Read the full piece in New York Focus and the Albany Times Union
You get a Facebook friend request from someone you don’t know. An unknown profile seeks permission to view your protected tweets. Your private Instagram gets a follow request from an account you don’t recognize. It could be the State Police.
A New York State Police-run fusion center — one of dozens of secretive intelligence-sharing hubs created during the post-September 11, 2001, expansion in domestic surveillance — creates and uses dummy social media accounts, according to documents obtained by New York Focus and the Times Union via a public records request. The social media policy for the fusion center, known as the New York State Intelligence Center, or NYSIC, shows that analysts use “alias online identities” with fake names, locations, photos, and other personal details to access people’s social media profiles and retain their posts and information.
According to the policy, police analysts can use fake accounts to engage with someone suspected of committing or planning a crime, as well as possible crime witnesses, victims, or missing people. They can also use dummy profiles for “situational assessment purposes” — that is, in any circumstances in which they identify “potential safety threats” to the public or public officials. And they can use computer programs to automatically scrape and analyze social media data.
The document provides a first-of-its-kind look into the social media monitoring powers of the state’s main police intelligence-sharing hub. It comes to light as New York Governor Kathy Hochul, citing increased rates of interpersonal violence and recent mass shootings, beefs up NYSIC’s social media monitoring capabilities.
“We’re watching you now,” Hochul said after a massacre in Buffalo last month. “We know what you’re up to and we’ll be coming after you.”
Across the country, police departments have come under fire for using fake social media accounts. In 2015, the transparency organization MuckRock found that the New York City Police Department’s social media policies allow officers to create online aliases. In April, a report from the Minnesota Department of Human Rights found that the Minneapolis Police Department has used fake accounts to post comments attacking police critics, send private messages criticizing elected officials, and surveil Black community members and organizations “without a public safety objective.” In one instance, an officer used a dummy account to send a message to a local NAACP branch criticizing the group.
Last month, The Intercept published documents showing that the FBI has provided the Chicago Police Department with dummy internet identities, which the department has used to surveil and prosecute protesters demonstrating against police brutality. The Memphis, Tennessee, and Los Angeles police departments have also used fake social media accounts to monitor Black Lives Matter groups. In response to those revelations, Facebook and Meta (the company that now owns Facebook and Instagram), respectively, sent letters to the departments informing them that fake accounts violated the platforms’ terms of service.
It’s unclear whether NYSIC’s monitoring is violating Facebook and Instagram’s terms of service: A spokesperson for the New York State Police twice declined to say on which social media platforms the fusion center uses online aliases, asserting that divulging such information “could compromise ongoing investigations.” In a statement sent to New York Focus and the Times Union, Roy Austin, vice president and deputy general counsel of civil rights for Meta, said that “we require everyone, including law enforcement authorities, to use their authentic names.”
It is “absolutely a violation of our policies to create a fake account, for any reason, no matter who you are, and when we find such accounts we remove them,” Austin said.
In addition to the platforms it uses, the New York State Police refused to elaborate on other aspects of NYSIC’s social media monitoring practices.
The social media policy specifically authorizes the fusion center to review “publicly-accessible” information. Asked what that means, the State Police only responded that it refers to “content that is accessible by the public.” But NYSIC likely wouldn’t need fake accounts to find information that’s available to anyone on the internet. Asked whether NYSIC personnel are permitted to friend request or follow people, join groups, or otherwise engage with social media users — a main reason other law enforcement agencies have used fake accounts — a spokesperson repeated that making such information public could “compromise ongoing investigations.”
The spokesperson also said that online aliases “are used to protect our staff and ensure there is no retaliation through the use of ‘doxing’ or direct threats of harm,” and pointed to an annual Department of Homeland Security audit as evidence that NYSIC follows relevant privacy laws. When asked for a copy of the audit, the spokesperson sent a link to reports that DHS compiles outlining the results of its “fusion center annual assessments” — the last of which was published in 2018 and includes no information on any individual fusion centers.
Chris Gelardi 