Author’s note: Feel free to copy/use/remix/reblog/Tumbl/tweet/steal any part of this post. It was a right pain in the ass to pull out the hundreds of terms from their PDFs, so take them as you will. There’s no need to have another person spend their time doing so.
By now you have likely seen reports that contain news of the list of terms the Department of Homeland Security searches for online, as it tracks what people are saying around the Internet. The list is extremely long, vague, and often quite humorous (even in the face of its importance).
As the Daily Mail notes, the Department of Homeland Security was forced to release the list, along with its entire Analyst’s Desktop Binder, following a Freedom of Information Act request. Essentially, the list is what the government is looking for online, hoping to spot threats, events, and other such things that would be of interest to the sprawling agency. The Mails report states that the Department has made the claim that the list is not used to search “the internet for disparaging remarks about the government [or] signs of general dissent.”
However, the list is worrisome all the same. The broadness of the terms that are being used as a starting point for tracking online communications is disconcerting; these are the words that could flag a person or conversation as potentially a threat to the United States. And thus, to have terms that come up in the daily news, and normal conversation, marked as worthy of tracking, is unsettling.
Here’s how the Binder describes the terms, and how they are to be used [Bracketed information via TNW]:
This is a current list of terms that will be used by the NOC [National Operations Center] when monitoring social media sites to provide situational awareness and establish a common operating picture. As natural or manmade disasters occur, new terms may be added. The new search terms will not use PII [Personally Identifiable Information] in searching for relevant mission-related information.
I’m going to attempt to summarize quite a bit of dense government policy in the next few paragraphs. Please don’t take my word for it. Pages 24 and 25 of the Binder have all that you need to know. However, it’s my job to gist and explain, so off we go.
What It All Means
There exist privacy controls in the Binder’s policies, but they can be overridden, whenever it is deemed required. As the Binder states, “Generally, both MMC and SN must never send out any IOIs with PII included except in“extremis situations”. An extremis situation occurs when there is an imminent threat of loss of life, serious bodily harm, or damage/destruction to critical facilities or equipment.” Even then, the disclosure of the information has to be approved by a Department of Homeland Security higher-up.
For the record, here are the big ‘no-nos’ of what MMC reports can’t have in the way of PII [Formatting adaptations: TNW]:
The following are cases in which PII must be removed from all MMC reports:
1. Names, positions, or other information that would enable someone to determine the identity of a particular persona.
The Privacy Impact Assessment (PIA) allows for certain exemptions in which PII [Personally Identifiable Information] may be included to identify spokesmen, government officials and reporters.
Note: Refer to section 3.1 and the current PIA for more information
2. Names of known or suspected terrorists, DTO leaders, or other individuals who are a threat to homeland security, regardless of whether a U.S. citizen or non-U.S. citizen
3. Links to the actual articles or postings referenced provided the links themselves do not contain PII. In this case the analyst would use “No Link Due To PII” instead of the actual link.
4. Addresses that would reveal where a person lives. In this case the analyst would either delete the street address completely generalize it to the street block. Example: instead of using “1345 John Doe Avenue”, the analyst could use “the 1300 block of John Doe Avenue”
So, the average person will essentially have any identifying information removed from any MMC that they are a part of, provided that it doesn’t ring massive alarm bells somewhere. In theory, you’re alright writing that paper about the use of dirty nuclear pipe bombs to disrupt domestic security, and national security, while causing an emergency. However, that’s just the start.
What is critical to this issue is who isn’t covered by the PII-exclusion requirements. Such exceptions include anyone (US citizen or not) in “situations involving potential life or death circumstances.” Or, any government official that has gone on the record, US or foreign. Also, terrorists and other such vermin. Those are hardly surprising, I think.
Here’s how the Binder describes the Department’s right to collect and report on their private information:
Furthermore, PII on the following categories of individuals may be collected when it lends credibility to the report or facilitates coordination with federal, state, local, tribal,territorial, foreign, or international government partners.
There is one last group listed, the description of which comically vague, and troubling. Here’s another slice of the population that can be tracked, and their private information shared in reports:
“Names of anchors, newscasters, or on-scene reporters who are known or identified as reporters in their post or article or who use traditional and/or social media in real time to keep their audience situationally aware and informed.”
