The Office of Inspector General found the agency did not have legal authority for searches in its "iCOP" surveillance program.

The United States Postal Inspection Service, the law enforcement arm of the post office, was “not legally authorized” to conduct blanket keyword searches of social media for terms such as “protest,” “attack,” and “destroy,” an inspector general investigation found, because it is only supposed to investigate cases with some connection to the post office or the mail.

The USPSIS is the oldest police agency in the country, called the United States Postal Inspection Service, or USPIS. Its job is to police the mail and crimes related to the mail such as mail fraud. USPIS dates back to a time when the postal service was the largest and most significant branch of the federal government and the USPIS was its only national policing power.

Of course, the federal government has many policing and law enforcement arms nowadays, which is one of the reasons that a Yahoo News report from April 2021 was so surprising to many Americans. Yahoo reported the agency’s Internet Covert Operations Program, better and somehow not satirically known as iCOP, was monitoring social media for “inflammatory” postings associated with protest movements on both the Left and the Right. This puzzled First Amendment watchdogs and security experts since the federal government has no shortage of agencies to monitor social media for inflammatory posts, yet for some reason postal cops were doing it. Yahoo News also reported that iCOP included use of Clearview AI, the highly controversial facial recognition system that is built on a database of images scraped from social media.

As a result of that investigation, the House of Representatives asked the USPS Office of Inspector General to investigate this program. The USPSOIG has just published that report which found iCOP used “proactive searches” that “did not include any terms with a postal nexus,” meaning they had nothing to do with the post office. The USPIS did not immediately respond to a Motherboard request for comment on the report.

In the months leading up to the Yahoo News report, which was published on April 21, iCOP used “one of the 10 profiles established in the [redacted] intelligence tool to conduct searches that were not legally authorized,” the report said. The USPSOIG found iCOP searched social media for terms that “did not include any terms related to the mail, postal crimes, or security of postal facilities or personnel.” The report gave three examples of keywords iCOP did use: “Protest,” “Attack,” and “Destroy.” After the Yahoo News report was published, the agency’s legal counsel suggested the term “protest” be removed to “protect people’s constitutional rights.”

Instead of starting by investigating crimes with a link to the post office, the program manager told the investigators that they went with the opposite approach, casting the widest net possible and then working their way backwards to see if it has any link to the post office “in an effort to broadly identify threats that could then be assessed for any postal nexus.”

The report also found that analysts working on iCOP did not retain investigative materials according to the agency’s record retention policies making investigating the use of such investigative materials difficult.

The report outlines several changes the USPIS made to iCOP in the months since the Yahoo News report, but notes they have not provided the necessary oversight to make sure such abuses don’t continue. However, the report does say that USPIS officials did move quickly to make one change immediately after the Yahoo News report. By the end of April 2021, they changed the name of iCOP. It is now called the Analytics Team.

In August, Motherboard published an internal USPIS slide presentation that showed how the division described itself. “Analytics Team specializes in providing actionable intelligence through cryptocurrency tracking, open source intelligence and social media analysis, geospatial mapping, and data visualization, and USPS backend and network data exploitation," the presentation reads.

The unit’s goals were to attribute “previously unknown individuals,” the presentation said. The document added that the unit’s training sessions are spread across 4 days over Zoom.

“You will not be an expert by the end of the training,” one of the slides reads.