Facebook’s facing a losing battle to protect users’ privacy

Facebook's facing a losing battle to protect users' privacy

Composite. Image of data privacy courtesy of Shutterstock. Last year, prosecutors in Manhattan held Facebook up by the ankles and shook out personal data on 381 users – a mugging that Facebook so far hasn’t had any luck in fighting.

It began in secret in July 2013.

That’s when Manhattan Criminal Court Judge Melissa Jackson first approved the sealed search warrants for a treasure trove of Facebook users’ postings: friend lists, photos, private messages and more, according to confidential court filings unsealed Wednesday and first reported by The New York Times.

Hands down, this is the largest data demand ever served on Facebook, the company said – by a magnitude of more than ten.

Facebook says that the “unprecedented” request is unconstitutional when it comes to Fourth Amendment protection against unreasonable search.

The company’s been fighting from the get-go, and it’s not done yet, in spite of the judge’s rejection last week of Facebook’s filing to quash the warrants which were issued against people who were thought to have taken part in an alleged scheme to fraudulently obtain disability benefits.

Those warrants covered a “cross-section of America”, Facebook said in a 23 July filing, spanning an age range between highschoolers and grandparents, and targeting a broad swath of occupations, including electricians, school teachers and members of the country’s armed forces.

Facebook fought, but in September, Jackson rebuffed its objections, saying that law enforcement has “the authority to search and seize a massive amount of material to seek evidence,” even if some of the items turn out to be irrelevant.

Facebook handed over the information in November 2013 after an appeals court refused to hold off Jackson’s order while Facebook’s appeal played out.

The data demands were vast, but the results don’t seem particularly fruitful. Out of the nearly 400 accounts squeezed for data, only 62 Facebook-user arrests resulted.

Those 62 Facebook users are among 134 people charged in the case. More charges are likely to come, given that prosecutors said that up to 1,000 people may have been involved in the alleged fraud.

That leaves more than 300 people who were shaken down, weren’t told about it, and who will never be charged, Facebook said.

Facebook argued that the warrants, which emanated from a single investigator, were outrageously broad:

These warrants fail to include date restrictions or any other criteria to limit the voluminous data sought, nor do they provide for procedures to minimize the collection or retention of information that is unrelated to the investigation. The warrants' extraordinary overbreadth and lack of particularity render them constitutionally infirm and defective under state and federal law, and they should be quashed.

Facebook argued the warrants cast a net as wide as “the digital equivalent of seizing everything in someone’s home”.

Or, really, wider still, Facebook said in its filing:

It is not a single home but an entire neighborhood of nearly 400 homes.

Prosecutors said that they provided the judge a 93-page explanation of why each targeted account would likely yield evidence.

A spokeswoman for the District Attorney’s office said in a statement on Friday that the seized Facebook postings revealed the truth behind defendants’ lies.

USA Today quoted the spokeswoman, Joan Vollero:

The defendants in this case repeatedly lied to the government about their mental, physical, and social capabilities. Their Facebook accounts told a different story.

Facebook had suggested an alternative to the warrants’ voracious data grab: namely, permission to notify people targeted by the warrants so that those persons could object to the expansive scope.

Last week, the same judge who OKed the warrants denied, in entirety, Facebook’s motion to quash them.

Her reasoning: Given that Facebook leaves it up to users to control their own privacy settings, it’s up to them, not Facebook, to argue about their own Fourth Amendment rights, she said.

Screenshot from Facebook court report

In the case at bar, it is the Facebook subscribers who could assert an expectation of privacy in their postings, not the digital storage facility, or Facebook.

But, in order to protect the secrecy of the investigation, the judge barred Facebook from letting the targeted users know what personal data investigators were draining from its servers.

That’s where things get really Kafka-esque. How do you fight something you don’t know about?

If Facebook – or other service providers, for that matter – doesn’t have legal standing to challenge the warrants, and if users are kept in the dark about them, nobody’s going to have the chance to object to possible privacy invasion.

The New York Times quotes Chris Sonderby, deputy general counsel for Facebook:

It appeared to us from the outset that there would be a large number of people who were never charged in this case. The district attorney’s response was that those people would have their day in court. There are more than 300 people that will never have that chance.

The case is now on appeal.

Facebook’s wise not to let the matter rest. The US is, after all, haltingly lurching toward redress of surveillance run amok.

An example of the privacy pendulum swinging in the opposite direction was the 12 June 2014 court decision that found warrantless tracking of mobile phones to be unconstitutional.

That court decision was unanimous, as nine US Supreme Court justices found that mobile phone data is so revealing about people’s lives that police must get a warrant to search it.

How is social media information different?

Civil liberties activists say that it’s not. The New York Times quotes Kurt Opsahl, deputy general counsel of the Electronic Frontier Foundation:

In that case, they were talking about how revealing the information could be on a cellphone. You could make a similar point about people’s social media profiles.

This a setback but the war still wages.

Facebook, keep fighting.

Facebook users, assume that everything you say in your postings can, and well might be, used against you in a court of law.

Image of data privacy courtesy of Shutterstock.