INVESTIGATION REPORT

Submitted April 6, 2016

by
Carolyn D. Walker, Attorney
Stoel Rives LLP

Table of Contents
I.

Background ........................................................................................................................1
Criminal Intelligence Unit.....................................................................................1

II.

Investigation Methodology ................................................................................................3

III.

Findings...............................................................................................................................4

IV.

Witness Interviews and Observations ..............................................................................7

V.

1.

Research Analyst 3 ....................................................................7

2.

Research Analyst 3 .....................................................................8

3.

Research Analyst 3 ................................................9

4.

Research Analyst 3 ..............................................................11

5.

Special Agent ...............................................................12

6.

Special Agent ....................................................................17

7.

David KirbySpecial Agent in Charge.............................................................18

8.

Darin TweedtDOJ Chief Counsel ...................................................................20

9.

Research Analyst 4 ..................................................................23

10.

Steven McIntoshAssistant Special Agent in Charge of CJD........................24

11.

Matt McCauleyAssistant Attorney General ..................................................26

Conclusions and Recommendations ...............................................................................28

I.

Background

On November 4, 2015, I was contacted by Lisa Umscheid, an attorney with the Oregon
Department of Justice (DOJ), regarding my availability to conduct an investigation into the use
of a digital monitoring software platform by at least one employee of the DOJs Criminal Justice
Division (CJD or division). By contract effective November 10, 2015, the DOJ retained me
under the supervision of the DOJs Supervising Attorney, Ms.Umscheid, to (a) conduct an
investigation into any improper conduct and performance of employees with regard to their
compilation, analysis, monitoring and use of digital information (such as content posted on
websites, social media or Twitter feeds) in the course of any work performed as employees of
DOJ; and (b) advise DOJ regarding the scope of an audit of the CJDs compilation, analysis,
monitoring and use of digital information in connection with the divisions work.
This investigation was initiated by order of Oregon Attorney General Ellen Rosenblum
after she learned that DOJ/CJD employee,
, used social media monitoring software
that was being tested for potential purchase by the DOJ to conduct a search using search terms
including #blacklivesmatter. The search resulted in a review of the Twitter account of Erious
Johnson, Jr., Director of Civil Rights for DOJ and Office of Attorney General, and
generated a report on the outcome of the search. The Attorney General notified Mr. Johnson of
this report, subsequently called for this investigation into the matter and placed
on
administrative leave pending the outcome of the investigation.
is an investigator assigned to the Oregon TITAN Fusion Center, which is a
unit within the CJDs Criminal Intelligence Unit. An overview of the Criminal Intelligence Unit,
as provided in writing by former DOJ Chief Counsel Darin Tweedt, is set forth below:
Criminal Intelligence Unit
The ability to gather and analyze information about criminals and their organizations
is invaluable to law enforcement agencies. 1 The Criminal Intelligence Unit, aka
1

The benefits of gathering and analyzing criminal information was recognized by

the Oregon legislature in 1977 when it directed the Department of Justice to:
(2) Establish a coordinated system of collecting, storing and disseminating
information relating to organized crime.
(3) Develop and maintain a liaison between local, state and federal law enforcement
agencies in Oregon, assisting them in the investigation and suppression of
organized criminal activity and encouraging cooperation among those agencies.
(4) Conduct comprehensive factual studies of organized criminal activity in Oregon,
outlining existing state
and local policies and procedures with respect to organized crime, and formulating
and proposing such changes in those policies and procedures as the department may
deem appropriate.
(continued . . .)
1

Criminal Intelligence Center, facilitates the gathering, analysis and sharing of criminal
information with local, state and national law enforcement agencies. The Unit is
composed of the Oregon TITAN Fusion Center, the Oregon HIDTA Investigation
Support Center, and the Oregon HIDTA Watch Center.

Oregon TITAN Fusion Center: The Fusion Center is Oregon's focal point for
receiving, analyzing, gathering, and sharing threat-related information in order to
better detect, prevent, investigate, and respond to criminal and terrorist activity.
The Fusion Center is composed primarily of staff from the Criminal Justice Division. 2
This staff works in conjunction with federal, state and local law enforcement
agencies. The Fusion Center produces threat assessments 3, officer safety bulletins,
general crime bulletins and terrorism related bulletins. In addition, the Fusion Center
is an essential component of the states critical infrastructure review process. The
Fusion Center also provides criminal analysts to assist federal, state and local law
enforcement agencies with criminal investigations. Finally, the Center provides
important training to law enforcement agencies, businesses and first responders about
active shooters and the latest terrorist trends, techniques and procedures.

High Intensity Drug Trafficking Area (HIDTA) Investigation Support

Center: The Investigation Support Center is a co-located multi-agency program.
Its mission is to promote, facilitate, and coordinate the exchange of criminal
intelligence information, and provide analytical support. The Criminal Justice
Division has five Research Analysts assigned to the Investigation Support Center.

(. . . continued)
ORS 180.610 (2), (3) (4).
2

The Criminal Justice Division component is one attorney, one Special Agent, five
Research Analysts and an IS Specialist.
3

A threat assessment is the [p]rocess of identifying or evaluating entities or events

for indications of potential harm to life, property, operations or information. These
assessments involve investigative research which results in a written product identifying
possible threats to a specific person or incident. Examples include Pendleton Round-up,
Hillsboro Air Show or Governor's Inauguration. Threat assessments may be conducted by
an individual or team of analysts based on the complexity of the assessment.
Oregon TITAN Fusion Center Procedure, Threat Assessments/Risk & Vulnerability
Assessments, September 18, 2015.


High Intensity Drug Trafficking Area (HIDTA) Watch Center: The Watch
4
Center's primary mission is to enhance officer safety through deconfliction for the
designated HIDTA counties. Watch Center analysts also provide tactical analytical
support to law enforcement officers throughout Oregon. The Criminal Justice
Division has three Research Analysts and a supervisor assigned to the Investigation
Support Center.
See Ex. A (November 25, 2015 Memorandum from Darin Tweedt).

II.

Investigation Methodology

Prior to conducting witness interviews, I met with various DOJ employees to obtain
background information on the CJD and the circumstances that led to the decision to conduct the
investigation that is the subject of this report. These individuals included: DOJ Senior Assistant
Attorney General Lisa Umscheid, Deputy Attorney General Fred Boss and DOJ Special Counsel
on Public Safety Michael Slauson. 5
Beginning December 15, 2015, I conducted face-to-face interviews with CJD employees
and obtained background information and documents relevant to the Attorney Generals
concerns. At the start of each interview, I explained my role as an investigator hired by DOJ to
conduct an investigation into the facts and provide recommendations to DOJ. I explained that
the statements made by the witnesses would be shared with the DOJ, but that the witnesses
should not discuss our interview with others. 6 I also explained the Garrity rights notices that
were provided to the witnesses.
I reminded these employee witnesses that there could be no retaliation either by or
against them for anyones participation in the investigation, and to immediately notify HR if they
experienced retaliation. I provided the witnesses with my business card and invited them to
contact me if they had any other information or documentation to share.
4

Deconfliction is a process designed to ensure that multiple agencies are not

inadvertently targeting the same event, individual, or organization. Deconfliction occurs
when officers of one investigative agency are notified that officers of another agency may be
conducting operations in the same area or may be investigating the same suspect.
Deconfliction prevents costly duplication of investigative effort and compromise of
investigations. Most importantly, deconfliction directly impacts officer safety by reducing
the chances two law enforcement agencies, unbeknown to each other, are carrying out
undercover law enforcement operations in the same area.
5

Mr. Slauson has since assumed the position of Acting Chief Counsel of the CJD.

Note, I have been informed that under the terms of their collective bargaining
agreement, union employees are permitted to engage in discussions with others regarding the
investigation.

