Documents

Bureau of Detectives Special Order Date of Issue 01 FEB 2019 Effective Date 01 FEB 2019 Subject Social Media Exploitation (SOMEX) Team Related Directives Access to Computerized Data, Dissemination and Retention of Computer Data G09-01-01 Use of the Internet G09-01-03 Department-Issued Electronic Communication Devices G09-01-05 Use of Social Media G09-01-06 Social Media Outlet: Twitter S02-03-10 Amends Rescinds 19-01 I. PURPOSE This order: A. Establishes the Social Media Exploitation (SOMEX) Team within the Bureau of Detectives. B. Provides definitions and guidelines relative to the SOMEX investigations. C. Provides procedures for conducting covert and overt social media investigations and identifies supervisory oversight and responsibilities. D. Introduces the SOMEX Team Intelligence Report [CPD 23.270] E. Introduces the Social Media Covert Identity Authorization form (SMCID) [CPD 41.307] F. Introduces the Social Media Request form [CPD 23.171] G. Introduces the Consent to Assume Online Identity form [CPD 23.271] II. POLICY Social media provides an effective means of assisting the Department and its personnel in meeting community outreach, problem solving, investigative, crime-prevention, and related objectives. Any social media participation made pursuant to a Department member’s official duties is not considered protected speech under the First Amendment. This policy is designed to ensure that the Department members adhere to the Constitution and laws of the United States and respects privacy, civil liberties, and the rights of the citizens it serves. On-duty Department BDSO 19-01 Social Media Exploitation (SOMEX) Team

members will only utilize social media, access social media websites, online aliases, and social media tools for a valid law enforcement purpose. Department members must ensure that all online investigative activities are focused in scope, time and manner to achieve an underlying purpose. III. DEFINITIONS A. "Social media" is any electronic communication (such as personal Websites, peer-to￾peer communication, electronic email, micro blogging, social networking sites, photo and video sharing platforms, electronic applications, geo-locational sites, sale sites, delivery sites, dating sites, and any and all online communication sites known and unknown which collect user data, require user identification name, or moniker) through which participants utilize online communities to share information, ideas, private messages, and other content through an electronic format. B. "Public domain" is material which is available to the public, accessible through the Internet for which no login information is necessary for online searches of information. C. "Online alias" or "covert profile" is an online identity encompassing identifiers such as name and date of birth, differing from the employee’s actual identifiers that use a nongovernmental Internet Protocol. D. "Bona fides" is a process to develop an online person’s legitimacy or credentials. E. "In-person undercover activity" is undercover activity which occurs in person and is precipitated by a use of investigative online social media. F. "Blog" is a self-published diary or commentary on a particular topic that may allow visitors to post responses, reactions, or comments. The term is short for "web log." G. "Crime Analysis and Situational Assessment Reports" are analytic activities and issue reporting as needed to enable Bureau of Detective SOMEX member to identify and understand trends, causes, and potential indications of criminal activity. H. "Criminal Intelligence Information" is data which meets criminal intelligence collection criteria and which has been evaluated and determined to be relevant to the identification of criminal activity engaged in by individuals who or organizations which are reasonably suspected of involvement in criminal activity. I. "Social media tool" is software used to capture data and review social media sites by utilizing automated programs such as web crawlers and word search functions to make predictive analysis, develop trends or collect information. J. "Valid law enforcement purpose" is the collection, use, retention, or sharing of information and intelligence gathered for the purpose of furthering the authorized functions and activities of a law enforcement agency, which may include the prevention of crime, ensuring the safety of the public, furthering officer safety, and homeland and national security, while adhering to law and agency policy designed to protect the privacy, civil rights, and civil liberties of Americans. BDSO 19-01 Social Media Exploitation (SOMEX) Team 2

