In the year since the deadly insurrection at the US Capitol, federal authorities have faced intense scrutiny for failing to detect warning signs on social media.

After the 6 January insurrection, the US agency tasked with combatting terrorism and extremism, the Department of Homeland Security (DHS), has expanded its monitoring of online activity, with officials touting a new domestic terrorism intelligence branch focused on tracking online threats and sharing information about possible attacks.

A senior DHS official told the Guardian this week the department aims to track “narratives known to provoke violence” and platforms that have been linked to threats. The primary goal, the official said, was to warn potential targets when they should enhance security.

In the days leading up to the anniversary of the riot, for example, the agency saw an uptick in activity on platforms tied to white supremacists and neo-Nazis and warned law enforcement partners when appropriate, the official said. This monitoring relies on DHS analysts, not artificial intelligence, and doesn’t target “ideologies”, the official added, but rather “calls for violence”.

The Guardian spoke with Harsha Panduranga, counsel with the liberty and national security program at the Brennan Center for Justice, a not-for-profit organization that has tracked police and government entities’ online surveillance programs, about the US government’s monitoring of social media in the wake of 6 January.

Although DHS says its online efforts are consistent with privacy protections, civil rights and civil liberties, the expansion of social media monitoring still raised concerns, Panduranga argued. Without proper safeguards, a new report from the center warns, the expanded social media surveillance could be both ineffective at preventing attacks and harmful to marginalized groups that end up targeted and criminalized by “counter-terrorism” efforts.

The conversation has been edited and condensed for clarity.

Which US government agencies monitor online activity?

Many federal agencies monitor social media, including DHS, the FBI, the state department, the Drug Enforcement Administration (DEA), the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), the US Postal Service, the Internal Revenue Service (IRS), the US Marshals Service and the Social Security Administration (SSA). Our work has primarily focused on DHS, FBI and the state department, which make extensive use of social media for monitoring, targeting and information collection.

Why do these agencies monitor civilians’ social media?

The FBI and DHS use social media monitoring to assist with investigations and to detect potential threats. Some of those investigations do not require a showing of criminal activity. For example, FBI agents can open an “assessment” [the lowest-level investigative stage] simply on the basis of preventing crime or terrorism, and without a factual basis. During assessments, FBI agents can search publicly available online information.

Subsequent investigative stages, which require some factual basis, open the door for more invasive surveillance, such as the recording of private online communications. The FBI also awarded a contract to a firm in December 2020 to scour social media and proactively identify “national security and public safety-related events” not yet reported to law enforcement.

DHS’s Homeland Security Investigations (HSI) division says it relies on social media when investigating matters ranging from civil immigration violations to terrorism. Government entities also monitor social media for “situational awareness” to coordinate a response to breaking events.

How broad is this surveillance?

Some DHS divisions, including Customs and Border Protection (CBP), the National Operations Center (NOC) and the Federal Emergency Management Agency (Fema), keep tabs on a broad list of websites and keywords being discussed on social media platforms. The agencies’ “privacy impact assessments” suggest there are few limits on the content that can be reviewed. Some assessments list a sweeping range of keywords that are monitored, including “attack”, “public health”, “power outage”, and “jihad”. Immigration authorities also use social media to screen travelers and immigrants coming into the US and even to monitor them while they live here. People applying for a range of immigration benefits also undergo social media checks to verify information in their application and determine whether they pose a security risk. Immigration and Customs Enforcement (Ice) agents can also look at publicly available social media content for a range of investigations, including probing “potential criminal activity” and are authorized to operate undercover online and monitor private communications.

How has this surveillance expanded in the wake of the insurrection?

The main new DHS effort we’re aware of is an initiative monitoring social media to try to identify “narratives” giving rise to violence. DHS says they’ll use social media to pinpoint tips, leads and trends. In September, for example, DHS warned there could be another attack on the Capitol in connection with a Justice for J6 rally. But reports showed that law enforcement personnel [and journalists] outnumbered the protesters, and there was no indication of violence at the protest. This shows how difficult it is to predict violence relying on social media chatter.

How concerned are you about the potential for civil rights violations in the wake of 6 January?