To better understand the search methodology used by

and others, I
requested training on the software that was used for the search. The company that developed and
owns the software (Digital Stakeout) that was used for the search cooperated with DOJs
request to provide me with an abbreviated general overview demonstration/training on the
software.
I further requested that the DOJ conduct a thorough search of CJD computers used by
to determine the scope of his searching and activity regarding #blacklivesmatter
and other relevant search terms.
As part of my investigation, I requested a copy of all CJD policies, procedures or
protocols relevant to privacy rights of individuals and groups and how and when information
could be gathered. I received and reviewed the following division policies:
o Oregon TITAN Fusion Center Privacy Policy. See Ex. B.
o Social Media Non-Covert Investigation Policy 3-101.5 dated July 31, 2015. See Ex. C.
o Fusion Center Procedure for Threat Assessments dated September 18, 2015. See Ex. D.
o Oregon TITAN/Fusion Center Policy Regarding First Amendment Protected Events. See
Ex. E.
I also reviewed the following statutes and regulations relevant to CJD employees:
o 28 CFR Part 23 regarding Criminal Intelligence Systems Operating Policies. This federal
regulation applies to state agencies if they are operating inter- or multi-jurisdictional
criminal intelligence systems that are supported with Crime Control Act funding. The
regulation forbids the collection or maintaining of criminal intelligence information about
the political, religious or social views, associations or activities of any individual or any
group, association, corporation, business, partnership or other organization unless such
information directly relates to criminal conduct or activity and there is reasonable
suspicion that the subject of the information is or may be involved in criminal conduct or
activity. See 28 CFR 23.20(b).
o ORS 181.575 (now recodified as ORS 181A.250) states that no law enforcement
agency, as defined in ORS 181.010 (Definitions for ORS 181.010 to 181.560 and
181.715 to 181.730), may collect or maintain information about the political, religious or
social views, associations or activities of any individual, group, association, organization,
corporation, business or partnership unless such information directly relates to an
investigation of criminal activities, and there are reasonable grounds to suspect the
subject of the information is or may be involved in criminal conduct.
My findings, summary of the interviews and observations, conclusions and recommendations are
below.

III.

Findings

1. In early 2015, Chief Counsel Darin Tweedt directed Special Agent In Charge Steve McIntosh
to identify and test social media monitoring software (SMMS) programs that could be
helpful in criminal investigations supported or conducted by the CJD.

2. On September 29, 2015, certain CJD employees within the Intelligence Unit were given a
demo and some training by the vendor of an SMMS product, Digital Stakeout. Digital
Stakeout takes user specified keywords and searches multiple open source social media sites,
and returns results that can be pinpointed to a geographic area specified by the user. The
vendor allowed the employees to use Digital Stakeout on a free trial basis after the demo, and
some employees tested it for a period of time. 7
3. On September 30, 2015, Agent
used Digital Stakeout to conduct a search on
the keyword search term #blacklivesmatter combined with #fuckthepolice (the search).
He focused his search on Salem, Oregon, which yielded results that included Twitter posts by
Erious Johnson, Jr.
believed that some of Mr. Johnsons posts were
threatening to the police and he verbally shared his concerns with Special Agent in Charge
David Kirby. 8
4. Mr. Kirby verbally described the concerning posts to Mr. Tweedt, and based on the
description, Mr. Tweedt recommended to Deputy Attorney General Fred Boss that
prepare a report on his search and the findings. Mr. Boss approved this
recommendation and
was then directed to write the report.
5. On October 1, 2015,
prepared and presented to Mr. Kirby a report he
referenced as Possible threats towards law enforcement by DOJ employee. This report was
a single page memo with an attachment that included several pages of posts that
printed directly from Mr. Johnsons Twitter feed rather than from Digital
Stakeout. See Ex. F.
6. On October 8, 2015, Mr. Kirby delivered the report to Deputy Chief Counsel Stephanie
Tuttle. In an email to Mr. Tweedt, Mr. Kirby reiterated his concerns about the crosshairs
image and gave Mr. Tweedt a detailed description of the image and the accompanying
language. Upon reading Mr. Kirby's detailed description, Mr. Tweedt emailed Mr. Kirby
that the image was actually the logo for the rap group Public Enemy. See Ex. G.
7. On October 8, 2015, Ms. Tuttle left
report on Mr. Tweedts office chair.
8. On October 12, 2015, upon his return from out of town travel, Mr. Tweedt reviewed the
report.
9. On October 13, 2015, Mr. Tweedt gave the report to Mr. Boss, who at some point thereafter
gave the report to Attorney General Ellen Rosenblum.
10. On October 20, 2015, the Attorney General called Mr. Tweedt into a meeting with herself
and Mr. Boss, during which she expressed her extreme displeasure over the report by
because she believed he had engaged in racial profiling. She instructed Mr. Tweedt
to find anti-racial profiling training for the Special Agents, and ordered that all SMMS use be
immediately discontinued.
7

Another SMMS program that was being considered for use by the Intelligence Unit was
X1, but it appears to only have been used on a very limited basis by Research Analyst
to conduct a keyword search on the word
based on some activity with
8

Note that none of Mr. Johnsons tweets that were attached to

2015 memo contained any reference to fuck the police.

October 1,

11. On or about October 20, 2015, at the direction of Mr. Tweedt, Steve McIntosh verbally
notified some employees to discontinue use of Digital Stakeout. It is unclear whether he
notified all of the employees at that time, as there are conflicting accounts of who received
this verbal notice and when it was received.
12. On November 10, 2015,
was placed on administrative leave pending the
outcome of this investigation.
13. On November 12, 2015, Mr. McIntosh sent an email to all subject employees to discontinue
use of Digital Stakeout. See Ex. H.
14. All other employees, except
, had stopped any active use of Digital Stakeout at
or before the time Mr. McIntosh issued his November 12, 2015 email.
15. The trial version of Digital Stakeout that was being used by employees was not enabled to
keep a record of searches conducted by employees, so the search terms could not be verified
independently from the list provided to this investigator that the employees reported having
used. 9
16. Digital Stakeout allows users to access only open source (publicly available) information,
and does not allow users to breach information that is protected by privacy settings. None of
the searches conducted by
and other employees using Digital Stakeout
accessed non-public information on Mr. Johnson or others.
17. Mr. Johnson was not specifically targeted for investigation by
or the DOJ.
18.
conducted the search of the terms that resulted in finding Mr. Johnsons
Twitter posts of his own volition, and not under any direct or implied orders of the DOJ.
19. The Intelligence Unit is subject to federal 28 CFR Part 23 regarding Criminal Intelligence
Systems Operating Policies and to its state equivalent, ORS 181.575 (now recodified as
ORS 181A.250) , as well as the units own policies regarding privacy and free speech
rights of individuals and groups. These policies apply regardless of whether the information
being gathered or sought is obtained while engaged in a training exercise or while conducting
substantive work.
20.
search was not in compliance with 28 CFR Part 23, ORS 181.575 or the
Intelligence Units Privacy Policy. 10
21. Once
conducted the search, the lack of a diverse or alternative point of view
regarding the import of the search results contributed to the belief that Mr. Johnsons posts
constituted a potential threat to the police.
22.
was verbally directed to prepare a written memo based on his description of the
search results and his belief that the posts constituted a potential threat to police.
23. Intelligence Unit employees either are not uniformly provided with copies of all relevant
departmental policies, or do not recall having received all such policies.

The combined list of search terms any of the employees reported using is included in a
November 9, 2015 email from Mr. McIntosh to Mssrs Tweedt and Kirby and Stephanie Tuttle.
See Ex. I.
10

Depending on whether he obtained prior written authorization from a superior,

actions may also be out of compliance with the Social Media Non-Covert
Investigation Policy 3-101.5.

24. Intelligence Unit employees are either not receiving or taking advantage of relevant training
offered on applicable laws and departmental policies on a consistent basis.
25. Intelligence Unit employees have not received adequate cultural competency training, or
training on anti-racial profiling , hidden or implicit bias, and/or diversity training.
26. The Intelligence Unit is in the process of updating its policies and training procedures and
implementing a system to maintain the policies and more consistently mandate and track the
training.
27. The Intelligence Unit has taken steps to implement anti-racial profiling training for its
employees and plans to move forward with the training pending the outcome of this
investigation.

IV.

Witness Interviews and Observations

Between December 15, 2015 and March 16, 2016, I conducted recorded interviews of
several DOJ/CJD employees. 11 These employees were selected for interviews because they
either participated in the training on the use of Digital Stakeout and/or used Digital Stakeout at
some point; had some pertinent communication with
after he conducted the
#blacklivesmatter search (the search); were in the supervisory chain of command over
; and/or were involved with CJD actions taken after the search.
1.

Research Analyst 3; employed since 4.10.2000 (interviewed on

December 15, 2015 and March 9, 2016)
was accompanied by her union representative, Joe Ederer.
is
assigned to the Fusion Center. She attended the demonstration/training for Digital
Stakeout, but thinks it was at the end of October 2015 (the demonstration was actually on
September 29, 2015), along with
and
.
believes she never used Digital Stakeout outside of the September 29 training, except
once to sign on another member.
She had previously conducted a search through the X1 Social Discovery platform using
the search term
because David Kirby wanted her to conduct the search based on
some activity with
.
reviews social media sites of individuals only in the context of providing
case support to law enforcement agencies, and has never conducted any information
gathering on individuals who were not part of a criminal investigation. She is familiar
with 28 CFR 23 and understands it applies to her, and that by extrapolation so does ORS
11

Note that on March 4, 2016, I contacted Mr. Johnson to invite him to meet with me in
the event he had information to share that might aid in the investigation, given that it was his
Twitter feed that brought the issue of
activity to light. Mr. Johnson expressed his
willingness to answer any specific questions, but declined to meet with me as he had no
independent information relevant to this investigation.

