RSG#336: How To Investigate Government Use of Social Media Monitoring Tools

Your local police department may describe social media monitoring as nothing more than checking public posts. That sounds delightfully harmless, rather like saying a surveillance camera is merely enjoying the scenery.

Modern social media monitoring can involve keyword searches, location filters, relationship mapping, automated alerts, covert accounts, image analysis, and commercial software that collects posts across several platforms. The information may then move into police reports, intelligence files, fusion centers, gang databases, or investigations involving people who were never suspected of a crime.

This Resistance Survival Guide explains how to investigate government social media monitoring tools, identify the vendors behind them, uncover what officials are searching, and determine whether protected speech has been quietly repackaged as suspicious behavior.

What Social Media Monitoring Can Include

Social media monitoring is broader than an officer reading a public Facebook post. Agencies may search names, usernames, hashtags, phrases, locations, events, organizations, photographs, and connections between accounts. They may also create covert profiles, send connection requests, enter private groups, preserve deleted content, or purchase access to commercial databases.

A monitoring system may produce alerts whenever selected words appear. It may display posts on a map or create profiles based on online associations. The vendor may call this situational awareness, threat intelligence, open source intelligence, or digital risk detection. Surveillance software enjoys a tasteful euphemism almost as much as government enjoys an invoice.

The Brennan Center for Justice examined 328 police departments serving large American cities. As of its February 2024 update, only 162 departments had publicly available policies addressing official use of social media to view or collect information. A missing policy does not prove that monitoring occurs. It does mean the public may have no reliable way to determine whether it occurs or what rules apply.

Why This Surveillance Deserves Scrutiny

Social media can contain legitimate evidence of crimes. However, broad monitoring can also capture political opinions, religious beliefs, friendships, jokes, photographs, neighborhood disputes, and participation in protests.

Context matters. A song lyric is not necessarily a confession. Following an activist is not proof of membership in an organization. Attending a protest does not transform someone into a public safety threat. Software can collect information quickly, but it cannot sprinkle judgment on an analyst like digital fairy dust.

Records obtained by civil liberties organizations have shown agencies monitoring racial justice demonstrations, Muslim communities, police critics, and other protected activity. The danger is not limited to what officers initially collect. Information can be retained, copied, shared with other agencies, or combined with intelligence databases long after the original event ends.

Establish the Rules Before Judging the Tool

Begin with the agency’s social media policy, intelligence policy, privacy policy, undercover operations rules, records retention schedule, and agreements with fusion centers or federal partners.

Government guidance published through the National Criminal Intelligence Resource Center recommends that law enforcement policies address authorization, access, collection, storage, dissemination, security, and privacy protections.

If collected information enters a federally funded criminal intelligence system, 28 CFR Part 23 may also matter. That regulation establishes operating principles for certain criminal intelligence systems, including standards concerning reasonable suspicion, information quality, dissemination, and review.

The First Amendment protects speech, association, religion, assembly, and petitioning the government. Publicly visible speech is not automatically immune from observation. However, surveillance based on protected beliefs, identity, or lawful political activity raises serious constitutional and civil liberties concerns.

Step by Step Guide

Step One: Identify the Agency and Every Possible User

Start with the police department, sheriff, prosecutor, emergency management office, school district police, transit authority, corrections department, and local intelligence or fusion center. Record which units conduct investigations, threat assessments, event planning, gang enforcement, or public information work.

Do not assume the tool lives with detectives. Analysts, contractors, communications staff, and regional intelligence centers may all have access. Surveillance loves an organizational chart with several escape hatches.

Step Two: Search Budgets and Purchasing Records

Search council agendas, purchase orders, vendor payment registers, contracts, amendments, grant documents, subscription renewals, and procurement card expenses.

Use broad terms such as social media monitoring, media intelligence, threat intelligence, situational awareness, open source intelligence, sentiment analysis, digital investigation, online investigations, and real time alerts. Search vendor names discovered in invoices and meeting packets.

Check whether the purchase was divided among smaller transactions or hidden inside a broader software contract. A modest subscription can reveal a substantial surveillance capability.

Step Three: Identify the Product’s Actual Capabilities

Find the vendor’s manuals, proposals, archived marketing pages, training materials, privacy documents, and demonstrations. Record whether the system offers keyword monitoring, location searches, network analysis, facial recognition, sentiment scoring, automated alerts, historical searches, or covert account management.

Separate marketing claims from verified functions. Vendors occasionally describe ordinary search features as if they have invented clairvoyance with a dashboard.

Step Four: Request the Search Terms

File a public records request for keywords, hashtags, usernames, locations, events, groups, topics, watchlists, alert rules, and geographic boundaries entered into the system.

Ask for the person who approved each search, the stated purpose, the date created, and the date disabled. Search terms often reveal more than the contract because they show who officials actually considered worth watching.

