech.
    Mr. Cravaack. Mr. Chavez, do you have any comment on that, 
as well?
    Mr. Chavez. No, that is exactly it. Again, we follow the 
guidelines that the Privacy Office sets forth. We do audit on a 
regular basis the individuals who are doing those types of 
things. We have a series of individuals that are reviewing the 
data, again, to make sure that the PII is not inappropriately 
passed on, displayed, or stored.
    Mr. Cravaack. Okay.
    I would like to dovetail on what the Ranking Member said. 
Why did you pick General Dynamics, for example, to be the 
contractor for monitoring social sites and not keep it in-
house, so to speak?
    Mr. Chavez. Sir, again, that was before my time. That is 
the contract I inherited. But I can get you the information on 
that.
    Mr. Cravaack. Okay. Who in DHS issued the directive for 
this establishment of this committee? You know, I agree, you 
have to get resource information and intelligence anywhere you 
can possibly get them, for various reasons. But who initiated 
the directive to initiate this social networking?
    Mr. Chavez. DHS did, again, before my time, right after 
Hurricane Katrina. Again, with the advantages of looking at the 
media to get a more timely response, see what is going on, 
provide greater situational awareness, the decision was made to 
monitor the social--or the media monitoring, traditional media. 
Then later on it evolved into the social media.
    Mr. Cravaack. Okay. One of the things that did kind of 
raise a red flag for me is reports on DHS components and other 
Federal agencies, positive or negative reactions to certain 
Federal organizations. Who gave that directive?
    Ms. Callahan. As I understand, sir, that is part of the 
General Dynamics contract. As was said, it predates Mr. Chavez.
    The purpose of that is not to keep track of what they are 
negatively saying, but for operational purposes to understand 
whether or not the Department is candidly meeting its 
standards. If, indeed, there is a long line as TSA, we don't 
care who is in the long line, but if someone tweets and says 
there is a long line, we then convey that information to TSA. 
It is part of the operational awareness that the National 
Operations Center does.
    Mr. Cravaack. Okay. My time has expired. I do have an issue 
with that, but I will yield back at this time. So thank you.
    Mr. Meehan. Thank you. Thank you, Mr. Cravaack.
    So, at this moment, the Chair will recognize the gentleman 
from--it is ``Missoura'' where you are from, right, not 
``Missouri''?
    Mr. Long. Right. You bet.
    Mr. Meehan. Mr. Long.
    Mr. Long. Thank you, Mr. Chairman.
    Mr. Chavez, what can the agency point to as your legal 
basis for your social network and media monitoring program, 
which a lot of us I think today have expressed concerns 
threaten important free speech and expression rights? What 
legal basis can you point us to that either this activity could 
even be concerned with----
    Mr. Chavez. It was, again, Section 515 of the Homeland 
Security Act, as amended, to provide situational awareness and, 
again, that common operating picture.
    Mr. Long. That is the legal basis for it?
    Mr. Chavez. Yes, sir, that is the legal basis.
    Mr. Long. Okay.
    Ms. Callahan, I, as a lot of us today, are very concerned 
about the chilling effect on our core First Amendment rights to 
political speech and free speech in general. Are there--what 
can you point us to? Are there protections to ensure that only 
necessary personal data is used and retained no longer than 
necessary to protect against accidental or deliberate misuse?
    Ms. Callahan. I, too, sir, am very concerned about the 
First Amendment and want to make sure that that is wholly 
protected with regard to this activity. We spent 9 months 
designing this program and have detailed it in the public 
Privacy Impact Assessments and compliance reviews.
    The standard by which we operate is, again, not the ``who'' 
but the ``what is taking place.'' What is the event that is 
going on? If an individual alerts us to that event, then that 
is the first report, but not the exclusive report.
    The way, sir, that we have the privacy protections embedded 
into the program is to make sure that no personally 
identifiable information is collected or disseminated unless it 
meets those seven categories.
    Mr. Long. No what information?
    Ms. Callahan. Personally identifiable information.
    Mr. Long. Okay.
    Ms. Callahan. No personally identifiable information is 
collected except for those public figures or in a life-or-death 
circumstance. The National Operations Center goes and very 
robustly audits that, and then we go in every 6 months to make 
sure that, indeed, the representations are correct.
    The personally identifiable information, the very narrow 
topics--which, again, are public figures making public 
statements or part of an event, or a life-or-death 
circumstance--are stored only in the report. We are not doing a 
table or an analysis of each of the different reports. They are 
only stored in that.
    In fact, I published a System of Records Notice, which is 
required under the Privacy Act. It was not necessary for me to 
do this; the general System of Records Notice for operations 
would have covered this activity. But for transparency 
purposes, when I finally authorized the use of personally 
identifiable information, we published that System of Records 
Notice to go and say, these are the seven categories that we 
are doing--public figures at public events, or life-or-death 
circumstances--in order to be very clear about what we are 
doing with information and, candidly, sir, what we are not 
doing with information.
    Mr. Long. So, in your mind, you are convinced that what you 
are doing is consistent with existing DHS policy?
    Ms. Callahan. Consistent with DHS policy, consistent with 
the Privacy Act, and consistent with the First Amendment, yes, 
sir.
    Mr. Long. Okay.
    I have another question for you, Ms. Callahan. As the 
public becomes aware of Government activity monitoring social 
media to gain rapid understanding of events, what are the risks 
of people or groups trying to affect those events, I guess--
say, people with bad intentions using the different platforms 
of social media to manipulate the Government understanding to 
their advantage? What can be done to guard against this 
problem?
    Ms. Callahan. My colleague Mr. Chavez may also have some 
thoughts about that. But I think that, because we don't rely on 
just one individual source but we actually confirm the sources 
and look for making sure that we have multiple sources 
identifying, for example, the train wreck in Michigan, would be 
one element.
    Also, to confirm, the National Operations Center, the 
situational awareness, is not attempting to investigate or 
confirm the validity of the event, just that an event has been 
reported.
    Mr. Chavez.
    Mr. Chavez. Ms. Callahan is absolutely right. No single 
source of information ever provides us with a complete picture. 
Oftentimes we use multiple sources--or, all the time we use 
multiple sources of information to corroborate information that 
we are getting in.
    So it is all part of the big picture. In order to get the 
big picture, again, in this environment, we look to multiple 
sources that are out there, not a single source, to corroborate 
that information that is being produced.
