By Nasser Eledroos and Kade Crockford¹, 2018

Executive Summary

The ACLU of Massachusetts obtained documents through the Massachusetts Public Records Law revealing that the Boston Police Department’s (BPD’s) Boston Regional Intelligence Center used a social media surveillance system called Geofeedia to conduct online surveillance in 2014, 2015, and 2016. This system explicitly targeted users’ First Amendment protected speech and association. It collected thousands of social media posts about political and social activism, current events, religious issues, and personal matters irrelevant to law enforcement concerns. It treated ordinary citizens discussing ordinary affairs as justifiable targets of surveillance.

What it did not do, according to the documents, was deter or help solve serious crimes. There is no indication that the wide net BPD cast over social media using Geofeedia was ever instrumental in preempting terrorism or other violence, solving serious crimes, or providing the residents of Boston with any other public safety benefit. This is unsurprising, given that many of the search terms fed into — or, frequently, provided by — Geofeedia were terms associated with political activism, like “#blacklivesmatter” and “protest.” BPD also used the software to track Boston Public Schools students protesting budget cuts. Perhaps most disturbingly, BPD used Geofeedia to monitor the use of various basic Arabic words used in everyday conversations and the hashtag “#muslimlivesmatter,” suggesting that BPD considered Muslims as a group to be legitimate targets of surveillance. Even in cases where BPD searched for keywords actually related to terrorist groups, like “ISIS,” a review of the posts BPD collected pursuant to that search term revealed that the surveillance turned up nothing criminal or even suspicious. The posts mentioning ISIS were either jokes or references to current events.

The Geofeedia files provide further evidence that police social media surveillance systems, operated in the dark without any public scrutiny, are likely to treat people as inherently suspicious based on their race, religion, or ethnicity, or because they are politically active, without advancing public safety or criminal investigations. The records demonstrate the clear need for both transparency and procedural safeguards to ensure that this type of software is subject to public scrutiny and ongoing oversight before it is used again.

In response to these revelations about BPD’s social media monitoring, we recommend the following:

• The Boston Police Department should change its privacy policy to forbid:
  • the collection or sharing of information about people who are not suspected of specific, articulable, criminal activity, with designated, enumerated exceptions for situations like missing persons investigations; and
  • surveillance based on race, religion, national origin, and protected political speech and association, except in cases where the Department has reasonable grounds to believe that a person has committed a crime and their protected activity or status is directly relevant to the investigation.
• The Boston City Council should pass a municipal law requiring a transparent, democratic process before BPD acquires new surveillance technologies to mandate community control over surveillance. Doing so would ensure that any future social media monitoring technology is only acquired after a public debate, and with City Council approval. The Mayor of Somerville recently established such a policy, and the City Council in Cambridge is currently working on an ordinance. The City of Seattle and Santa Clara County have both adopted ordinances based on ACLU models.
• The Massachusetts state legislature should pass the Fundamental Freedoms Act, which would forbid public agencies including police departments from collecting information about people’s First Amendment protected activities, speech, beliefs, and associations, except in cases where law enforcement has reasonable grounds to believe that a person has committed a crime and their protected activity or status is directly relevant to the investigation.

Police officers are charged with protecting not only public safety but also individual rights. Social media monitoring that turns Muslims, politically active residents, and others into “persons of interest” without demonstrated utility in solving crimes accomplishes neither of these aims. We need transparency, accountability, and government and community oversight to ensure that this does not happen again.

Social Media Monitoring in Boston: Free Speech in the Crosshairs

A 2014 survey of 1,200 law enforcement agencies found that 80 percent used some form of social media surveillance. But is social media surveillance actually a good use of law enforcement resources? Does it enhance public safety? Does it safeguard civil rights and civil liberties? Do the possible benefits to public safety outweigh the costs to a free and open society?

To date, the evidence points overwhelmingly towards “no” for all of these questions. Beyond marketing hype, there is no clear evidence that social media surveillance is an effective public safety tool. There is, however, ample evidence that it is a tool for racial and religious profiling, and for surveillance of political and social activists.

Data that we obtained from the Boston Police Department (BPD) about its use of a social media surveillance product called Geofeedia reinforces that conclusion. There is no evidence that a single act of violence or serious crime was either prevented or solved through the use of Geofeedia’s social media dragnet tool. Instead, BPD used the tool primarily to monitor the entire Boston Muslim community, treating the use of common Arabic words or terms like “#muslimlivesmatter” as suspicious.  The BPD also used the software to track online speech associated with large protests in November 2014². In other words, Geofeedia facilitated the automation of biased and politically motivated surveillance, not effective policing.

