Judge: No Expectation Of Privacy In User Info Voluntarily Shared With Facebook, OKs FBI’s User Data Grab

from the recording-evidence-of-your-own-crimes-is-always-a-bad-idea dept

While this ruling [PDF] is likely correct under current Fourth Amendment case law, it does raise questions about the propriety of mass data grabs that aren’t particularized to suspected criminals or investigation targets. (h/t Orin Kerr)

Tennessee resident Matthew Bledsoe was recently convicted during a jury trial for his participation in the January 6, 2021 raid of the US Capitol building. Here’s what the Justice Department has to say about Bledsoe’s actions that day:

According to the government’s evidence, in the days immediately following the Nov. 3, 2020, election, Bledsoe began posting to social media about the presidential election. On Jan. 6, 2021, he attended a rally near the Ellipse. Bledsoe then headed to the Capitol, and illegally entered the Capitol grounds shortly after 2:13 p.m. He then moved to the Capitol Building itself. He scaled a wall at the Upper Northwest Terrace and entered through a fire door at the Senate Wing. Among other things, he yelled, “In the Capitol. This is our house. We pay for this s—. Where’s those pieces of s—at?” He climbed a statue and was outside the corridor to the House Chamber and hallways near the Speaker’s Lobby. He left the building about 2:47 p.m., after approximately 22 minutes inside.

What’s not mentioned here is how the FBI began its search for Bledsoe and others like him. The FBI cast a very wide net first, using geofence warrants to obtain information on everyone in the area of the capitol building and working backwards from that haystack to open investigations on suspected insurrectionists.

Facebook received one of these requests. That’s the request that was challenged by Bledsoe — a challenge that ultimately failed. It appears the initial request did not involve a warrant. This is from Judge Beryl Howell’s decision:

As part of that investigation, and in the context of the emergency situation at the Capitol, the Federal Bureau of Investigation (“FBI”) requested from Facebook identification information for accounts using its platform to broadcast videos of this highly public event that were live-streamed or uploaded to Facebook while the account user was physically in the U.S. Capitol during the time period when the mob was storming and occupying the Capitol building. Armed with the account identifiers, in the days that followed, the FBI then sought search warrants requiring Facebook to disclose various records and content associated with the accounts that would constitute evidence of specific federal criminal law violations.

That’s exactly where it gets problematic. It was an “emergency” request, which allowed FBI to sidestep warrant requirements. And it obviously swept up plenty of people who weren’t actually committing criminal acts. Some may have just been documenting the mayhem. Others may have been near the building but not actually in it.

The FBI then worked backwards from this data haul to identify suspects. Bledsoe challenged both the initial request and the subsequent warrants, but had both challenges denied. Judge Howell’s conclusion is a single sentence, albeit one proceeding a much longer explanation of the issues. While the court does see this as a “novel Fourth Amendment issue,” it says the Fourth Amendment simply wasn’t implicated in the first request made by the FBI.

[D]efendant has not established that he had a reasonable expectation of privacy in the non-content account information disclosed by Facebook

The FBI made three requests, using the emergency disclosure provision of the Stored Communications Act. Facebook provided three responses to this request, all of them voluntary.

In response to the FBI’s request, Facebook made three separate disclosures, on January 6, January 13, and January 22, 2021, voluntarily identifying Facebook and Instagram accounts that fell within the scope of the FBI’s request. For each qualifying account responsible for streaming or uploading a video to Facebook from within the U.S. Capitol building during the January 6, 2021 attack, Facebook disclosed both an Object ID, which is a unique, numeric code assigned to any video uploaded to Facebook or Instagram Live, and an associated User ID, which is a unique numeric code assigned to each Facebook or Instagram account, identifying the account that posted content indicative of being inside the U.S. Capitol building during the January 6 breach.

The FBI searched Facebook and Instagram using these identifiers but found “no publicly available content associated with these accounts.” Actual warrants followed, compelling Facebook to turn over private content associated with these accounts.

The court’s focus is on the initial data requests, though. If that’s constitutional, it makes the subsequent searches that obtained content constitutional. Applying the Supreme Court’s Carpenter decision — one creating a warrant requirement for obtaining long-term cell site location info — the court says this is a different thing entirely, even if it also deals with third-party location records collected by Facebook.

While cell site location info (CSLI) is created involuntarily simply by having a cell phone turned on, the records generated by Bledsoe while in the US Capitol building were far more voluntary: i.e., he opened an app and began recording, affirmatively generating a wealth of data (and evidence). Had Facebook collected any location data from Bledsoe’s device while the app was inactive, it would have put him in the initial disclosures to the FBI, but the subsequent warrants would not have produced any evidence from his account.

