The Military Wants a Privacy Firewall for Disaster Response

When disaster strikes on U.S. soil, first responders are learning to look at tweets and Instagram posts to learn what areas are hardest hit, where the danger has passed, and where it is going. But should U.S. troops join that effort, privacy laws would quickly snarl efforts to share helpful bits from social media. The military is now seeking software that can strip out information that might identify who is posting what, leaving just the data that might inform relief efforts.

The idea arose during a visit to U.S. Northern Command by James A. “Sandy” Winnefeld, a retired admiral who served as vice chairman of the Joint Chiefs of Staff. “He asked, ‘Why can’t we look at crowdsourcing so, in case of a natural disaster, you can find out where the areas of concern are so we can reposture and reposition our forces?’” NORTHCOM director of science and technology Robin Brunner told a crowd at a recent National Defense Industrial Association event in Tampa.

But various laws and guidelines restrict how the military, police, and government can use personally identifiable information, or PII, even during disasters.

“Operational utility [of social media] is significantly hampered by the inability to legally and legitimately analyze this information due to the exposure of PII from analytical tools currently available,” wrote officials for the Rapid Innovation Fund, which is handling the software procurement for NORTHCOM, in their April 2015 broad agency announcement. “There is a need (1) for blocking (removal/blocking/masking) direct PII found within streaming or static data sets (text, images, etc.) or metadata of social media without loss of information, and (2) to be monitoring and analytical tool agnostic (the post-processed data should operate in common monitoring and analytical tool sets).”

In theory, stripping PII out of social media content should be easy. Just block the account name and, perhaps, the avatar photograph. The problem is that people use social media to talk about themselves — in other words, to create never-ending streams of PII that we send out to the world.

“It’s easy to strip out different categories where the field says ‘name.’ But if there’s things embedded in the actual message itself, that’s not so simple to strip out,” Brunner said. “So if you can get a way to get together a personally identifiable information firewall, so that you can still have the information and we can use that information for planning purposes or for spring loading our responses to disasters, that would be very helpful.”

The military is currently running "a competitive, source-selection process" to choose which company will build the new privacy firewall, a Pentagon official said. The announcement is expected in September.