    Mr. Long. How does that affect people trying to I guess put 
a different spin or take advantage of----
    Mr. Chavez. There is always that--yes, there is always that 
deception.
    Mr. Long. That was kind of my question.
    Mr. Chavez. If it doesn't match up with the preponderance 
of information coming in that is counter to the information we 
are receiving, then we can pretty much write off that. Plus we 
are not investigating that information, we are turning that 
over to the appropriate law enforcement or Government agency to 
look at what is happening again and is it really happening.
    Mr. Long. Okay. I have no time to yield back, but if I did, 
I would.
    Mr. Meehan. Well, thank you, Mr. Long. Thank you for your 
questions. I am going to exercise the prerogative to ask a 
couple of follow-up questions and certainly would make that 
opportunity available to anybody who would like to as well or 
not.
    Ms. Callahan, you spent some time talking about the 
circumstances in Michigan and about some protections. I know 
you haven't stated it today I spent time going through your 
written testimony and other sorts of things. I know you 
suggested that this is an anomalous circumstance. This is being 
identified as an event that happened, but maybe the statement 
would be but it wouldn't happen today. You have a moment, tell 
me how you have cured that kind of a circumstance and how we 
would not have a repeat where there is an incident that occurs 
in which the Government begins to be looking for the 
information that was disseminated, collected, and disseminated 
in Michigan.
    Ms. Callahan. Yes, thank you, sir. To clarify slightly, 
that information was never disseminated, it was never a live 
report, it does not meet the standards of the privacy impact 
assessments and would not have actually been done. It was an 
early example of what could possibly be done. Together with the 
National Operations Center, we both agreed that we don't care 
about First Amendment speech, we don't care about the events.
    Mr. Meehan. Well, you do care. What you are trying to say 
is that is not what you are inquiring about?
    Ms. Callahan. We care about the events, not the First 
Amendment elements. Right, we care about the events. Candidly 
even in that example, Guantanamo Bay and the transition of any 
prisoners from Guantanamo Bay is actually not within the 
Homeland Security mission. So it wouldn't even have met that 
threshold question. That is the current threshold standard that 
we implemented since January 2010, making sure it is a Homeland 
Security mission and an event and a situation. So for those two 
that is kind of a threshold point. We then would not--as I 
said, no element of First Amendment protected speech is 
collected, disseminated, or analyzed.
    We also make sure that--as I said, I review the media 
monitor reports when I receive them to make sure that they 
continue to be compliant, that we are only reporting on the 
what and not the who. So I think all of these multiple levels 
are an example of why that Standish, Michigan, to give an 
example, is an anomaly. It is obsolete, and it only is in the 
handbook that was done, that is 2 years old, and was quickly 
replaced once we started to work on the pilots and to fine-tune 
to make sure that we can provide situational awareness and 
protect privacy.
    Mr. Meehan. Let me go back then to prospectively where we 
may be looking at other kinds of events, as you say the who, 
not the what. Now I know there were attempts to look at things 
like the Olympics, there was an effort to track information 
that may be related to that. I can foresee a number of other 
events, conventions, are you going to be monitoring activity 
around conventions?
    Ms. Callahan. Again, I turn it over to Mr. Chavez, but we 
do monitor National security special events to make sure. For 
example, we monitored the Super Bowl. But again it is not about 
the who, but the what. How are the roads moving, how are the 
processes, are there any suspicious activities?
    Mr. Meehan. You are not calling in the plays for Bill 
Belichick, are you?
    Ms. Callahan. I abstain on which--who I was supporting in 
the Super Bowl, but it is the what, it is the event.
    Mr. Chavez. Holistically we are monitoring the whole 
Homeland Security enterprise, not just the events. We are 
looking for the same, again, keywords criteria that would 
indicate any type of action----
    Mr. Meehan. You keep saying keywords. What I am trying to 
get to is who begins the process of identifying what should be 
analyzed. I guess the what, not the who, but who is it that is 
saying to go after the what. I don't know where this has begun.
    Mr. Chavez. Right. It is not the National Operations 
Center. Again the National Operations Center is the messenger.
    Mr. Meehan. Who is giving the direction? I want your 
analysts to look into X. Where does that come from?
    Mr. Chavez. That again does not come from the National 
Operations Center.
    Mr. Meehan. I know it doesn't.
    Ms. Callahan. So if I can just step back for a second, sir. 
The National Operations Center is to provide situational 
awareness for the entire Homeland Security enterprise. The way 
that we implemented the Social Media Initiative was to provide 
these keywords that you can use on publicly commercially 
available software that you can basically refine, no see 
individual Tweets, but see what is trending and what is 
happening and if there are elements. The keywords, as I said, 
are disclosed in my privacy impact assessment.
    Mr. Meehan. But when your analysts start work in the 
morning, do they just pick up a keyword book and start going 
out looking for----
    Ms. Callahan. No, it is programmed in all the time, is what 
I was going to say. It is programmed in all the time. We don't 
modify the keywords, disaster, flood, tornado, train wreck, 
derailment, those sorts of things.
    Mr. Meehan. You keep talking to me about incidents that are 
disasters, and I get that. We are going to put that aside. Part 
of the mission here was to monitor activities that may be--we 
are Homeland Security, we are worried about the potential that 
there could be someone acting in some capacity that would 
threaten our homeland and cause harm to the American citizens. 
I get that, too. We are also worried about the fine line in 
which people may be talking about things they don't like about 
their Government, it is legitimate protest. So where are there 
activities that are taking place that it could be a 
collaboration of individuals from outside the country that are 
meeting at a convention all over the world. Does somebody say, 
hey, let's watch what is happening there. I need to know where 
this process begins, who's telling people to track the what?
    Mr. Chavez. The individual Government agencies we provide, 
we will call them our customers, are the ones who determine 
whether or not the data is actionable or not, whether or not to 
pursue a follow-up, each of those executing their own 
authorities to do the investigations to collect intelligence in 
those type things. Often again the reports we provide through 
the social media monitoring are a supplement to getting the 
information to these organizations.
    Mr. Meehan. So it might be a legitimate investigative 
agency that has the capacity to in their own right but using 
legitimate investigative tools and protections, they are asking 
you to get secondary publicly available information that fills 
a gap or something of some sort?
