The Lawfare Podcast: Government Use of Open-Source Information

[Introduction]

Kenneth Wainstein: Here's the problem with that authority. I mean, do I want it, in many ways, no, I don't want it because it's a hot potato. It's incredibly difficult, but it has to be done and, at the end of the day, it's our job. And so, we just have to do it effectively. Effectively, in terms of preventing violence and threats against our people, but, also, effectively in a way that protects people's privacy and civil liberties. And here's the problem, when you think about it, our mission, in fact, our limited mission, is to look online for social media that might relate to threats to the homeland, which is our intelligence space. And we can only either go to publicly available, or we have to be overt about it. So, we can't lie about who we are and get into a private chat room. We can't do that, right? We're very constrained in where we can go. And the ironic thing is that each one of you can be much more effective in doing this than we can because you don't have those constraints. Private individuals, private organizations can do a lot more than we can in the open environment.

Benjamin Wittes: I'm Benjamin Wittes, and this is the Lawfare Podcast. We are to you from the Knight Foundation's INFORMED Conference in Miami, Florida. We are on the stage in front of a live audience, as you can hear. I am here with Ken Wainstein, Under Secretary of DHS for Intelligence and Analysis, Jameel Jaffer of the Knight Institute at Columbia, and of course, Quinta Jurecic of Lawfare and Brookings. And we're here to talk about government surveillance of open-source social media.

[Main Podcast]

Ken, I want to get right into it. You guys, the agency that you head, has a very particular and unusual authority and mission, and it relates to everybody's social media, and I want you to explain to us what it is, and what you are and aren't allowed to do.

Kenneth L. Wainstein: Okay, thanks Ben. Good to see everybody. It's a real pleasure to be here. Good to be with this panel of distinguished thinkers in this issue. So look, the Office of Intelligence and Analysis at DHS was stood up with the department 20 years ago. And it was stood up to address some of the deficiencies that the intelligence and law enforcement communities had pre-9/11 that were laid bare by 9/11. And one of them was the fact that there was inadequate information- and intelligence-sharing between the federal authorities, intelligence community, and federal law enforcement authorities, and the state, local, territorial, tribal, and private sector partners out in the country. So, INA was stood up to help to bridge that gap and share information, but, also to be an intelligence agency.

We are one of the agencies within the intelligence community. So we are responsible for all parts of the intelligence cycle: that's collecting intelligence that's relevant to intelligence requirements, analyzing that information, producing intelligence products, and disseminating it to our partners. In this case, it's largely to our state and local, territorial, tribal, and private sector partners. In the course of doing that, of course, it is our job to be meeting the needs of our partners. And the needs of our partners are broadly to protect the homeland, and to protect against threats to the homeland that manifest out in the states, in the counties, in the cities and jurisdictions where our partners have responsibility to protect their people.

So, we have to collect, analyze, and disseminate the intelligence that helps them. In terms of collecting, we get a lot of that intelligence from our fellow intelligence community partners by way of reporting from the CIA, reporting from the FBI about threats that might manifest here in the homeland. We also collect some of our own intelligence. And that's where we get to the issue that you're talking about. We collect that in a variety of different ways. We can do interviews with people throughout the country. But, also, we can look on the internet and we can look in social media. And I've often likened what we do, and others like the FBI do, on social media, sort of, to the police officer 50 years ago who is patrolling a town and walking along looking for open doors or windows or anomalies that might suggest something is wrong. That was pre-internet. Now, when you're trying to help people protect against and anticipate threats to the homeland, oftentimes you're not walking down a street looking for open doors; you're looking for indications in social media about a coming threat.

And there's no greater, probably example, no example I think that's sort of most vivid in its demonstration of this than January 6th. We all know that January 6th-- prior to January 6th--there was a lot of discussion in the open-source space and social media. And a lot of it related to anticipation, preparations, and discussion of actual steps to perpetuate violence up on Capitol Hill. And those threat indicators that were online were viewed and the question was sort of how to get them out and give sufficient alert to the people who could possibly have prevented January 6th from happening. That didn't happen. And so, in the aftermath of January 6th, there had been a lot of discussion about what collection should have happened, what alarm or what alert should have been given. And we are one of the organizations that looked at that open-source area, the FBI was one of the organizations that did. And I think it's important to look at that episode because if nothing else, January 6th demonstrates the need to do this kind of surveillance, to do this kind of review, because we can't let the next January 6th happen if those indicators are out there in social media.

That is what we do, and we do it in a very constrained way. In fact, I've often said that we are the kinder, gentler intelligence agency. And I say that because we have the most constraints on us, the most limitations on us, the most reporting requirements on us, which is exactly as it should be. Because our job is to do intelligence here in the homeland, where we have constitutional rights and privacy are paramount. And so we have to do this mission and we look at the social media environment with those constraints in place. So that's the challenge--that's the mission we have, but also the challenge we have.

