Modern Keyword Surveillance Systems - Source Excerpt 03 - The 2011/2012 DHS Social Media Monitoring Keyword Matrix

Back to Modern Keyword Surveillance Systems

Summary

This source excerpt begins near The 2011/2012 DHS Social Media Monitoring Keyword Matrix and preserves the surrounding evidence from 2IA.org/agent-file-handoff/Archive/2026-05-17-civil-liberties-overhaul/Content/Modern Keyword Surveillance Systems.md.

**Source path:** 2IA.org/agent-file-handoff/Archive/2026-05-17-civil-liberties-overhaul/Content/Modern Keyword Surveillance Systems.md

While the NSA and the Five Eyes apparatus focus largely on foreign intelligence, military targets, and the global internet backbone, domestic law enforcement and border security agencies within the United States have turned their attention to the public web. Open-Source Intelligence (OSINT) and social media monitoring have become foundational tools for generating situational awareness, vetting immigrants, and predicting domestic disruptions.24 The Department of Homeland Security (DHS), alongside its components Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE), actively monitor platforms to assess public sentiment and identify emerging threats.27

In 2012, transparency litigation initiated by the Electronic Privacy Information Center (EPIC) forced the disclosure of internal DHS documents, including the National Operations Center (NOC) "Analyst's Desktop Binder".27 This extensive 2011 directive revealed the exact search parameters, keyword lists, and categorical structures utilized by DHS contractors to scour public social networks, blogs, and forums.27 The stated objective was to monitor websites—including the comment sections of major news outlets like the New York Times, the Los Angeles Times, the Huffington Post, the Drudge Report, Wired, and ABC News—to capture public reaction to major government proposals, policy directives, and potential catastrophic events.27

### **The 2011/2012 DHS Social Media Monitoring Keyword Matrix**

The leaked DHS keyword list demonstrates a broad, lexicon-based approach to surveillance. The terminology was categorized into specific operational domains, intended to provide early warning of terrorism, natural disasters, infrastructure failures, and border violence.10 However, the linguistic ambiguity of the targeted words illustrates the fundamental flaw of static keyword surveillance: an extraordinarily high rate of false positives.10

The following tables detail the comprehensive keyword matrix utilized by the DHS NOC for situational awareness monitoring:

#### **Domestic Security, Law Enforcement, and Emergency Response**

| Operational Focus | Targeted Keywords and Phrases |
| :---- | :---- |
| **Law Enforcement & Security** | Drill, Exercise, Cops, Law enforcement, Authorities, DNDO (Domestic Nuclear Detection Office), Mitigation, Prevention, Response, Recovery, First responder, Homeland security, Militia, Shooting, Shots fired, Evacuation, Deaths, Hostage, Explosion (explosive), Police, Organized crime, Gangs, National security, State of emergency, Security, Breach, Threat, Standoff, SWAT, Screening, Lockdown, Bomb (squad or threat), Crash, Looting, Riot, Emergency Landing, Pipe bomb, Incident, Facility, Assassination, Attack.10 |
| **Agencies & Organizations** | Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Coast Guard (USCG), Customs and Border Protection (CBP), Border Patrol, Secret Service (USSS), National Operations Center (NOC), Homeland Defense, Immigration Customs Enforcement (ICE), Agent, Task Force, Central Intelligence Agency (CIA), Fusion Center, Drug Enforcement Agency (DEA), Secure Border Initiative (SBI), Federal Bureau of Investigation (FBI), Alcohol Tobacco and Firearms (ATF), U.S. Citizenship and Immigration Services (CIS), Federal Air Marshal Service (FAMS), Transportation Security Administration (TSA), Air Marshal, Federal Aviation Administration (FAA), National Guard, Red Cross, United Nations (UN).10 |

#### **Terrorism, Extremism, and Cyber Security**

| Operational Focus | Targeted Keywords and Phrases |
| :---- | :---- |
| **Terrorism & Extremist Groups** | Terrorism, Al Queda (all spellings), Terror, Iraq, Afghanistan, Iran, Pakistan, Agro, Environmental terrorist, Eco terrorism, Conventional weapon, Target, Weapons grade, Dirty bomb, Enriched, Nuclear, Chemical weapon, Biological weapon, Ammonium nitrate, Improvised explosive device, IED, Abu Sayyaf, Hamas, FARC, IRA, ETA, Basque Separatists, Hezbollah, Tamil Tiger, PLF, PLO, Car bomb, Jihad, Taliban, Weapons cache, Suicide bomber, Suicide attack, Suspicious substance, AQAP, AQIM, TTP, Yemen, Pirates, Extremism, Somalia, Nigeria, Radicals, Al-Shabaab, Home grown, Plot, Nationalist, Recruitment, Fundamentalism, Islamist.10 |
| **Cyber Security & Intrusions** | Cyber security, Botnet, DDOS (dedicated denial of service), Denial of service, Malware, Virus, Trojan, Keylogger, Cyber Command, 2600, Spammer, Phishing, Rootkit, Phreaking, Cain and abel, Brute forcing, Mysql injection, Cyber attack, Cyber terror, Hacker, China, Conficker, Worm, Scammers, Social media.10 |