In November 2014, protesters in Boston flooded the streets to denounce the non-indictment of Darren Wilson, the Ferguson, Missouri police officer who killed Michael Brown in 2014, and in support of the national Black Lives Matter movement.

Background

In October 2016, the Boston Herald reported that BPD had published a $1.4 million request for proposals (RFP) to purchase a social media surveillance system. In response, companies submitted proposals detailing social media monitoring systems that claimed to enable advanced surveillance and tracking.³ Boston Police Commissioner William Evans told local media the police wouldn’t use such a tool to track anyone but serious criminals. “We’re not going after ordinary people,” Evans told WGBH in November 2016. “It’s a necessary tool of law enforcement and helps in keeping our neighborhoods safe from violence, as well as terrorism, human trafficking, and young kids who might be the victim of a pedophile.” But when faced with public backlash after the ACLU of Massachusetts and Bostonians raised public concerns about BPD’s plans, the police commissioner scrapped the RFP and, at least for now, has publicly stepped away from plans for a new social media monitoring system.

In fact, this was not BPD’s first foray into automated social media surveillance. Documents obtained by the ACLU of Massachusetts show that BPD’s Boston Regional Intelligence Center (BRIC) used a social media monitoring tool called Geofeedia⁴ during the years 2014, 2015, and 2016.

But Geofeedia was soon to come under intense public scrutiny. In September 2016, the ACLU of Northern California published records showing that Geofeedia marketed itself to law enforcement as a tool to keep track of dissidents. In October 2016, the ACLU obtained records showing Twitter, Instagram, and Facebook were making user data available to the company. Ultimately, as a result of the ACLU’s advocacy, all three of the social media giants kicked Geofeedia off their platforms altogether. Since Twitter posts made up a majority of the content Geofeedia scanned and made available to its customers in law enforcement and marketing, this move effectively killed the social media monitoring company.

While Geofeedia may be history, BPD’s use of the tool in 2014, 2015, and 2016 tells an important story about BPD’s approach to social media monitoring.  To uncover that story, the ACLU of Massachusetts filed a public records request with BPD, requesting information about how BPD used Geofeedia.

The Geofeedia Files

We received thousands of pages of documents in response to our inquiry documenting BPD’s use of Geofeedia between January 2014 and June 2016. According to those documents, BPD first used Geofeedia on a trial basis for two weeks in January 2014 and then for another two weeks in November 2014. The Department subsequently contracted with the company from January 13, 2015 to May 31, 2016, paying Geofeedia a total of $26,698 for a year and four months of service for up to 30 BPD users.⁵ According to these documents, about 15 BPD employees, mostly analysts at the BRIC — BPD’s Department of Homeland Security-funded fusion center — had access to the software during this period. BPD used Geofeedia to collect and monitor thousands of posts on Instagram, Twitter, YouTube, Facebook, YikYak, and Flickr. BPD’s contract with Geofeedia gave BPD analysts access to “unlimited data” and “unlimited locations and recordings,” with a search radius of 15 kilometers, or just over nine miles.

The bulk of the documents BPD disclosed are “email alerts.” These are automated emails based on particular search criteria (keywords) that Geofeedia users can tailor to their interests. In response to our public records request, BPD gave us approximately 1,900 of these email alerts. The email alerts give us a clear sense of the types of content Boston police officers targeted on social media platforms.

These documents confirm what our colleagues in Northern California warned us about: police in Boston were using Geofeedia’s automated surveillance capabilities to conduct surveillance on entire communities and to monitor First Amendment protected speech and association, not to fight crime. In its initial trial of the service, BRIC used Geofeedia to monitor online speech associated with the Black Lives Matter movement in Boston, including protests in response to the non-indictment of Darren Wilson in November 2014. After contracting with the company in 2015, BRIC used Geofeedia primarily to target so-called “Islamic Extremist Terminology,” which consists primarily of commonly used words like “ISIS” and a list of Arabic words used regularly by ordinary members of Muslim communities. Unsurprisingly, the result was that Geofeedia captured a large number of conversations and posts about Islam itself. Even monitoring terms like “ISIS” succeeded only in capturing content that discussed — or, quite often, made jokes involving — terrorism, not content remotely related to any actual terrorist threat. Of the thousands of posts BPD disclosed in response to our records request, the ACLU was unable to identify a single post that appeared to link a social media user to terrorism or other violence.

The documents don’t reveal whether BPD investigated any of these social media users further. They also don’t tell us whether BPD retained information it collected on people’s social media use, or whether that information was shared with any outside agencies like Immigration Customs Enforcement (ICE) or the FBI. But current BPD policy allows such sharing, even if the information doesn’t relate to criminal activity.

