Judge: No Expectation Of Privacy In User Info Voluntarily Shared With Facebook, OKs FBI’s User Data Grab

Privacy

from the recording-evidence-of-your-own-crimes-is-always-a-bad-idea dept

While this ruling [PDF] is likely correct under current Fourth Amendment case law, it does raise questions about the propriety of mass data grabs that aren’t particularized to suspected criminals or investigation targets. (h/t Orin Kerr)

Tennessee resident Matthew Bledsoe was recently convicted during a jury trial for his participation in the January 6, 2021 raid of the US Capitol building. Here’s what the Justice Department has to say about Bledsoe’s actions that day:

According to the government’s evidence, in the days immediately following the Nov. 3, 2020, election, Bledsoe began posting to social media about the presidential election. On Jan. 6, 2021, he attended a rally near the Ellipse. Bledsoe then headed to the Capitol, and illegally entered the Capitol grounds shortly after 2:13 p.m. He then moved to the Capitol Building itself. He scaled a wall at the Upper Northwest Terrace and entered through a fire door at the Senate Wing. Among other things, he yelled, “In the Capitol. This is our house. We pay for this s—. Where’s those pieces of s—at?” He climbed a statue and was outside the corridor to the House Chamber and hallways near the Speaker’s Lobby. He left the building about 2:47 p.m., after approximately 22 minutes inside.

What’s not mentioned here is how the FBI began its search for Bledsoe and others like him. The FBI cast a very wide net first, using geofence warrants to obtain information on everyone in the area of the capitol building and working backwards from that haystack to open investigations on suspected insurrectionists.

Facebook received one of these requests. That’s the request that was challenged by Bledsoe — a challenge that ultimately failed. It appears the initial request did not involve a warrant. This is from Judge Beryl Howell’s decision:

As part of that investigation, and in the context of the emergency situation at the Capitol, the Federal Bureau of Investigation (“FBI”) requested from Facebook identification information for accounts using its platform to broadcast videos of this highly public event that were live-streamed or uploaded to Facebook while the account user was physically in the U.S. Capitol during the time period when the mob was storming and occupying the Capitol building. Armed with the account identifiers, in the days that followed, the FBI then sought search warrants requiring Facebook to disclose various records and content associated with the accounts that would constitute evidence of specific federal criminal law violations.

That’s exactly where it gets problematic. It was an “emergency” request, which allowed FBI to sidestep warrant requirements. And it obviously swept up plenty of people who weren’t actually committing criminal acts. Some may have just been documenting the mayhem. Others may have been near the building but not actually in it.

The FBI then worked backwards from this data haul to identify suspects. Bledsoe challenged both the initial request and the subsequent warrants, but had both challenges denied. Judge Howell’s conclusion is a single sentence, albeit one proceeding a much longer explanation of the issues. While the court does see this as a “novel Fourth Amendment issue,” it says the Fourth Amendment simply wasn’t implicated in the first request made by the FBI.

[D]efendant has not established that he had a reasonable expectation of privacy in the non-content account information disclosed by Facebook…

The FBI made three requests, using the emergency disclosure provision of the Stored Communications Act. Facebook provided three responses to this request, all of them voluntary.

In response to the FBI’s request, Facebook made three separate disclosures, on January 6, January 13, and January 22, 2021, voluntarily identifying Facebook and Instagram accounts that fell within the scope of the FBI’s request. For each qualifying account responsible for streaming or uploading a video to Facebook from within the U.S. Capitol building during the January 6, 2021 attack, Facebook disclosed both an Object ID, which is a unique, numeric code assigned to any video uploaded to Facebook or Instagram Live, and an associated User ID, which is a unique numeric code assigned to each Facebook or Instagram account, identifying the account that posted content indicative of being inside the U.S. Capitol building during the January 6 breach.

The FBI searched Facebook and Instagram using these identifiers but found “no publicly available content associated with these accounts.” Actual warrants followed, compelling Facebook to turn over private content associated with these accounts.

The court’s focus is on the initial data requests, though. If that’s constitutional, it makes the subsequent searches that obtained content constitutional. Applying the Supreme Court’s Carpenter decision — one creating a warrant requirement for obtaining long-term cell site location info — the court says this is a different thing entirely, even if it also deals with third-party location records collected by Facebook.

While cell site location info (CSLI) is created involuntarily simply by having a cell phone turned on, the records generated by Bledsoe while in the US Capitol building were far more voluntary: i.e., he opened an app and began recording, affirmatively generating a wealth of data (and evidence). Had Facebook collected any location data from Bledsoe’s device while the app was inactive, it would have put him in the initial disclosures to the FBI, but the subsequent warrants would not have produced any evidence from his account.

Thus, unlike the CSLI data at issue in Carpenter, the only way that Facebook was able to determine when and where a user engaged in account activity on January 6, 2021, is by virtue of the user making an affirmative and voluntary choice to download the Facebook or Instagram application onto an electronic device, create an account on the Facebook or Instagram platform and, critically, take no available steps to avoid disclosing his location, before purposefully initiating the activity of live-streaming or uploading a video of a highly public event, in a manner that occurs during the normal course of using Facebook as intended. Defendant has not identified a single instance where Facebook logs information concerning his account activity of posting any photo or video content on the Facebook platform without user action.

That last sentence is key. So is the fact that there’s no judicial precedent that deems Facebook to be an essential part of everyday life, unlike cell phones themselves, which provide communications, internet access, and other key components of modern life.

This suppression denial will likely be appealed. As the court observed, it’s a “novel Fourth Amendment issue.” And, as such, it probably needs a second pass. Whether or not it changes anything, it will at least give the next level of judiciary system something to contemplate — not just for this case, but its implications moving forward.

Filed Under: 3rd party doctrine, 4th amendment, data, doj, fbi, matthew bledsoe, social media, warrants
Companies: facebook