181.575. She is unfamiliar with the September 18, 2015 Fusion Center Procedure for
Threat Assessments, and she does not typically conduct threat assessments. When threat
assessments are conducted, the assessment is targeted toward an event (such as the
Hillsboro Air Show) to determine whether the event is subject to a threat, rather than
conducting an assessment to determine whether a particular individual is considered a
threat. She is familiar with the Fusion Center Privacy Policy and has received formal
online training within the last year on some of the information contained therein.
does not have the ability to access emails of individuals, which requires a
subpoena. She does not conduct surveillance in her position, and does not know whether
individuals whom she has conducted research on based on a law enforcement request are
subjected to surveillance after she submits her search results to law enforcement.
attended the September 29, 2015 vendor demonstration/training on Digital
Stakeout along with others in her department. Sometime after the training,
showed
a map location with a dot on it, which represented the building
they were in, but she does not recall the search terms he used to obtain that geographical
location result.
expressed surprise that someone in the building was
expressing views that
felt presented an officer safety issue. The next time
she heard anything about the search
conducted was when it came out in the
media.
was told verbally (she believes sometime in September or October)
that the department could no longer use Digital Stakeout or other social media monitoring
platforms by either David Kirby, Steve McIntosh or another employee, and also later
received a November 12, 2015 email from Mr. McIntosh that they were to discontinue
use. At the time
was put on administrative leave (November 10, 2015),
was not using the software at all to conduct searches.
has been trained on 28 CFR 23 and recognizes there are some search terms
that would be inappropriate, such as conducting a search based on a persons religion,
political views/party affiliation, race or sexual orientation, etc. She is not aware of
anyone in her department conducting such searches.
has not been given any training on racial bias, hidden biases or racial
profiling, but has had diversity training in the past.
2.

Research Analyst 3; employed since 6.12.2006 (interviewed on

December 15, 2015 and March 9, 2016)
was accompanied by her union representative, Mr. Ederer.
has been assigned to the Fusion Center since October 1, 2015 and prior to that was an
analyst assigned to the High Intensity Drug Trafficking Areas (HIDTA). She is
familiar with Digital Stakeout, and she was given access to it although she never used it
and did not attend the September 29, 2015 demonstration provided by the vendor.
showed
how the geofence component on Digital Stakeout
worked on the computer in his office either on September 29 or 30, 2015. The next day,
showed
on his computer a search he had conducted using
8

unsatisfied with the results he was getting, so he went back to using Google and watching
the news to get updated information.
also used terms similar to no new
animal labs in light of demonstrations that were occurring in Seattle, but did not get a lot
of useful information. On November 12, 2015, Mr. McIntosh sent an email telling
employees to stop using Digital Stakeout.
During his December 15, 2015 interview,
stated that he was not aware of
black lives matter search until after
was put on
administrative leave (which was on November 10, 2015). During the March 9, 2016
follow-up interview,
stated that Mr. McIntosh had previously walked down
the center walkway in the department and given verbal instruction that there was to be no
more use of Digital Stakeout until the issues were taken care of
believes
this was prompted by the black lives matter stuff.
It has been ingrained in
during his many years of law enforcement that the
only time it is appropriate to research an individual or group is during an active criminal
investigation. He has had training on what is appropriate or legal in terms of gathering
and maintaining information on individuals. The department follows the Fusion Center
Privacy Policy, and has a practice of checking with its attorney (Matt McCauley) on
reviewing all the work product it creates (before disseminating it).
understands that it is impermissible to look into the social, political or religious beliefs of
individuals unless there is some tie to criminal activity, and that if there is any question to
check the legality with Mr. McCauley.
helped write the Fusion Center Privacy Policy and is familiar with federal
and state laws/regulations related to privacy issues. Other CJD Fusion Center employees
receive training on the Privacy Policy, and Mr. McCauley provides training on the policy
and the laws at the DOJ conferences in March of each year. All employees do not go
every year, but do go at some point. The Privacy Policy was implemented, and all
employees should have a copy of it to ensure that they do not gather information illegally.
Examples of search terms that
would not run include the Elks, the
church or Occupy, unless there was a crime that had been committed or a terrorism
nexus for some impending bad action related to the terms. It would also be unacceptable
to use the search term Black Lives Matter unless looking up specific individuals
associated with the term that had committed a crime.
has seen the September 18, 2015 Fusion Center Threat Assessments
Procedure, but has not seen the July 31, 2015 Social Media Non-Covert Investigation
Policy. The department does not engage in gathering personal information, such as credit
card, telephone or cell phone usage, on individuals without a search warrant. It does not
conduct surveillance, does not review individuals online browser histories and does not
have the ability to look into individuals emails. Prior to gathering information on an
individual, some criminal predicate would need to existfor example, if there is a
request from a police department, a case number must be provided to ensure there is a
legitimate crime before Fusion Center employees start to gather information.

10

The HR department has conducted diversity training in the department within the last two
years. There has been no training on racial bias in the context of determining threats, and
no training on racial profiling issues, although
believes the Attorney
General wanted to have such training. They have received no training on cultural
competency or hidden biases.
4.

Research Analyst 3; employed since 12.1.1999 (interviewed on

December 15, 2015 and March 9, 2016)
was accompanied by her union representative, Mr. Ederer. She has been
assigned to the Fusion Center since July 2011.
attended the Digital
Stakeout training demonstration on September 29, 2015 and used a keyword search on
the Animal Liberation Front (ALF) in the Seattle area, as there was trouble with
protestors targeting the University of Washington.
stated that ALF is
recognized by the FBI as a criminal organization.
did not actively use
Digital Stakeout after attending the demonstration. However, she continued to receive
emails from Digital Stakeout that her search was too broad. She thought she had disabled
it around the end of October, although she learned later that it was still running. 14
learned that
had done the #blacklivesmatter search using
Digital Stakeout. At the time of her interview,
did not know whether she
had ever used that search term, but she later recalled that on September 10, 2015, she sent
a bulletin alert related to #blacklivesmatter to other law enforcement agencies. See
Ex. J.
does not think she would have known not to use the search term prior to
learning how the Attorney General feels about that. Because of the aftermath of
search,
would check with the attorney in the departments unit
(Mr. McCauley) prior to putting in any search term going forward. Most of
searches are related to matters such as school bomb threat in Salem,
Oregon. She would not search a term like #Muslim, because that is a reference to
religion, but she might search #extremists.
stated she was not currently
searching hashtags and did not know whether she ever would again.
She stated that she had not been given training on what would be an inappropriate social
media search term, but that Mr. McCauley talks with the employees fairly often about
civil rights and civil liberties.
stated that a couple of years ago
Mr. McCauley had provided an entire CJD training on privacy rights and individuals not
being subject to searches, and then a year ago he trained two newly hired analysts on
these issues while
sat in on the training.
understands that
individuals have a right to protest and cannot be reported for it, but that if they engage in
criminal acts while protesting, the criminal behavior can be the subject of a report.
14

Digital Stakeout allows a user to create an ongoing search that will continue even after
logging out of the system until the user disables the ongoing search.

11

Mr. McCauley told

he would have counseled
against
conducting the search if
had come to him first, and that he was
disappointed that it had happened.
is familiar with the TITAN Fusion Center Privacy Policy, but she tends to
go to Mr. McCauley if she has questions.
had not been aware of the
July 31, 2015 Social Media Non-Covert Investigation Policy until Mr. McIntosh had her
sign off on having received it two weeks prior to this interview, and the only copy of the
document she has seen was during the interview.
believes she received a
copy of the September 18, 2015 Fusion Center Procedure for Threat Assessments. She
previously had training on 28 CFR Part 23, most recently sometime in November 2015.
She is aware that it applies to social media searches and that it applies to both analysts
and investigators.
is not as familiar with the state equivalent, ORS
181.575, and believes she is more familiar with the Oregon Administrative Rules
(OARs) on the subject.
did not receive a verbal directive from Mr. McIntosh on or around
October 20, 2015, to discontinue using Digital Stakeout, and she first learned that the
employees were not to use it when she received his November 12, 2015 email.
has not received training on racial bias, diversity training (except at a
conference in 2006) or racial profiling.
5.