    Mr. Chavez. Most definitely. Again once the reports come in 
we very seldom get the direction from an outside organization 
to look for specific things because under their own authorities 
they can drill down farther than the National Operations Center 
can on information that was provided.
    Mr. Meehan. Where does the top of the line come from; is 
this a career professional that makes these decisions or public 
appointee in the DHS who may be overseeing what is being looked 
at?
    Mr. Chavez. Let me take an example of the intelligence 
field with their skill sets they have in the enterprise. There 
are individuals, both political appointees and senior 
officials, that again take a look at the information they have 
and decide whether or not to take action on to pursue 
investigations to open up whatever, again under their 
authorities, they can do to defend the homeland and produce 
that information in these reports.
    Ms. Callahan. If I could summarize, sir. The Situational 
Awareness Initiative we have been talking about is essentially 
breaking news, here is what is happening. To your point, if 
indeed someone receiving a report of breaking news and they 
have the underlying authority to investigate it, then they go 
off on their own track and the operations nor does the Privacy 
Office know they are doing it separate and apart from we are 
going to do audits and reviews of social media when the 
management directive is final. So they are breaking news and 
then other there are other authorities in the Department and 
also throughout the Federal Government.
    Mr. Meehan. Final question. Breaking news, the Attorney 
General just decides he is going to try Guantanamo detainee in 
New York City. There is a lot of news about that now. Is it 
possible that you would be contacted by somebody who said 
follow what is happening, report to us what the reaction is to 
that?
    Mr. Chavez. In the history of the time I have been at the 
National Operations Center, no, sir, that has not happened.
    Mr. Meehan. What would be your protection against that kind 
of request? How to you tell a political appointee who is high 
up in the administration that is not appropriate for us to 
monitor?
    Mr. Chavez. It is not only appropriate, it is not under our 
authority. It is illegal to do that.
    Mr. Meehan. Well, that is a good answer to any kind of a 
political appointee. At this point I have gone well over my 
time.
    Mr. Thompson.
    Mr. Thompson. Yes, I do. Ms. Callahan, you talked about 
taking 9 months to put this program together.
    Ms. Callahan. Yes, sir.
    Mr. Thompson. Did you vet the program with any outside 
stakeholders or was it strictly an internal process?
    Ms. Callahan. Actually, sir, with regard to the situational 
awareness I discussed it in my quarterly meeting with advocates 
that takes place, I believe after the initiative launched but 
before it became a program, so during the three pilot phrases.
    In addition, one of my staff testified in front of my FACA 
committee, the Data Privacy and Integrity Advisory Committee 
early in the process. In fact in December I had hoped to have 
one of Mr. Chavez's colleagues testify in front of the Data 
Privacy and Integrity Advisory Committee, but unfortunately--he 
was there, he was prepared to testify about this very issue 
because of the importance of the issue but we ran out of time. 
But yes, we have discussed this publicly and gotten advice on 
it.
    Mr. Thompson. Well, I am concerned that given what I am 
picking up that there are a lot of people who have interest in 
privacy and this whole area that has not been included in the 
discussion. What I would like for to you do is provide us with 
those organizations or individuals who you have collaborated 
with over that 9 months to develop this program.
    Ms. Callahan. To be clear, sir, I did not discuss this 
outside the Department until it was launched as a pilot under 
the Haiti earthquake, but then I did discuss it, as I said, in 
several advocate meetings, that I have quarterly advocate 
meetings with advocates and we did discuss it publicly in the 
FACA committee. But we are happy to provide you that 
information. Yes, sir.
    Mr. Thompson. Whoever the advocate, whoever attended, how 
broad that attendance is, all that, just please get it to us.
    Ms. Callahan. Absolutely.
    Mr. Thompson. The other concern I have is taken off of from 
what the Chairman was talking about, is the notion of 
identifying political and journalistic activities that reflect 
adversely on the agency or the Federal Government. Ms. Chavez, 
it is your testimony that you don't do this?
    Mr. Chavez. Indeed, we don't do that. What we do do again 
is if there are long lines at the airport, at the screening 
centers, those types of things, those would come up to us, and 
we would pass it on to the appropriate DHS component for action 
again through corroboration, is this really happening, what is 
happening and what we need to do to fix that. But identifying 
individuals again or an individual that is making that would be 
irrelevant to us. There is something happening, go check it 
out.
    Mr. Thompson. Well, okay. I will go back to the General 
Dynamics contract again. Obviously some of us are troubled by 
it. Why would you ask them to look at the Drudge Report or New 
York Times or L.A. Times?
    Mr. Chavez. We don't focus again on any one media source. 
There are many that are out there. It all goes back to the 
information that they are providing, not the provider of that 
information.
    Mr. Thompson. So they are the only source of--so in other 
words, they have this expertise that they can look at the blogs 
and read the newspapers better than the Department if that is 
what you want to do?
    Mr. Chavez. Well, you have to look at it also. We are not 
in here currently watching television or looking at the media 
reports that are coming in. We all have a vested interest in 
this Homeland Security. So what we are providing is a service 
where we are looking at individual action or actions that could 
be happening around the United States and elsewhere that again 
we see and push that information out to the Federal Government 
and our State and local partners, the entire homeland security 
enterprise, to let them know that something is happening. They 
may already see it and be acting on it, in which case we would 
receive information from those agencies on here is what is 
currently going on with this also.
    Mr. Thompson. Ms. Callahan, to your knowledge are there any 
other branches of the Federal Government who are doing similar 
kind of programs?
    Ms. Callahan. I don't have a comprehensive knowledge of 
this, but I do know that National Operations Center has a 
unique statutory responsibility to provide situational 
awareness to the Federal Government. So I am not aware that 
anyone else is doing that given the NOC's authorities.
    Mr. Thompson. FBI, DOD, nobody to your knowledge?
    Ms. Callahan. I believe they are operating within their own 
authorities consistent with what I discussed with the Chairman.
    Mr. Thompson. I just asked you.
    Ms. Callahan. I don't know, sir, sorry.
    Mr. Thompson. So you don't know--you designed the program 
without any review of whether or not another agency is doing 
it?
    Ms. Callahan. As I said, sir, I believe the NOC's statutory 
authority is unique.
    Mr. Thompson. No, no, no, just answer the question.