#### **Public Health, HAZMAT, and Infrastructure**

| Operational Focus | Targeted Keywords and Phrases |
| :---- | :---- |
| **HAZMAT & Nuclear** | Hazmat, Nuclear, Chemical Spill, Suspicious package/device, Toxic, National laboratory, Nuclear facility, Nuclear threat, Cloud, Plume, Radiation, Radioactive, Leak, Biological infection, Chemical, Chemical burn, Biological, Epidemic, Hazardous, Hazardous material incident, Industrial spill, Infection, Powder (white), Gas, Spillover, Anthrax, Blister agent, Exposure, Burn, Nerve agent, Ricin, Sarin, North Korea.10 |
| **Health Concerns & Disease** | Outbreak, Contamination, Exposure, Virus, Evacuation, Bacteria, Recall, Ebola, Food Poisoning, Foot and Mouth (FMD), H5N1, Avian, Flu, Salmonella, Small Pox, Plague, Human to human, Human to ANIMAL, Influenza, CDC, FDA, Public Health, Toxic, Agro Terror, Tuberculosis (TB), Agriculture, Listeria, Symptoms, Mutation, Resistant, Antiviral, Wave, Pandemic, Infection, Water/air borne, Sick, Swine, **Pork**, Strain, Quarantine, H1N1, Vaccine, Tamiflu, Norvo Virus, Epidemic, WHO, Viral Hemorrhagic Fever, E. Coli.10 |
| **Infrastructure & Weather** | Infrastructure security, Airport, CIKR, AMTRAK, Collapse, Computer infrastructure, Communications infrastructure, Telecommunications, Critical infrastructure, Metro, WMATA, Airplane, Chemical fire, Subway, BART, MARTA, Port Authority, NBIC, Transportation security, Grid, Power, Smart, Body scanner, Electric, Failure or outage, Black out, Brown out, Port, Dock, Bridge, Canceled, Delays, Service disruption, Power lines, Hurricane, Tornado, Twister, Tsunami, Earthquake, Tremor, Flood, Storm, Crest, Temblor, Forest fire, Brush fire, Ice, Stranded/Stuck, Help, Hail, Wildfire, Avalanche, Typhoon, Shelter-in-place, Disaster, Snow, Blizzard, Sleet, Mud slide, Erosion, Lightening, Aid, Relief, Closure.10 |

#### **Southwest Border Violence and Cartel Activity**

| Operational Focus | Targeted Keywords and Phrases |
| :---- | :---- |
| **Cartels & Locations** | Drug cartel, Violence, Gang, Drug, Narcotics, Cocaine, Marijuana, Heroin, Border, **Mexico**, Cartel, Southwest, Juarez, Sinaloa, Tijuana, Torreon, Yuma, Tucson, Decapitated, U.S. Consulate, Consular, El Paso, Fort Hancock, San Diego, Ciudad Juarez, Nogales, Sonora, Colombia, Mara salvatrucha, MS13, Drug war, Mexican army, Methamphetamine, Cartel de Golfo, Gulf Cartel, La Familia, Reynose, Nuevo Leon, Narcos, Narco banners, Los Zetas, Shootout, Execution, Gunfight, Trafficking, Kidnap, Calderon, Reyosa, Bust, Tamaulipas, Meth Lab, Drug trade, Illegal immigrants, Smuggling (smugglers), Matamoros, Michoacana, Guzman, Arellano-Felix, Beltran-Leyva, Barrio Azteca, Artistics Assassins, Mexicles, New Federation.10 |

### **The Failure of Lexicon-Based Domestic Surveillance**

The inclusion of common, mundane words such as "pork," "cloud," "smart," "team," and "Mexico" generated significant pushback from civil liberties organizations, who correctly argued that such broad, vague, and ambiguous terminology would inevitably sweep up the innocent communications of millions of Americans.10 The lack of semantic understanding in these early lexicon systems routinely resulted in high-profile intelligence failures. A widely cited example of this technological shortcoming occurred in 2012 when a British tourist was denied entry into the United States after DHS agents flagged and misinterpreted his Twitter posts. The tourist had tweeted that he was going to "destroy America" (which is common British slang for partying) and "dig up Marilyn Monroe's grave" (a joking reference to a television show).29 Because the system relied on static keyword triggers rather than contextual sentiment analysis, the individual was treated as a literal terrorist threat.

### **The Evolution of DHS Tactics: Masked Engagement and Data Aggregation**

Recognizing the limitations of passive, keyword-based monitoring, the DHS has significantly upgraded its operational tactics and technological infrastructure in the years since the 2012 disclosures. The agency has aggressively transitioned toward direct data aggregation and a practice internally referred to as "masked engagement".32