Special Agent assigned to CJD Fusion Center; employed since

2.8.2010 (interviewed on December 18, 2015 and March 9, 2016)
was accompanied by his union representative, Micah Persons, and attorney
for the Criminal Investigators Association (CIA), Becky Gallagher. Prior to being
assigned to the Fusion Center a year ago, he was assigned to the Internet Crimes Against
Children area. He is a police officer and previously worked for the Klamath Falls Police
Department.
Along with some of his coworkers, he attended the demonstration/training in September
2015 on the use of Digital Stakeout. The trainer showed them how to conduct a
geosearch, which allows the user to isolate a search to a specific geographic area.
During the training,
chose to use search terms related to outlaw motorcycle
gangs (OMGs) because there had been a recent criminal incident in Salem involving
one of these gangs. 15 After the training they were allowed to continue to use the program
on a trial basis.
also used the program to monitor social media threats at
the state capitol in Salem because there were protests and/or threats going on around that
timee.g., threats made to

15

One of

assigned job duties pertains to matters related to OMGs.

12

As part of his job, sometimes

would conduct searches as requested by his
supervisors or law enforcement agencies on specific matters such as threats at schools.
Other times, he would do searches without being requested if the search was based on
cases/investigations he had going on or based on whats hot in the news.
When
used Digital Stakeout to conduct the search, he stated the reason he
used that term was because he learned through the news and flyers from other agencies
that:
There were a lot of protests and law enforcement assaults that were going on
throughout the country and the hashtag itself was being used by many different
persons that were organizing riots and looting and threats against law
enforcement and just social disobedience in general.[16]
also stated that he had been advised by Portland (my presumption is that
was referring to the Portland Police Bureau) of protests taking place where
bridges and roads were blocked, and that although he had not been given any indication
of a threat to public safety or the police, anytime theres a riot or any kind of social
disobedience theres always an underlying threat to law enforcement and the public.
combined the search terms #blacklivesmatter and #fuckthepolice and input
them to Digital Stakeout on September 30, 2015 and that there were many results. He
focused his search on Salem, Oregon, and many images, names and Twitter and
Facebook accounts showed up in the results.
looked at the images that
appeared and said that one of the images included a police officer in crosshairs with a
caption consider yourselves warned.
was adamant that the image in the
crosshairs was definitely a police officer because the person had a typical policeman hat
and stance and because the hat is not a normal hat that somebody wears. Thats
definitely a law enforcement hat. 17
16

A search of
computer revealed memos from two other states referencing
threats associated with #blacklivesmatter and #fy911 for activity reportedly to take place on
September 11, 2015, which was almost three weeks prior to
September 30, 2015
Digital Stakeout search on these terms.
17

(and many others) made this assumption. I recognized the image as the
logo for the hip hop group Public Enemy and the silhouette in the image as an individual wearing
a hat that was popular urban fashion in the rap music industry. Note that Mr. Tweedt also
recognized the logo after Mr. Kirby described it in an email. See October 8, 2015 email string
attached as Ex. G. Public Enemy member and creator of the logo Chuck D has explained, The
crosshairs logo symbolized the black man in America . A lot of people thought it was a state
trooper because of the hat, but the hat is one of the ones that Run-DMC wore. The B-Boy stance
and the silhouette was more like the black man on the target. Kory Grow, Public Enemy Reveal
Origins of Name, Crosshairs Logo, Rolling Stone, Aug. 18 2014,
http://www.rollingstone.com/music/news/public-enemy-reveal-origins-of-name-crosshairs-logo20140818. See also Ex. K.
13

He interpreted what he saw to be a threat toward law enforcement, so he clicked on the

image, and then found an assortment of other pictures that he considered threats toward
law enforcement. When he looked at the name associated with these images, he thought
it was Mr. Johnson, the Director of Civil Rights who worked in the building, and he
could not imagine him posting all this hate stuff and especially anti-law enforcement
stuff since he worked with us. He showed the posts, which included Mr. Johnsons
photograph, to
who confirmed it was Mr. Johnson.
and
encouraged
to show the results to Mr. Kirby.
stated that other images on Mr. Johnsons Twitter page depicted cartoons
showing law enforcement to be complete jerks; that a political cartoon showing white
police officers shooting at a statue of Martin Luther King makes it appear that law
enforcement hate everything that Martin Luther King stood for; and that his posts were
making all white people appear to be racist.
thinks that anyone who
came across Mr. Johnsons name in a search would hold the same opinion. He felt that
Mr. Johnsons posts showed a lot of hate.
was also disturbed by
Mr. Johnsons August 24 post, which depicts what
thinks is an image of rap
group N.W.A.s album cover that he remembers seeing when he was approximately 16
years old. He described the image as showing a beat up and bloodied police officer being
held in a headlock while the city burns in the background, with the caption, Three
Cheers for Gentrification. 18
does not recall seeing any references to #fuckthepolice in Mr. Johnsons
posts, but could not say because that search term was mixed together with the search term
he had also entered, and he never did a review of Mr. Johnsons postings to see whether
there was a separate reference to #fuckthepolice.
A day or two passed and then the Umpqua Community College shooting happened (on
October 1, 2015). Mr. Kirby came by
office, and
still had
Mr. Johnsons posts up on his computer and showed the crosshairs image to Mr. Kirby,
who told him to write a memo that would be provided to management.
prepared the memo dated October 1, 2015, attached here as Ex F. He heard nothing
further about the memo for a couple of weeks and was then placed on administrative
leave on November 10, 2015.
18

I am unaware of any such N.W.A. album cover. The image is actually a photograph of
a painting that hangs in the Know bar on Alberta Street in Portland, Oregon. The neighborhood
where the Know is located is widely recognized as a gentrified neighborhood, and the bar is a
punk/rock bar. It appears that rather than a post meant to celebrate violence directed at police
officers, Mr. Johnsons caption, Three Cheers for Gentrification, may have been intended as an
ironic comment about the content of the art work hanging in a punk bar located in a gentrified
Portland neighborhood.
comments about this post, the crosshairs post and other
of Mr. Johnsons posts demonstrates a possible lack of cultural awareness that may have affected
his perception and led him to experience a heightened sense of concern.

14

has seen the Fusion Center Policy Regarding First Amended Protected
Events and had read it twice when he started working in the Fusion Center, but he has not
had any training on it. He has not seen the Fusion Center Privacy Policy or the Social
Media Non-Covert Investigation Policy. Regarding Oregon and federal statutes and
regulations that apply to the gathering and maintenance of information on individuals,
is familiar with 28 CFR, but had not heard of ORS 181.575 until he read
about the news story surrounding the subject matter of this investigation in the Willamette
Week. He has had 28 CFR training on several occasions, most recently in October 2014.
believes the search complied with 28 CFR because he felt he was not
collecting or maintaining information, merely searching for it using open source terms
that anyone could use.
does not believe any search terms are off limits
because you can search for anything you want, but if you start to collect it and maintain
it then you have to have a reason. 19
19

While there has been some suggestion that the search itself did not constitute
collection or maintaining of information, this does not change the fact that the Fusion Center
employees (including
) are bound by the Fusion Center Privacy Policy, which
specifically states, in part below, that the Fusion Center will seek or retain information as
follows:
4.1 Information That May Be Sought or Retained
1. The Oregon TITAN Fusion Center will seek or retain information only under the
following circumstances:
*
*
*
c. The information is based on a possible threat to public safety or the
enforcement of the criminal law; or
d. Where there is reasonable suspicion that a specific individual or organization
has committed a criminal offense or is involved in or is planning criminal
(including terrorist) conduct or activity that presents a threat to any individual,
the community, or the nation, and the information is relevant to the criminal
(including terrorist) conduct or activity; or
e. The information is relevant to the investigation and prosecution of suspected
criminal (including terrorist) incidents; the resulting justice system response;
the enforcement of sanctions, orders, or sentences; or the prevention of crime,
or
*
*
*
3. The Oregon TITAN Fusion Center will not seek or retain information about an
individual or organization solely on the basis of their religious, political, racial, or
social views or activities; their participation in a particular non-criminal organization
or lawful event; or their race, ethnicity, citizenship, place of origin, age, disability,
gender, or sexual orientation.
*
*
*
5. The information is subject to ORS 181.575, ORS 192.410-192.505, OAR 137-0900000, et seq., 28 CFR Part 23, the United States Constitution and the Oregon
Constitution restricting access, use or disclosure.
(continued . . .)
15

stated he has had training regarding racial bias through law diversity
classes and the military, as well as when he was with the Klamath Falls Police
Department. In mid-September 2005, he had such training through DOJs HR
department. He has received no anti-racial profiling training, and although he recalls
receiving some kind of information in class regarding recognizing what would be
considered racial profiling, he does not recall the class, any specifics about it or how long
ago he took the class. He received some cultural competency training when he was in the
military and with the police department, but he has not had any such training since
coming to the DOJ. He has not had any training on implicit or hidden bias.
does not believe the search was inappropriate because it was a hot topic at
the time that was causing riots and people getting injured and killed and public
destruction. He felt the search was no different from a search on OMGs or Volksfront,
because #blacklivesmatter is simply a hashtag used by a wide assortment of people to do
a wide assortment of things, one of which is to promote violence. 20
During the December 18, 2015 interview,
stated he had never been told to
stop using Digital Stakeout, and that he continued using the program until he was placed
on administrative leave on November 10, 2015. However, during the follow-up March 9,
2016 interview,
stated that he had been directed to stop using the program
by Mr. McIntosh shortly after he generated his October 1, 2015 memo, and that he had
actually stopped using it even before Mr. McIntoshs instruction.
did not
explain his earlier contradictory statements. 21