Thus, unlike the CSLI data at issue in Carpenter, the only way that Facebook was able to determine when and where a user engaged in account activity on January 6, 2021, is by virtue of the user making an affirmative and voluntary choice to download the Facebook or Instagram application onto an electronic device, create an account on the Facebook or Instagram platform and, critically, take no available steps to avoid disclosing his location, before purposefully initiating the activity of live-streaming or uploading a video of a highly public event, in a manner that occurs during the normal course of using Facebook as intended. Defendant has not identified a single instance where Facebook logs information concerning his account activity of posting any photo or video content on the Facebook platform without user action.

That last sentence is key. So is the fact that there’s no judicial precedent that deems Facebook to be an essential part of everyday life, unlike cell phones themselves, which provide communications, internet access, and other key components of modern life.

This suppression denial will likely be appealed. As the court observed, it’s a “novel Fourth Amendment issue.” And, as such, it probably needs a second pass. Whether or not it changes anything, it will at least give the next level of judiciary system something to contemplate — not just for this case, but its implications moving forward.

Filed Under: , , , , , , ,
Companies: facebook

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Judge: No Expectation Of Privacy In User Info Voluntarily Shared With Facebook, OKs FBI’s User Data Grab”

Subscribe: RSS Leave a comment
Anonymous Coward says:


Yeah, let’s do that. Those protesters in 2020 did something as comparably heinous as enter the Capitol building to threaten lawmakers and attempt to reverse the certification of a legitimately conducted democratic federal election. Let’s make a false equivalence between active insurrectionists and screaming crowds outside of government buildings.

LostInLoDOS (profile) says:

Re: Re:

If you continue to lump a few dozens in with the thousands who did not break any law, Republicans will continue to lump the few dozens of looters, fire bombers, and anarchists.

Because 20 people breaking in and screaming to be heard is so much worse than burning a federal courthouse with people locked inside.

I won’t downplay the crimes of a small contingent of protestors on the 6th. But as I said below, stop pretending that there wasn’t violent mayhem during the BLM protests.
Acts of treason started on the left. Burning a federal building… ?

LostInLoDOS (profile) says:

Re: Re: Re:2

Which story?
The august 18 2020 firebombing of a county building that hosted federal court sessions? With people inside!
Only six of the 19 filmed criminals have been captured.

Or the few dozen people independent of the many thousands of protestors on Jan 6 who broke into and violated the sovereignty and sanctity of the capital? All of them facing trial.

And yes, I’m ignoring those who peacefully walked in through doors after the police allowed and invited them in, with restrictions on where and what of the activities. A matter for the court system to sort through as to if capital police have the power to legally have done so.

Those of us not tied to a party nor brainwashed by one or another cable commentary show; the tendency is to demand that criminal actions be prosecuted. Not passive belief.

Qwertygiy says:

This is a very different situation from the cell tower location data, for a lot of reasons, and I agree with the end result.

When you have a phone, you don’t choose to connect to specific cell towers; the device automatically does it for you. Constantly. Even when the screen is off, and you haven’t touched it in 2 hours. As long as you have the phone turned on, and are able to receive texts or calls or data, it’s pinging the nearest cell tower. You can’t anonymize the location in any way, because that would break the basic functionality of being able to receive calls.

And, at the same time, “constantly tracking your location” is not one of the many reasons a typical person would possess or use a cellphone. It’s just a technological side-effect of making a wireless connection.

But streaming to Facebook is a direct action, intentionally taken by the user. This isn’t data that was incidentally logged while the phone was in their pocket because they decided to obtain a Facebook account five years ago, and it was always tracking them the whole time. This is data that they provided by specifically choosing to document their own incrimination.

And there are plenty of ways they could have done so without sharing their location with Facebook to begin with! Photos and videos could have been taken, then uploaded at a different time, from a different place. They could have denied the Facebook app access to their location data, which would not have interfered with the intention purpose of sharing content through Facebook. They could even have used a location-spoofing app, a popular concept during the heyday of Pokemon Go, to give Facebook a false location, and their data wouldn’t have been caught up in the initial search.

It also doesn’t hurt the case that over 2,000 people are believed to have illegally entered the Capitol. I would believe that to be far more than the number of legally-present people who, upon witnessing or opposing an armed insurrection, decided that the best course of action was to post about it on social media.

So, to sum it up:

This dude gave Facebook explicit permission to track his location whenever he recorded content, even though he didn’t need to.

He then recorded himself committing federal crimes.

He then found out the consequences for his actions.

LostInLoDOS (profile) says:

Come again?

A real platform may have asked the government to present some paperwork. Gab, however, says all you need is an informal request.

Didn’t I just spend the whole ‘gab turns over user data’ getting destroyed over my commentary that like it or not there is nothing different between established platforms, that the article termed “real”, and the rest of the internet?


Does not facebook fall into the “real” category?!!!!

Personally, I say whatever.
The sooner the small percentage of protesters who broke the law that day get tried, convicted, and punished, the sooner we can move on. Because I’m past sick and tired in hearing news pretend that there was any more of a tiny violent criminal group in parallel to peaceful demonstrators at that one protest, (by people they don’t like), then every other protest over the last few years.

If you do the crime, do the time. The FBI did nothing wrong here.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...