T he FBI operates on the internet with unprecedented vigor and under loose rules, according to secret internal guidelines obtained by The Intercept, with undercover agents freely chatting online with unsuspecting people who are not even under investigation. The bureau has made online counterterrorism a strategic focus, lavishing staff and attention on a clearinghouse project called Net Talon and measuring performance through such metrics as the amount of time agents spend online, how many postings they make, and the personas they create. The FBI’s virtual tentacles are so ubiquitous that the bureau sometimes finds itself investigating its own people. Because terror groups have made effective use of online networks to spread propaganda and to connect with troubled individuals, the virtual realm has become a significant counterterrorism theater for the FBI. The bureau has given broad authority to agents operating online in order to ramp up counterterrorism sting operations, among other activities. But lawyers, experts, and activists express concern that the FBI’s aggressive use of undercover operations may be creating terrorists out of hapless people who say stupid things online. The information in this story is drawn largely from the FBI’s Counterterrorism Policy Guide, a manual for agents working on both international and domestic terrorism cases. The document, classified secret, is dated April 1, 2015, and has not been previously released. The Intercept is publishing sections of the guide dealing with the FBI’s online investigations, a subject on which the bureau has offered little transparency. Other guidance on undercover operations has been made public in the past, but none that goes into as much detail on online investigations. According to the guide, an online counterterrorism investigation can target websites or online networks that the FBI believes terrorists are using “to encourage and recruit members” or to spread propaganda. Such probes may extend to the administrators or creators of those forums, as well as people engaged in “the development of communications security practices” or “acting as ‘virtual couriers’ for terrorist organizations by passing online messages among members or leadership.” The guide classes as online investigations those that rely primarily on online informants or undercover employees, and those that involve surveilling internet facilities or foreign websites hosted on U.S. servers. The FBI often runs such operations jointly with other U.S. intelligence agencies or “international partners,” according to the document. Since 2008, the Counterterrorism Division has coordinated these operations under a program called the Net Talon National Initiative. Net Talon uses informants, linguists, and FBI employees working undercover, posing as ordinary internet users, to zero in on terrorists’ use of the internet, according to the guide. The initiative was meant to centralize expertise on particular targets and platforms, to “address intelligence gaps,” and to create a clearinghouse of the intelligence the bureau has collected on terrorists’ use of the internet. The FBI’s online activities are apparently pervasive and uncoordinated enough to lead to confusion. The document refers to “resources being wasted by investigating or collecting on FBI online identities,” including undercover employees, informants, or people who have already been investigated by other offices or agencies. An FBI official told the Intercept, “You would be in a forum, and you’re like, ‘This person’s way out there,’ and we’ve gone and opened up a case, and sometimes that was a local police department, or a friendly foreign service. There are still instances of that, and deconfliction is still necessary.”

Khurrum Wahid and Joshua Dratel, defense attorneys for Ahmed Omar Abu Ali, answer questions from the media after Abu Ali was sentenced on March 29, 2006, at a federal court in Alexandria, Va. Photo: Alex Wong/Getty Images

