New York Appeals Court Says Facebook Can't Challenge The 381 Broad Warrants Handed To It By New York Prosecutors

from the no-standing-and-no-remedy dept

Almost four years ago, Manhattan DA Cyrus Vance’s office issued 381 warrants seeking information on Facebook subscribers. The warrants arrived almost immediately after the first Snowden leaks, which quite possibly pushed Facebook towards challenging the multitude of overbroad warrants.

Once the gag order was lifted, Facebook was able to reveal the astonishing breadth of the DA’s demands. Hoping to dig up info on participants in a disability fraud scheme — one that had already resulted in the arrests of more than 100 former police officers and firemen — the 381 warrants demanded everything Facebook had on the named accounts, including private messages, Friends lists, and a variety of non-public content.

Facebook spent the next three years fighting the warrants in New York courts. It hasn’t gone particularly well. There’s the issue of standing, which few courts are willing to grant to third parties seeking to protect the privacy of their subscribers and users.

The case has reached the top of the New York judicial system, and the result is a loss for both Facebook and its users. The state’s top court has rejected Facebook’s appeal on procedural grounds, saying the company lacks standing to challenge the warrants. According to the court, it’s up to individual users to challenge the validity of the warrants, something they can only do after the warrants have been served and fulfilled.

Facebook sought to have the warrants treated as subpoenas, which would have given it a bit more standing to challenge prosecutors’ demands. It pointed out the warrants used by Vance’s office more resembled subpoenas, as they weren’t deployed by law enforcement to perform a search of the target’s residence/papers, but rather served to a third party to demand digital data. A subpoena would be challengeable by Facebook, seeing as it’s both the target and the recipient.

The lower court didn’t find this persuasive and neither does the New York Supreme Court. From the decision [PDF]:

[A]n SCA warrant compels a third party — here, Facebook — to compile and turn over digital data under its control, and the presence of a law enforcement officer is not required for service or execution of the warrant. A traditional search warrant, by comparison, authorizes law enforcement to enter, search, and seize property. These differences in execution, however, can be easily explained by the nature of the material sought. The service provider is more likely to be better equipped to access and conduct a search of its own digital information than law enforcement personnel, and the data may be stored in different locations. Thus, the framework of execution for SCA warrants ensures efficiency and minimizes intrusion into the provider’s business while promoting and protecting legitimate law enforcement interests in criminal investigation.

Despite the minor similarities between SCA warrants and subpoenas, in this post-digital world, we are not convinced that SCA warrants — which are required under the statute to obtain certain content-based information that cannot be obtained with a subpoena due to heightened privacy interests in electronic communications — should nevertheless be treated as subpoenas.

With that argument out of the way, the court affirms the lower court’s ruling: Facebook does not have standing to challenge the 381 warrants issued by prosecutors. If Facebook doesn’t like it, it’s welcome to take it up with its Congressional representatives.

The dissenting opinion is less kind to the majority’s opinion — and to the actions of DA Vance’s office. Judge Wilson lays down this scathing description of the warrants the court says Facebook can’t challenge.

The facts are these: On the basis of a single 93-page affidavit (not subsequently shown to Facebook, or to its users whose files were seized, or to the Appellate Division, or to this Court), Supreme Court issued 381 warrants. Those bulk warrants authorized the seizure of what the District Attorney tepidly describes as “specified categories of information,” but which functionally amounts to 381 users’ entire histories on the platform. At least several of the users were high school students who are unlikely to have themselves been suspects in the investigation.

The warrants compelled Facebook to produce not only any and all text, photos, or videos a user had shared with her limited universe of friends, but also any private messages exchanged between the user and another individual (who could have been a spouse, doctor, religious figure, or attorney), as well as information the user had chosen to no longer share with anyone, such as a previous email address, a deleted friend, or a hidden post, and information the user had never intended to share with anyone, such as her searches and location.

It also compelled Facebook to produce content shared by users who were not named in the 381 warrants, and may not even have known anyone named in the 381 warrants, but had the misfortune of posting on the timelines of those users, uploading photos of those users, or simply belonging to any one of the groups with which a named user was affiliated.

Wilson’s dissent goes on to point out the end result of this “our hands are tied by a perverse combination of federal, state, and local laws” decision: Facebook will be forced to entertain even more of these overly-broad warrants. The court’s decision eliminates any possible remedy for service providers.

Finally, this appeal is the only opportunity to litigate fully the rights Congress granted to Facebook. The grounds underlying at least one portion of Facebook’s motion to quash are specific to Facebook, not its users, and Facebook is before us to defend not only the constitutional rights of its users (where the majority has focused its analysis), but also its own business interests.

Even if those users could realistically seek relief for their own injuries through pretrial suppression hearings or Section 1983 suits — which the majority believes, but I dispute — Facebook will not be a party to those actions and the hypothetical resolution of their claims would not address or remedy Facebook’s injuries. The majority does not suggest an alternative means for the company to vindicate its right to be free of unusually voluminous or unduly burdensome requests.


Under the majority’s decision, this Court is powerless to protect the business interests of a major company [or] return information seized from either the 381 individuals, many of whom were never suspected of wrongdoing, or the thousands of innocent individuals who communicated or simply happened to share an interest with a user named in the bulk warrants…

This is a straight-up win for DA Cy Vance’s office and New York law enforcement. It does nothing for anyone else involved in the equation, including the vast majority of those swept up in the “search.” As the dissent notes, only 62 of those named in the warrants ever faced criminal charges. Most of those whose information was sought were innocent bystanders who had the unforeseeable misfortune of communicating with — or being Facebook friends of — people caught up in an incredibly broad and far-reaching fraud investigation.