    Ms. Callahan. I do not have any other knowledge.
    Mr. Thompson. You said it took 9 months to put the program 
together, and I just want to know as part of your due diligence 
did you check and see whether or not another agency within the 
Federal Government was doing something just like this. I would 
assume that the FBI would be doing something like this, I would 
assume that DOD would be doing something like this, just given 
their mission. If you say you don't know, I don't think that is 
the right answer from a due diligence standpoint.
    Ms. Callahan. I can check with my staff, and maybe Mr. 
Chavez is aware of what other people are doing in this. We are 
trying to be very transparent about what we are doing and 
perhaps the other departments have not necessarily taken that 
tack.
    Mr. Chavez. I am not aware of anyone else that is doing the 
social media monitoring at again the unclassified level. The 
intelligence community with their skill craft may, but no, I 
don't.
    Mr. Thompson. I yield back, Mr. Chairman.
    Mr. Meehan. Thank you, Mr. Thompson. It appears to me as we 
have been going through this issue I have got the very 
difficult recognition that as I chastise my children about 
spending significant time on Facebook, they are now going to be 
saying to me, well, dad, it can be a career.
    At this point let me turn it over to the gentleman from 
Minnesota for a few follow-up questions.
    Mr. Cravaack. Thank you, Mr. Chairman. Does DHS use any 
other contractors to monitor to the best of your knowledge?
    Mr. Chavez. Right now, no, we don't, sir.
    Mr. Cravaack. Is there any plans to?
    Mr. Chavez. Right now we have got all we need with, again, 
the services being provided.
    Mr. Cravaack. Just kind of dovetailing what the Ranking 
Member was saying, one of the things I read is that you want to 
capture public reaction to major Government proposals. You are 
monitoring positive or negative reports on FEMA, CIA, ICE.
    Mr. Thompson. Would the gentleman yield?
    Mr. Cravaack. Yes, sir, I will yield.
    Mr. Thompson. I asked you a question about the General 
Dynamics contract. You told me there was an RFP out right now. 
That was your answer to me on social monitoring. You look back 
to the gentleman, you said it wasn't sole source, it was open. 
That was your answer to me then.
    Mr. Chavez. It is a firm fixed contract, not sole source.
    Mr. Thompson. But you said there is an RFP out right now.
    Mr. Chavez. RFP. I am sorry, I am not familiar.
    Mr. Thompson. Request for proposal. We talked about the 
General Dynamics contract. We asked about it. Your conversation 
talked about whether or not it was sole sourced or it was open, 
and you indicated that we are going out looking for another 
contract right now.
    Mr. Chavez. No. If I did, sir, I apologize, sir. I stand 
corrected. It is a firm, again, fixed contract and again not 
sole sourced.
    Mr. Thompson. How long is this fixed for?
    Mr. Chavez. Actually, I don't have that information. I 
don't have the fixed.
    Mr. Thompson. Thank you. Thank you for yielding.
    Mr. Cravaack. Yes, sir. I will reclaim my time. Going back, 
it was mentioned some of the--you know, FEMA, CIA, CBP, ICE--
these are organizations that are outside of DHS. Now if 
somebody--if there was an organization outside of DHS 
requesting this information, would you provide it to them?
    Mr. Chavez. We don't normally get, again, requests for 
information. We just take it from the media and push it to the 
organizations that are out there because they have their own 
information authorities, gathering authorities and those types 
of things that they use. So they use our media monitoring 
reports to supplement what they have already got.
    Mr. Cravaack. The thing I am really having problems with I 
guess is the Government proposals, reactions to Government 
proposals and then feeding that information to different 
organizations within the Government. You are using a public 
sector source that may be used for private individual 
attainment of information for other reasons then that would 
benefit the public. That is what I am concerned with and how 
would you go about preventing this from occurring?
    Mr. Chavez. That specific purpose of the media monitoring I 
have never encountered. Again, the only kind of evaluation, if 
you will, of the departments or other Government agencies is 
just, as I said, there is a service that is being provided, 
that again there is a hold-up at the airports, as Ms. Callahan 
said also, but to go out and solicit that information or to 
collect it. I have not seen this in my tenure at DHS.
    Mr. Cravaack. Well, now this hearing has occurred, I think 
you have a higher profile. But my question would be what are 
the checks and balances in there from ensuring that this is not 
used for private initiatives?
    Mr. Chavez. Again, with the information that comes in it is 
reviewed by a number of individuals throughout the National 
Operations Center and Operations Coordination and Planning to 
ensure that the compliance with the PIIs out there and the 
distribution lists also are pre-approved so that it doesn't get 
out to sectors, again so we don't compromise proprietary 
information and those types of things.
    Mr. Cravaack. Can you give me an example of what kind of 
information you have been gleaning thus far in regard to 
Government proposals?
    Mr. Chavez. I am not aware of any information we have 
gathered on Government proposals.
    Mr. Cravaack. Okay. All right. Say I am ICE or say I am 
those who would be interested in the gun walking down in Mexico 
and I want to get information in regards to what is the public 
reaction to this. Say I am an organization, I am just trying to 
use broad general terms so we don't have to get into another 
area, a realm. How would you go about that request?
    Mr. Chavez. Again, that would not be a request that was 
appropriate or a function of the National Operations Center. 
Given our, again, authority under the Homeland Security Act for 
a situational awareness or operating picture, we are not a 
pollster, we don't again solicit for opinion. We are putting 
down actual incidents that are happening at any one time.
    Mr. Cravaack. Okay, I am the Attorney General, I am asking 
for this information.
    Mr. Chavez. Okay.
    Mr. Cravaack. What are you going to tell him?
    Mr. Chavez. Again, that is not the appropriate mission or 
within our authorities for the National Operations Center to 
gather that information. There are other organizations within 
in the Federal Government who do have the authority to gather 
that information more thoroughly, again, than we do.
    Mr. Cravaack. Mr. Chavez, you are telling the Attorney 
General that I cannot acquire this information, this is a vital 
need for American security.
    Mr. Chavez. It would be outside the skill set of what we 
actually do. We are not the source for that. So I would not be 
afraid to tell the Attorney General that we are not the 
organization that does that.
    Mr. Cravaack. You are an Air Force officer, aren't you?
    Mr. Chavez. Yes, sir.