Benjamin Wittes: All right, so Jameel, you have been in one way or another thinking about this issue since the creation of the department after 9/11. A lot of people react to this as like, "Hey, it's available for anybody. Why shouldn't an intelligence agency take a look at it?" A lot of other people look at it and say, "Oh my God, the government tracking social media. That's really scary." What is your instinctive reaction and, for that matter, your considered reaction to the idea that some government agency, whether DHS, INA, or the FBI, is watching for "Storm the Capitol" hashtags?

Jameel Jaffer: So, what is my instinctive reaction? My instinctive reaction is I don't like anything about it. I don't even like the word "homeland." My considered reaction is--let's just take a step back first. Okay, so, I think there are very good reasons why--and I'm sure Ken would agree with me--very good reasons why a democratic society should place strict limits on government surveillance.

If you want a democracy to work, you need people to feel comfortable communicating with each other, privately and publicly. You need them to feel comfortable organizing into political groups, taking political action, collective action, protesting. And people who think or know that the government is tracking their expressive or associational activities, are going to be chilled from doing all of those things. That's just Civil Liberties 101, right? People whose activities, expressive and associational activities, are tracked, will be much less likely to participate in the activities that are necessary for any democracy to function and every authoritarian regime knows this. Every authoritarian regime knows that surveillance can be a powerful tool of censorship.

You don't actually have to look to authoritarian regimes overseas to see how all this can go wrong. It's gone wrong in the United States, in the homeland, if you like, many, many times, right? In the 1950s and '60s, intelligence agencies abuse their surveillance powers to kneecap civil rights organizations. After 9/11, the NYPD tracked countless Muslim groups in New York City, including Muslim student groups. Not because they'd done anything wrong, but because the NYPD just wanted to map out what Muslims were doing in in New York City. There are lots of other abuses over the last 50 years. You don't, again, have to look overseas to see the ways this kind of thing can go wrong.

Now, all of that said, there are circumstances in which I think we need to accept that, even in an open society, the government is going to have a legitimate reason to track what citizens are doing, including their expressive and associational activities. But I think we should approach that with an awareness of past abuses, and approach this with the view that these kinds of surveillance activities need to be surrounded by safeguards. It can't be that executive branch officials have broad discretion, unsupervised by another branch, unsupervised by the, courts to engage in this kind of surveillance. We need to think about not just what they're collecting, but what they're doing with the information, how long they're retaining it, who it gets disseminated to. So, I guess, that's sort of the way I come at the set of questions.

I also think that this is the wrong moment to be talking about whether the government's surveillance power should be expanded. I think we haven't yet fully responded to the abuses that were disclosed by Edward Snowden. I think that those abuses, which were written about endlessly by American newspapers, those documents and those stories showed that the safeguards we have in place right now are insufficient to keep these surveillance powers in check. That surveillance powers we thought were granted for relatively limited purposes were ultimately used for much broader purposes. The institutional checks and balances that were supposed to keep all of this in within limits, failed over and over again.

And when I say failed, one way to measure the failure is just to look at what happened after those surveillance programs were disclosed. And one of the things that happened is that Congress, once the public knew about, for example, the call records program, which was the program, that involved collecting metadata from hundreds of millions of Americans' phone calls. Once that was public, Congress felt obliged to rein in those surveillance activities. So, they were allowed to persist only because, only while they were secret. Once they were public Congress felt obliged to rein them in. So, I think we haven't addressed those failures.

I also think that, as many of us are thinking about, what life might be like under a different administration, a new administration, or the same administration we had a few years ago, one of the questions we should be asking is, what kinds of surveillance, even if you trust this administration with these surveillance powers, what kinds of surveillance powers do you want in the hands of the next administration?

So, I guess, if I were framing this conversation, I would frame it in exactly the opposite way. I think the right question to be asking is not what additional surveillance powers should the government have right now, but, rather, what new safeguards do we need to ensure that these powers are used consistent with the public interest and consistent with our values?

Benjamin Wittes: So, fair enough. And to be clear, I don't think anybody is actually talking about expanding these authorities. The DHS just got through fending off an amendment from Marco Rubio, a local senator, to substantially curtail these powers. I actually think the question, as currently, framed is very much in the direction that you would want it to be.

But, I fear that the de facto compromise that has been reached over the last few years is to have these powers but then not use them. And I want, Quinta, you to sort of--this creates a kind of a weird, almost like pincer action, where on the one hand, Congress has given this set of authorities to INA. On the other hand--and to the FBI. On the other hand the INA, as I will ask Ken to develop, is not really staffed to actually use them in an active way, and then, the FBI more or less chooses not to. And so, you end up de facto with very much the environment that, Jameel, you're describing, which Congress then gets upset about when January 6th happens.

So, Quinta, walk us through the actual--who in the government is reading whose social media and under what circumstances?

