The U.S. Department of Homeland Security actively monitors social media platforms such as Facebook and Twitter, scanning for specific keywords that trigger what the agency calls “Items of Interest” (IOI). This surveillance program came to light through internal government documents obtained and published by the Electronic Privacy Information Center (EPIC).

How DHS Social Media Monitoring Works

According to the released files, a DHS subcontractor carries out real-time scanning of social network activity using a predefined set of baseline search terms. When those terms appear in public posts or updates, the system generates IOI reports for review by analysts. Notably, the keyword list in the original PDF was embedded as an image rather than selectable text, a move that prevented easy digital indexing of the monitored vocabulary.

Privacy Protections and Their Exceptions

DHS maintains an internal privacy framework designed to remove Personally Identifiable Information (PII) from collected social media data. However, the policy carves out significant exceptions. PII may be retained for individuals in life-or-death emergencies, senior government officials making public statements, government and private-sector spokespersons issuing public communications, identified journalists reporting through traditional or social channels, current and former public officials who become victims of homeland security incidents, and known terrorists or individuals connected to major crimes of national security concern such as mass shootings.

Beyond these formal exceptions, the Media Monitoring Capability (MMC) team retains the authority to share personal information with the DHS National Operations Center by telephone whenever approved by a DHS operations authority. The caveat is that such information must not be entered into any database searchable by an individual’s PII.

Furthermore, the agency reserves the right to introduce additional search terms on a situational basis as new threats or disasters emerge. The only stated limitation is that these added terms should not incorporate PII in their construction.

Complete List of DHS Surveillance Keywords

The following categories and terms represent the full baseline vocabulary that DHS analysts use when scanning social media for situational awareness.

DHS and Federal Agency Terms

• Department of Homeland Security (DHS)
• Federal Emergency Management Agency (FEMA)
• Coast Guard (USCG)
• Customs and Border Protection (CBP)
• Border Patrol
• Secret Service (USSS)
• National Operations Center (NOC)
• Homeland Defense
• Immigration Customs Enforcement (ICE)
• Agent
• Task Force
• Central Intelligence Agency (CIA)
• Fusion Center
• Drug Enforcement Agency (DEA)
• Secure Border Initiative (SBI)
• Federal Bureau of Investigation (FBI)
• Alcohol Tobacco and Firearms (ATF)
• U.S. Citizenship and Immigration Services (CIS)
• Federal Air Marshal Service (FAMS)
• Transportation Security Administration (TSA)
• Air Marshal
• Federal Aviation Administration (FAA)
• National Guard
• Red Cross
• United Nations (UN)

Domestic Security Keywords

• Assassination
• Attack
• Domestic security
• Drill
• Exercise
• Cops
• Law enforcement
• Authorities
• Disaster assistance
• Disaster management
• DNDO (Domestic Nuclear Detection Office)
• National preparedness
• Mitigation
• Prevention
• Response
• Recovery
• Dirty Bomb
• Domestic nuclear detection
• Emergency management
• Emergency response
• First responder
• Homeland security
• Maritime domain awareness (MDA)
• National preparedness initiative
• Militia
• Shooting
• Shots fired
• Evacuation
• Deaths
• Hostage
• Explosion (explosive)
• Police
• Disaster medical assistance team (DMAT)
• Organized crime
• Gangs
• National security
• State of emergency
• Security
• Breach
• Threat
• Standoff
• SWAT
• Screening
• Lockdown
• Bomb (squad or threat)
• Crash
• Looting
• Riot
• Emergency Landing
• Pipe bomb
• Incident
• Facility

HAZMAT and Nuclear Threat Terms

• Hazmat
• Nuclear
• Chemical Spill
• Suspicious package/device
• Toxic
• National laboratory
• Nuclear facility
• Nuclear threat
• Cloud
• Plume
• Radiation
• Radioactive
• Leak
• Biological infection (or event)
• Chemical
• Chemical burn
• Biological
• Epidemic
• Hazardous
• Hazardous material incident
• Industrial spill
• Infection
• Powder (white)
• Gas
• Spillover
• Anthrax
• Blister agent
• Exposure
• Burn
• Nerve agent
• Ricin
• Sarin
• North Korea

Public Health and Pandemic Surveillance Terms

• Outbreak
• Contamination
• Exposure
• Virus
• Evacuation
• Bacteria
• Recall
• Ebola
• Food Poisoning
• Foot and Mouth (FMD)
• H5N1
• Avian
• Flu
• Salmonella
• Small Pox
• Plague
• Human to human
• Human to animal
• Influenza
• Center for Disease Control (CDC)
• Drug Administration (FDA)
• Public Health
• Toxic
• Agro Terror
• Tuberculosis (TB)
• Agriculture
• Listeria
• Symptoms
• Mutation
• Resistant
• Antiviral
• Wave
• Pandemic
• Infection
• Water/air borne
• Sick
• Swine
• Pork
• Strain
• Quarantine
• H1N1
• Vaccine
• Tamiflu
• Norvo Virus
• Epidemic
• World Health Organization (WHO and components)
• Viral Hemorrhagic Fever
• E. Coli