In sum, the documents provide no indication that Geofeedia was ever useful in stopping or solving a serious crime involving violence or terrorism. It was simply a tool to monitor ordinary people’s online speech and political activity, primarily on the basis of their religion. Without safeguards, there is no guarantee that any future social media surveillance tools obtained by BPD will not result in the same outcome.

Social Media Surveillance: What’s the Problem?

Hundreds of millions of people — including people in the Boston area — post articles and commentary on social media about current events, religious ideas, community affairs, and personal matters. The records we obtained show BPD collected at least 1,900 such posts using Geofeedia’s technology over the nearly one-year and a half period the software was in use. We don’t know what BRIC’s analysts did with this information. But we know that this type of surveillance facilitates larger problems with 21st century policing: data overload, politically motivated spying, and digital racial profiling.

It is ineffective at stopping terrorism and other crimes

The National Research Council (NRC) and others have found that large-scale data mining is an ineffective public safety approach. In a 2008 study funded by the Department of Homeland Security, the NRC concluded that “[a]utomated identification of terrorists through data mining (or any other known methodology) is neither feasible as an objective nor desirable as a goal of technology development efforts.” Research by a former counterterrorism analyst at the CIA found that information overload in the US intelligence community hinders, rather than advances, national security efforts. Most recently, in response to a proposal by the Department of Homeland Security to automate social media surveillance as part of “Extreme Vetting, ” dozens of prominent machine learning experts warned that the technology would likely produce too many false positives, undermining its stated goals as well as putting civil rights and civil liberties at risk.

It enables politically motivated surveillance and chills speech

While there is no evidence that social media monitoring prevents serious violence, the potential harms to civil society and democracy are clear. This is particularly true when law enforcement uses social media monitoring to monitor dissidents and other political activists, as well as the press. In Bahrain, Turkey, China, Egypt, Saudi Arabia, and Russia, for example, governments have effectively used social media monitoring tools to undermine social and political reform movements, illustrating the utility of social media monitoring as a tool of political control.  Here in the United States, law enforcement agencies have likewise used social media monitoring to track political speech and even to inappropriately target a government employee simply because of the political views he expressed online.

Recent history provides us with ample reason to be concerned about BPD’s use of this technology to target activists. In 2012, the ACLU and National Lawyers Guild published a report based on BPD documents showing the Department tracked the activities of antiwar and peace groups in the city, writing “intelligence reports” about individuals and organizations labeled with terms like “HOMESEC-DOMESTIC” and “EXTREMIST.” When the ACLU exposed these records, the Department’s response was to say the intelligence files had been retained in violation of the Department’s privacy policy because of a computer glitch. But the policy that enabled the police to monitor and document the groups’ activities in the first place remains unchanged.

It facilitates digital racial profiling

There’s also evidence that law enforcement’s social media monitoring is tainted by the same kind of racially disparate enforcement that infects street policing, leading some researchers to warn about “stop and frisk online.” This can readily lead to both biased outcomes on the individual level and pervasive surveillance and discrimination against entire communities.

Social media surveillance companies not only allow but also outright encourage monitoring of political activists of color. Both Geofeedia and rival tools like MediaSonar have suggested that law enforcement monitor terms like “#blacklivesmatter,” “#dontshoot,” or “#mikebrown” associated with racial justice movements. And that’s exactly what happened when BPD used Geofeedia.

How BPD Used Geofeedia to Monitor Activists and Ordinary Muslims

The documents we obtained contain no evidence that Geofeedia helped BPD solve crimes or prevent violence.  Even more problematically, they don’t even support the argument that BPD tried to use Geofeedia to fulfill its public safety mission. Instead, Geofeedia was used for two primary purposes: to track online racial justice activism in the wake of the events in Ferguson, MO and to conduct broad surveillance of ordinary Muslims in Boston.

Targeting political activists for surveillance

The documents show that during the Department’s two-week trial of Geofeedia in November 2014, BPD used the software to monitor social media posts about protests in Boston in support of the Black Lives Matter movement. During the trial period, the Department tracked the terms “protest,” “#blacklivesmatter,” and “Ferguson.” Among the unsuspecting targets of this surveillance was then-City Councilor Tito Jackson, whose Facebook post about racial disparities and inequality in Boston was among the social media posts BPD collected through Geofeedia. Jackson’s post read in part:

“As we have the much needed conversation about #Ferguson and police brutality and the disproportionate number of unarmed Black men that are killed by police nationwide, which is long overdue, we must have a parallel conversation. Homelessness and Poverty are brutal. Mental Health and Addiction Issues are brutal. Criminal records and incarceration are brutal. Health care disparities and a 33-year difference in life expectancy at birth between Roxbury and Back Bay is also brutality. We must not shy away from these issues because they are hard, we must address them because it is the right thing to do and because all of these folks are our brothers and sisters.”

