APD’s Secret Informants Eyeing Neighbors for “Suspicious” Activity, Leaked Documents Reveal

In early June, an intelligence center operated by the Austin Police Department was hacked, along with many others like it across the country. Known as BlueLeaks, the collection of leaked documents from the hack contains over 10 gigs of material taken from the Austin center. They reveal a secret citizen spying program that's active in the Austin area and across the country. The Chronicle has obtained copies of BlueLeaks and will report further on the documents in the coming weeks.

Known as a fusion center, the Austin Regional Intelligence Center (ARIC) is a partnership between 19 local law enforcement agencies, housed at the Texas Depart­ment of Public Safety complex on North Lamar. Established after the perceived failures of intelligence sharing that contributed to 9/11, fusion centers use a national networked database that is also shared with the FBI and Department of Homeland Security. This network includes 78 DHS-recognized fusion centers, with at least one in each state. Texas currently has eight.

A critical part of ARIC's intelligence gathering process is the use of Threat Liaison Officers (TLOs), who report suspicious activity or behavior to ARIC. Accord­ing to APD Public Information Specialist Tara Long, ARIC currently works with about 800 such officers. These include sworn law enforcement officers, but also non-sworn government employees as well as private citizens. Long confirmed the hack, but could not provide us with a breakdown of sworn and civilian TLOs.

Documents examined by the Chronicle show that each TLO must sign a nondisclosure agreement with ARIC, including those not working in law enforcement, essentially creating secret citizen officers. These informants, known as For Official Use Only TLOs, are able to access the fusion centers' national intelligence database (excluding personal identifying information). The FOUO TLOs include private security officers with local hotels, malls, large venues, and local semiconductor companies. Government employees in "education," "code enforcement," and "public works" also contribute to ARIC as FOUO TLOs.

Long indicated there were no other categories of FOUO TLOs, but a document from the Texas Division of Emergency Manage­ment (included with BlueLeaks but also available at the agency's website), titled "Building Relationships With Fusion Cen­ters – A Guide for Non-Law Enforcement Organizations," listed "military," "hospital systems," and "faith community" as additional "partner organizations." These expanding partnerships exemplify what civil rights activists often criticize as the fusion centers' "mission creep" – from well-defined efforts to combat terrorism into a broad conception of "suspicious activity" without clear links to any kind of crime.

"The FOUO TLO program appears to create a cadre of anonymous, non-law-enforcement citizen informants who, unlike ARIC, are completely unaccountable to the public," said Texas Civil Rights Project lawyer and ARIC Community Advocate Peter Steffensen. "When we have no idea who is surveilling Austin's communities, I find it hard to trust that the Privacy Policy is actually serving one of its core functions: 'to protect the privacy, civil rights and civil liberties of all individuals[.]' The NDAs may contractually obligate these TLOs not to disclose any information they receive from ARIC, but it does not appear from the strict wording of the Privacy Policy that these people are even authorized to receive this information to begin with. Given this country's tortured history of over-surveillance of Black and brown communities, these secretive programs deserve intense scrutiny and more substantial public oversight."

Is an “Arabic Hat” a Threat?

The reports submitted by ARIC TLOs range from mundane observations to serious threats that require immediate law enforcement action. For example, numerous school shooting threats are included, derived from comments made to school counselors and on social media. APD gave the Chronicle an example of a person who had told a counselor of an interest in committing a mass shooting at a school, mall, or other gathering place, with a detailed plan and access to weapons. The counselor said the individual "had previously expressed ideations of ramming their truck into a crowd of people so they could 'hear their bones crushing.'" The report led to the individual being taken into custody for a mental health evaluation.

That's the sort of report a community would expect their police to follow up on. But there are many more troubling examples, such as racial profiling of Middle East­ern persons and reports on First Amend­ment­-protected speech involving protests. For example, one report warns that a person "who regularly rides the MetroRail from Howard Station to the Downtown Station has changed his dress from traditional westernized clothing to 'tunics with an Arabic style hat,'" and describes the person as tense and sweaty. Another describes a planned peaceful protest by Bee Cave high school students, saying the "interest of attendees is unknown."

ARIC is governed by a Privacy Policy which is relatively progressive compared to other fusion centers (though the bar is quite low). ARIC's policy states the center "shall collect and retain information only where there is reasonable suspicion that a specific individual or organization has committed a criminal offense or is involved in or is planning criminal (including terrorism) conduct or activity that presents a threat to any individual, the community, or the nation." It defines suspicious activity as "observed behavior reasonably indicative of pre-operational planning related to terrorism or other criminal activity." Some reports meet this standard, but many describe "suspicious activity" that falls well short of what a reasonable person would consider criminal or terrorist activity or evidence of such intent.

The leaked documents include submission forms TLOs use to make their reports. At the top of the forms are boxes to check indicating the type of activity being reported. These include the aforementioned "School Threat," but also "Eliciting Infor­ma­tion," "Observation/Surveillance," and "Suspicious/Odd Facebook Post." The TLO report spreadsheet contains 128 reports of school threats. But the category most reported by far was "Expressed or Implied Threat," with more than a thousand entries.

One threat is simply listed as "Photo­graphy," with at least 35 examples reported as suspicious. According to one FOUO TLO's report, an individual was seen taking photos of Zach Scott's Topfer Theatre on Sept. 22, 2016. The report includes five different pictures of a young person using a camera on a tripod to photograph the theatre from across the street. Another report, from a law enforcement TLO, describes a person who got out of their vehicle to take photos of a school building's facade and then drove away. Apparently even taking photos at a "public commission meeting" can be considered suspicious, as another report indicates. (As a Chronicle staff photographer, this reporter found these examples disturbingly similar to their own assignments at times.)

Another TLO report described an "Expressed or Implied Threat, Other" that appears more gross than criminal: A person "posted comments on a social media page, that he was going to spit in the drink of a classmate, whom he dislikes. The subject later posted to having completed the act and enjoying watching the classmate unknowingly drink the subject's spit."

None of these reports led to the completion of a Suspicious Activity Report by an intelligence analyst, the next step taken when a report is considered credible enough to add to the ARIC database. But worrisome examples of "suspicious activity" have led to that increased scrutiny; in the coming weeks, the Chronicle will report on local political activists whose noncriminal activity has resulted in their surveillance by TLO officers, along with other concerning aspects of ARIC. Stay tuned.