Therefore, anyone in the media, period, doesn’t have the right to have their private information kept secret by the Department of Homeland Security. Woah. Scarier is how broad this is – anyone who uses social media to update others, and is merely ‘known’ as perhaps being a ‘reporter’ has no right to their PII being kept secret. In other words, if you are online, and comment on the news to an audience, you are essentially absolving the Department of Homeland Security from the need of redacting your private information, including “1) full name; 2) affiliation; 3) position or title; and 3) publicly-available user ID.”
I’m certainly not trying to be overly paranoid or tin-hatted, but the rules on how PII can be distributed for the above listed groups sounds quite like this: ‘if you fall into any of these categories, we are going to use any information about you that we can in any level of government, foreign or domestic.’ And that, if you are but an active user of social media that happens to be talking about an issue that is on their list of terms, you just may fall into the group. Now, to the list.
The following list of terms is directly taken from the Binder. Again, I had to strip them out, clean the text, and them format it, so please just take the list. Don’t do all that tedious work all over again. This post is for anyone. Educate people. Here you go:
The List
Domestic Security
- Assassination
- Attack
- Domestic security
- Drill
- Exercise
- Cops
- Law enforcement
- Authorities
- Disaster assistance
- Disaster management
- DNDO (Domestic Nuclear Detection Office)
- National preparedness
- Mitigation
- Prevention
- Response
- Recovery
- Dirty bomb
- Domestic nuclear detection
- Emergency management
- Emergency response
- First responder
- Homeland security
- Maritime domain awareness (MDA)
- National preparedness initiative
- Militia
- Shooting
- Shots fired
- Evacuation
- Deaths
- Hostage
- Explosion (explosive)
- Police
- Disaster medical assistance team (DMAT)
- Organized crime
- Gangs
- National security
- State of emergency
- Security
- Breach
- Threat
- Standoff
- SWAT
- Screening
- Lockdown
- Bomb (squad or threat)
- Crash
- Looting
- Riot
- Emergency Landing
- Pipe bomb Incident Facility
HAZMAT & Nuclear
- Hazmat
- Nuclear
- Chemical spill
- Suspicious package/device
- Toxic National laboratory
- Nuclear facility
- Nuclear threat
- Cloud
- Plume
- Radiation
- Radioactive Leak
- Biological infection (or event)
- Chemical
- Chemical burn
- Biological Epidemic
- Hazardous
- Hazardous material incident
- Industrial spill
- Infection Powder (white)
- Gas Spillover
- Anthrax
- Blister agent
- Chemical agent
- Exposure Burn
- Nerve agent
- Ricin
- Sarin
- North Korea
Health Concern + H1N1
- Outbreak
- Contamination
- Exposure
- Virus
- Evacuation
- Bacteria
- Recall
- Ebola
- Food Poisoning
- Foot and Mouth (FMD)
- H5N1
- Avian Flu
- Salmonella
- Small Pox
- Plague
- Human to human
- Human to Animal
- Influenza
- Center for Disease Control (CDC)
- Drug Administration (FDA)
- Public Health
- Toxic
- Agro Terror
- Tuberculosis (TB)
- Agriculture
- Listeria
- Symptoms
- Mutation Resistant
- Antiviral Wave
- Pandemic
- Infection
- Water/air-borne
- Sick
- Swine
- Pork
- Strain
- Quarantine
- H1N1 Vaccine
- Tamiflu
- Norvo
- Virus
- Epidemic
- World Health Organization (WHO) (and components)
- Viral
- Hemorrhagic