Sixteen months later, after BPD had contracted to use the software, BRIC used the technology to monitor a Boston Public Schools student walkout in March 2016. Over 1,000 students walked out of school to protest budget cuts, taking public transportation downtown and marching to the state house steps. Boston Public Schools students are overwhelmingly Black and Brown; 42 percent of students are Latinx and 35 percent are Black, while only 14 percent are white. Emails indicate Geofeedia encouraged a Boston Police analyst at BRIC to review social media posts students and supporters made about the protests.

Above: Emails between Geofeedia and the Boston Police Department show a BRIC employee used Geofeedia to review social media posts made by students who walked out of the Boston Public Schools to protest budget cuts.

The documents show that BPD routinely used Geofeedia’s automated query tool to conduct just this type of biased surveillance. The primary targets were not terrorists or people making threats. Instead, after its November 2014 trial of the software, BPD’s social media surveillance targeted broad swaths of the Boston Muslim community.

Casting Islam as suspicious

When discussing the most recent proposal to acquire and use social media surveillance, Commissioner Evans explicitly said that technology would not be used to “go[] after ordinary people.” But the records amply demonstrate that BPD routinely used Geofeedia to collect vast amounts of information about ordinary Muslims discussing both matters of public interest and mundane aspects of their personal lives. There seem to be only two possible conclusions to draw from that: either BPD did in fact consciously and intentionally “go after ordinary people,” or BPD thinks that Muslims are in fact not “ordinary” but inherently suspicious. Neither of those are remotely tolerable beliefs for law enforcement officials to hold.

One of the terms that BPD explicitly monitored was “#muslimlivesmatter.” This tag, like its counterpart “#blacklivesmatter” (also deemed suspicious by BPD), is part of an essential conversation about equality taking place in our country. The conversations captured under this tag most often express solidarity and common humanity. There is no clear reason why the tag would be treated with suspicion other than because it is an indicator of potential political activism.

Above: Alerts tracking the phrase “muslimlivesmatter.” BPD began to track posts containing the phrase after three Muslim students were shot and killed near the University of North Carolina Chapel Hill campus. These tweets are both about an attack at a Synagogue in Copenhagen, Denmark, but the Geofeedia system BPD programmed picked them up because people in Boston posted them.

More broadly, BPD used Geofeedia to track numerous Arabic terms for no apparent reason other than their frequent use in the Muslim community. Among the categories of keywords BPD tracked using Geofeedia was “Islamic Extremist Terminology,” which included not only references to ISIS and similar terrorist organizations⁶ but also innocuous Arabic words routinely used to discuss religion or community, including “ummah” (which means “community” in Arabic) and “al Sham” (which roughly translates to Greater Syria).⁷

Above: The number of email alerts Geofeedia sent to the Boston Police Department, broken down by the category BPD assigned for the search terms. The documents indicate BPD selected these search terms and categories in light of samples provided by the social media monitoring company.

The resulting surveillance put the mundane social media posts of Boston area Muslims under police scrutiny simply because of the posters’ religious beliefs and language. The surveillance was entirely unjustifiable from a public safety perspective. By targeting ordinary terms, BPD captured ordinary communications, like someone asking Muslims to participate in the annual Walk for Hunger because they used the word “ummah.”An example of an alert for “Islamic Extremist Terminology,” flagged because it contained the word “ummah” (meaning “community” in Arabic).

The inclusion of these terms under the banner of “extremism” raises serious civil liberties concerns, alarming advocates like Shannon Al-Wakeel, executive director of the Boston-based Muslim Justice League.⁸ “As a supposed public safety tool, scanning for ‘Islamic’ words might merely be absurd if it weren’t also so downright racist,” said Al-Wakeel after reviewing the alerts. “We sometimes hear local policymakers denounce federal targeting of Muslim communities; we urge elected officials to learn how national security is used as a pretext to surveil and criminalize folks locally—here and now—and to use their power to end these abuses.”

The visualization above shows the types of posts the Boston Police sought to monitor on social media. As the chart shows, the keywords are lumped into categories such as “Islamist Extremist Terminology” and “Boston Bike Life.”⁹ In the system, those larger categories are called the ‘Recording Name,’ and they each include keywords, such as “ISIS,” “jannah,” and “bikelife.” Around 67 percent of all the alerts in the dataset fall under what the Boston Police Department classified as “Islamic Extremist Terminology.” Above: A breakdown of BPD’s automated query surveillance in 2015 and 2016, by social media platform. 1195 of the email alerts generated by Geofeedia, based on BPD search terms, came from Twitter.