Quinta Jurecic: So, let me focus specifically on the story of January 6th because I do think that that is very telling in a number of ways. We now have a pretty enormous body of reporting from Congress, from various inspectors general, less so actually from the House Select Committee on January 6th, which kind of set this part of the story aside. But, through a lot of this investigative work, we have a sense of what was going on at DHS INA and at the FBI in the run up to January 6th. And what you see essentially is an environment where, as you say Ben, these are agencies that pretty clearly have some level, that is constrained, of authority to monitor public social media posts, so, your posts on Twitter. The problem is that, as you hinted, these agencies appear to have been really unwilling to actually use that authority. And to the extent that analysts were using that authority to review material, they weren't recording it; to the extent that they weren't recording it, they weren't passing it along the chain; to the extent that it was passed along the chain, it wasn't shared inside or amongst agencies.

The reasons for why that might be are complicated, and I'll get to that in a little bit, to the extent that we have a sense of that. But, what you really do see if you look through these Inspector General reports, these reports from Congress, is people who are aware that something bad is going to happen because they have an internet connection, just like everybody else. And like a lot of us in the run up to January 6, we're looking at Twitter and looking at Facebook and looking at Reddit and could see that something was going to happen. And yet, are very gun shy, for lack of a better term, about moving forward. And turning that material into something that those agencies could actually do something with. And as an end result, you reach the situation where DHS and the FBI are, kind of, frankly, caught with their pants down. You would have expected that these agencies who are very much tasked with protecting the U.S. Capitol would have seen something like this coming, but we've all seen the footage of people rushing into the building, and it took hours and hours before there was an adequate response.

So, then let me move a little bit to the kind of after-action report. What you see, and I'll focus a little more on the, on the Bureau here, just because I've focused a little bit more on it in my own work--is that FBI Director Christopher Wray, and then Assistant FBI Director for Counterterrorism Jill Sanborn go in front of Congress after January 6th and are asked, "Do you have the authority to look at public social media posts? And if so, why didn't you?" And their answers, I would argue, are pretty misleading. They kind of suggest that there's a higher level of authority that is required than the Bureau actually had in those circumstances. But, if you actually look at the very, very in depth manual that was written in response to the abuses of the FBI in the '50s and '60s that Jameel is pointing to, it's pretty clear that they explicitly do have the authority and the ability to look at, again, publicly available social media posts without jumping through the particular set of hoops that Director Wray seemed to suggest before Congress. And there's also, in addition to that, there's some reporting from the Senate Homeland Security and Government Affairs Committee that suggested that the Bureau had actually begun some of the investigative steps that would have allowed it to have even more authorities.

So, it's not a question of not having the authority, it's a question of having the authority and then not doing anything with it. This leads us to the question, why not do anything with it? I think this is actually something that we have much less of a sense of. It's much more speculative. I will say, there's a book that recently came out from Ryan Reilly at NBC News--he's been doing a lot of reporting on the fallout from January 6th--that's called Sedition Hunters, that makes the argument that essentially the Bureau was scared about what would happen if it went after far-right extremists. Specifically, and if you look too closely at supporters of the president, who is, after all in charge of the FBI ultimately, and there was a level of anxiety about what would happen if that moved too far forward. You also see a level of anxiety, again, according to Reilly's book and according to Inspector General reports, from INA about perceived overreach by that agency in response to the protests in Portland earlier that year, which I think gets exactly to some of the abuses that Jameel was touching on.

And so, you end up, as you say, Ben, with this kind of pressure from both sides, where the agencies nominally have this authority. In the case of Portland and other George Floyd protests, they did use it to some extent in ways that I would argue were actually abusive, and then become, sort of pull back and are unwilling to take that step going forward.

Benjamin Wittes: All right. So, can--Jameel doesn't want anybody to have this authority. Chris Wray wants anybody but him to have this authority. I'm caricaturing both's point of view. Is this an authority you actually want?

Jameel Jaffer: But before you answer, Ken, can I just ask a question about, like, what authority exactly are we are we talking about? Because obviously there are many versions of this.

Benjamin Wittes: Sure.

Jameel Jaffer: And it might matter which one we're talking about.

Benjamin Wittes: Right. So, so right. So, let's say that the authority in question is the authority to review open-source social media material for violent threats, not to compile dossiers on any individual, not to track networks, but to, you see in the newspaper that there's a "Storm the Capitol" hashtag trending. What can you do with that? Right? And, and I, I think Quinta's account of, first of all, if you're, if you disagree with Quinta's account, that's, love to know that, but I'm, my impression is that it's quite accurate that this was something that the Bureau sort of disclaimed. How many people do you have doing this sort of thing and, and what is, is this a mission that DHS actually wants to have?

Kenneth Wainstein: Okay, you got a few questions in there.

Benjamin Wittes: Yeah, yeah. Take such time as the gentleman may require.

