Joint letter to State Dept raising concerns over visa applicants data collection

Attn: Department of State Desk Officer
Office of Information and Regulatory Affairs
Office of Management and Budget
725 17th Street, N.W.
Washington, DC 20503

Bureau of Consular Affairs, Visa Office
U.S. Department of State
2201 C Street, N.W.
Washington, DC 20520

October 2, 2017

Re: 82 Fed. Reg. 36180, OMB Control No. 1405-0226; Supplemental Questions for Visa Applicants

Dear Sir or Madam:

The undersigned organizations write to express our serious concerns about the Department of State’s proposed policy, published for comment in Public Notice 10065. This policy would make permanent the collection of additional information from immigrant and nonimmigrant visa applicants who have been determined to warrant additional scrutiny in connection with terrorism or other visa ineligibilities, including national security-related ineligibilities.[1]

As with the emergency collection that was put in place in May, the additional requirements impose significant burdens on visa applicants; are apt to chill speech and reveal private information about travelers that is irrelevant to their suitability for entry to the United States; and expose information about their families, friends and business associates in the U.S. Further, the context in which these policies are being developed raises concerns that the populations targeted for additional scrutiny will be identified by their shared religion, nationality, or ideology. Lastly, the data collection will facilitate the bulk mining and analysis of information about travelers and U.S. citizens, amplifying the concerns above, all in exchange for speculative national security benefits in light of the vanishingly small number of foreign-born persons who commit terrorist attacks on U.S. soil.

I.The Proposed Collection Excessively Burdens Visa Applicants for Speculative National Security Benefits

Applicants falling within populations the State Department determines require additional scrutiny (which, as detailed below, will disproportionately impact Muslim populations) will have to provide: fifteen years’ worth of travel, address, and employment history; five years’ worth of social media platforms and identifiers, email addresses, and phone numbers; names of siblings, children, and former spouses not already provided; prior passport numbers; and details and documentation on any travel to an ISIS-controlled territory.[2] Travel information from applicants must include “details for each trip [and] source[s] of funds” for foreign travel and even potentially domestic travel.[3]

First, the request for fifteen years’ worth of details on travel, address, and employment imposes an excessive – and potentially exclusionary – burden on affected applicants without commensurate benefits for national security. Second, the request for social media data (“platforms and identifiers”) is fatally ambiguous and will have a deleterious impact on the speech and privacy of applicants as well as the Americans with whom they communicate. Finally, social media communications have context-specific meanings that are notoriously difficult to interpret, and are more apt to raise false positives than to identify real security threats.

a.Request for Fifteen Years of Travel, Address and Employment History is Overly Burdensome

First, the additional disclosures are overly onerous, given that visa applicants under the current system are already required to provide a significant amount of documentation and information.[4] For example, gathering fifteen years’ worth of travel history in addition to what is already required – even assuming it were available and recorded – could require weeks’ worth of time and substantial resources, involve tracking down accommodation and transportation providers, and finding credible people to corroborate trip details. The State Department’s estimate that the “Average Time Per Response” will be 60 minutes per applicant, resulting in a “Total Estimated Burden Time” of 65,000 hours, seems an implausible guess.[5]

Perhaps more significantly, it is unclear how collecting extensive personal and travel histories would be helpful for national security purposes, particularly since many current terrorist threats like ISIS did not even emerge until 2013.[6] Indeed, the questions for even a short visit to the U.S. require more personal information than the standard forms required to get a Top Secret security clearance.[7] In any event, one consequence of this policy is clear: the heavy burdens discussed above will mean less people coming to the U.S., whether because they find visa application requirements prohibitive or too invasive,[8] or fear making application errors that could give rise to false suspicions of fraud.[9]

b.Request for Social Media Platforms and Identifiers is Ambiguous and Broad

The request for social media information in this information collection request (ICR) is also problematic. As an initial matter, the description of the data requested – namely, “[s]ocial media platforms and identifiers, also known as handles, used during the last five years” – is insufficient to provide guidance on the scope of required disclosure. The term “social media platforms” is not defined; while popular social media services such as Twitter, Facebook, and Instagram may be the most obvious targets, some definitions of social media include blogging and similar online activities.[10] It is not clear whether applicants are meant to cast as wide a net as possible in their disclosures, or whether an inadvertent failure to do so may be used as a reason, whether pretextual or not, to deny their entry into the country.