Conclusion

The Boston Police Department doesn’t use Geofeedia anymore, and in early 2017, the Department announced it was withdrawing its controversial $1.4 million request for proposals for a new social media surveillance system. But when officials made that announcement, they left the door open to the Department’s use of a similar social media surveillance system in the future.

These records show that BPD spent over $26,000 on Geofeedia subscriptions over approximately 16 months, and that the social media posts it tracked using the software were mostly benign comments about racial discrimination, current events, and Muslim religious practice. Where BPD tracked words associated with terrorism, like “ISIS,” the documents provide no indication that the surveillance ever produced valuable public safety results. Given this experience, it’s unclear why BPD thought it wise to spend over one million dollars on even more invasive social media surveillance technology.

If the Department plans to buy such a system in the future, it should first consult with the public, elected city officials, and civil liberties and civil rights groups. But before even considering expending public resources on a system like this, BPD must make a clear and compelling case detailing how and why social media surveillance benefits public safety. These BPD documents strongly suggest it does not.

Recommendations

• The Boston Police Department should change its privacy policy to forbid:
  • the collection or sharing of information about people who are not suspected of specific, articulable, criminal activity, with designated, enumerated exceptions for situations like missing persons investigations; and
  • surveillance based on race, religion, national origin, and protected political speech and association, except in cases where the Department has reasonable grounds to believe that a person has committed a crime and their protected activity or status is directly relevant to the investigation.
• The Boston City Council should pass a municipal law requiring a transparent, democratic process before BPD acquires new surveillance technologies to mandate community control over surveillance. Doing so would ensure that any future social media monitoring technology is only acquired after a public debate, and with City Council approval. The Mayor of Somerville recently established such a policy, and the City Council in Cambridge is currently working on an ordinance. The City of Seattle and Santa Clara County have both adopted ordinances based on ACLU models.
• The Massachusetts state legislature should pass the Fundamental Freedoms Act, which would forbid public agencies including police departments from collecting information about people’s First Amendment protected activities, speech, beliefs, and associations, except in cases where law enforcement has reasonable grounds to believe that a person has committed a crime and their protected activity or status is directly relevant to the investigation.

---

¹ Special thanks to Chris Conley for his invaluable assistance editing this report.

² In November 2014, protesters in Boston flooded the streets to denounce the non-indictment of Darren Wilson, the Ferguson, Missouri police officer who killed Michael Brown in 2014, and in support of the national Black Lives Matter movement.

³ The company Uncharted, for example, boasted that its system would allow BPD to “determin[e] movements of social media users” by using a combination of Tweets and cell phone data to “quickly identify patterns of a target’s life.” Verint’s proposal claimed the company could provide Boston Police Department officers and analysts with access to “covert collection capabilities” and “private content.”

⁴ Geofeedia was a Software-as-a-Service (SaaS) product the company described as a “Location-based Analytics Platform” through which customers could “search and analyze real-time social media content coming from any location in the world.” The company received funding from the CIA’s venture capital arm, In-Q-Tel.

⁵ An email dated April 16, 2015 from the director of the Boston Regional Intelligence Center (BRIC), David Carabin, to Geofeedia asks that the reauthorization of BPD’s service contract cost less than $10,000. “[I]f it goes above [$10,000],” Carabin writes, “we will need to put this contract out to bid which will delay the process and create additional risks.” If the contract were posted for bidding, the fact that the Boston Police Department was looking to lease or purchase social media surveillance software would have become public information, inviting the kind of public backlash that resulted when BPD posted a request for proposals for social media surveillance software in 2016. BPD contracted with Geofeedia on three separate occasions; all three contracts fell below the $10,000 threshold for public bidding.

⁶ None of the posts collected that referred to ISIS or similar organizations actually revealed any terrorist or criminal activity; instead, those posts consisted of discussions of terrorism and jokes.

⁷ Other ordinary words BPD labeled as “Islamic Extremist Terminology” were: shirk, tawheed, and jannah.

⁸ Shannon Al-Wakeel serves on the Board of Directors of the ACLU of Massachusetts.

⁹ The other primary category of information tracked by BPD focused on the social media posts of youth who ride dirt bikes in the city. In May 2016, Boston.com reported the arrest of ’14 individuals for reckless driving’. It’s possible that BPD’s tracking of the youths’ social media posts helped to facilitate some of these arrests.