Kenneth Wainstein: Thank you. Quinta's article, I read that just last night, it's excellent, excellent sort of dissection and description of what happened and how that square, didn't square with the relevant, guidelines under which the FBI operated, and the same thing could be done with our conduct throughout the January 6th. Let me just step back and try to generally answer this. The reason I started with January 6th is not because it's one that, well, partly because it's one that everybody knows, but also because I think it so clearly demonstrates the need for this work to be done. I mean, as Jameel said, there are circumstances where the government needs to be able to do this. And so, I think that's just an example, a good starting point, okay, that human smugglers online and them trying to promote their, their operations online. Obviously, there are areas where I think we'd all agree that government authorities should have the ability to see that information, act on it in appropriate circumstances. So let's start with that. Here's the problem with that authority. I mean, do I want it? In many ways, no, I don't want it because it's a hot potato. It's incredibly difficult, but it has to be done. And at the end of the day, it's our job. And so we just have to do it effectively, effectively in terms of preventing violence and threats against our people, but also effectively in a way that protects people's privacy and civil liberties.

And here's the problem. I mean, when you think about it, our mission, in fact, our limited mission is to look online for social media that might relate to threats to the homeland, which is our intelligence space. And we can only either go to publicly available information, or we have to be overt about it. So we can't lie about who we are and get into a private chat room. We can't do that. Right? We're very constrained in where we can go. And the ironic thing is that each one of you can be much more effective in doing this, then we can, because you don't have those constraints, private individuals, private organizations can do a lot more than we can in in the open environment. Which is ironic of course, since we're the ones with the mission for to protect the homeland, but understandable for all the reasons that Jameel laid out about and-

Benjamin Wittes: And to be clear, do you object to that? Are you asking for authorities that you don’t have?

Kenneth Wainstein: No, we're not asking for further authority.

Benjamin Wittes: Okay, but, but, but hang on, so I don't want to, I don't want to make the case for authorities you don't want. But it seems to me that we are in a situation that's a little bit absurd, which is to say that you have one agency that doesn't want to do this work at all, which is the Bureau, which is has 35,000 people and it's a very serious manpower operation. It has field offices all over the country. And then you have one agency that is tiny. How many people do you have on this?

Kenneth Wainstein: We have like a couple, three dozen, I think, all together.

Benjamin Wittes: All right, so three dozen people in a, with a highly constrained set of Attorney General's guidelines. And so it seems like the, we've set up a situation in which it is essentially impossible for this to be done effectively. Whether the answer to that is more people, or to let the agency that's bigger do it, or maybe to get out of the business of doing it at all, which is Jameel's, I'm, I'm sort of agnostic, but it seems like there's, it seems like we've built a situation that can't be successful.

Kenneth Wainstein: Yeah, I agree with you. You know I'm saying, we're not, we're not urging, we're not asking Congress for INA to have additional authorities at this moment. I do agree, though, that we need to look across the whole enterprise, the Bureau and us, see that there is a need to deal with conditions of violence in particular in the open source arena, and then make sure that we, that we, the government, have the capability to see that, detect plots before they happen, and then get the intelligence out to those actors who can prevent those plots from becoming reality.

We, you're right, we don't have the size, we don't have the staffing, we don't have the authorities, frankly, to effectively do that. Now, in our case, it's a balancing act, right? We were set up against the backdrop of the Bureau and other agencies that had authorities. And as Quinta said the Bureau does have the ability to look in social media in the first instance. They then have the, once they establish that there is the predicate for an investigation or there are different degrees of investigation, each of which allows more intrusive tools, investigative tools. So they can do that. We don't have those investigative tools. We don't have, we can't get search warrants. We can't do 702 surveillance. We can't do, you know we can't arrest people. So, we are limited to just reviewing what we see in social media and then reporting on it. And keep in mind, when we look in social media, we can't just track Ben Wittes. We can't just say, let's just say-

Benjamin Wittes: Well, you did once.

Kenneth Wainstein: There was that. We'll talk about that later. But we can't, we can't just put a person in and say, okay, let's just follow that person. We have to look only in areas where we have a reasonable belief there's going to be information that relates to a threat, that relates to one of our missions, either a departmental mission or a national mission. And look, at the end of the day, let me just step back for a quick second, then I'll wind up on this. This sounds like it should be easy, but it's incredibly difficult, because just look at the domestic terrorism area. I think that's the best example. We say, we don't look in the, in social media anywhere where we don't have a reasonable belief that there's discussion of, coordination of, what have you, relating to violence.

The problem with domestic terrorism is that the vast majority of it emanates from political belief, political rhetoric and expression. That is the most core protected type of speech we have. So, what we have to do is, we might go to a website where we know that there are domestic violent extremists, and there will be discussion that sounds quite extremist, but that's fully protected unless it crosses that line into discussion of violence. And that's what makes this such a difficult, sort of constitutionally perilous undertaking. But it has to be done, and the fact that it's perilous, yet it has to be done is the reason why we have such tight constraints on us.