Similarly, the proposed form to be completed by applicants asks for social media platforms and identifiers “for any websites or applications you have used to create or share content (photos, videos, status updates, etc.) as part of a public profile within the last five years.”[11] It appears that travelers who contribute to multiple accounts on a single platform – a personal one and a professional one, for instance – will be required to disclose all such accounts, raising the risk that they will be held accountable for posts on a profile for which they exercise only partial control. The form does not offer a mechanism to explain the applicant’s role in using a particular platform or whether content is created or shared by other users as well.

The proposal does impose an important limitation on consular officers’ authority with respect to social media information – namely, the directive that adjudicating officers are to refrain from requesting applicants’ social media passwords or from subverting other privacy safeguards. Nonetheless, account collection may precede password collection: DHS started by collecting social media handles and identifiers from certain travelers in 2016,[12] for instance, but the agency signaled shortly after President Trump’s inauguration that it might demand users’ passwords as well.[13] It is also unclear how the State Department would ensure that this rule is followed, and what remedy applicants would be afforded for violations.

In any case, this guidance is insufficient to overcome significant problems with the substance of the policy, as described in the next section.

c.Social Media Collection Will Capture Information That is Difficult to Interpret, Chill Expression and Affect Third Parties

The ICR assumes that the investigation of applicant-provided social media information will assist the department in uncovering potential terrorists applying for visas.[14] This seems unlikely. As an initial matter, it is doubtful that an individual who promotes terrorism online will disclose information about the social media profile he is using to do so, or will retain postings that might raise concerns in the eyes of consular officials or software programs analyzing online content.

Moreover, problems of interpretation are guaranteed to plague any review of social media postings. One need only look at the 2012 experience of a British citizen who was turned back at the border because DHS agents misinterpreted his posting on Twitter that he was going to “destroy America” – slang for partying – and “dig up Marilyn Monroe’s grave” – a joke.[15] In a similar vein, government agents and courts have erroneously interpreted tweets repeating American rap lyrics as threatening messages in several court cases, including high-stakes national security matters.[16] Even greater difficulties are inevitable if the language used is not English.

This is to say nothing of the challenges posed by non-verbal communication on social media. On Facebook, for instance, users can react to a posting with a range of emojis. The actual meaning of these emojis is highly contextual. If a Facebook user posts an article about the FBI persuading young, isolated Muslims to make statements in support of ISIS,[17] and another user “loves” the article, is he sending appreciation that the article was posted, signaling support for the FBI’s practices, or sending love to a friend whose family has been affected? Assuming it is even possible to decode the meaning, that could not be done without delving further into the user’s other online statements, interactions, and associations, as well as the postings of those with whom he or she communicates, a laborious, invasive, and error-riddled process. Indeed, such ambiguity is already affecting domestic criminal proceedings with dire consequences, including individuals put behind bars for their Facebook likes.[18]

This concern may be amplified for journalists, particularly those writing on conflict zones. Take the example of a foreign journalist who “favorites” a provocative tweet from an ISIS follower in order to find it again more easily for a piece of writing – will that be taken as support for the poster’s positions? If so, will he or she be called to account for every “heart” and “like”? Political scientists and other scholars who follow or interact with individuals with provocative or even reprehensible views for purposes of research and public education will face similar quandaries. In light of the multitude of possible interpretations of both speech and non-verbal communication, consular officers will be in a position to exercise enormous, unchecked discretion when it comes to assessing foreign residents’ suitability to enter the country, potentially quizzing them about the meaning and significance of a range of expression.