(. . . continued)
Oregon TITAN Fusion Center Privacy Policy, at 3-4 (italics added).
20

It is concerning that
sees no distinction in this regard between
Volksfront, a group founded on the premise of white supremacy and a reported goal to
repatriate minorites; OMGs, which are known to engage in drug trafficking, crime rings, theft,
gang violence, etc.; and #blacklivesmatter, which is a self-described, online forum intended to
build connections between Black people and our allies to fight anti-Black racism, to spark
dialogue among Black people, and to facilitate the types of connections necessary to encourage
social action and engagement. See http://blacklivesmatter.com/about/.
21

Note that in the time period between

initial December 18, 2015
interview and his March 9, 2016 follow up interview, this investigator learned from the Attorney
Generals office that there was concern that the Attorney Generals October 20, 2015 directive to
immediately discontinue use of SMMS programs was not immediately communicated to and/or
followed by employees. I therefore questioned some employees on when and whether they were
verbally notified of the directive any time prior to having received Mr. McIntoshs November 12,
2015 email. I do not know whether anyone told
prior to his follow up interview
that the timing of the implementing the directive and when the employees stopped using SMMS
programs had become an issue in the investigation.
admitted he had the chance to
(continued . . .)
16

does not have the ability to monitor a persons emails or cell phone usage
without a court order, and the investigators do not conduct surveillance on individuals
unless there is an active investigation.
makes a distinction between a
person making social, political or religious commentary and a person being a potential
threat, noting that once the individual starts threatening, implying threats or supporting
violence toward specific groups, then thats when we need to start paying attention.
considered the crosshairs image he observed in Mr. Johnsons posts to be
such a threat.
stated that he did not engage in any targeted investigation of Mr. Johnson
and that he encountered Mr. Johnsons social media page by happenstance using hashtags
associated with both violent and peaceful behavior.
6.

Special Agent assigned to CJD Internet Crimes Against Children

Task Force; employed since 9.10.2009 (interviewed on December 18, 2015 and March 9,
2016)
was accompanied by his union representative, Mr. Persons, and CIA
attorney, Ms. Gallagher.
is a Special Agent assigned to the Internet Crimes
Against Children (ICAC) Task Force.
During the time Digital Stakeout was available to the department, he attempted to use it
to view social networking activity of particular individuals he was investigating as part of
his ICAC assignment, but was unsuccessful in obtaining useful information. He was
notified to discontinue use of Digital Stakeout and any other such monitoring software,
but does not recall when or by whom.
When
conducts internet research, he uses keyword searches focusing on
pedophiles and search terms known to be used by people engaged in that type of criminal
conduct. He cannot access emails of individuals he is investigating unless the individual
gives consent or unless he obtains a search warrant or subpoena. He has heard of 28 CFR
23 and is aware that law enforcement agencies cannot collect or maintain information
about the political, religious or social views of an individual unless it directly relates to an
investigation of criminal activities, but he does not give much thought to the statute
because the information he gathers is always in the context of a criminal investigation.
Although he does not recall having received training on 28 CFR 23 or on ORS
181.575, he may have at some point in his career, but it is not a part of any training
regimen that exists at DOJ.

(. . . continued)
review the transcript from his initial interview prior to his follow up interview, so his
unexplained contradiction undermines his credibility.

17

Regarding
search that led to this investigation,
understanding is that there was no search or profiling of Mr. Johnson, but that there was a
search for #blacklivesmatter and for white supremacist groups and OMGs in conjunction
with phrases that represent hostility or threats to law enforcement. He understands there
was no particular criminal case number open investigating a particular act or person, but
that conducting a search regarding threats to police could be perceived to be an
investigation of a criminal act. He has seen on the news and social media posts that
individuals who have claimed association with the Black Lives Matter movement have
made threats against the police.
assisted in conducting research into the October 2015 Umpqua
Community College shooting and on that day looked for any connection with the Black
Lives Matter movement after seeing speculation in an internet thread that the shooter was
associated with the movement.
is not assigned to the Fusion Center, and is unfamiliar with the Fusion
Center Privacy Policy, Procedure for Threat Assessments or Policy Regarding First
Amended Protected Events. He has seen the Social Media Non-Covert Investigation
Policy and believes it applies to him.
has received basic HR harassment training and thinks racial bias training is
included with that. He has not received any training on racial profiling or hidden or
implicit biases, but thinks he has had diversity training sometime within the last six years.
7. David KirbySpecial Agent in Charge; employed since 9.29.2014 (interviewed on
December 30, 2015)
Mr. Kirby was accompanied during the interview by his attorney, Daniel Thennell.
Mr. Kirby is a police officer and his job title is Special Agent in Charge at the Criminal
Division of the DOJ. In early 2015, Chief Counsel Tweedt asked Mr. Kirby to research
different options for testing social media monitoring software programs the department
might purchase as a tool to assist in investigations of criminal matters. Digital Stakeout
was one such tool they considered, and some of the CJD employees, including
, participated in a training/demonstration of the product on September 29, 2015.
On September 30, Mr. Kirby stopped by
office and saw
and
in there.
told them he had used Digital Stakeout to conduct a
keyword search on the terms #blacklivesmatter and #fuckthepolice, isolated the search to
Salem, Oregon, and found Mr. Johnsons Twitter feed containing posts
considered troubling.
Based on this, Mr. Kirby reported the matter to Mr. Tweedt who checked with Fred Boss,
and a decision was made that
should prepare a memo about his search and
his findings. Upon receiving the instruction to do so,
prepared the memo
dated October 1, 2015.

18

Mr. Kirby reviewed the memo, which had Mr. Johnsons Twitter posts attached, and was
concerned because his perception at the time was that the image in one of the posts was
the silhouette of a police officer in crosshairs. He has since done his own google research
on the image, learned that the image was rap group Public Enemys logo and learned that
the image was not a police officer, but a hip-hop person in a hip-hop pose, with a hat
that was worn by a member of another rap group.
At the time
showed Mr. Kirby Mr. Johnsons tweets, Mr. Kirby did not
think delving into Mr. Johnsons personal postings was problematic because the search
conducted was on open source information, although it may have not been
appropriate for
to use the search terms he used.
Mr. Kirby thinks that with education and training, he and other police officers within the
unit may have had a different perception on what the concerning crosshairs image really
was. Mr. Kirby would not have conducted the search
conducted because
he was not concerned with any activity going on with Black Lives Matter, and he tries to
make good decisions about things he does or does not do. He recognizes that Black
Lives Matter is a movement and that many people with nefarious agendas that have
nothing to do with the movement will join and commit criminal activity, such as what
happened with the Occupy movement. There are many search terms, such as protected
class terms based on race, religion, etc., that would be off limits to Mr. Kirby and his
employees.
Mr. Kirby is part of the management team and is in charge of assigning tasks to the
investigators and analysts.
assignments include monitoring sovereign
citizens, OMGs, individuals making threats on the Attorney General and actual criminal
cases.
assignments did not include monitoring or gathering information on
threats to police, but if information from another agency regarding threats to the police
came in, he would review it and make sure the proper people were aware. Mr. McCauley
would then review the information and determine whether it conformed with the law (i.e.,
28 CFR and other laws regarding privacy rights) before approving it for further
dissemination.
Mr. Kirby can envision as situation in which it would be appropriate for an employee to
conduct a search based on a bulletin received from another law enforcement agency, even
if there was no ongoing criminal investigationfor example, if they received a bulletin
describing a sovereign citizen who threatened to kill a sheriff.
On October 20, 2015, while Mr. Kirby was in Canada conducting active shooter training,
he learned during a phone call with Mr. Tweedt and others on the management team that
the Attorney General had ordered that the department was to stop using the social media
monitoring software. Mr. Kirby understands that Mr. McIntosh then went around the
office that day and told the individuals who had been using the software to discontinue
doing so. He understands Mr. McIntosh then sent an email on November 12, 2015 with
the directive to stop using social media monitoring software.