    Mr. Cravaack. Hooray. With that, I yield back.
    Mr. Meehan. Mr. Long, do you have follow-up questions?
    Mr. Long. Well, you know that, sure. Thank you, and to my 
friend from Minnesota Mr. Chavez may be better known after this 
hearing but I just checked Twitter and we are not yet a 
trending topic on there.
    The longer I sit here I think the more confused I get. The 
title of what we are supposed to be talking about today is 
``Department of Homeland Security Monitoring Social Networking 
and Media: Enhancing Intelligence Gathering and Ensuring 
Privacy.'' We are all kind of in agreement on that?
    Ms. Callahan. Yes, sir.
    Mr. Chavez. Yes, sir.
    Mr. Long. Of course we had a classified briefing yesterday 
and I came away from that thinking what we were trying to do is 
protect the homeland and watch for events that may affect the 
security of citizens here in this country. But yet today I keep 
hearing about breaking news, which Twitter is pretty good for 
that. So either one of you can answer this if you want. I 
appreciate you being here today, but what is your charge? I 
have a disconnect with the breaking news, trying to follow that 
up. I mean that is history, breaking news has happened. 
Prevention and protecting the citizens while ensuring their 
Constitutional rights is a whole different can of worms. So 
both of you can answer this: What is your charge? What do you 
visualize your job and the agency job as far as--am I 
completely off-base that we are supposed to be trying to 
protect the homeland while ensuring privacy, as they say?
    Ms. Callahan. You are correct that that is our mission. 
That is the point of this hearing. I think the disconnect 
perhaps is that, as I pointed out in my oral testimony, there 
are three uses of social media. We have been focusing on the 
second, which is the situational awareness, which is the 
breaking news element, to know there is an event that could 
impact the homeland.
    The third element, which is the operational use you spoke 
to the under secretary yesterday, about when we would do it 
consistent with our authorities for law enforcement or other 
investigatory purposes using social media if there was a 
predicate, some sort of reasonable suspicion or elements for 
that. That is kind of the third element on the prevention side. 
Mr. Chavez and I have been speaking a lot about the situational 
awareness, which is the second of the three uses that the 
Department uses social media for.
    Mr. Chavez. The National Operations Center again is part of 
the bigger picture out there. We are one of the tools that 
again the agencies use to again monitor the homeland and those 
types of things, again that they do under their own authority. 
So to put the intelligence piece in there with the Nation 
Operations Center, we are providing through the National 
Operations Center another piece of information that again those 
individuals who can use intelligence under their authorities or 
enhance their operations as with ICE, as was brought up in the 
other departments or components of DHS, that is what they do 
with it. We provides one piece of the information, the total 
information that is out there that they can use and that source 
again is the media portion of that.
    Also, because the intelligence and all those other 
communities that are out there looking at it, again may not see 
something happening because they are executing a mission that 
is out there. What we do again is provide that service that 
something is happening, turn it over to the appropriate 
Government agency, to include State----
    Mr. Long. That is all after the fact, correct?
    Mr. Chavez. Indeed. There are other organizations that 
again that are looking at the prevention piece and looking, 
doing assessments to determine what threats may be coming at 
us. We are dealing with the here and now.
    Mr. Long. I am sure there is something I am missing because 
I can't believe that we would go to all this effort to look 
into breaking news.
    Ms. Callahan, another question for you to wrap up. I am 
going to try this, can you describe the Department's on-going 
privacy and civil liberty protection oversight process that is 
in place now to ensure citizens' Constitutional rights are not 
violated during the execution of the Department's social media 
monitoring?
    Ms. Callahan. Yes, sir. Thank you very much for that 
question. The Congress has been very generous with my oversight 
authority, and as I have described earlier, we have been doing 
mandated, required privacy compliance reviews that we publish 
on the website. To be clear about what is going on with regard, 
we are doing these reviews every 6 months, in fact February we 
started again.
    We are also authorized to do investigations into individual 
types of use of social media, as I said kind of that third 
category in an operational sense. We are finalizing a 
management directive to make sure that everyone complies with 
privacy protections across the board with regard to 
investigations and operational use. In there we are requiring 
audits every 3 months, as well as specific investigation by my 
office. So we take this issue very seriously and we try to be 
as diverse and robust in working with the Office of Civil 
Rights and Civil Liberties in all three categories in which the 
Department uses it--communication, situational awareness, and 
operational use.
    Mr. Long. During those 3-month and 6-month checkups are you 
finding things that are of concern to you about people's 
Constitutional rights?
    Ms. Callahan. We have not. No, with regard to the 
situational awareness, the second use that the Department uses, 
the National Operations Center has been very consistent with 
the public-private protections that we have identified.
    Mr. Long. Thank you all for being here today and I yield 
back.
    Ms. Callahan. Thank you, sir.
    Mr. Meehan. Thank you, Mr. Long. I want to express my 
appreciation to the panel for being with us here today. I think 
we have begun an important discussion, and there is 
appreciation of the difficult charge that you share with some 
of the other agencies here who not only protect our homeland 
but American interests around the world. I am grateful for your 
service in that capacity.
    I think all Americans appreciate the huge challenge of 
fulfilling the responsibility of having the imagination to 
appreciate what could happen and connecting the dots real-time, 
all of things we are asking you to do to prevent another issue 
of terrorism here on American soil, but we also appreciate that 
you are one of the real protectors of the individual's rights 
to privacy, what it means to be an American, and this is a 
delicate and difficult area that I think we have to continue to 
explore. I am asking you to continue to use your diligence and 
most assuredly to assure that there isn't inappropriate 
interference politically, especially inappropriate political 
interference in which somebody takes your mission and uses it 
for another purpose, and that every effort be made to safeguard 
the rights, the privacy rights of individuals.
    We may have another opportunity to follow up on things we 
did not get into because, as I say, I appreciate what you are 
doing at the DHS level. I am cognizant in my own State of 
Pennsylvania of the historic context in which State-run but 
related fusion centers and otherwise have conducted these same 
kind of inquiries, and that information found its way not just 
to Governmental entities but to private contractors, private 
businesses who were using it for their own purpose. So this 
whole question of, you know, who is collecting what 
information, what are we doing to safeguard it and what are we 
doing to assure that at some appropriate time it disappears.
