An Update on Homeland Security Intelligence Reporting on Me

When I last checked in on the saga of the Department of Homeland Security’s intelligence reporting about me, I had a bit of a cliff-hanger on my hands. “Is the Department of Homeland Security (DHS) still filing intelligence reports about journalists?” I asked:

It seems like a simple question. And I confess I wasn’t expecting the routine status report a federal judge ordered the government to file on Wednesday to raise my eyebrows—much less to warrant an article. But asked to address this apparently easy question, the Justice Department said—in essence—that it’s not sure and will get back to the judge in a few weeks. “Defendant needs additional time to appropriately address the question. ... Defendant’s response could potentially have a wide implication beyond this particular case.”

To this question, we now have an answer—and a reassuring one at that. 

Yet in the meantime, a lot of new information has come out, thanks to the good offices of Sen. Ron Wyden—who recently released an internal DHS report on the matter. This document contains a large amount of new information and analysis including, among other things, the revelation that “an I&A employee requested a report on [me] and included instructions to add ‘a list of any [of my] associates or groups.’”

Let us unpack, taking the easy part first. 

I will not rehash in detail the facts I laid out in my prior article on this subject. Suffice it to say that the government took me a bit by surprise by being unable to answer Judge Randolph Moss’s apparently simple question of whether it was still filing intelligence reports on journalists. 

Judge Moss asked for a filing on the subject and the government, after giving itself a week to file its response, filed a document saying it needed more time. Here is the relevant portion of the government’s status report:

On September 21, 2022, the parties appeared for a pre-motion conference and the Court ordered, inter alia, Defendant to file a status report addressing whether ... Defendant discontinued the practice of collecting information involving members of the press. ...

In terms of the first question, Defendant needs additional time to appropriately address the question, as expressed during the September 21, 2022, pre-motion conference. Defendant’s response could potentially have a wide implication beyond this particular case. Consequently, Defendant requests additional time, to and through October 21, 2022, to provide a response.

On Oct. 18, the government finally answered Judge Moss’s question—and the answer seems solid enough: 

5. In response to the first question, Defendant confirmed that it has discontinued the practice. A written order was issued on July 31, 2020 by the then-Acting Secretary of Homeland Security to the then-Acting Secretary for Intelligence and Analysis, directing the Department’s Office of Intelligence & Analysis (“I&A”) to “discontinue collecting information involving U.S. members of the press” and stating that “[t]he Department . . . will no longer identify U.S. members of the press in its intelligence products.” That order, which has not been rescinded or modified, remains in effect, and I&A continues to adhere to it. 

6. Defendant, in attesting that the July 31, 2020 order remains in effect, has also confirmed with the manager of the I&A element responsible for the collection and dissemination of Open Source Intelligence Reports (“OSIRs”) that his team is fully aware of the prohibitions in the order, that he knows of no violations of the order, and that he did a word search of the OSIRs generated since July 31, 2020 to confirm that none reflects a violation of the order. 

Nine days later, however, Sen. Wyden released a document entitled “Report on DHS Administrative Review into I&A Open Source Collection and Dissemination Activities During Civil Unrest,” dated Jan. 6, 2021. The department had released a significantly redacted version of this report some time ago and there had been some press on the subject. It had actually produced the document to me with similar redactions, which included redactions of information specifically about the unclassified intelligence reporting concerning me. Here is what one page of the document dealing with me looked like: 

Here’s what the page looks like in the unredacted version Wyden released: 

As you can see, the redactions protected as purported intelligence sources and methods such sensitive facts as that I used Twitter to report on DHS. It protected the contents of the OSIRs, which I had already made public and were composed entirely of public information anyway. And it protected the fact of the reassignment of I&A’s then head, Brian Murphy, which has been anything but a secret. 

The unredacted version, explained I&A’s new chief—the redoubtable Ken Wainstein—in a letter to Wyden, is now releasable because “my I&A colleagues and I have completed [a] review, which has resulted in the issuance of a new policy that will permit greater disclosure of source and method information under FOIA and thereby increase the public transparency of our work.”

“The new guidance,” Wainstein writes, “supplants any prior practice of withholding all material specifically referencing sources and methods and requires disclosure thereof unless ‘its disclosure would materially negate or impair the effectiveness of those sources and methods’” (emphasis in original).

All of which should provoke I&A and its lawyers at the Justice Department to revisit the redactions in my case, to which Wainstein’s review speaks rather directly. Recall that I&A is withholding my name from me, among other things. As I explained in the last post:

One thing the department has disclosed, however, is the specific reports about me—but with an important catch. The documents are highly redacted. Assuming these are the same documents that were leaked to me in full, it appears that my name cannot be released—to me. It further appears it cannot be disclosed that my Twitter feed is the subject of the reports. Ditto the substance of my tweets, which is available to all of my more than 400,000 Twitter followers and anyone else who wants to see them.

I would hope the government will now review the redactions in the documents it has previously released to me in light of this salutary policy change. 

But there’s another really interesting component of the document Wyden released: what’s in it. 