As a result of both the information request and the ambiguity pervading interactions on social media, online speech – particularly of the political or religious variety – will inevitably be chilled. Visa applicants will surely sanitize their own postings and internet presence to ensure that nothing online would provide cause for further scrutiny or suspicion by a rushed consular officer. Even if these travelers do not have First Amendment rights before they arrive in the United States, a system that potentially penalizes people for statements they make online due to misinterpretation is profoundly incompatible with core American constitutional values. It is also incongruent with the International Covenant on Civil and Political Rights, which guarantees “the right to freedom of expression,” including the “freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice.”[19]

Moreover, the notice’s statement that this collection of information will not be used to deny visas on the basis of religion or political views, while commendable, is insufficient. The point of the disclosure requirement, presumably, is for consular officers to view and assess the content of applicants’ postings. It is hard to imagine that the religious and political views reflected in those postings will not be taken into account in practice, even if officers are on paper prohibited from doing so.

We note the same point with respect to the direction to “[c]onsular staff…to take particular care to avoid collection of third-party information.”[20] Such collection and analysis will be inevitable if the purpose of gathering social media data is in part to ascertain whether an applicant’s associations are relevant to her eligibility for a U.S. visa – for example, to determine whether she has sufficient links to her country of origin to overcome the statutory presumption that temporary visa applicants intend to immigrate to the U.S.,[21] or whether her social media associations have been flagged in government databases as potential national security threats.[22] As such, reviews of travelers’ social media profiles will also likely reveal personal information not contained within any given account, including peoples’ connections to friends, relatives, and business associates in the U.S., potentially subjecting Americans to invasive scrutiny of their personal lives. This scrutiny may undermine the right to communicate anonymously, too, a right that is protected by the First Amendment and was called a necessary condition of free expression by the U.N. Special Rapporteur on Freedom of Expression.[23] Requiring visa applicants to disclose their online identities may thus enmesh American citizens’ communications and sweep in large quantities of constitutionally protected speech.

Lastly, the government can point to no evidence that social media screening works and is worth expanding. While no public audits have yet been released for State Department social media collections, the DHS Office of Inspector General recently audited the Department of Homeland Security’s existing social media pilot programs and found that insufficient metrics were in place to measure the programs’ effectiveness, concluding that existing pilots had provided little value in guiding the rollout of a department-wide social media screening program.[24]

II.The Proposed Collection Will Primarily Burden Applicants on the Basis of National Origin

The burdens detailed above would be substantial regardless of the faith or ethnicity of a visa applicant. While the State Department has stated that applicants flagged for additional scrutiny will be chosen “based on individual circumstances and the information they provide,” it is evident that these vetting procedures will be applied on the basis of national origin and will mainly be felt by Muslims. The proclamation issued by the president on September 24, 2017, explicitly provides for additional vetting of nationals of Iraq, Iran, and Somalia.[25] In addition, the Department of State describes the anticipated respondents as “[i]mmigrant and nonimmigrant visa applicants who have been determined to warrant additional scrutiny in connection with terrorism or other national security-related visa ineligibilities.”[26] It estimates that 65,000 respondents, or 0.5% of U.S. visa applicants worldwide, will be affected.26 This number closely tracks the roughly 68,000 nonimmigrant visas issued to nationals of the six travel ban countries and Iraq – which was included in Executive Order 13769, the first travel ban executive order – in fiscal year 2016, suggesting that the criteria triggering additional scrutiny may include national origin or religion.[27] Finally, the State Department’s first attempt at implementing these requirements – which were halted due to ongoing litigation – required additional scrutiny specifically of nationals of the initial Muslim ban countries.[28] So “populations warranting increased scrutiny” could refer to people from Muslim countries or some subset thereof.