    There is a lot here. I know it is part of your job. I thank 
you for the work that you are doing, but we are going to 
continue to ask these tough questions because it is vital to 
the protection of the most fundamental thing we have, which is 
our Constitutional rights as American citizens to privacy and 
to be free from inappropriate Governmental intrusion.
    Thank for your work and thank you for your testimony. The 
Members of the committee may have additional questions for 
witnesses. If they do, we will ask you to respond in writing. I 
know there are some things that were asked that you go back and 
do your best to be responsive to the questions that the 
committee did ask. The hearing record will remain open for 10 
days.
    So without objection the committee stands adjourned.
    [Whereupon, at 11:35 a.m., the subcommittee was adjourned.]

                            A P P E N D I X

                              ----------                              

 Letter Submitted to Chairman Patrick Meehan From Mary Ellen Callahan 
                           and Richard Chavez
                                     March 1, 2012.
The Honorable Patrick Meehan,
Chairman, U.S. House of Representatives, Committee on Homeland 
        Security, Subcommittee on Counterterrorism and Intelligence, 
        Washington, DC 20515.
    Dear Representative Meehan: Thank you for the opportunity to 
testify before you and your subcommittee on February 16, 2012 about 
Department of Homeland Security (DHS) review of publicly available 
social media websites. DHS remains fully committed to providing the 
subcommittee with all of the information it requires on this topic. We 
ask that our letter, along with the enclosed attachment, be 
incorporated into the official record for the February 16, 2012 hearing 
before your subcommittee.
    At the hearing, questions were raised regarding contract language 
that appeared to permit the use of social media websites to track First 
Amendment-protected speech by collecting information on public dissent 
or disagreement on Government activities. As detailed in our written 
testimony DHS does not now, and has never collected or used, social 
media reporting for such purposes. We will modify the existing contract 
and all DHS documentation to clarify and align guidance language with 
the Privacy Impact Assessments (PIAs).
    To further illustrate this point, this week Director Chavez issued 
the enclosed memorandum to the National Operations Center (Attachment 
1) stating that the Office of Operations Coordination and Planning and 
the Privacy Office are currently reviewing the 2011 Media Monitoring 
Analyst's Desktop Binder to ensure alignment with the PIAs. Although 
the media monitoring efforts are in accordance with the privacy 
guidelines outlined in the PIAs it is important that all documentation 
relating to media monitoring be similarly aligned. The Privacy Office 
will complete its fourth Privacy Compliance Review in mid-March 2012 
and this alignment will be part of the review.
    Director Chavez's memorandum to the National Operations Center also 
reiterates the privacy guidelines that have been in place since the 
start of this program: Collection of personally identifiable 
information from social media websites is permitted only in specific 
circumstances and is limited to the categories described in our written 
testimony and in the January 6, 2011 PIA. The information that is 
collected may be retained only in the report that is generated, and is 
not cross-referenced or tracked in any other way.
    We appreciate the subcommittee's interest in our efforts in this 
regard. We would be happy to meet with subcommittee staff or Members 
individually the week of March 5, 2012 to provide you with any further 
information or discussion of these issues you may require. NOC media 
monitoring reports are also available for your review.
            Sincerely,
                                       Mary Ellen Callahan,
       Chief Privacy Officer, U.S. Department of Homeland Security,
                                            Richard Chavez,
    Director, Office of Operations Coordination and Planning, U.S. 
                                   Department of Homeland Security.
MEMORANDUM FOR: National Operations Center

FROM: Richard Chavez, Director, Office of Operations Coordination and 
Planning

SUBJECT: Media Monitoring Guidance Reminder

    As part of the fourth Privacy Compliance Review that is scheduled 
to occur in mid-March 2012, the National Operations Center (NOC), in 
coordination with the DHS Privacy Office, will review the 2011 Media 
Monitoring Analyst's Desktop Binder, any associated standard operating 
procedures, and the existing media monitoring support services contract 
to ensure conformity with all Publicly Available Social Media 
Monitoring and Situational Awareness Initiative Privacy Impact 
Assessments (PIAs) and to ensure the scope and purpose of the NOC Media 
Monitoring Capability (MMC) are accurately reflected and recommend 
clarifications and updates to the language if necessary. In the 
interim, the NOC will continue to use the PIAs as the authoritative 
source to guide the program.
    The NOC MMC should continue to limit the review, use, collection, 
and dissemination of non-personally identifiable information and the 
seven narrow categories of personally identifiable information to 
information that affect the operations of the Department of Homeland 
Security (memorialized in the January 2011 PIA). No First Amendment-
protected speech relating to dissent or disagreement with the 
Department and its activities should be reviewed, used, collected, or 
disseminated.
    The MMC can review, use, collect, and disseminate information 
intended to provide guidance on DHS programs and initiatives that 
inform the general public. An example would be the Transportation 
Security Administration's PreCheck program. The MMC can also review, 
use, and collect information related to oversight reports about DHS 
components such as DHS Inspector General Reports or Government 
Accountability Office Reports.
    The MMC cannot review, use, collect, or disseminate information 
related to individuals' positive or negative opinions or reports on the 
Department, but for the narrow circumstance where the MMC reviews and 
informs the relevant Component of an operational issue adversely 
impacting the Component. Examples of these issues include security 
violations at airports or ports of entry. In this narrow operational 
circumstance, no personally identifiable information can be collected, 
stored, or disseminated to the relevant Component.
                                 ______
                                 
Questions Submitted by Ranking Member Bennie G. Thompson for Mary Ellen 
                      Callahan and Richard Chavez
    Question 1. Please explain the circumstances under which DHS might 
collect information on journalists.
    Answer. DHS does not collect information on journalists (other than 
recording the name of the author when saving a particular article so as 
to ensure proper attribution, or including a individual journalist's 
name that is part of that journalist's social media internet link). As 
described below, DHS collects information on events.
    In support of its statutory mission to provide situational 
awareness and a common operating picture for the Federal Government and 
for other homeland security enterprise partners, the National 
Operations Center (NOC) within the DHS Office of Operations 
Coordination and Planning reviews publicly available traditional and 
social media postings to gain an enhanced awareness of rapidly emerging 
or evolving incidents and events concerning homeland security, 
emergency management, and National health. If a journalist posts a 
report on a publicly available social media site about a breaking news 
incident relevant to homeland security, the NOC's media monitoring 
analysts may use the information posted to build a report that is 
distributed to DHS leadership and other homeland security partners 
including Federal interagency, State, local, Tribal, and territorial 
government entities. The NOC may include reporters' names and 
affiliations in the reports as described below.
