Analysis The US government will now require "most" visa applicants to provide details of their social media accounts before they are allowed into the country.
The controversial policy seemingly came into force on Friday. As far as we can tell, it will require people to provide the URLs or handles of social media accounts – from Twitter and Tumblr to LinkedIn, Instagram, and Facebook – they have used in the past five years as well as email addresses. No passwords are requested.
This information must be declared on their DS-160 application forms, which need to be completed to apply for non-permanent visas to stay and work in the United States. These are the forms on which you normally fill out your personal information, such as your passport details.
The new online forms asking for email addresses and social media handles: Click to enlarge ... Source: Immigration lawyer Greg Siskind (link)
However, there is a startling lack of detail over how exactly the policy will be enforced, and how any data gathered from social media profiles will be used, despite more than a year of debate, including public comment periods and lawsuits seeking more detail.
The policy covers visa applicants, which should mean that tourists from the 38 countries that the US allows foreigners to visit for 90 days via the Electronic System for Travel Authorization (ESTA) scheme are not impacted by this latest change. Since December, at least some ESTA applicants have been asked to provide online handles, though it is not mandatory to comply.
Anyone not from those 38 countries, or anyone who wants to work in the US, or anyone who has traveled to seven specific countries (Iraq, Syria, Iran, Sudan, Libya, Somalia, Yemen) will be required to apply for visas and hence will be required to provide their social media handles. It is expected to impact over 14 million people annually.
It is not clear if the policy will eventually extend to permanent residents. And it is unclear for how long the US government will store any harvested information, and for what purpose exactly. Which is surprising given that the policy has been repeatedly put out to public comment since 2017 – and each time has received thousands of responses from the public who overwhelmingly feel the approach is too invasive.
The only official statement on the new policy so far is vague and lacking in detail.
"We already request certain contact information, travel history, family member information, and previous addresses from all visa applicants," read a State Department statement. "We are constantly working to find mechanisms to improve our screening processes to protect US citizens, while supporting legitimate travel to the United States."
Asked for more details, the department issued another vague response: "National security is our top priority when adjudicating visa applications, and every prospective traveler and immigrant to the United States undergoes extensive security screening."
A request for social media handles during a visa application was first introduced during the Obama Administration but was notably voluntary. That changed when President Trump came into power.
In February 2017, the-then head of Homeland Security, John Kelly, told Congress that he wanted to turn the voluntary requirement into a compulsory one, arguing that it was a "glaring deficiency" in the vetting of visitors.
Kelly even suggested that people would be required to hand over their passwords so officials can log into their accounts. "We want to say 'what kind of sites do you visit and give us your passwords,' so we can see what they do," Kelly told a House Committee.
FYI: Get ready for face scans on leaving the US because 1.2% of visitors overstayed their visasREAD MORE
A week later, US Representative Jim Banks (R-IN) proposed the Visa Investigation and Social Media Act (VISA) that would require visa applicants to provide their social media handles to immigration officials. The law went nowhere.
Here comes Trump
A month later, as part of a wider push to exclude anyone from the seven countries mentioned above, President Trump signed an executive order asking key officials to put together a "uniform baseline for screening and vetting standards and procedures."
Two months after that and social media handles – though, notably, not passwords - were officially added to a list of requirements in a proposed new State Department policy. The policy was met with strong criticism from a wide range of groups, including privacy advocates and Homeland Security's own inspector general who said in an official report [PDF] that he was concerned about both a lack of metrics to test for the program's success, and the fact there was no effective system for analyzing what would be a vast amount of data from applicants.
But despite those concerns, the DHS and State Department pushed ahead with the gathering of social media profiles as part of vetting, prompting lawsuits and freedom of information requests to find out what was going on behind the scenes. The results from that appeared to show that pilot projects to test the value of social media profile gathering were ineffective.
But the State Department pushed ahead regardless and in March 2018, published a plan to expand the program from what one that would impact 65,000 people annually to one that covered 710,000 each year. In a second announcement, it sought public comment on a plan to expand the program to cover everybody that applied for a visa to enter the US – roughly 14 million people each year.
Sponsored: Webcast: Simplify data protection on AWS