T he Counterterrorism Policy Guide shows just how much flexibility informants and undercover agents have when operating online, even when they’re not working specific targets. The FBI insists that there is nothing to see here: In statements provided to The Intercept, the FBI said that “while there are obvious differences between online and offline environments,” FBI employees and informants working on the internet are subject to the same rules, and that bureau employees can only monitor people’s online activity as part of an authorized investigation. The guide, however, suggests that the internet offers areas of ambiguity. Much comes down to the questions of what informants can do, as opposed to FBI employees, and whether the goal of an operation should be construed as seeking to obtain specific intelligence, simply watching public websites, or developing a profile for an undercover identity. For instance, the guide states that an FBI employee can visit a message forum or blog only when the site is relevant to an investigation. An FBI employee, according to the guide, could be an undercover agent or an “online covert employee,” a term that presumably refers to FBI workers other than agents, like analysts. FBI employees can’t chat online with someone who isn’t already the subject of an investigation for the purposes of gathering intelligence on that person. They can, however, “engage in unlimited communication with associates” of a person under investigation, if the conversations are relevant to the investigation. Informants and undercover FBI employees are also allowed to do a great deal online in the name of “building bona fides,” such as creating fake identities or making themselves appear to be normal commenters on online fora. The guide says that in order to establish credibility, FBI employees “may make postings and communicate with individuals who are neither the subjects nor the associates of subjects … there is no limitation with respect to the amount of communication [they] may initiate in this regard.” And the FBI is allowed to open new investigations on people it identifies through “passive monitoring or active communication” on websites. An FBI spokesperson clarified that in order for an undercover or covert employee to monitor a website or forum, the site must already be associated with an investigation, “either because the forum was known to be used by a subject [of an investigation], or because the subjects are there. I can’t be in the forum trying to bait you into conversation.” However, the FBI acknowledges that when its employees participate in online fora, they interact with people who may be bystanders to whatever activity led the bureau there in the first place. And that is not accidental. “We want to know if the subject has other people who are joining in, which people are part of the activity, and who is just there,” a spokesperson explained. In other words, FBI agents can post and chat online with people who have nothing to do with an investigation, so long as they aren’t collecting intelligence — but in the course of those online communications, they can decide to start investigating someone. Michael German, a former FBI agent who is now with the Brennan Center for Justice at New York University Law School, said that agents have always had a little bit of wiggle room in this regard. They can have a certain number of in-person meetings with someone, or in some circumstances go to public meetings or public websites, without identifying themselves as part of the FBI. This helps agents avoid a bureaucratic mess when carrying out a simple “buy and bust” drug sting, for example, German said. But the ability to conduct unlimited online conversations in the name of building bona fides gives agents “a pretty long rope,” German said. Criminal defense attorney Khurrum Wahid, who has handled or been an adviser on many national security cases, notes that FBI employees or informants frequently pose as experts offering guidance to lost individuals. “These uninformed young people go online and become almost smitten with people who show a level of knowledge, who often turn out to be informants or undercovers,” said Wahid. Informants operate under looser rules than FBI personnel. They are allowed unlimited engagement with a target in the course of an “assessment,” a preliminary investigation that can be opened on a loose tip of suspicious behavior, in order to collect general intelligence on a subject, or to evaluate a potential new informant. Assessments were created as a category in 2008. German finds their allowance for the expansive use of informants problematic. “What we’ve seen in sting operations is that there is this shady portion before the official operation begins which often involves the informant,” said German. “And then it’s passed off to an agent, and it looks like they are ready to commit a crime pretty quickly.” Wahid noted that at least in online cases, there are generally logs of all the conversations between suspect and informant, whereas “when it’s a live informant, they can turn off the recorder and we never know what it was all about.” The use of informants in counterterrorism sting operations has expanded since the 9/11 attacks, when the FBI adopted the mantra that its job is to stop terror attacks before they occur, not just investigate them afterward. The government argues that the anonymity the internet affords to suspects necessitates an aggressive approach, including stings. The FBI’s national security director told the New York Times this summer that “using undercover agents online allowed the FBI to ‘flesh out’ suspects by gaining their trust and persuading them to disclose their real identities.” In some cases, the FBI even created fake webpages in order to draw in suspects. “Agencies are under a lot of pressure to find a needle in a haystack, something that has haunted us since the beginning of the war on terror,” said Karen Greenberg, director of the Center on National Security at Fordham Law School. “It’s true that the internet has changed everything about how we communicate, but are we just going to be trawling online forever? It turns the principles of criminal investigation on their head.”

FBI officials collect evidence from the parking lot of Pulse nightclub, the site of a mass shooting days earlier, in Orlando, Fla., June 15, 2016. Photo: Adrees Latif/Reuters