The State Police Sent You a Friend Request

You get a Facebook friend request from someone you don’t know. An unknown profile seeks permission to view your protected tweets. Your private Instagram gets a follow request from an account you don’t recognize. It could be the State Police.

A New York State Police-run fusion center — one of dozens of secretive intelligence-sharing hubs created during the post-September 11, 2001, expansion in domestic surveillance — creates and uses dummy social media accounts, according to documents obtained by New York Focus and the Times-Union via a public records request. The social media policy for the fusion center, known as the New York State Intelligence Center, or NYSIC, shows that analysts use “alias online identities” with fake names, locations, photos, and other personal details to access people’s social media profiles and retain their posts and information.

According to the policy, police analysts can use fake accounts to engage with someone suspected of committing or planning a crime, as well as possible crime witnesses, victims, or missing people. They can also use dummy profiles for “situational assessment purposes” — that is, in any circumstances in which they identify “potential safety threats” to the public or public officials. And they can use computer programs to automatically scrape and analyze social media data.

The document provides a first-of-its-kind look into the social media monitoring powers of the state’s main police intelligence-sharing hub. It comes to light as New York Governor Kathy Hochul, citing increased rates of interpersonal violence and recent mass shootings, beefs up NYSIC’s social media monitoring capabilities.

“We’re watching you now,” Hochul said after a massacre in Buffalo last month. “We know what you’re up to and we’ll be coming after you.”

Across the country, police departments have come under fire for using fake social media accounts. In 2015, the transparency organization MuckRock found that the New York City Police Department’s social media policies allow officers to create online aliases. In April, a report from the Minnesota Department of Human Rights found that the Minneapolis Police Department has used fake accounts to post comments attacking police critics, send private messages criticizing elected officials, and surveil Black community members and organizations “without a public safety objective.” In one instance, an officer used a dummy account to send a message to a local NAACP branch criticizing the group.

Last month, The Intercept published documents showing that the FBI has provided the Chicago Police Department with dummy internet identities, which the department has used to surveil and prosecute protesters demonstrating against police brutality. The Memphis, Tennessee, and Los Angeles police departments have also used fake social media accounts to monitor Black Lives Matter groups. In response to those revelations, Facebook and Meta (the company that now owns Facebook and Instagram), respectively, sent letters to the departments informing them that fake accounts violated the platforms’ terms of service.

It’s unclear whether NYSIC’s monitoring is violating Facebook and Instagram’s terms of service: A spokesperson for the New York State Police twice declined to say on which social media platforms the fusion center uses online aliases, asserting that divulging such information “could compromise ongoing investigations.” In a statement sent to New York Focus and the Times-Union, Roy Austin, vice president and deputy general counsel of civil rights for Meta, said that “we require everyone, including law enforcement authorities, to use their authentic names.”

It is “absolutely a violation of our policies to create a fake account, for any reason, no matter who you are, and when we find such accounts we remove them,” Austin said.

In addition to the platforms it uses, the New York State Police refused to elaborate on other aspects of NYSIC’s social media monitoring practices.

The social media policy specifically authorizes the fusion center to review “publicly-accessible” information. Asked what that means, the State Police only responded that it refers to “content that is accessible by the public.” But NYSIC likely wouldn’t need fake accounts to find information that’s available to anyone on the internet. Asked whether NYSIC personnel are permitted to friend request or follow people, join groups, or otherwise engage with social media users — a main reason other law enforcement agencies have used fake accounts — a spokesperson repeated that making such information public could “compromise ongoing investigations.”

The spokesperson also said that online aliases “are used to protect our staff and ensure there is no retaliation through the use of ‘doxing’ or direct threats of harm,” and pointed to an annual Department of Homeland Security audit as evidence that NYSIC follows relevant privacy laws. When asked for a copy of the audit, the spokesperson sent a link to reports that DHS compiles outlining the results of its “fusion center annual assessments” — the last of which was published in 2018 and includes no information on any individual fusion centers.

Expantded Monitoring

In an attempt to crack down on shootings, Governor Hochul is building out NYSIC’s social media monitoring capabilities.

Hochul succeeded in inserting line items into this year’s state budget that — as New York Focus and The Intercept reported in March — gave the fusion center $527,000 to hire a new social media analysis team, which she said would screen for school violence threats and evidence of gang activity and illegal guns. And last month, in the wake of the Buffalo shooting, Hochul signed an executive order creating yet another new NYSIC social media unit — this one to mine for “radical extremist activity.”

Hochul’s efforts are slated to balloon NYSIC’s social media monitoring capacity. As the Times-Union reported, before the Buffalo shooting, the fusion center had one analyst monitoring social media. But at the end of current recruitment efforts, officials expect to have 15: seven monitoring for potential crime and eight scanning so-called “dark web” spaces like 4chan and 8chan for signs of violent extremism.

The State Police told New York Focus and the Times-Union that NYSIC does “not randomly monitor or surveil social media users or pages.” But Hochul specified in the executive order that the new unit will be responsible for “developing investigative leads” and “identifying online locations and activities that facilitate radicalization” — that is, proactively scouring the internet to identify suspicious activity.

“The eight members of this new unit will have a specific focus: identifying threats of violent extremism made via publicly available posts on social media in order to advance criminal investigations, foil legitimate terrorist threats before they happen, and keep New Yorkers safe,” Jim Urso, a spokesperson for the governor, said in a statement. “Governor Hochul is laser focused on building State Police’s capacity to pinpoint, track, and thwart threats of domestic terrorism and violent extremism in order to protect our communities and save lives, while also preserving New Yorkers’ right to personal privacy.”

Given the revelations about other departments’ fake accounts, however, civil liberties advocates are concerned about the fusion center’s ability to show restraint in its social media monitoring. “Time and time again, we see that it is not going to be targeted towards the white supremacists,” said Daniel Schwarz, privacy and technology strategist at the New York Civil Liberties Union. “But rather, it falls on the Black and brown communities that are already over-policed.”

As the governor ramps up NYSIC’s social media monitoring, the issue of internet monitoring and surveillance — including the use of fake accounts — is garnering attention among state legislators.

Last month, Assemblymember Zohran Mamdani introduced a bill that would ban government agencies from using dummy profiles and prohibit police and prosecutors from using information obtained via a fake account to investigate or prosecute people. Mamdani, who is Muslim and represents a Queens district with large Muslim communities, cited police’s documented use of fake accounts to coax Muslim people into expressing interest in acts of terrorism as one source of inspiration for the bill.

“I’m under no illusion as to how the internet is often a place where people can become radicalized and plan out attacks,” Mamdani told New York Focus and the Times-Union. “[But] we do not believe that it is right for police to use methods of deception and entrapment under the guise of protecting our safety.”

Though the bill did not make it to the floor before the end of the legislative session this month, Mamdani and Schwarz of the NYCLU said they expect the issue to gain momentum in future sessions.

Police have reservations about banning online aliases. Robert Winn, deputy chief of the Colonie Police Department in Albany County, said he is open to new limitations and privacy policies, but that law enforcement should have a say in crafting them, and that an all-out ban on fake accounts would inhibit crucial investigations.

According to Winn, the Colonie police have one investigator — assigned to an FBI Child Exploitation and Human Trafficking Task Force — who has used fake accounts to investigate human trafficking, child pornography, and child exploitation cases. “I think anyone can agree that that’s something that people want law enforcement to be involved in,” he said.