Privacy Group Challenges USPS Surveillance Operation

A general view of the United States Postal Service (USPS) headquarters building in Washington Dec. 30, 2014. Jim Watson/AFP/Getty Images

A prominent internet privacy group is suing the U.S. Postal Service (USPS), alleging that its social media surveillance program violates federal law.

According to a lawsuit filed last week in Washington by the Electronic Privacy Information Center (EPIC), the USPS has been operating its Internet Covert Operations Program (iCOP) without conducting a privacy impact assessment—a review of what information is collected, why it’s being collected, how the information is used, and how the data is stored.

EPIC seeks to have a federal judge suspend iCOP until the USPS at least conducts and publishes such a review, as required by the E-Government Act.

The existence of iCOP was first reported in April by Yahoo News, which had obtained an internal USPS memo about monitoring right-wing anti-lockdown protestors.

“Parlor users have commented about their intent to use the rallies to engage in violence. Image 3 on the right is a screenshot from Parlor indicating two users discussing the event as an opportunity to engage in a ‘fight’ and to ‘do serious damage,’” the March 16 USPS memo reads, circulated ahead of the “World Wide Rally—For Freedom, Peace, & Human Rights” event scheduled for March 20.

“No intelligence is available to suggest the legitimacy of these threats.”

The Yahoo News report prompted questions from some lawmakers about why the postal service is conducting intelligence operations. A group of 32 Republican lawmakers wrote Postmaster General Louis DeJoy on April 22, seeking a briefing on iCOP.

“It is unclear why the USPS, of all government agencies and the only one devoted to the delivery of Americans’ mail, is taking on the role of intelligence collection,” the letter reads. “The type of general review of social media alleged in the reporting does not indicate that the posts reviewed by iCOP are related to the protection and security of USPS, its postal routes, its employees, or the mail generally.”

Chief Postal Inspector Gary Barksdale reportedly briefed lawmakers later in a closed-door session in April, following which Rep. Nancy Mace (R-S.C.) published an op-ed denouncing the surveillance operations. Mace said Barksdale was “unprepared to answer our questions to the point of incompetence.”

“Barksdale couldn’t tell us when the program started, how much taxpayers were paying to run it, or even what legal authority the post office had to spy on the public’s social media activities,” Mace said. “He denied iCOP was a program, but said it had an ‘executive’ overseeing it. He said the post office coordinated with other agencies, but couldn’t list a single one.”

“What’s worse, he denied iCOP was used to monitor social media activities, but in the very same breath, said his analysts use iCOP to do exactly this.”

Following its initial April report, Yahoo News revealed more details about iCOP in May. According to Yahoo, the USPS also used internet surveillance tools to monitor social media to track potential violence at protests following the death of George Floyd.

“After the Jan. 6 riot at the Capitol by Trump supporters, the analysts turned their attention to right-wing accounts,” Yahoo News reported in May.

Around that time, EPIC also filed a Freedom of Information Act (FOIA) request in May, seeking records about iCOP, including its privacy impact assessment.

In EPIC’s lawsuit, the group said that the postal service “failed to locate” its privacy impact assessment in response to the FOIA request—suggesting that one doesn’t exist.

“Defendants have unlawfully initiated [iCOP] ... and used facial recognition and social media monitoring tools to initiate or significantly modify collections of personal information under the iCOP without first conducting and publishing the full and complete Privacy Impact Assessment(s) required by ... the E-Government Act,” EPIC stated in its Aug. 12 filing.

In a separate statement about the lawsuit, EPIC expressed skepticism at the notion that the USPS should be conducting broad intelligence operations such as iCOP.

“The iCOP’s surveillance of protests and tracking of ‘inflammatory’ content goes far beyond the program’s mandate to investigate fraud and other crimes perpetuated through the mail or USPS’s website,” EPIC said in the statement.

Representatives for the USPS didn’t respond to a request for comment by press time. The postal service has previously defended iCOP as a legal open-source intelligence operation designed to protect its employees.

“This review of publicly available open-source information, including news reports and social media, is one piece of a comprehensive security and threat analysis, and the information obtained is the same information anyone can access as a private citizen,” a U.S. Postal Inspection Service spokesperson told Yahoo News in May.

“News report and social media listening activity helps protect the 644,000 men and women who work for the postal service by ensuring they are able to avoid potentially volatile situations while working to process and deliver the nation’s mail every day.”

The nonprofit Judicial Watch is pursuing similar litigation against the USPS for not responding to the group’s FOIA request about iCOP. In that case, the USPS has until Sept. 1 to respond to the group’s lawsuit. No dates have been scheduled in the EPIC case.