19

DOJ analysts and investigators cannot without a search warrant or subpoena obtain or
view emails, credit card use, banking and financial information, land or cell phone
information, etc. of a private citizen.
Mr. Kirby does not recall whether he has received training on 28 CFR or the state
equivalent ORS 181.575, but understands the common sense parameters that you may
not target protected classifications. Mr. Kirby is familiar with the Fusion Center Privacy
Policy and the Fusion Center Procedure for Threat Assessments. He does not recall the
Fusion Centers Policy Regarding First Amendment Protected Events and has not seen
the Social Media Non-Covert Investigation Policy.
Since he has been with the DOJ, Mr. Kirby has not received any training on racial bias in
the context of doing his work, but he has in the past as a police officer and has received a
lot of diversity training during his career. He has not received training per se regarding
racial profiling, but has received training on awareness of it, as well as cultural
competency and hidden or implicit bias training, when he was working as an officer for
Clackamas County.
Mr. Kirby has been in touch with a trainer to provide diversity training for the department
that includes a profiling component, and is waiting for approval to proceed with the
training.
8. Darin TweedtDOJ Chief Counsel 22; employed since 2.26.2007 (interviewed on
December 30, 2015)
Mr. Tweedt was accompanied by his attorney, Judy Snyder.
The Oregon TITAN Fusion Center Privacy Policy; Social Media Non-Covert
Investigation Policy 3-101.5 dated July 31, 2015; and the Fusion Center Procedure for
Threat Assessments dated September 18, 2015 apply to all Fusion Center employees.
About a year ago, Mr. Tweedt recognized that there was an intelligence gap in the Fusion
Center and HIDTA. To address this, he directed Mr. McIntosh and
to
evaluate social media monitoring software that would allow the user to collect public
social media postings with the ability to limit the search to specific terms and geographic
areas. This type of program is commonly used by other Fusion Centers around the
country, but the Oregon Fusion Center had not yet utilized this type of program. This is
how the Digital Stakeout platform came to be tested by certain CJD employees. Some
employees also tried out X1 Social Discovery, which has a similar use.
In the Fusion Center and HIDTA, the way an analyst typically gets assigned to a case is
when there has been a request for assistance from some other law enforcement agency
22

At the time I interviewed him, Mr. Tweedt was DOJ Chief Counsel. I understand that
his position has since changed and he now serves as a DOJ Assistant Attorney General.

20

e.g., a police officer from some jurisdiction requesting information on a specific person.
The Fusion Center would verify that there was an actual ongoing criminal investigation
before agreeing to pull together information for the requestor.
There was no criminal investigation going on with respect to the Digital Stakeout search
conducted; rather it was the testing of a computer program. The Fusion
Center Privacy Policy, on page 7 at paragraph 4, is instructive in listing the applicable
prohibitions (on gathering information). At the time the policy was drafted in 2012, the
department was not using social media or social media monitoring tools to the extent they
are being used now, but the policy still applies to these more modern standard
investigation tools. Mr. Tweedt understands from Mr. McCauley that shortly before
conducted the search,
attended an annual training by Mr.
McCauley that addressed this policy and issues around protected speech.
The employees in the department are trained on compliance with 28 CFR and its Oregon
equivalent, ORS 181.575, 23 and the Fusion Centers Privacy Policy is drafted to comply
with both. The way an employee would be able to extrapolate from the policy to apply it
to social media searches is through training and consultation -- specifically, consultation
with Mr. McCauley, whose office is located within the Criminal Intelligence Unit so as to
be accessible on a day-to-day basis as a resource to employees to ensure their actions are
compliant.
Since becoming Chief Counsel, Mr. Tweedt has been concerned about the Fusion Center
and therefore directed his senior level management to begin a complete review of Fusion
Center policies. 24 They have since been meeting regularly to review the OARs governing
the unit, and have developed draft revised policies that are awaiting review. Mr. Tweedt
considers the existing OARs to be out of date. During the process of creating the draft
policies, the policy work group has considered many issues that may have addressed the
incident involving
. Mr. Tweedt has been asked by the Attorney Generals
office to hold off on further implementation of the revised policies until the matter
involving
is resolved.

23

Mr. Tweedt explained that there is a question of whether ORS 181.575 applies to the
DOJ based on the wording of 181.575 and the definitions it references in ORS 181.010, but
that he believes the Attorney General would certainly determine it applies to the DOJ and to
certified law enforcement officers like
24

One of Mr. Tweedts concerns regarding the Fusion Center was that it was operating in
an outdated manner with few written policies that were poorly communicated and were
insufficient to address relevant issues. There was also a concern as to what information the
Fusion Center should be disseminating as bulletinsfor example, in the past, the Fusion Center
was prepared to report on groups that were assembling in protest even when there was no report
of criminal nexus or public safety concern.

21

Conducting a search to gather information on #blacklivesmatter based on information

heard in the news may be appropriate even in the absence of a criminal
investigation. Whether it was appropriate would depend on many factors, such as
understanding whether the hashtag is one anyone posts to or whether it is identified to a
particular recognized group. Common sense should be used, and when common sense
fails, departmental policies provide bedrock guidance and Mr. McCauley as the legal
advisor should also be consulted.
Mr. Tweedt learned that
found social media postings by Mr. Johnson that
contained possible threats to law enforcement from Mr. Kirby. Mr. Kirby described one
particular post to him as the silhouette of a law enforcement officer in the crosshairs of a
gun with the caption you are warned. Mr. Tweedt immediately contacted Mr. Boss,
Deputy Attorney General, explained the situation and recommended that they have
write a report for review by the Attorney Generals office.
Mr. Tweedt saw the report (memo) on October 12, 2015 upon his return from out of state.
Once he saw
October 1, 2015 memo, and reviewed the search terms that
had been used (i.e., #blacklivesmatter and #fuckthepolice), he became very concerned
because of the possibility that ORS 181.575 had been violated, and also because he has
worked very hard to prevent any perception that the CJD is engaging in investigating or
collecting data on peoples exercise of their constitutional rights. He felt that the images
were to a certain degree not as [previously] advertised to him, and the concerns he had
about the potential threat to police officers prior to reviewing the memo were much
diminished. He still had a concern that negative postings about the police could reflect
very poorly on the Attorney General. After reviewing the memo, he passed it on to
Mr. Boss on October 13, 2015.
On October 20, 2015, Mr. Tweedt was summoned to meet with Attorney General
Rosenblum and Mr. Boss. The Attorney General was very angry about the memo, as she
believed
had engaged in racial profiling. The Attorney General ordered
Mr. Tweedt to find anti-racial profiling training for the Special Agents in the division.
On November 10, 2015, Mr. Boss notified Mr. Tweedt that there was going to be an HR
investigation of
and that he was to be put on administrative leave effective
that day.
Mr. Tweedt is not certain that conducting a search by itself constitutes collecting or
gathering information. The collecting of information by
in this
instance was directed by the Deputy Attorney General (by virtue of having directed
to prepare the memo). There is little guidance for agencies on this issue,
and reasonable people could differ on whether running a search without saving the data
constitutes collection.
Mr. Tweedt believes that some of Mr. Johnsons posts may be construed as threatening to
law enforcement officers when taken out of context by people who do not know
Mr. Johnson, but Mr. Tweedt knows him and does not find the posts to be threatening.

22

9.