- Fever
- E. Coli
Infrastructure Security
- Infrastructure security
- Airport
- Airplane (and derivatives)
- Chemical fire
- CIKR (Critical Infrastructure& Key Resources)
- AMTRAK
- Collapse
- Computer infrastructure
- Communications infrastructure
- Telecommunications
- Critical infrastructure
- National infrastructure
- Metro
- WMATA
- Subway
- BART
- MARTA
- Port Authority
- NBIC (National Biosurveillance Integration Center)
- Transportation security
- Grid
- Power
- SmartBody scanner
- Electric
- Failure or outage
- Black out
- Brown out
- Port
- Dock
- Bridge
- Cancelled
- Delays
- Service disruption
- Power lines
Southwest Border Violence
- Drug cartel
- Violence
- Gang
- Drug
- Narcotics
- Cocaine
- Marijuana
- Heroin
- Border
- Mexico
- Cartel
- Southwest
- Juarez
- Sinaloa
- Tijuana
- Torreon
- Yuma
- Tucson
- Decapitated
- U.S. Consulate
- Consular
- El Paso
- Fort Hancock
- San Diego
- Ciudad Juarez
- Nogales
- Sonora
- Colombia
- Mara salvatrucha
- MS13 or MS-13
- Drug war
- Mexican army
- Methamphetamine
- Cartel de Golfo
- Gulf Cartel
- La Familia
- Reynosa
- Nuevo
- Leon
- Narcos
- Narco banners (Spanish equivalents)
- Los Zetas
- Shootout
- Execution
- Gunfight
- Trafficking
- Kidnap
- Calderon Reyosa
- Bust
- Tamaulipas
- Meth Lab
- Drug trade
- Illegal immigrants
- Smuggling (smugglers)
- Matamoros
- Michoacana
- Guzman
- Arellano-Felix
- Beltran-Leyva
- Barrio
- Azteca
- Artistic
- Assassins
- Mexicles
- New Federation
Terrorism
- Terrorism
- Al Qaeda (all spellings)
- Terror
- Attack
- Iraq
- Afghanistan
- Iran
- Pakistan
- Agro
- Environmental terrorist
- Eco terrorism
- Conventional weapon
- Target
- Weapons grade
- Dirty bomb
- Enriched
- Nuclear
- Chemical weapon
- Biological weapon
- Ammonium nitrate
- Improvised explosive device IED (Improvised Explosive Device)
- Abu Sayyaf
- Hamas
- FARC (Armed Revolutionary Forces Colombia)
- IRA (Irish Republican Army)
- ETA (Euskadi ta Askatasuna)
- Basque
- Separatists
- Hezbollah
- Tamil Tigers
- PLF (Palestine Liberation Front)
- PLO (Palestine Liberation Organization)
- Car bomb
- Jihad
- Taliban
- Weapons cache
- Suicide bomber
- Suicide attack
- Suspicious substance
- AQAP (AL Qaeda Arabian Peninsula)
- AQIM (Al Qaeda in the Islamic Maghreb)
- TTP (Tehrik-i-Taliban Pakistan)
- Yemen
- Pirates
- Extremism
- Somalia
- Nigeria
- Radicals
- Al-Shabaab
- Home grown
- Plot
- Nationalist
- Recruitment
- Fundamentalism
- Islamist
Weather/Disaster/Emergency
- Emergency
- Hurricane
- Tornado
- Twister
- Tsunami
- Earthquake
- Tremor
- Flood
- Storm
- Crest
- Temblor
- Extreme weather
- Forest fire
- Brush fire
- Ice
- Stranded/Stuck
- Help
- Hail
- Wildfire
- Tsunami
- Warning Center
- Magnitude
- Avalanche
- Typhoon
- Shelter-in-place
- Disaster
- Snow
- Blizzard
- Sleet
- Mud slide or Mudslide
- Erosion
- Power outage
- Brown out
- Warning
- Watch
- Lightening
- Aid
- Relief
- Closure
- Interstate
- Burst
- Emergency Broadcast System
Cyber Security
- Cyber security
- Botnet
- DDOS (dedicated denial of service)
- Denial of service
- Malware
- Virus
- Trojan
- Keylogger
- Cyber
- Command
- 2600
- Spammer
- Phishing
- Rootkit
- Phreaking
- Cain and abel
- Brute forcing
- Mysql injection
- Cyber attack
- Cyber terror
- Hacker
- China
- Conficker
- Worm
- Scammers
- Social media
Get the TNW newsletter
Get the most important tech news in your inbox each week.