Step Five: Obtain Policies and Approval Records

Request all policies, standard operating procedures, legal memoranda, approval forms, supervisory reviews, audit requirements, and disciplinary rules governing the tool.

Determine whether monitoring requires an active investigation, reasonable suspicion, a documented threat, supervisory approval, or no justification at all. Also ask whether special approval is required when searches concern protests, journalists, elected officials, religious groups, minors, or political organizations.

Step Six: Investigate Covert Accounts

Request policies and statistics concerning fictitious, undercover, alias, or assumed identity accounts. Ask who may create them, whose photograph may be used, how connection requests are approved, and whether officers may enter private groups.

Request logs showing when each account was opened, its authorized purpose, reviewing supervisor, platforms used, and closing date. Do not request operational credentials or details that would expose a legitimate active investigation.

Step Seven: Trace Data Retention and Sharing

Determine what happens after a post is collected. Request retention schedules, deletion logs, export records, dissemination reports, database names, and agreements governing information sharing.

Ask whether collected material enters police reports, intelligence files, gang databases, suspicious activity reports, case management systems, or federal portals. Record every recipient and whether the receiving organization must follow the original restrictions.

Step Eight: Compare Monitoring With Protected Activity

Create a timeline of searches and compare it with demonstrations, public hearings, strikes, religious events, student organizing, campaigns, and criticism of government officials.

A matching date does not prove unconstitutional surveillance. Examine the search terms, stated threat, authorizing official, information collected, and subsequent police action. The objective is to document the connection, not leap over the evidence wearing a tiny conspiracy cape.

Step Nine: Test Accuracy and Context

Review examples of posts flagged by the system. Determine whether analysts preserved the full conversation, date, account identity, surrounding posts, and original link.

Look for satire, quoted lyrics, recycled photographs, impersonation, mistranslation, and mistaken identity. Ask whether analysts corroborated information before placing it in an official record or sharing it with another agency.

Step Ten: Measure Results and Harm

Request statistics showing how many alerts produced investigations, warrants, arrests, charges, convictions, emergency interventions, or confirmed threats.

Then document false alerts, closed cases, complaints, disciplinary findings, and people retained in databases without charges. A tool that collects thousands of posts and produces no verified threat is not necessarily successful because someone made the map look dramatic.

Step Eleven: Audit the Vendor’s Influence

Request communications between the vendor and agency officials, including demonstrations, sales presentations, contract negotiations, troubleshooting, and renewal discussions.

Look for claims that the product can predict violence, identify extremists, monitor sentiment, or reduce staffing costs. Compare those promises with internal evaluations and actual results. Also examine whether the vendor trained officials to avoid politically sensitive language while performing the same monitoring under a nicer label.

Step Twelve: Publish Evidence With Care

Create a public record showing the vendor, contract value, capabilities, authorized users, search rules, retention period, sharing partners, oversight, and documented outcomes.

Protect private individuals whose lawful posts were swept into government files. Redact personal contact information and avoid republishing sensitive content merely because an agency collected it. The investigation should expose government conduct, not provide surveillance with a second distribution channel.

Red Flags That Require Closer Examination

Warning signs include monitoring without a written policy, searches based on political or religious terms, covert accounts used without supervision, indefinite retention, undocumented sharing, missing audit logs, and contracts approved without public discussion.

Other red flags include searches created shortly before lawful protests, intelligence reports containing no suspected crime, vendor claims that cannot be independently tested, and officials who insist the system collects only public information while refusing to reveal what they searched.

Public information can still be collected at a scale, speed, and level of organization that changes its meaning. A person speaking in a public park is visible. That does not mean the government should record every sentence, map every listener, preserve it indefinitely, and call the result community engagement.

Turning the Findings Into Accountability

Present confirmed facts separately from inference. Ask the agency to publish its policy, vendor contracts, search categories, retention limits, sharing rules, audit results, and aggregate outcome statistics.

Send documented findings to local civil liberties groups, public defenders, independent journalists, inspectors general, privacy commissions, and elected oversight bodies. Recommend warrants or documented investigative standards where appropriate, senior approval for event monitoring, strict deletion rules, independent audits, and prohibitions on targeting protected activity.

The goal is not to prevent investigators from examining genuine evidence. It is to stop broad surveillance from becoming an ordinary government reflex with a monthly subscription.

Closing RK Thoughts

Social media monitoring tools can turn scattered online conversations into searchable government intelligence. That power deserves more than a cheerful procurement memo and a promise that responsible adults are definitely in charge.

A strong investigation follows the entire system. Find the contract. Identify the searches. Trace the data. Test the results. Document who was watched, who approved it, and where the information traveled.

Resistance Kitty supports public safety. She simply declines to accept a secret keyword list as a substitute for evidence.