Benjamin Wittes: All right, so I want to give Jameel a chance to respond to this, but before I do, I actually want to take the temperature of the audience here, because it seems to me a reasonable person listening to this could have one of, one of two reactions, and I'm just interested from a show of noise which one how many of you have.

One is the government shouldn't be reading public social media without a criminal predicate. How many of you react in that way?

Jameel Jaffer: Ben, Ben, hold on.

Benjamin Wittes: Sorry?

Jameel Jaffer: Okay, so, it matters what the surveillance looks like, okay? We're talking at a very high level of generality. At some level, I mean, who's going to disagree with the proposition that the government should be able to go on social media and see if anything somebody's planning something terrible?

Quinta Jurecic: Well, Christopher Wray.

Benjamin Wittes: Well, yeah, I mean, the FBI director.

Jameel Jaffer: Christopher Wray may misunderstand First Amendment limits in this context, I don't know. But at some level of generality, I think I certainly would agree, I think most civil libertarians would agree, that the government needs to know what's going on in the world, and looking at public social media posts can be a way of learning what's going on in the world.

But there's a difference between, there are different steps that the government can take, right? One is there's a difference between looking at social media posts generally and then following a particular person. There might be a difference between following a particular person disclosing that you're a government agent and following a particular person pretending you're somebody other than a government agent, right? Infiltrating a political group might raise additional concerns. And I think that you have to have a graduated system here where the safeguards are commensurate to the intrusion into speech and privacy, right?

I suspect that most people at that level of abstraction were probably all on the same page. The question is what, what level of intrusion can be justified on the basis of, you know, what kind of predicate do you need to justify any particular level of intrusion?

Benjamin Wittes: Okay? So let, let me formulate. And let me formulate it a little differently: One reaction possible reaction to the events of the last several years is to say there should be less public social media monitoring by law enforcement outside the context of predicated investigations. Another possible reaction would be to say there should be more monitoring of social media for intelligence purposes outside of the context of predicated investigations. Is that a fair?

Jameel Jaffer: I still don't like it, but I've interrupted so much.

Benjamin Wittes: Well, let's, let's see who here thinks there should be less public monitoring of social media outside of the context of predicated criminal investigations.

Audience: [Scattered applause.]

Benjamin Wittess: Alright, who here thinks there should, the surveillance crew, thinks there should be more public monitoring of social media outside, for intelligence purposes, outside of the context of predicated investigations?

Audience: [Silence]

Benjamin Wittes: Wow, Ken.

Kenneth Wainsten: Oh, I'm taking it personally. Thank you. Thank you.

Benjamin Wittes: The smattering of applause for Jameel's position carries the day.

Jameel Jaffer: Well, okay, so, so can I say a couple of things here?

Benjamin Wittes: Yeah, please.

Jameel Jaffer: So, we have a case at the Knight Institute where we're challenging a State Department rule that requires visa applicants to register their social media handles with the State Department. And this has entirely predictable results. Some people who would otherwise apply for visas to come to the United States now think twice about doing it. Some people don't apply at all, especially if you're, if you're a, say a Saudi dissident who uses a pseudonym on social media, you might be hesitant to turn over your real identity to associate yourself with your pseudonym in your application to the State Department.

And further consequences, people in the United States who would otherwise have had the opportunity to engage with people from other countries maybe lose out on that, you know opportunity sometimes. So we were concerned about the First Amendment implications of this, surveillance and urged the, the Trump administration not to go down this road, urged the Biden administration to reject the rule after the Trump administration had adopted it, were unsuccessful in these advocacy efforts. And then so finally filed a FOIA lawsuit to try to get internal government reports about the effectiveness of this surveillance. And our FOIA lawsuit was unsuccessful at unearthing the actual report, but we did get email exchanges in which government officials. exchanged views about this social media surveillance and the underlying report, which we didn't get.

And documents from the office of the Director of National Intelligence, email exchanges from that, that, that office, characterized the value, characterized this social media surveillance program as having, quote, no value, no intelligence value. This is a program that has been in place now for six years or something like that. And the government itself, the ODNI, characterizes the program as having no intelligence value. Now, I don't want to suggest that this means that no form of social media surveillance would be effective or useful, but I think that there is this instinct after any intelligence failure to think that the problem was, we didn't have the information we needed, when often the problem is, we didn't share the information, or we didn't know what the info, we didn't actually look at the information, or we didn't analyze it in the way that we, we should have. And I started this whole conversation by saying we should approach proposals for expansion of surveillance authority, and I understand that that's not that's not perhaps what's being proposed here, but we should approach those with a degree of skepticism, and this is just another reason to approach those those kinds of proposals with, with skepticism.

Benjamin Wittes: All right, we are going to go to audience questions momentarily. But before we do, Ken, I just want you to address the question, was there, was there information in the case of January 6th that INA had available that didn't get shared, or was this an information deficit problem? And Quinta in the case of the Bureau, I think the answer to that question is a little bit more florid than in the case of INA, right?