    The NOC includes a particular journalist's name with recorded media 
in accordance with the guidelines set forth in the Publicly Available 
Social Media Monitoring and Situational Awareness Initiative Privacy 
Impact Assessment (PIA) (dated June 22, 2010) and its January 6, 2011 
update. As stated in the PIA update and the February 1, 2011 System of 
Records Notice, personally identifiable information on seven narrow 
categories of individuals may be collected when it lends credibility to 
the report or facilitates coordination with Federal, State, local, 
Tribal, territorial, foreign, or international government partners. In 
such instances DHS will only collect the following limited pieces of 
information from journalists: Names, titles, and organizational 
affiliation of anchors, newscasters, or on-scene reporters who are 
known or identified as reporters in their post or article or who use 
traditional and/or social media in real time to keep their audience 
situationally aware and informed. Frequently with breaking news on 
social media, the individual journalist's name or names of other key 
individuals will be part of the story's internet link. In order to 
disseminate these publically available links, the NOC must include the 
personally identifiable information contained in the link address. 
Removing the PII from the link address will render the link, and thus 
the story, unusable.
    All National Operations Center (NOC) social media initiative PIAs 
are available to the public at www.dhs.gov/privacy.
    Question 2. Please explain how DHS came to report on information 
related to citizens' opinions on moving Guantanamo Bay Detainees to 
Standish, MI, and whether this is an appropriate use of social media by 
DHS.
    Answer. The DHS Office of Operations Coordination and Planning 
(OPS) never reported on potential plans to move detainees to Standish, 
MI. During the development of the Media Monitoring capability, OPS 
developed a Social Networking/Media Capability Analyst Handbook also 
known as a Desktop Binder. The purpose of the Desktop Binder was to 
serve as a desk reference for media monitoring analysts. In an early 
draft version of the Desktop Binder, an example was created based on 
actual information related to citizens' opinions regarding moving 
Guantanamo Bay Detainees to Standish, MI. This document was part of a 
``weekly report example,'' not an actual report in a very early, and 
obsolete version of the Desktop Binder. This version of the Desktop 
Binder was created while OPS was still in the midst of developing its 
media monitoring processes, and before the media monitoring reports 
were ever distributed. This example has been removed from the Desktop 
Binder, and this information was never released through the situational 
awareness reporting channels.
    To maintain a capability focused on reviewing incident and event 
information, OPS trains analysts to review information in compliance 
with the parameters set forth in the Privacy Impact Assessments (PIAs). 
During the report production process, reports are reviewed multiple 
times to ensure PII is not inadvertently included. Reports are reviewed 
at least twice, once by the analyst generating the report and then 
again by the analyst's counterpart. Each report is then checked by the 
media monitoring lead prior to dissemination. All reports distributed 
during each 24-hour period are checked by a media monitoring capability 
senior reviewer, and the media monitoring capability's quality control 
leads conduct weekly reviews of all distributed reports to ensure any 
inadvertent PII inclusions are identified and corrective action is 
taken. As described previously, the Privacy Office conducts Privacy 
Compliance Reviews every 6 months to ensure OPS is complying with the 
PIAs.
    Question 3. Please explain the terms of the contract and the 
rationale for contracting with General Dynamics to conduct social media 
situational awareness reporting.
    Answer. To fulfill the National Operations Center's (NOC) statutory 
responsibility to provide situational awareness, the NOC examines 
publicly available traditional and social media, compares it with many 
other sources of information, and includes it where appropriate into 
NOC reports. At the time the contract was awarded, the Office of 
Operations Coordination & Planning (OPS) did not have available Federal 
employees to complete this task. OPS procured contracted services to 
fulfill this function. Additionally, OPS has not ascertained if this 
service will be required on a permanent basis, making it more 
economical to utilize contractor services in the interim.
    OPS is continuing to assess current performance to determine the 
most efficient and effective mechanism for performing the media 
monitoring function in light of operational needs and budgetary 
direction.
    The Media Monitoring contract was competed for and awarded to 
General Dynamics Advanced Information Systems (GDAIS) on May 27, 2010, 
under the GSA Mission Oriented Business Integrated Services (MOBIS) 
contract vehicle. The Period of Performance (POP) for this contract is 
July 1, 2010 through December 31, 2014, and the total contract value is 
$11.3 million. The contract includes tasks to monitor open sources for 
incidents relating to potential and emerging threats and hazards to the 
homeland.
    In accordance with the Federal Acquisition Regulation, the award to 
GDAIS was based on the Evaluation Team's review and assessment of the 
qualifications of multiple vendors that submitted a quotation in 
response to the Request for Quotation (RFQ). The Evaluation Team made a 
recommendation to the Source Selection Authority (SSA) that GDAIS 
offered the best value quote for fulfilling the Department's social 
media situational awareness reporting requirement. After a thorough 
review of the Evaluator's assessment which included an evaluation of 
the strengths, weaknesses, and risks of the quotes received, the SSA 
determined that GDAIS would provide superior performance of the 
Government's objectives, and was the most technically competent 
contractor that had submitted a quotation.
    Question 4. Please describe the way that DHS solicited feedback 
from the privacy community regarding DHS' use of social media.
    Answer. In addition to the five Privacy Impact Assessments (dealing 
with the three pilots, the program, and the update to include seven 
narrow categories of personally identifiable information) and three 
Privacy Compliance Reviews, the DHS Privacy Office has engaged in 
dialogue with the privacy community regarding DHS' use of social media 
in a number of ways. These include several quarterly advocate outreach 
meetings (Privacy Information for Advocates), Chief Privacy Officer 
Testimony before the Data Privacy and Integrity Advisory Committee 
(DPIAC) in public meetings, DHS Privacy Office staff testimony before 
the DPIAC, and inter-agency and intra-agency discussions. The Privacy 
Impact Assessments and other documentation are available at 
www.dhs.gov/privacy.