K. "Internet Protocol (IP)" is the method or protocol by which data is sent from one computer to another on the Internet. Each computer (known as a host) on the Internet has at least one IP address that uniquely identified it from all other computers on the Internet. L. "Non-attributable equipment" means equipment that cannot be traced back to the Chicago Police Department or any other law enforcement agency. IV. SOCIAL MEDIA EXPLOITATION TEAM (SOMEX) OPERATIONAL GUIDELINES A. The SOMEX Team is a multi-agency/ multi-jurisdictional task force designed to bring the appropriate authorities and highest level of expertise together to focus jointly on intelligence gathering on criminal activity, provide investigative support through social media exploitation, identify confidential human sources and assist in determining if federal or state is the appropriate means for adjudication. B. The Chief of the Bureau of Detectives will establish one Social Media Exploitation (SOMEX) Team per Detective Area, that will be comprised of members of the BOD and other Department members detailed to the Team, as agreed upon by the respective Bureau Chiefs. C. Each team will be staffed with no less than eight department members on a full-time basis, working 2"4 and 3rd watch and on an on-call basis to address emergency situations and supervised by a designated sergeant. 1. Off-duty members will not use electronic communication devices to access covert accounts, respond to electronic messages, or perform other work related to Departmental business unless the member is directed by his/her immediate supervisor. 2. Supervisors will ensure the approval of overtime for members working outside assigned duty hours. D. The FBI will detail personnel to assist in the implementation of the SOMEX Team, and to oversee the day-to-day operations. The Agents will collect and share relevant intelligence on violent crimes and street gangs, facilitate the vetting and development of confidential human sources, design relevant SOMEX training, refer cases as appropriate to FBI SQUADS, work collectively with the CPD to determine if potential for federal prosecution exists, and act as the primary liaison between Bureau of Detective and the FBI. E. The SOMEX Team will respond to requests for case development assistance from other law enforcement agencies. SOMEX Team sergeants will be informed of all requests for assistance and shall determine if the requested assistance will be provided by the SOMEX Team. F. Due to the jurisdictional makeup of Chicago area law enforcement lends itself to investigative overlap during the course of social media investigations, the SOMEX Team BDSO 19-01 Social Media Exploitation (SOMEX) Team 3

will adhere to standard notification procedures, such as HIDTA deconfliction, in order to minimize conflicts with the enforcement routine of the affected jurisdiction. G. Each Detective Area will provide a securable space for the SOMEX Team to operate and are supervised by the Area Commanders or his/her designee. V. RESPONSIBILITIES A. BOD SOMEX Team members will solely utilize social media to seek or retain information that: 1. Is based upon a criminal predicate or threat to public safety; or 2, Is based upon reasonable suspicion that an identifiable individual, regardless of citizenship or U. S. residency status, or organization has committed an identifiable criminal offense or is involved in or is planning criminal conduct or activity that presents a threat to any individual, property, the community, or the nation and the information is relevant to the criminal conduct or activity (criminal intelligence information); or 3. Is relevant to an on-going investigation and prosecution of suspected criminal incidents; the resulting justice system response; or the prevention of crime; or 4. is useful in crime analysis or Officer Safety Bulletins or Informational Bulletins for the safety of Department members and/or public safety. B. BOO SOMEX Team members shall: 1. Conduct open source investigative activity as well as deploy and operate covert online alias identities for the purpose of compiling analytical assessments in support of BOD investigations. a. Seek patterns of criminal activity from online covert and overt activity. b. Conduct undercover investigations with a social media component. 2. Collaborate with the Cook County State’s Attorney’s Office to approve or enhance charges with a social media component. 3. Research new and emerging social media applications and technology. 4. File preservations requests with providers, write, execute search warrants or serve other legal processes. SOMEX Team members shall adhere to policies established in "Search Warrants" Special Order SO4-19. 5. Identify potential witnesses and suspects utilizing social media assets. BDSO 19-01 Social Media Exploitation (SOMEX) Team 4