The history of the vetting procedures also suggests the intent to target Muslims. Shortly after becoming the official Republican presidential nominee, Donald Trump rolled out a new plan: “extreme vetting” for Muslims entering the United States.[29] He proposed that the United States admit only those “who share our values and respect our people.” [30] One campaign official explained that people who have “attitudes about women or attitudes about Christians or gays that would be considered oppressive” would be barred.[31] Department of Homeland Security officials have indicated that visa applicants could be queried about honor killings, the role of women in society, and legitimate military targets.[32] It is difficult to see the connection between a visitor’s view of the role of women in society and terrorism, but the connection between such questions and criticisms of the rights of women in Muslim societies is plain.[33]

Such an approach is unlikely to make us safer. There is no evidence that an applicant’s national origin or religion reflects a propensity for terrorism. In fact, writing in opposition to Executive Order 13780, more than 40 national security experts from across the political spectrum argued that vetting should be responsive to “specific, credible threats based on individualized information,” not stereotypes of religions or countries.[34] They also warned that banning nationals from Muslim countries would damage the “strategic and national security interests of the United States,” corrode relationships with allies and “[reinforce] the propaganda of ISIS.”[35] Indeed, pro-ISIS social media accounts have used the Muslim ban to vindicate the claim that the U.S. is at war with Islam and stoke anti-American sentiments.[36] An analysis by the Trump administration’s Department of Homeland Security found that citizenship was an unreliable indicator of terrorism threat,[37] an unsurprising finding in light of U.N. estimates that in 2015 about 244 million people were living outside of the countries in which they were born.[38] As has been detailed in previous Brennan Center reports, decades of counterterrorism research has not been able to identify traits that could be used to identify people who have a propensity for terrorism.[39]

The Department of State’s notice does state that “[t]he collection of social media platforms and identifiers will not be used to deny visas based on applicants’ race, religion, ethnicity, national origin, political views, gender or sexual orientation.”[40] However, given the context in which this ICR arises, and because it is part of the broader “extreme vetting” framework that appears aimed at Muslims, that assurance seems less than credible.

III.Information Collection may Facilitate Bulk Data Mining and Algorithmic Analysis Efforts that Amplify Privacy and Discrimination Concerns

While the ICR says that “[t]he additional information collected will facilitate consular officer efforts to apply more rigorous evaluation of these applicants for visa eligibilities,” it does not say what those efforts will consist of or how the State Department will use or store the data it obtains. Will it be able to analyze such large amounts of data? If so, through what means, and based on what criteria? Presumably this information about visa applicants from around the world will be recorded in government databases; for what purposes will these databases be used? Exploiting this data for bulk mining or algorithmic analysis would further amplify many of the privacy and discrimination-oriented concerns highlighted above. 

The sensitive applicant information collected would likely be shared with the Department of Homeland Security, which may use the information as an input into new technological tools it wants developed as part of an “Extreme Vetting Initiative.”[41] For this initiative, the Department of Homeland Security reportedly intends to “establish an overarching vetting [system] that automates, centralizes and streamlines the current manual vetting process,” driven by the mandates in President Trump’s immigration Executive Orders, including Executive Order 13780.[42] Vetting would be dynamic: this computerized system would attempt to “continuous[ly] vet” visitors within the country using information including “media, blogs, public hearings, conferences, academic websites, social media websites…radio, television, press, geospatial sources, [and] internet sites.”[43] It would further be targeted at “evaluat[ing] an applicant’s probability of becoming a positively contributing member of society as well as their ability to contribute to national interests.”[44] Naturally, the program would seek to predict whether those entering the U.S. intended to commit a crime or terrorist attack once they arrived here.[45]

Setting aside that these standards – especially those measuring the likelihood that an applicant will “positively contribute” to society or to the national interest – are impossible to administer, computer analyses are only as good as their inputs. Recent efforts to employ predictive algorithms throughout the criminal justice system have been shown to reflect enduring biases, including those based on race and income, since they rely on historic crime data that integrates those biases.[46]  

In the realm of immigration, use of such algorithms may have the effect of facilitating religious or ideological vetting.[47] Indeed, there are already Homeland Security programs that attempt to draw inferences about social media data to develop traveler risk profiles on the basis of “tone analysis,” a process that is likely to incorporate decontextualized judgments about entire communities or religions, raising questions about both its ostensible neutrality and its effectiveness.[48] In light of these concerns, collecting social media and other data for the purpose of vetting foreign travelers in order to subject it to algorithmic analysis seems highly unlikely to contribute measurably to domestic safety and security.  