    The Chief Privacy Officer invites privacy organizations and privacy 
advocates (who have requested to participate) to quarterly 
informational meetings during which the Chief Privacy Officer provides 
updates on DHS privacy issues. To date, 24 distinct organizations have 
requested invitations. The quarterly Privacy Information for Advocates 
meetings allow the Chief Privacy Officer and privacy advocates to 
discuss privacy issues that impact DHS and individuals. In 2010 and 
2011, Chief Privacy Officer Mary Ellen Callahan spoke in depth about 
DHS's use of social media and the situational awareness initiative at 
four of the quarterly meetings. Additionally, the March 2012 Privacy 
Information for Advocates meeting provided an opportunity to update 
advocates on the social media situational awareness initiative at 
length, including discussing examples, as well as clarifying 
misconceptions.
    The DPIAC was established by the Secretary of Homeland Security as 
a discretionary committee under the Federal Advisory Committee Act to 
provide advice to the Secretary and to the DHS Chief Privacy Officer, 
upon request, on policy, programmatic, operational, administrative, and 
technological issues within DHS that relate to personally identifiable 
information, as well as data integrity and other privacy-related 
matters. Committee members are individuals from the private sector, 
academia, non-governmental organizations, and State government who have 
expertise in privacy, security, and emerging technologies.
    The DPIAC holds several public meetings throughout the year to 
receive updates from the DHS Privacy Office, learn more about how DHS 
components have implemented privacy, and gain information on specific 
DHS programs that have privacy implications. In 2010 and 2011, Chief 
Privacy Officer Mary Ellen Callahan provided public testimony on the 
development, progression, and modification of the social media 
situational awareness initiative at four of these meetings. 
Additionally, DHS Privacy Office staff publicly testified at DPIAC 
meetings on the social media situational awareness initiative. In 
September 2010, one of the Associate Directors for Privacy Compliance 
testified on the development of Privacy Compliance Reviews generally, 
and how public Privacy Compliance Reviews focusing on the social media 
situational awareness initiative function. In March 2011, another 
Associate Director for Privacy Compliance publicly testified on the 
social media situational awareness initiative, focusing on the addition 
of the seven narrow categories of personally identifiable information 
that would be collected. Finally, in December 2011, staff from the 
National Operations Center (NOC), which runs the social media 
situational awareness initiative, was scheduled to publicly testify on 
the social media situational awareness initiative and the associated 
Privacy Compliance Reviews. However, the testimony was postponed due to 
extended deliberations by the DPIAC on pending recommendations from the 
committee to the Department. Information about DPIAC, and the publicly 
available meetings, can be found at www.dhs.gov/privacy.
    Throughout 2010-2012, the DHS Privacy Office also provided 
information about DHS' use of social media, whether for public 
communications and outreach, situational awareness, or operational use, 
to interagency privacy groups, including the Innovation and Emerging 
Technologies Subcommittee of the CIO Council Privacy Committee. These 
briefings were provided as examples of ways to embed privacy 
protections in Government use of social media generally, including 
developing Privacy Impact Assessments and System of Records Notices as 
necessary.
    In addition to providing information via interagency fora, in 2011, 
the DHS Privacy Office hosted an intra-agency privacy compliance 
meeting where staff from the National Operations Center updated DHS 
Component Privacy Officers on the social media situational awareness 
initiative and corresponding Privacy Compliance Reviews, as well as 
fielded questions from the Component Privacy Officers about the 
initiative.
    Question 5. Please explain who/what determines what the NOC looks 
at and searches for on social media sites.
    Answer. The Senior Watch Officer (SWO) within the National 
Operations Center (NOC), as guided by the Privacy Impact Assessments 
(PIAs), determines the NOC's search parameters. There are 13 broad 
Items of Interest (IOI) that focus analysts' efforts when searching 
publicly available social media sites. The IOI categories provide a 
general framework for the NOC's searches. The following are the 
categories:

    (1) terrorism (includes media reports on the activities of 
        terrorist organizations in the United States and abroad);
    (2) weather/natural disasters, emergency management (includes all-
        hazard reports, such as reports on hurricanes, tornadoes, 
        flooding, and earthquakes);
    (3) fire (includes reports on the ignition, spread, response, and 
        containment of wildfires, industrial fires, and explosions);
    (4) trafficking/border control issues (includes reports on the 
        trafficking of narcotics, people, weapons, and goods into and 
        out of the United States);
    (5) immigration (includes reports on apprehension of illegal 
        immigrants and border control events or incidents);
    (6) HAZMAT (includes reports on chemical, biological, and 
        radiological hazardous materials discharges);
    (7) nuclear (includes reports terrorist attempts to obtain nuclear 
        materials, security incidents at nuclear facilities, and 
        potential threats to nuclear facilities);
    (8) transportation security (includes reports on security breaches 
        and incidents or threats involving rail, air, road, and water 
        transit);
    (9) infrastructure (includes reports on attacks or failures in 
        transportation networks, telecommunications networks, energy 
        grids, utilities, domestic food and agriculture, Government 
        facilities, and financial infrastructure);
    (10) National and international security (includes reports relating 
        to threats against American citizens, political figures, 
        military installations, embassies, and consulates);
    (11) National and international health concerns (includes reports 
        on outbreaks of infectious diseases and recalls of food or 
        other items dangerous to public health);
    (12) public safety (includes reports on public safety incidents, 
        building lockdowns, bomb threats, mass shootings, and building 
        evacuations); and
    (13) cybersecurity (includes reports on cybersecurity matters such 
        as cyber attacks, computer viruses, and the use of technology 
        for terrorism purposes).

    There were originally 14 IOI categories. IOI 14 was ``Reports on 
DHS, Components, and other Federal agencies: Includes both positive and 
negative reports on FEMA, CIS, CBP, ICE, etc. as well as organizations 
outside of DHS.'' This IOI has been subsequently eliminated in order to 
prevent misunderstandings about the intended use of this information.
    Analysts conduct searches using publicly available streaming media 
and news-based search engines. These tools allow analysts to search by 
keyword or a collection of terms. The keywords and terms that inform 
searching are pre-loaded onto the publicly available search tools. The 
core social media websites utilized by the NOC are listed in Appendix A 
of the January 6, 2011 Privacy Impact Assessment that is available to 
the public via www.dhs.gov/privacy. The core search terms, or keywords, 
utilized by the NOC are listed in Appendix B of the same publicly 
available document.

                                 

```