Infrastructure Security Watch Terms

• Infrastructure security
• Airport
• CIKR (Critical Infrastructure & Key Resources)
• AMTRAK
• Collapse
• Computer infrastructure
• Communications infrastructure
• Telecommunications
• Critical infrastructure
• National infrastructure
• Metro
• WMATA
• Airplane (and derivatives)
• Chemical fire
• Subway
• BART
• MARTA
• Port Authority
• NBIC (National Biosurveillance Integration Center)
• Transportation security
• Grid
• Power
• Smart
• Body scanner
• Electric
• Failure or outage
• Black out
• Brown out
• Port
• Dock
• Bridge
• Canceled
• Delays
• Service disruption
• Power lines

Southwest Border and Drug Cartel Terms

• Drug cartel
• Violence
• Gang
• Drug
• Narcotics
• Cocaine
• Marijuana
• Heroin
• Border
• Mexico
• Cartel
• Southwest
• Juarez
• Sinaloa
• Tijuana
• Torreon
• Yuma
• Tucson
• Decapitated
• U.S. Consulate
• Consular
• El Paso
• Fort Hancock
• San Diego
• Ciudad Juarez
• Nogales
• Sonora
• Colombia
• Mara salvatrucha
• MS13 or MS-13
• Drug war
• Mexican army
• Methamphetamine
• Cartel de Golfo
• Gulf Cartel
• La Familia
• Reynose
• Nuevo Leon
• Narcos
• Narco banners (Spanish equivalents)
• Los Zetas
• Shootout
• Execution
• Gunfight
• Trafficking
• Kidnap
• Calderon
• Reyosa
• Bust
• Tamaulipas
• Meth Lab
• Drug trade
• Illegal immigrants
• Smuggling (smugglers)
• Matamoros
• Michoacana
• Guzman
• Arellano-Felix
• Beltran-Leyva
• Barrio Azteca
• Artistics Assassins
• Mexicles
• New Federation

Terrorism-Related Search Terms

• Terrorism
• Al Qaeda (all spellings)
• Terror
• Attack
• Iraq
• Afghanistan
• Iran
• Pakistan
• Agro
• Environmental terrorist
• Eco terrorism
• Conventional weapon
• Target
• Weapons grade
• Dirty bomb
• Enriched
• Nuclear
• Chemical weapon
• Biological weapon
• Ammonium nitrate
• Improvised explosive device
• IED (Improvised Explosive Device)
• Abu Sayyaf
• Hamas
• FARC (Armed Revolutionary Forces Colombia)
• IRA (Irish Republican Army)
• ETA (Euskadi ta Askatasuna)
• Basque Separatists
• Hezbollah
• Tamil Tiger
• PLF (Palestine Liberation Front)
• PLO (Palestine Liberation Organization)
• Car bomb
• Jihad
• Taliban
• Weapons cache
• Suicide bomber
• Suicide attack
• Suspicious substance
• AQAP (Al Qaeda Arabian Peninsula)
• AQIM (Al Qaeda in the Islamic Maghreb)
• TTP (Tehrik-i-Taliban Pakistan)
• Yemen
• Pirates
• Extremism
• Somalia
• Nigeria
• Radicals
• Al-Shabaab
• Home grown
• Plot
• Nationalist
• Recruitment
• Fundamentalism
• Islamist

Weather, Disaster, and Emergency Terms

• Emergency
• Hurricane
• Tornado
• Twister
• Tsunami
• Earthquake
• Tremor
• Flood
• Storm
• Crest
• Temblor
• Extreme weather
• Forest fire
• Brush fire
• Ice
• Stranded/Stuck
• Help
• Hail
• Wildfire
• Tsunami Warning Center
• Magnitude
• Avalanche
• Typhoon
• Shelter-in-place
• Disaster
• Snow
• Blizzard
• Sleet
• Mud slide or Mudslide
• Erosion
• Power outage
• Brown out
• Warning
• Watch
• Lightning
• Aid
• Relief
• Closure
• Interstate
• Burst
• Emergency Broadcast System

Cyber Security Monitoring Terms

• Cyber security
• Botnet
• DDOS (dedicated denial of service)
• Denial of service
• Malware
• Virus
• Trojan
• Keylogger
• Cyber Command
• 2600
• Spammer
• Phishing
• Rootkit
• Phreaking
• Cain and Abel
• Brute forcing
• MySQL injection
• Cyber attack
• Cyber terror
• Hacker
• China
• Conficker
• Worm
• Scammers
• Social media

One particularly ironic detail stands out: among the hundreds of flagged terms spanning terrorism, border violence, nuclear threats, and pandemics, the DHS also monitors the phrase “social media” itself.

What the DHS Keyword List Means for Online Privacy

The breadth of this vocabulary reveals just how wide the federal surveillance net extends across everyday digital conversation. Words as common as “police,” “cloud,” “power,” “flu,” and “smart” all appear on the official monitoring list. Any American posting publicly on social media could unknowingly trigger a government review simply by discussing the weather, a power outage, or a news headline.

The document underscores a fundamental tension between national security objectives and the constitutional right to free expression. While the DHS frames this program as a tool for building situational awareness during emergencies, the sheer volume of ordinary words on the list raises serious questions about how effectively PII protections actually function when the data collection threshold is this low.

Originally published February 2012. Internal DHS documents were released through a Freedom of Information Act request by the Electronic Privacy Information Center (EPIC).