Kenneth Wainstein: Well, look, I, I've just had the benefit of going back and looking at the various reports, and I think bottom line is, for both organizations, the FBI and DHS, and you can read this in the recent HSGAC report, is that they did have access to information that would have suggested that there was a possible looming threat, and that that information did not get promptly conveyed to the people who could act on it.

And look, so that's been a major focus of ours since I got there, and major focus of the Secretary and the Deputy Secretary, has been to make sure that we're doing everything pursuant to the guidelines, but we're also making sure to get the information out. And so, for example, and this is a much different situation, when the Dobbs decision came out, the abortion decision, came out by surprise one morning, it was a Friday morning, and there was great concern that that could foment potential violence, and there have been indications that there, there were plans to possibly do something when that came down on both sides, right. And so by that afternoon, we had corralled whatever our intelligence we had about, both from our partners, but also what we saw in open-source media, and put something out to all our partners saying here's what we're seeing and what we're not seeing. Fortunately, as you recall, things were quite peaceful and protests were dignified and respectful.

That being said, we were able to get out, this is the intelligence picture, that process is now much, much more in place than it was. And I think there were some very difficult circumstances that you all have alluded to in January 6th that hopefully won't replicate.

Benjamin Wittes: Quinta?

Quinta Jurecic: I think that on the part of the Bureau in advance of January 6th, it's both. It's a failure to process information that was sitting around waiting for someone to pick it up, and it was a failure to do anything with the information once it was presented.

I also think it's, it's worth connecting what we're talking about here to some of the dynamics that we've alluded to over the course of the day in terms of political pressure on people who are looking at questions of far-right extremism online. I think if, if you look at the dynamics, and within the Bureau as has been reported in these documents from Congress before and then after the 6th, what you see is an organization that essentially was successfully bullied into not doing anything. I don't think I'm getting out over my skis too much in saying that, and an organization that has been, continued to be bullied into not doing anything, or not exercising its authorities within the appropriate First Amendment limits because of concern that if anything is done that the director will be held before Congress. And so I think that that is an additional dynamic that is worth keeping in mind here, and adds an additional and important layer of complication to everything that we've said.

Benjamin Wittes: All right, a question from over there.

Audience Member: Justin Henderson, Tech Policy Press. So not to, kind of redirect the conversation away from social media, but another thing that Christopher Wray is mealy mouthed about in front of Congress is the FBI's use of commercially available information from data brokers and the like, which arguably, much larger ingestion going on potentially in the federal government of that information than perhaps social media. And I know we have a partially declassified ODNI report on this last year, et cetera. I just put that to the panel, anything to say about commercially available information from data brokers and the extent to which, some of the topics that you've discussed here perhaps should apply to that question?

Benjamin Wittes: Yeah, so super interesting question. Jameel, first of all any thoughts on ingestion by the Bureau and Ken, what are the rules affecting you guys for commercially available information? Jameel first, or?

Jameel Jaffer: I mean, I guess I would just say that I think this is another area where the law hasn't kept up to new technology. And if the FBI searches, wants to search somebody's home, they need to get a warrant to do it. But if they want the same information, if they access the same information by purchasing it from a data broker there's no, no judicial oversight, no probable cause requirement.

Even the issues we were talking about earlier, I would say that the, the, part of the problem here is that the law has not kept the, the First Amendment hasn't kept up to, kept up with new technology. And this kind of social media surveillance looks so different from the kinds of surveillance that the Supreme Court was thinking about, in cases decided 50 years ago, like Laird v. Tatum which involved an army surveillance program in which army officials were, were taking news clippings, clippings from the newspaper about a particular set of individuals and the court said well, this kind of collection of news clippings doesn't amount to a First Amendment injury.

And now we're talking about these massive dragnet programs where the government officials are tracking individuals over long periods of time, and your, your information is kept indefinitely in these huge government databases. And the same cases that the court decided 50 years ago, those are the cases that have sort of created the legal, that, that still form the legal architecture in which government officials are making these decisions. And there has been, I mean this would be a long digression, but there has been a kind of updating of the Fourth Amendment over the last few years with cases like Jones and Carpenter, I think we're still waiting for the court to do that with the First Amendment.

Benjamin Wittes: Ken, what are you, what, are you allowed to buy all the stuff that you're not allowed to collect yourself?

Kenneth Wainstein: Look, there, the rules are taking shape in terms of what, what publicly available and commercially available information can just be purchased and adjusted. And, and there are a lot of programs, both in our department and elsewhere, that rely on that for legitimate national security and law enforcement reasons. But I do want to just sort of add on, or, or, carry on Jameel's point, he's right that the law in terms of the court decisions and the analysis of the constitutional implications of these new, new technologies and new issues hasn't kept up with today's reality. But the same with legislation, and I think Congress needs to wrestle these issues to the ground, and I actually applaud them doing it, whether it's commercially available information, whether it's our access to social media, whether it's our old friend 702, the authority which is up for reauthorization.