Research Analyst 4; employed with DOJ for the last 10 years

(interviewed on January 7, 2016 and March 16, 2016)
was accompanied by her union representative, Mr. Ederer. She is supervised
by Mr. McIntosh and assigned to the HIDTA of the CJD, which is co-located with the
Fusion Center.
did not receive the demonstration/training for Digital Stakeout, but was
aware the Fusion Center was testing the program. Within a day or so after the training,
she asked
to show her how to use it because she did not have access.
stated that during that timeframe, there was a lot of nationwide social media
buzz about the Black Lives Matter movement and threats against the police and police
officers being murdered by people using that hashtag.
stated that
told her he was going to see if we had any of those violent type people in
our area that could be of concernnot specifically targeting supporters that are using
that, but looking for any viable threats to law enforcement. She said that
input the search terms #blacklivesmatter and #fuckthepolice because those two were
being used pretty regularly withsome that were calling for the massacre of police
officers and white people. The search results showed Mr. Johnsons posts. 25
felt the posts were very derogatory toward law enforcement, and they
included an image of a silhouette of a police officer in crosshairs. She never heard that
the silhouette was not a police officer and stated thats exactly what it looked like. All
the other posts were showing police officers being threatening, incompetent or targeting
black people.
asked Mr. McCauley to look at the posts as they (she and
)
were concerned with the crosshairs image because it included the language, youve been
warned.
was concerned because there were police officers in the building
and it appeared to her that this constituted a threat to police. Mr. McCauley agreed that
management should be notified because
explained to him that the purpose of
searching those hashtags was because they were being used across the country for threats
against law enforcement and white people on a regular basis, with people calling for the
massacre of police officers. She based this on what she said were social media posts
regarding people using the hashtag, including news articles of a black lady making
threatsand they actually arrested her.
said that the hashtag had been
utilized repeatedly with the ambush and murder of police officers, and that she is not
aware of any other hashtags that she has seen recently that are consistent with threats to
the police.
husband is a police officer and
had previously
been a police officer.
acknowledged that there were many people that have
also used the #blacklivesmatter in noncriminal, nonthreatening ways.

25

Note that none of Mr. Johnsons tweets that were attached to

2015 memo contained any reference to fuck the police.

23

October 1,

stated that along with herself and

, Mr. McCauley,
and Mr. Kirby came into
office and looked at Mr. Johnsons
posts that were up on
computer screen, and that no one expressed concern
that the search was inappropriate.
is aware that
was asked to
write up an explanation of the search that was to be given to Chief Counsel Tweedt.
is not aware of anyone besides Mr. Johnson whose social media account had
been reviewed using Digital Stakeout.
As a Research Analyst,
role is to support law enforcement with its cases,
specifically drug cases. She receives her case assignments when a law enforcement
agency calls and requests assistance, but she does not take it upon herself to conduct
unrequested research not related to a case. As part of her research, she checks publicly
available social media sites such as Facebook. There is always a particular target to the
investigation where there has been criminal activity. In conducting her research, she
distinguishes between individuals making a threat and individuals making social, political
or religious commentary based on how a reasonable person would view it.
is familiar with and has received training on 28 CFR and feels it applies to
all the work she does. She also knows that ORS 181.575 applies to her work, given that
these laws and related regulations and administrative rules are all listed in the
departments Privacy Policy. She believes these laws and rules applied to the search and
review of Mr. Johnsons twitter posts.
has received training on how to
eliminate personal opinion biases in writing, and that training has touched on ethnic,
national origin, religious and other biases. She has not received anti-racial profiling,
cultural competency or hidden bias training, but believes she has received some diversity
training within the last couple of years.
is familiar with departments Social Media Non-Covert Investigation Policy.
She has not received the Fusion Center Policy Regarding First Amendment Protected
Events because she does not work for the Fusion Center. She is aware of the Fusion
Center Privacy Policy because it has been made applicable to the entire Criminal
Intelligence Center.
10. Steven McIntoshAssistant Special Agent in Charge of CJD; employed with DOJ for
six years (interviewed on January 7, 2016)
Mr. McIntosh was unaccompanied by any representative during his interview.
Mr. McIntosh is in charge of the Criminal Intelligence Unit and the ICAC Task Force.
Digital Stakeout is a social media monitoring tool that collects publicly accessible
information from social media sites, and is used by most Fusion Centers and by other
agencies within Oregon. It was being tested in the Fusion Center by
,
,
,
and
. Mr. McIntosh instructed them
to test it out while doing their case work and give him their thoughts on it. The work
done by the employees under his supervision includes assisting other law enforcement
agencies by conducting analytical work on criminal investigations, conducting internal
24

investigations and assisting in requests for threat assessments. Mr. McIntosh has a
document he refers to as the Fusion Center Roles and Responsibilities that specifies the
tasks and priorities assigned to each of his subordinates.
For any Criminal Intelligence Unit employee to conduct a search for any reason, a
reasonable suspicion of a crime must exist, as the employee would not simply do a search
on an individual or entity if there is no criminal predicate. This is mandated by the
various federal and state data collection laws. Mr. McIntosh does not know whether
had a reasonable suspicion when he conducted the search and has not delved
any further into it because he was aware this investigation was taking place.
Around September 10, 2015, the Fusion Center issued a report in its weekly bulletin
advising that members of #blacklivesmatter and #fy911 social media users were calling
for the murder of police officers on a site called Blog Talk Radio. Mr. McIntosh believes
this would represent reasonable suspicion of a crime sufficient to warrant a search being
done by one of his investigators. The timeframe that the reasonable suspicion would be
limited to would be right around September 11, but he cannot give me an exact
timeframe. If the report they received included information stating an event was going
to happen yesterday, they would not go any further because the danger would have
ended before they were alerted of the problem. The September 10, 2015 Fusion Center
report stated that the Fusion Center was not aware of any specific threat directed to
Oregon law enforcement, but recommended extreme caution to be exercised over the
weekend of September 11.
Mr. McIntosh is not aware of any individual besides Mr. Johnson whose social media
activity was viewed in this way, and has heard of no employee other than
who conducted a search that turned up information on individuals that were not related to
a crime. He is unaware of any individuals within the CJD who have done searches that
were inappropriate or illegal.
The September 18, 2015 Fusion Center Procedure on Threat Assessments was written
and implemented by Mr. McIntosh because the Fusion Center was not keeping good
statistics on the threat assessments it was conducting. He disseminated this procedure to
employees via email. The Fusion Centers Social Media Non-Covert Investigation Policy
was disseminated in July 2015it describes how social media can be used and applies to
the types of investigations conducted by the CJD. This policy requires written supervisor
authorization in order to conduct passive viewing of websites. In October or November,
2015, after the incident involving
came to light, Mr. McIntosh sent such
authorizations to the analysts.
The Fusion Center Privacy Policy was in effect prior to Mr. McIntoshs arrival, and it is
in the process of being changed. Mr. McIntosh is also implementing training on the
Privacy Policy to be conducted every February.

25

Mr. McIntosh verbally informed Fusion Center employees to stop using social media
monitoring software (including Digital Stakeout) at the end of October and again via
email several weeks later.
Mr. McIntosh does not know whether the employees have received any training on racial
bias in the context of determining whether and when to gather information. The
department received diversity training several years ago. He is not aware of any training
the employees received on cultural competency or implicit or hidden bias.
11. Matt McCauleyAssistant Attorney General; employed with DOJ for 13 years
(interviewed on December 15, 2015)
Mr. McCauley was accompanied by the attorney for the Oregon Association of Justice
Attorneys, Jennifer Chapman. Mr. McCauley is assigned to the CJD Criminal
Intelligence Center, and half of his assignment involves acting as the legal advisor to the
Criminal Intelligence Unit. The Criminal Intelligence Center regularly receives
information bulletins from other agencies or jurisdictions and disseminates information to
other agencies. Mr. McCauley reviews the information they collect, share, disseminate,
store and discard for legal compliance with the OARs, 28 CFR and the Fusion Center
Privacy Policy.
Approximately once a year or whenever requested by the Fusion Center, Mr. McCauley
also provides training on 28 CFR 23, ORS 181.575 and the Fusion Center Privacy
Policy (which Mr. McCauley describes collectively as having slightly different wording
of all the same concepts). He gave his last overview on the relevant privacy laws at a law
enforcement conference in Bend, Oregon in March of 2015. See email and attached
training materials, attached as Ex. L. This conference was attended by
Mr. McCauley regularly instructs the CJD Criminal Intelligence Center employees to
come to him whenever they encounter red flags in the course of gathering
informationi.e., any information that affects the protected class for which there may be
a question on whether there is reasonable suspicion of a crime. For example, if a bulletin
came in from another states Fusion Center and the employee sees a red flag issue, the
employee will come to Mr. McCauley and Mr. McCauley will ask targeted questions to
determine whether the information complies with the law and the departments rules.
Mr. McCauley recalls that the Fusion Center in the past received requests for information
from other agencies related to Black Lives Matter, but that the Fusion Center did not
issue any reports specific to Black Lives Matter because there was no probable cause in
Oregon of anybody associated with the movement committing a crime. Mr. McCauley
acknowledged that there was a report issued from the Fusion Center on around
September 10, 2015 advising that members of #blacklivesmatter and #fy911 social
media users were calling for the murder of police officers on a site called Blog Talk
Radio. The report noted that the Fusion Center was not aware of any specific threat
directed to Oregon law enforcement, but recommended extreme caution to be exercised
over the weekend of September 11. Mr. McCauley was in court and unavailable when
26

the decision to issue this memo was made, and the memo was approved by
due to the unavailability of Mssrs. McCauley and McIntosh. If Mr. McCauley
had been available, they would have had a hard discussion about whether to publish it.
did not come to Mr. McCauley to engage in any discussion prior to running
showed Mr. McCauley the search results that were displayed on
computer, specifically an image that Mr. McCauley described as a
silhouette of a police officers head in crosshairs with the caption, you are warned and
an image Mr. McCauley described as a photo of a painting of several young men beating
up a cop.
told Mr. McCauley that he had been experimenting or playing
around with (the Digital Stakeout) software, and that he had run the search. This caused
Mr. McCauley serious concerns because Black Lives Matter is obviously a political
movement, and this raised a red flag of the type Mr. McCauley has had numerous
discussions with
in the past in the context of discussing OMGs.
his search.