IV.There is No Evidence that Foreign Visitors Pose a Significant Threat to the U.S.

Lastly, empirical evidence shows that the risk of an attack on U.S. soil perpetrated by a foreign person who has been improperly vetted is infinitesimal. This is not surprising: the U.S. has one of the world’s most thorough visa vetting systems, built to identify national security threats. The government has had trouble showing otherwise. According a federal court of appeals: “There is no finding that present vetting standards are inadequate, and no finding that absent the improved vetting procedures there likely will be harm to our national interests.”[49]

Indeed, over the past ten years, Americans have been more than ten times as likely to drown in a bathtub or die in a lightning strike than to die in a terrorist attack perpetrated by a foreign born terrorist on U.S. soil.[50] According to a Cato Institute study, only five foreign-born terrorists have successfully carried out deadly attacks on U.S. soil since September 11, 2001, when the U.S. immigration security infrastructure was overhauled.[51] Four were U.S. permanent residents or citizens who perpetrated terror attacks years after entering the country; indeed, three entered the United States as children. Entry screening would have been unlikely to catch them years before they decided to commit violence.[52] Only Tashfeen Malik – who, along with her husband Syed Rizwan Farook, killed 14 people and injured 22 others in San Bernardino – entered the U.S. near in time to when she perpetrated an attack.[53] But even discounting the proximity between a terrorist’s entry and his or her attack, and counting the September 11 hijackers (who came to the U.S. on temporary visas), Cato’s analysis of cases from 1975 through 2015 shows that 7.38 million such visas were issued for every one issued to a foreign-born terrorist, amounting to a near-zero (0.0000136) percent of visas.[54] In short, the State Department’s expanded collection is a solution in search of a problem.

V.Conclusion

For the above reasons, we urge the Department of State to abandon this proposed information collection initiative. Please do not hesitate to let us know if we can provide any further information regarding our concerns. We may be reached at patelf@brennan.law.nyu.edu (Faiza Patel: 646-292-8325), levinsonr@brennan.law.nyu.edu (Rachel Levinson-Waldman: 202-249-7193), or pandurangah@brennan.law.nyu.edu (Harsha Panduranga: 646-292-8719).

Sincerely,

18MillionRising.org
Access Now
Advocacy for Principled Action in Government
American Library Association
Americans United for Separation of Church and State
Arkansas United Community Coalition
Article 19
Asian Americans Advancing Justice
Brennan Center for Justice at NYU School of Law
Council on American-Islamic Relations (CAIR)
Center for Democracy & Technology
Center for Media Justice
Center for Security, Race, and Rights
Committee to Protect Journalists
Data & Society
Defending Rights & Dissent
Electronic Frontier Foundation
Free Press
Government Information Watch
Human Rights Watch
Immigrant Law Center of Minnesota
Iranian American Bar Association
Japanese American Citizens League
Legal Aid Justice Center
Marhaba Service LLC
Mi Familia Vota
Muslim Community Network
Muslim Justice League
Muslim Public Affairs Council
NAACP
National Asian Pacific American Women's Forum (NAPAWF)
National Center for Transgender Equality
National Hispanic Media Coalition
National Immigrant Justice Center
National Immigration Law Center
National Korean American Service & Education Consortium (NAKASEC)
New America's Open Technology Institute
New York Immigration Coalition
OpenTheGovernment
PEN America
Poligon Education Fund
Resilient Communities, New America
Services, Immigrant Rights, and Education Network (SIREN)
Southern Poverty Law Center
The Constitution Project
United Church of Christ, OC Inc.
Yemen Peace Project