Benjamin Wittes: Pushed back till April.

Kenneth Wainstein: Pushed back till April, but it was, I mean, it's a classic example of technology outpacing a law that was passed in the late 1970s based on the technology of the time. In 2008, Congress, in a really admirable show of what I think was good, strong bipartisan national security legislation, rolled up their sleeves, hammered out a reform of the FISA statute that brought it up to date, put in place a lot of good protections and safeguards that weren't in place before. And now it's been reauthorized a number of times and it's back up and they're looking at it again. I applaud that. I applaud the fact that they're looking at it again. But as you know, in the 702 context, it's absolutely critical that it, for national security, that it be continued. I think that same congressional interest, as much as it, as much as I'd prefer not to be up in Capitol Hill having to deal with the situation you talked about last year where there was an attempt to curtail our collection efforts, at the end of the day that was a healthy exercise.

Congress scrutinized what we were doing, scrutinized the safeguards we had in place, whether they were sufficient, considered legislation, ultimately backed off of that legislation, but gave us a package of safeguards that really enhanced the oversight of our operations. That's good legislation. I think we need more of it.

Benjamin Wittes: Last question over here.

Audience Question: Hi there, I am Bea Covello. I'm the director of emerging technologies at Aspen Digital, program of the Aspen Institute. And I have a two part question for you, and feel free to let me know if there's not enough time for that. But I am not a constitutional scholar, I don't know a whole lot about intelligence agencies. So I'd love if you could break down for me two things. One is, you talked about, monitoring the potentially monitoring the social media and, looking for expressions of violence or intent for violence and I was wondering if you could give a little more clarity on what, what qualifies, what does that mean? Where, where's the threshold?

And then two, in the situation, perhaps for good reason or wrong, in the situation where agencies are constrained or afraid to act, what alternative pathways are there. You talked about, kind of, in our perhaps, unpopular poll, should there be more or less monitoring, there was a caveat there, which was, like, there was a caveat whether or not there was sort of a, a cause, an instigating circumstance, and I'm wondering if you could share what is the alternative path? Are we, the citizens of social media, meant to report when we see expressions of intent to violence? One, what is intent of violence? When do we cross that line? And then two, what is the alternative to government monitoring?

Benjamin Wittes: Great. Please.

Kenneth Wainstein: Okay. Excellent set of questions. And before I answer the first question, I think you've hit on a really important point, and I don't know exactly how everything played out with January 6th, but one thing I've seen over the years is paralysis occurs by government workers when they feel they don't have clear guidance, clear leadership, and clear support for what they're doing. So they don't really understand exactly where they should go. And I think that's what happened with January 6th. There's a lack of, of understanding of exactly where the right and left boundaries were. And when they hear that, when that, that's the case. People tend, as a matter of just human nature, to say, okay, I'm just going to back off from doing that work because I'm scared, right?

And so we saw some of that, which leads back to my last point, which is incumbent on Congress to give us the rules, but it's incumbent on people like me to make sure that those rules are enunciated, trained, clarified among the workforce so that people understand where the, the guidelines are, but also understand and can move confidently forward and do their job for the American people. So that's a really important thing.

In terms of what is that guideline as it applies to violence here, that's a very good point. What we, we cannot, we're prohibited by the Attorney General guidelines from doing any, accessing any post for the purposes of just monitoring somebody's First Amendment activity. We can't do it just solely for that reason. We can't do it to try to stifle dissent. We can't do it in any way to try to prevent political views being expressed. So we're prohibited from doing that. We can only go and look at a post if we have a reasonable belief, and that's defined in the guidelines, in other words, not a hunch, but a reasonable belief based on training, expertise, understanding of maybe that particular website and the extremists who visit that website, that there might be a post that, that is related to domestic violence and extremism. And we do it by using search terms that relate to that possibility and go into the places where we have a reasonable belief we might find that discussion.

So that's how it's done and that's, so roughly speaking, how we will zero in on something and how frankly prior to January 6th, they did zero in on some conversations that suggested that some sort of attack was coming. And so once you understand it's carefully circumscribed and I think that's, people need to take comfort from that. We cannot just monitor people unless we have a basis for a reasonable belief that they're engaged in some kind of threatening behavior.

Your second question is what the alternative is. I mean, it's interesting I don't think there really is. I don't think the American people want the government to delegate national security to private actors. But you could see a world where that is what happens, right? I mean, as we discussed, every one of you has more authority than I do and my people do in the open source environment. You guys can go a lot of places we can't go and see more. There are private organizations out there that can do that and do do that day in and day out to protect their schools, or their faith institutions, or what have you. We cannot make them agents of ours, but there is a world where they're the ones who are generating all the threat indicia, and then putting them out, and the government's on the sidelines.