6. Compile Officer Safety Alerts and/or Informational Bulletins and disseminate to CPIC if necessary. 7. Coordinate with other CPD units that engage in social media investigations, 8. Document information and intelligence received via social media sites on a SOMEX Team Intelligence Report. [CPD-23,270] C. BOD SOMEX Team members will not utilize social media or retain information about: 1. Individuals or organizations solely based on the basis of their religious, political, social views or activities; or 2. An individual’s participation in a particular non-criminal organization or lawful event unless such information is relevant to the individual’s criminal conduct or activity or if required to identify the individual; or 3. An individual’s race, ethnicity, citizenship, place of origin, disability, gender, or sexual orientation unless such information is relevant to the individual’s criminal conduct or activity or if required to identify the individual; or 4. An individual’s age unless such information is relevant to the individual’s criminal conduct or activity or if required to identify the individual, or to determine if someone is a minor. NOTE: Members of the SOMEX Team shall adhere to applicable laws, follow the guidelines set forth in the Rules and Regulations of the Chicago Police Department and any relevant Department policies and directives including, but not limited to, "Use of the Internet" and "Use of Social Media Outlets" and "Department￾Issued Electronic Communication Devices." VI. DETECTIVES REQUESTING ASSISTANCE FROM SOMEX TEAM A. To request the assistance of the BOD SOMEX Team, the investigating detective shall: 1. Complete the Social Media Request [CPD 23,171] form; 2. Have his/her supervisor approve; 3. Deliver to the BOD SOMEX Team NOTE: In the case of an emergency or during hours when the SOMEX office is not open, detectives will contact the SOMEX Team supervisor for assistance. The supervisor will contact the on-call SOMEX Team member to provide assistance, BDSO 19-01 Social Media Exploitation (SOMEX) Team 5

VII. REPORTING AND FILE RETENTION A. Team members will document all positive investigative results via the SOMEX Team Intelligence Report [CPD-23.270]. Completed SOMEX Team Intelligence Reports are submitted to the supervisor for approval. Upon approval, the SOMEX Team Intelligence Report will be disseminated to the Unit Supervisor, for which the intelligence relates, for inclusion into the official case file. 1. Any data of evidentiary value captured on a covert device shall be transferred only via Compact Disc (CD), Digital Video Disk (DVD) or Blue-ray Disk and must be inventoried in eTrack within ten working days. a. Team members will include a copy of the SOMEX Intelligence Report with the inventoried evidence. 2. Team members will document material pursuant to any Officer Safety Alerts and/or Informational Bulletins disseminated from the SOMEX Team. 3. When a BOD SOMEX member observes information that cannot be printed due to the short duration it is available (i.e. Snapchat), the member will memorialize any information of investigatory value in a SOMEX Team Intelligence Report. B. If a victim or witness during the course of an investigation consents for the investigating detective to allow the Chicago Police Department full access to the accounts for the purpose of viewing its contents, the Consent to Assume Online Identity Authorization Form [CPD 23.2711 will be completed. Upon its completion, a copy will be added to the case file, and the original inventoried utilizing E-Track. C. BOD SOMEX Team members will adhere to Department policies regarding technology and records management. a. BOD SOMEX Team members will not distribute reports outside the Chicago Police Department unless a written request "Inquiry Requests Worksheet" [CPD- 11,704] is submitted as directed by G.O. 09-01-01, or unless the reports are shared with agencies that have a direct working relationship with the SOMEX Team supported by a Memorandum of Agreement (MOA). b. Records maintained or created by BOD SOMEX are subject to the Local Records Act (50 ILCS 205/1), the Illinois Freedom of Information Act (5 ILCS 140/1), and Department records retention schedules. VII. UTILIZATION OF FBI ONLINE ALIAS A. BOD SOMEX Team members provided an alias identity from the Federal Bureau of Investigation will utilize the Confidential Alias Number, CG-XXX assigned to the alias in BDSO 19-01 Social Media Exploitation (SOMEX) Team 6