January 6 seems to be accelerating this emphasis on social media monitoring without sufficient safeguards. And the monitoring to identify “narratives” that may lead to violence is broad enough to sweep in constitutionally protected speech and political discussion on various issues. We’ve long seen that government monitoring of social media harms people in a number of ways, including wrongly implicating an individual or group in criminal behavior based on their online activity; misinterpreting the meaning of social media activity, sometimes with severe consequences; suppressing people’s willingness to talk or connect openly online; and invading individuals’ privacy. Authorities have characterized ordinary activity, like wearing a particular sneaker brand or making common hand signs, or social media connections, as evidence of criminal or threatening behavior. This kind of assumption can have high-stakes consequences.

Can you share some specific examples that illustrate these consequences?

In 2020, DHS and the FBI disseminated reports to law enforcement in Maine warning of potential violence at anti-police brutality demonstrations based on fake social media posts by rightwing provocateurs. Police in Kansas arrested a teenager in 2020 on suspicion of inciting a riot reportedly based on a mistaken interpretation of his Snapchat post, in which he was actually denouncing violence. In 2019, DHS officials barred a Palestinian student arriving to study at Harvard from entering the country allegedly based on the content of his friends’ social media posts. The student said he had neither written nor engaged with the posts, which were critical of the US government. In another case of guilt by association, the NYPD was accused of wrongly arresting a 19-year-old for attempted murder in 2012 in part because prosecutors argued his “likes” and photos on social media proved he was a member of a violent gang. That same year, British travelers were interrogated at Los Angeles international airport and sent back to the UK reportedly due to a border agent’s misinterpretation of a joking tweet.

Is social media surveillance effective at identifying legitimate threats?

Broad social media monitoring for threat detection purposes generates reams of useless information, crowding out information on real public safety concerns. Government officials and assessments have repeatedly recognized that this dynamic makes it difficult to distinguish a sliver of genuine threats from the millions of everyday communications that do not warrant law enforcement attention. The former acting chief of DHS’s Office of Intelligence and Analysis (I&A) said last year, “Actual intent to carry out violence can be difficult to discern from the angry, hyperbolic – and constitutionally protected – speech and information commonly found on social media.” And a 2021 internal review of I&A reported that searching “for true threats of violence before they happen is a difficult task filled with ambiguity”. The review observed that personnel collected information on a “broad range of general threats” that provided “information of limited value”, including “memes, hyperbole, statements on political organizations and other protected first amendment speech”. Similar concerns cropped up with the DHS’s pilot programs to use social media to vet refugees.

What groups are most impacted by this kind of surveillance?

Black, brown and Muslim people, as well as activists and dissenters more generally, are especially vulnerable to being falsely labeled as threats based on social media activity. Both the FBI and DHS have monitored Black Lives Matter activists. In 2017, the FBI created a specious terrorism threat category called “Black Identity Extremism” , which can be read to include protests against police violence. This category has been used to rationalize continued surveillance of Black activists, including monitoring of social media activity. In 2020, DHS’s Office of Intelligence and Analysis used social media and other tools to target and monitor racial justice protestors in Portland, Oregon, justifying this surveillance by pointing to the threat of vandalism to Confederate monuments. DHS then disseminated intelligence reports on journalists reporting on this overreach. Muslim, Arab, Middle Eastern and South Asian communities have often been particular targets of the US government’s discriminatory travel and immigration screening practices, including social media screening.

How do you think the government should be responding to the intelligence failures of 6 January?

A Senate committee report from last year found that DHS failed to produce a specific warning connected to what would happen on 6 January. An FBI field office had circulated a warning about an online threat with a specific call for violence, but it didn’t convince officials to better prepare for the attack. I think one takeaway from these failures is that broadly monitoring social media for scary things people are saying, without any further reason to suspect wrongdoing, tends to flood warning systems with useless information. This makes it harder to pick out what matters and sweeps in thousands of people who haven’t or wouldn’t do anything violent. Intelligence and law enforcement agencies already have ample and potent tools to investigate far-right violence without relying on indiscriminate social media monitoring, but they are not using these tools as effectively as they should. Instigators of the 6 January riot, for example, were members of groups that were already known to law enforcement. Some of them had previously participated in organized far-right violence, yet authorities did not bring charges or fully investigate the criminal activities of these organizations. So more indiscriminate surveillance isn’t the answer – in fact, such measures are much more likely to harm the very communities that are already at greater risk.