The main document is a thorough review of the “facts and circumstances regarding the collection and publication of three Open Source Intelligence Reports (OSIRs) that reported on the activities of U.S. journalists who published unclassified I&A materials that were provided to them without authorization,” records the executive summary. To be clear, two of these OSIRs were about me, and one was about Mike Baker of the New York Times. “These intelligence reports were unusual in that they reported on the activities of U.S. journalists engaged in ordinary journalism,” the document concedes up front. Here is the summary of its conclusions:

This review determined that the release of the OSIRs is attributable to the following causes: 

• a poorly thought-out and insufficiently resourced reorganization and transition of Open Source Collection Operations to 24/7 operations 
• the lack of a formal OSCO [Open Source Collection Operations] training program and disruptions to on-the-job training caused by the sudden increase in OSCO personnel and COVID-19 restrictions 
• insufficient supervision of junior collectors caused by the excessive burdens imposed upon senior desk officers, which was exacerbated by the sudden increase in OSCO personnel and COVID-19 restrictions 
• the deployment of untrained, inexperienced collectors to Portland 
• improper collection tradecraft 
• the pressure put on the Certified Release Authorities to review and publish OSIRs 
• the decision to categorically unmask certain U.S. person information (USPI) against the recommendations of staff 
• a poor staffing process for reviewing OSIRs prior to publication 
• the faulty practice of identifying applicable collection requirements by viewing those listed on released OSIRs ostensibly concerning the same subject material 

This review also examined the command and workforce climate at I&A. It found that Mr. Murphy created a toxic atmosphere at I&A as a result of his demeaning, dismissive and degrading treatment of I&A employees, and that many employees, to include senior personnel, continue to fear retaliation if he is reinstated.

. . . 

Finally, in the course of the investigation, the review uncovered the practice of using Operational Background Reports (OBRs, colloquially “baseball cards”) to create dossiers on [US persons] arrested by federal authorities in Portland. Significant irregularities apparently existed regarding this practice given the collection, retention and potential dissemination of USPI regarding persons arrested for offenses seemingly unrelated to homeland security.

Buried on page 59 of this document and somewhat obscured by redaction in the version turned over to me is that one of those “Operational Background Reports” was requested (though never actually prepared) about me. The relevant passage reads: 

In another instance, an I&A employee requested a report on another journalist – the same journalist at issue in one of the leaked OSIRs – and included instructions to add “a list of any [of his] associates or groups.” The journalist in that case had not been arrested for anything, but had posted unclassified DHS internal correspondence to his social media page. In addition to poor optics, completing an OBR on this journalist without a clear connection to a national or departmental mission arguably would have failed to satisfy the reasonable belief standard. Fortunately, a collector recognized that the subject was a journalist, alerted the requestor to this fact, and declined to proceed with that particular search. But the facts of this particular incident suggest that at least some I&A personnel did not understand the relevant legal standard before running checks on [US persons]. 

So how did Baker and I come to be the subjects of intelligence reporting in the first place? The specific events that led to the publication of the OSIRs are detailed on pp. 48-54. But the general answer to the question appears on page 21 in the following remarkable passage: 

In the case of the three OSIRs that were leaked and are at issue in this investigation, a junior collector stumbled across the information of the leaked DHS material, and with an understanding that a leak of unclassified DHS information was a significant concern of the Department, mistakenly believed that the leak warranted production of an intelligence report. Several individuals who were interviewed, including CETC’s Director and OSCO’s Branch Chief, believed that a leak of unclassified information by a [US person] with no foreign connection fit under the counterintelligence umbrella. . . . Remarkably, less than five witnesses asked were able to specify a foreign connection in the definition of counterintelligence. . . . There was no suspected involvement of a foreign adversary with respect to the three OSIRs at issue, which involved the unauthorized release of information to an USPER member of the media. Nonetheless, many CETC employees appeared to erroneously believe a CI nexus existed. Several appeared to be confused about how to report an unclassified leak and some were not aware that a leak needed to be reported to the Chief Security Officer, or that DHS even had an insider threat program (emphasis added).

Memo to all I&A employees: Journalism is not spying. 

The document’s conclusion regarding the propriety of the three intelligence reports reads as follows on page 48:

Three OSIRs OSCO published during the deployment to Portland raised significant concerns. Specifically, OSIR-04001-0932-20, OSIR 04001-0937-20, and OSIR-04001-0952-20, all of which were later recalled, should not have been published in the first place, and if appropriate safeguards were in place, their publication could have been prevented. Most significantly, no collection requirement and no apparent intelligence mission supported the collection of the information that was included in any of the three serialized reports. In addition, insufficient masking of USPI drew focus from what was ostensibly the intended subject matter of the OSIRs and raised First Amendment concerns. The OSIRs documented USPER journalists publishing unclassified information that was supplied to them, which is activity protected by the First Amendment. While interviews revealed that the individuals within OSCO who identified and published the information at issue were not motivated by a desire to prevent or focus on First Amendment protected activity, the OSIRs were nevertheless problematic and should not have been published.

As to the Operational Background Reports, the document makes clear that these were deeply problematic on a number of levels—and that’s as to people arrested in Portland in connection with the unrest there. In my case, as the passage quoted above makes clear, the collection would have been impossible to justify (“completing an OBR on this journalist without a clear connection to a national or departmental mission arguably would have failed to satisfy the reasonable belief standard”).

All in all, I find this report pretty impressive. And I actually find the basic finding—that nonpolitical incompetence, bad training, overwork, and a toxic work environment cumulatively explains the matter—fairly persuasive. I still want to see the rest of the material, particularly the material related to the baseball cards requested about me. But this document answers a lot of questions that have been bothering me for a long time. 

I wonder how long it will take DHS to produce the unredacted version to me.