all reporting. B. BOD SOMEX Team members provided an Online Alias Identity from the Federal Bureau of Investigations will submit a Social Media Covert Identity Authorization (SMCID) form [CPD-41.307] to the SOMEX Team assigned FBI agent. This form will be maintained in the FBI’s Confidential Human Source Room. VIII. UTILIZATION OF COVERT ALIAS FOR ONLINE UNDERCOVER ACTIVITY A. Undercover online activity occurs when the BOD SOMEX Team member, utilizing an online alias, "friends/follows/like" a person or group for the purpose of building alias account bona fides. B. SOMEX Team members will request authorization to create an online alias identity by submitting a Social Media Covert Identity Authorization Form [CPD-41.307] to their unit Commander for approval. 1. Upon approval by the Commander, the SOMEX Team member will notify the SOMEX Team sergeant who will register the alias with a covert departmental identification number. 2. The SOMEX Team member will ensure a deconfliction is completed. 3. Profile pictures utilized on alias online accounts must be a uniquely created photo and not attributed to an actual individual. 4. The SOMEX supervisor will ensure all forms are completed, a covert departmental identification number is provided, and a covert alias file is maintained and kept secured within the SOMEX office, C. For online undercover activity, BOD SOMEX Team members, with an authorized alias may: 1. Request verbal authorization to engage in online undercover activity to their exempt supervisor. Only BOD SOMEX members designated by their exempt supervisor or his/her designee will be authorized to engage in undercover activity utilizing the online alias. IX. ONLINE UNDERCOVER INTERACTION A. Online undercover interaction occurs when the BOD SOMEX Team member, utilizing the online alias, directly interacts with a person online via social media. Online undercover operations will only be utilized when there is reasonable articulable suspicion to believe that criminal offenses have been, will be, or are being committed (i.e, online display of weapons, narcotic sales, armed robberies, murder for hires, etc.) B. For online undercover interaction, BOD SOMEX Team members with an authorized alias may: BDSO 19-01 Social Media Exploitation (SOMEX) Team 7

1. Request authorization to engage in online undercover interaction utilizing the online alias by submitting a TO/FROM Subject Report to their exempt supervisor. 2. The TO/FROM Subject Report must include the following: a, Online alias(es) to be used utilizing the covert departmental alias number: b. Specified unlawful activity (under Criminal Code of Illinois or Title 18,21 of the United States Code; c, Social Media accounts utilized; d. Valid law enforcement purpose; e. Anticipated duration for the online undercover activity. NOTE: Should exigent circumstances exist for authorized alias be used for undercover interaction, verbal approval from their Exempt Supervisor will suffice until a reasonable time permits to submit the TO/FROM Subject Report. (i.e. pending violent crime) X. IN-PERSON UNDERCOVER ACTIVITY A. In-person undercover activity occurs when the BOD SOMEX Team member, utilizing the online alias, directly interacts with a person online via social media in an effort to further investigative efforts. Undercover operations will only be utilized when there is reason to believe that criminal offenses have been, will be, or are being committed (i.e. online display of weapons, narcotic sales, armed robberies, murder for hires, etc.) B. For in-person undercover activity, BOD SOMEX Team members with an authorized alias may: 1. Request authorization to engage in in-person undercover activity utilizing the online alias by submitting a TO/FROM Subject Report to their exempt supervisor. 2. The TO/FROM Subject Report must include the following: a. Online alias(es) to be used utilizing the departmental alias number; b. Specified unlawful activity (under Criminal Code of Illinois or Title 18,21 of the United States Code; c. Social Media accounts utilized; d. Valid law enforcement purpose; e. Anticipated duration for the online undercover activity; BDSO 19-01 Social Media Exploitation (SOMEX) Team 8

f. Operations plan for in-person undercover activity. NOTE: Should exigent circumstances exist for authorized alias be used for undercover interaction, verbal approval from their Exempt Supervisor will suffice until a reasonable time permits to submit the TO/FROM Subject Report. (i.e. pending violent crime) XI. BOO SOMEX EQUIPMENT A. Only approved Task Force equipment may be utilized for investigative purposes. B. BOD SOMEX Team members will ensure assigned equipment is secured at all times. C. During a covert investigation, only non-attributable devices can be utilized. D. All non-attributable devices will be issued and shall be used strictly for covert activity and never shall be used to access private and personal websites and email in true name or for Department use. Melissa A. Staples Chief Bureau of Detectives BDSO 19-01 Social Media Exploitation (SOMEX) Team 9

Total Number of Redactions in Document: 1 Redaction Reasons by Page Page Reason Description Occurrences 9 1 Redaction Date: 4/5/2021 7:56:38 AM Redaction Log

Redaction Reasons by Exemption Reason Description Pages (Count) 9(1) Redaction Date: 4/5/2021 7:56:38 AM Redaction Log