If
had come to Mr. McCauley before conducting the search, as he has in
past situations, Mr. McCauley would have put the issue through the process he uses when
a red flag is involved. Mr. McCauley stated that the department does not move forward
unless there exists an articulated reasonable suspicion. The reason it has the rules in
place today is because of how Hoover and the FBI handled Martin Luther King and other
civil rights groups back in the 1950s, 1960s and 1970s. Mr. McCauleys job includes
doing a balancing act between public safety and civil liberties. If a political movement
such as Occupy is protesting, and the protests are infiltrated by anarchists, this would
not be reported as crimes committed by Occupy simply because a criminal group of
anarchists utilized the protest to commit crimes under their own agenda.
If
was conducting the search because he believed Black Lives Matter
presented a threat to police, he would need to show Mr. McCauley the probable
causethe reasonable suspicion of criminal behavior. Reasonable suspicion is based
on the officers knowledge of all the events, training and experience, so in order to
determine whether it existed with respect to
search, there would have been
a discussion among
, Mr. McIntosh, Mr. McCauley and others, with
Mr. McIntosh making the final call if
had come to Mr. McCauley prior to
conducting the search.
Mr. McCauleys advice to
would have been to run other hashtags unrelated
to #blacklivesmatter if the purpose was to get at threats to the police, given that there are
other hashtags that are more pointedly violent, and there would be no need to use a
hashtag related to the Black Lives Matter movement. Mr. McCauley thinks that in order
for
actions to constitute collecting/gathering information, he would have
had to have somehow stored it. Mr. McCauleys understanding is that
was
told to make a copy of the search results by management.
Mr. McCauley is unaware of whether the CJD has provided training to its employees on
racial bias or anti-racial profiling. Mr. McCauley has helped Mr. Kirby draft an antiprofiling policy that will be modified and applied to the entire CJD. Mr. McCauley and
27

Mr. McIntosh are planning to conduct annual training for every employee in the Criminal
Intelligence Unit on all the policies, including the racial profiling policies that are being
developed. Mr. McIntosh has drafted a policy regarding the use of social media tools
within the Criminal Intelligence Center, and the goal was to have this policy disseminated
by January 1, 2016.

V.

Conclusions and Recommendations

Based on my investigation to date, I do not believe there is widespread behavior/actions

by CJD Intelligence Unit employees like that engaged in by
regarding his search of
#blacklivesmatter postings. It appears to have been an isolated incident prompted by the testing
of the software Digital Stakeout, and I do not believe that a further department-wide internal
audit into employees searching for information on individuals or groups is necessary.
The Intelligence Unit employees have varying levels of understanding whether 28 CFR
23 applies to the CJD investigators/analysts, although most seem to accept that it does. The
employees also have varying levels of knowledge/awareness of ORS 181.575 (now recodified
as ORS 181A.250). Despite the fact there has been training given as recently as March 2015
on the applicability of these statutes to the employees, not all have attended or recollect the
training.
Some employees questioned whether 28 CFR 23 and ORS 181.575 apply to the CJD
investigators/analysts in conducting open source internet searches and whether such a search
alone constitutes collecting or maintaining data if the search is not saved or printed out.
Assuming arguendo that the statutes do not apply to a simple Google search, for example, I think
the argument fails when applied to a SMMS program like Digital Stakeout. The very nature and
presumably the most beneficial use of Digital Stakeout is that it searches various social media
sites and gathers or collects the data into a single onscreen location/format that can then be
accessed by the user of the product. Information, such as screen name, hashtags, mentions, urls,
generator and content type are automatically extracted and stored as [searchable] fields 26 on the
users computer screen.
In any event, the CJD privacy/first amendment policies are sufficiently clear to suggest that
such a search is not acceptable unless based upon a possible public safety threat or reasonable
suspicion that an individual or organization has committed or is planning to commit a crime.
search using the search term #blacklivesmatter (even combined with
#fuckthepolice) was not in compliance with the statutes, regulations and departmental rules
applicable to the CJD employees.
stated that, [d]ue to increased threats toward
law enforcement, I used a hashtag search for, fuckthepolice, and blacklivesmatter, which are
keywords and hashtags known for posting threats towards law enforcement. However,
search was not tied to a criminal investigation and there were no reasonable grounds
to believe there was an existing threat in the Salem area at the time he conducted his search.
26

See http://www.digitalstakeout.com/threat-intelligence-platform (italics added).

28

may assert that along with news media reports from other parts of the
country, he relied on bulletins received from other law enforcement agencies that alerted CJD
employees of threats associated with #blacklivesmatter. I obtained copies of such bulletins
from a search of
computer. The bulletins I reviewed came from two intelligence
agencies outside the state of Oregon within the week leading up to September 11, 2015. These
bulletins addressed perceived threats of protests and violence to take place specifically targeted
to September 11, 2015 that were alleged to have been made on a site called blog radio. The
bulletins asserted that these threats were associated with the terms #blacklivesmatter and
#fy911, among others. 27 I did not find any post-September 11, 2015 bulletins that contained
such warnings.
did not conduct his search until September 30, 2015, almost three weeks
after the September 11 target date. Further, according to Mr. McCauley,
told him
he was just playing around with the software to see what it could do, as opposed to conducting a
search related to an active criminal investigation. The search results yielded Twitter posts made
by Mr. Johnson. However, Mr. Johnson had not made any threats, and rather appears to have
been expressing his dissatisfaction with incidents of police shootings of or biased behavior
toward African Americans. Rather than depicting threats to the police, the majority of the law
enforcement related posts by Mr. Johnson appear to be satirical cartoon images depicting threats
from the police toward African Americans. These postings are protected by Mr. Johnsons First
Amendment rights to free speech. Thus there should have been no continued viewing,
documentation, sharing with others or any other action based on the tweets.
Based on the description by
to his supervisors of Mr. Johnsons postings
constituting violent threats toward police officers, and based on the lack of recognition by
and others of an alternative point of view of what postings actually depicted or
represented, it is not surprising that he was directed to prepare a memo on the matter.
There is a lack of training on anti-racial profiling 28 and/or anti-bias in the workplace as
applied to law enforcement/support activities. Further, there appears to be a lack of racial
27

Note that these bulletins contained privacy statements generally prohibiting their
dissemination, so I have not attached them to this report.
28

The American Civil Liberties Union (ACLU) describes racial profiling as follows:
Racial Profiling refers to the discriminatory practice by law enforcement officials of targeting
individuals for suspicion of crime based on the individuals race, ethnicity, religion or national
origin. Oregon House Bill 2002, signed into law on January 2015, directs law enforcement
agencies to adopt written policies and procedures prohibiting profiling by January 1, 2016 (note,
this requirement was not in effect at the time of the incident that led to this investigation and is
being included herein for the purpose of providing the definition of profiling under Oregon law).
Under Oregon law, profiling is described as when a law enforcement agency or a law
enforcement officer targets an individual for suspicion of violating a provision of law based
solely on the real or perceived factor of the individuals age, race, ethnicity, color, national
origin, language, gender, gender identity, sexual orientation, political affiliation, religion,
(continued . . .)
29

diversity and cultural competency within the CJD that may have contributed to the situation that
prompted this investigation. The CJD should proceed with the Attorney Generals directive to
provide anti-racial profiling to the Intelligence Unit, and should implement mandatory training in
the related and often overlapping areas of diversity, cultural competency and anti-bias training.
The CJD should also focus on increasing the racial and ethnic diversity within the Intelligence
Unit.
The Intelligence Unit as a whole would benefit from clear and consistent leadership and
direction regarding applying the relevant statutes and regulations to their daily activities,
specifically with respect to electronic monitoring of social media. This training should be
mandatory, documented and monitored for compliance, and refresher training should be
provided at scheduled intervals.

(. . . continued)
homelessness or disability, unless the agency or officer is acting on a suspect description or
information related to an identified or suspected violation of a provision of law.

30