I'm not sure, at the end of the day, that addresses the constitutional concerns and the privacy concerns, because those become almost quasi government actors. So I guess, if I'm trying to think of like an alternative world, that's it, and I guess if we don't sort of iron out this conundrum of, okay, this needs to happen. Right now you have agencies that are not fully equipped to do it, either resource wise or authorities wise, how is this, how should this be reconfigured to be effective, but also to be suitably constrained if we can't get that worked out, who knows? It might be that we, you move to that alternative world, but I just don't see that as a viable possibility.

Benjamin Wittes: Jameel, do you have final thoughts?

Jameel Jaffer: I, I guess the only thing I'd say in response to that is it's, it's not an unusual thing that private citizens would have more access to a lot of these spaces than government officials do and it's I don't think it's a problematic thing. Like for example if you know, let's say, you go to church and somebody brings a gun to church I don't think it would be reassuring to know that there's a government agent sitting in the back pew who will, you know, see that that person has a gun and then take whatever action is required.

No you assume that in those kinds of circumstances private citizens will, yes, report to the government what's, what's going on. And I don't think people would find it reassuring to know that there are government agents, and I don't actually think this is what you're proposing, but government agents in private political organizations just in case somebody happens to make a threat of, of, of violence. So it's not a problem in my view that the government doesn't have visibility into all of these spaces, that's just a function of living in a democratic society in which the government has limited, limited powers.

I don't want to pretend that these questions though are easier than they are. I do think this question of when the government should have access to even publicly available information is a complicated question. It's a complicated question because the government is engaged in the same kinds of collection activities that journalists are engaged in, that Clearview AI is engaged in when it puts together its facial recognition app, right? And we don't have a legal framework right now that draws clear distinctions, that sort of distinguishes between these activities. Our legal framework right now kind of squints at all these activities and says these look like the same thing. And that doesn't seem like a workable framework, as we go forward. We need, we need a legal framework that kind of distinguishes all of these collection activities that has a, has different legal rules for each of these collection activities. And we don't have that right now and it's not an easy thing to figure out what that framework should look like.

Benjamin Wittes: Quinta, bring us home.

Quinta Jurecic: I think, actually, to some extent, we are already seeing this kind of collaboration between government agencies and private researchers and, again, I'll point to Ryan Reily’s book, Sedition Hunters. He's not paying me, but you should read it, it's a great book. And the ‘sedition hunters’ he's referring to there in the title are a group of private citizens who turned out to be much better at sleuthing social media then the FBI. And who were able to look at the enormous amount of material that folks posted on the day of January 6th selfies, videos of themselves in the Capitol and use open source investigative techniques among themselves to help identify those people. And you see to this day, there are still people being arrested who entered the Capitol who have been identified through those techniques. And those are people who are working with the Bureau, to help the Bureau identify those people. And so I do think that raises a lot of questions, whether you think that is a good or a bad thing, but whatever you make of it, it has been extraordinarily effective.

The second thing, going back to your, your first question about how, how we think about what constitutes a level of violence that merits some kind of review or collection. I think that's a really important issue, particularly because, again, if you look at congressional reports about what's going on in these agencies in advance of January 6th, what you see is a lot of missing the forest for the trees.

Where if you, if you zoom back and look at the whole body of posts that people are making on social media saying I'm bringing my gun, let's go to the Capitol, right, or hang Mike Pence. In the aggregate, there's just an extraordinary amount of material there that is deeply, deeply concerning. But if you look at any individual posts, you might say, okay, this person's saying hang Mike Pence, but he's in Montana, right? This person says, let's all go to the Capitol. But like, are they really going to the Capitol? Probably not. And that might not rise to a level where an FBI analyst would have previously thought this is something that is actually concerning.

And I think that this dynamic in terms of how we move from a world of looking at sort of more individualized communication as a potentially concerning threat to understanding aggregate information, and sort of mob movement and harassment as something that could potentially be threatening and, and worthy of concern, whether from private actors or from government actors is something that we're still working out. I think it, it maybe touches on the point that Jameel made about the difficulty of thinking through First Amendment implications of different kinds of, of work right now in a world that looks very different than a lot of that original jurisprudence was, was decided in. But I, I think that you, you see these dynamics not only in terms of how government agencies are trying to think through these things, but how judges now are trying to think through the question of what constitutes incitement to violence, and also in terms of how private researchers are, are understanding the material that they're seeing on these platforms.

Benjamin Wittes: We are going to leave it there. Please join me in thanking our panelists.

The Lawfare Podcast is produced in cooperation with the Brookings Institution. You need to do your part to become a material supporter of Lawfare. Hey, you don't like the ads on this? Go become a material supporter and get access to our ad-free podcast. We need your help to bring you everything that you want from us this year.

The Lawfare Podcast is edited by Jen Patja Howell. Our music is performed by Sophia Yan. And as always, thanks for listening.