Filed Under: , , , ,
Companies: facebook

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “New York Appeals Court Says Facebook Can't Challenge The 381 Broad Warrants Handed To It By New York Prosecutors”

Subscribe: RSS Leave a comment
Ninja (profile) says:

“Most of those whose information was sought were innocent bystanders who had the unforeseeable misfortune of communicating with — or being Facebook friends of — people caught up in an incredibly broad and far-reaching fraud investigation.”

And here’s the thing, most criminals don’t appear to be criminals and this is specially true for white collar or non-violent crimes (unless you are the Brazilian intelligence agency, then they look like this in this banner asking citizens to contact them prior to the olympics: So it’s certain all of us are connected somehow at some point with at least one ‘crook’.

If there’s no way companies can fight back those warrants then STASI is effectively in operation.

Anonymous Coward says:

Re: just a 1st amendment question

The problem is with corrupt interpretations of the Constitution.

The constitution is written such that even Mythical or Magical or electrical methods of communication or information storage are covered the same as a sheet of paper sent through the postal service.

The same corruption that is used to say that the Constitution applies to non-citizens is the same corruption that says blacks are not human so that rights can be denied, is the same corruption that states citizens cannot carry guns, is the same corruption that says police can take your property through asset forfeiture, is the same corruption that says a barking dog is power that overcomes the 4th, and the same corruption that says you can be forced to talk in breach of your 5th amendment rights any time of a Judge says otherwise.

There is NOTHING left of the Constitution. We citizens know nothing about it and intentionally accept corruption and rewording to fit our politics. And since we SHIT upon the document you can bet THEY will as well!

Roger Strong (profile) says:

Re: just a 1st amendment question

just because it is a social network, don’t people have a first amendment right to assemble in a digital arena as well?

If so, it raises another interesting question:

Martial law was declared in parts of the United States half a dozen times in the last century. Which often suspends that right to assembly.

If the first amendment right to assemble extends to a digital arena, then does martial law extend there also?

Anonymous Coward says:

Simple solution

Sue all of the people involved in this fiasco and have warrants for all of their personal information done as part of discovery. Everything then becomes public record and at least 30% will be losing jobs and or spouses as a result of the revelations. They should then all become opponents of this process in the future and hopefully help make it an non issue.

That One Guy (profile) says:

"You are allowed to protest the violation of your rights only AFTER they have been violated."

Facebook knows that someone is demanding information on certain users.

The users involved do not know that someone is demanding their information.

Facebook does not have standing to challenge the demands for user information.

The users do have standing to challenge the demands for their information.

The people who know about the demands for information can’t challenge the demands, and the people who’s information is being demanded cannot challenge the demands because they aren’t told about them until after the fact(if ever).

Rulings like this are absolutely insane, as they mean that the most someone can do is protest against a violation of their rights that’s already happened, with no possibility of preventing said violation before it occurs. It’s a complete reversal of ‘Innocent until proven guilty’, as the targets are assumed guilty on accusation alone and it’s up to them to demonstrate their innocence if they want to engage in any after-the-fact damage control.

To say that this ruling is a travesty of justice is understating it greatly.

duane (profile) says:

agreement beforehand

Not that facebook necessarily wants to get in this business, but is there a way that facebook could throw in some sort of limited power of attorney or somesuch that basically says, if facebook learns that your info is being sought by x entities, you give facebook the right, but not obligation, to challenge that request for you and notify you that they are taking that action?

That One Guy (profile) says:

Re: agreement beforehand

The gag clause that agencies like to throw around would prohibit the ‘notify you’ part, but as a non-lawyer the rest of it seems like it would be feasible. Facebook wouldn’t be fighting the demands for information on their behalf, they’d be doing it on yours, even if you didn’t know it at the time.

If any actual lawyers want to weigh in on this though as to whether or not it would be viable that’d be great.

That One Guy (profile) says:

But wait, it gets worse

The Third Party Doctrine that the government loves so much states that once you hand your information to a company like Facebook it ceases to be your information, and as such the government can demand it without a warrant.

Pair the legal abomination that is the third party doctrine with a ruling like this and no-one would have standing to challenge the demand for information. It doesn’t belong to the user, it doesn’t belong to the service, so nobody would have standing to object to it being handed over to whoever demands it.

Anonymous Coward says:

privacy policy - FB standing

I read FB’s privacy policy some time ago. I am not a facebook friend as I am not a fan of their king. But, doesn’t the FB privacy policy state that all data uploaded to their site belongs to Facebook? Wouldn’t that give Facebook standing? Also, wouldn’t there be a chilling effect of having all their users learn that the US government is using a drag net for a fishing expedition into facebook’s user’s accounts? And because of that, the likely possibility that FB would then lose a large portion of their user base? That seems like standing.

This (old) article says that Facebook has a license to your data. So if an action puts the fruits of thier licensing in jeopardy then it seems they have standing. (I’m sure someone will correct me).

“Facebook has a license to use your content in any way it sees fit, with a license that goes beyond merely covering the operation of the service in its current form. Facebook can transfer or sub-license its rights over a user’s content to another company or organisation if needed. Facebook’s license does not end upon the deactivation or deletion of a user’s account, content is only released from this license once all other users that have interacted with the content have also broken their ties with it (for example, a photo or video shared or tagged with a group of friends).”

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...