Background Check Agency Wants a Social Media Search Tool

The Defense Counterintelligence and Security Agency wants a tool to automatically cull social media and other public websites to create a searchable database of posts, actions and interactions that can be used in insider threat investigations.

Along with conducting background investigations for all of government, DCSA also manages the insider threat program for the Defense Department. The DOD Threat Management and Analysis Center, or DITMAC, “provides an enterprisewide capability to identify, assess, and mitigate risk from insiders; to oversee and manage unauthorized disclosures; and to integrate, manage, mature, and professionalize insider-threat capabilities.”

When a DOD employee or contractor is flagged as a potential threat—to information or physical security—DITMAC analysts are charged with investigating, including using digital evidence contained within DOD networks.

But nothing happens in a vacuum. And with so much information being posted to social media and other open forums, public digital sources can provide important context, according to a request for information posted to SAM.gov.

DITMAC analysts need “an automated capability to receive publicly available electronic information inclusive of—but not limited to—social media data on referred individuals in an effort to contextualize behavior that may be indicative of a potential insider threat,” the RFI states.

The tool—which must meet “all federal and DOD technological requirements for access and use on government systems”—must be designed to automate intake of open-source electronic information and allow DITMAC investigators to search the database by name.

The results should include “photos, text and actions—such as likes or retweets—taken by the primary actor(s) online without requiring DITMAC analysts to visit the social media site themselves,” the RFI states.

The tool must meet seven specific criteria to be considered:

• The capability to broadly scan the internet based on a known primary actor.
• The capability to conduct extremely accurate identity resolution based on initially limited data sets to validate that the results truly belong to the primary actor.
• The capability to scan the internet not only for text but for photos and videos containing images related to the primary actor and behaviors of concern.
• The capability to deliver both screen shots of relevant materials and the ability to view more broadly the information surrounding it to ensure appropriate context is captured.
• The capability to not only conduct a single check on an individual for existing information but to maintain continuous checks with frequency no less than weekly on a known actor during the period of time the individual’s case remains open.
• The existing capability to meet all DOD and federal information technology standards to ensure use and capability on DCSA networks.
• The ability to access all data without creating a fake user account or creating affiliations with the known primary actors, which is strictly prohibited.

DITMAC is not looking for information that would otherwise be kept private. To drive this home, the RFI specifies that the agency only wants to collect “information that is available to the public, under privacy settings set to ‘public,’ after creating a user login for the social media site.”

The contract will include training and technical support for the tools, as well.

The contractor will also be expected to conduct regular audits and maintain reports showing the activity of each DITMAC user and the names those users have run through the system. The RFI stresses that these reports should be kept as encrypted documents to protect individual privacy.

The contract will likely include a one-year base period with four one-year add-on options.

Responses to the RFI are due by 4 p.m. Aug. 24.

This latest RFI comes as DITMAC looks to overhaul all of the IT systems supporting its insider threat program.