Last week, after finally having a gag order lifted by a court, Facebook revealed how it had spent the last year
fighting back against an incredibly broad search warrant from the Manhattan District Attorney's office, for basically all information -- including private messages -- from 381 user accounts. The warrant came complete with a gag order forbidding the company from telling anyone -- including the 381 people -- about the search. The searches were related to an investigation that resulted in charges being filed against over 100 former NYC police and firefighters for a giant disability fraud scheme
. Basically, those retired officers faked disabilities, while their Facebook accounts supposedly revealed that their disability claims were bogus. While we're all for rooting out former government employees clearly abusing the system, we're even more worried about overly broad government intrusions like this.
Part of the issue, though, is over who has standing. As you may recall, Twitter was involved in a somewhat similar situation a few years back, when it went to court to protect
the private messages of Malcolm Harris, who was involved in some Occupy Wall St. protests. In that case, Twitter told Harris, and Harris objected, but the court said it was only an issue between the government and Twitter, so Harris had no standing. Twitter then fought the issue, but eventually lost
. The details in this case are a bit different (including the type of request -- a search warrant, rather than a 2703(d) order
in Twitter's -- case, but the basic principles are fairly similar.
Unfortunately, the law is a bit of a mess on this issue, again getting to the difficulty of applying old laws to new technologies
Orin S. Kerr, a law professor at George Washington University who is an expert on digital searches and seizures, said Facebook was trying to do something unusual in establishing a right for service providers to challenge a warrant. “The real question is, ‘Can they challenge warrants for their customers?’ And I think the answer is probably not, under current law,” Mr. Kerr said.
While some have made comparisons to last week's Supreme Court ruling
on mobile phone searches, which recognized that the digital data you store on your phone and "in the cloud" are more like the personal effects you have in your house, it's unlikely that ruling will have much of an impact here. After all, the point of that case was to tell law enforcement to "get a warrant." And, in this case, that's exactly what the DA's office did.
The bigger question may be one of due process and standing in terms of challenging these warrants. As Facebook's deputy general counsel, Chris Sonderby, explains:
Of the 381 people whose accounts were the subject of these warrants, 62 were later charged in a disability fraud case. This means that no charges will be brought against more than 300 people whose data was sought by the government without prior notice to the people affected. The government also obtained gag orders that prohibited us from discussing this case and notifying any of the affected people until now.
We’ve gone to court and repeatedly asserted that these overly broad warrants–which contain no date restrictions and allow the government to keep the seized data indefinitely–violate the privacy rights of the people on Facebook and ignore Fourth Amendment safeguards against unreasonable searches and seizures. We fought forcefully against these 381 requests and were told by a lower court that as an online service provider we didn’t even have the legal standing to contest the warrants. We complied only after the appeals court denied our application to stay this ruling, and after the prosecutor filed a motion to find us in criminal contempt.
In talking to the NY Times, Sonderby elaborated that when the DA's office said that the individuals themselves would have standing to challenge the use of the collected evidence later, that left out all of the people whose information was taken, but who weren't charged. To them, they just had their private effects searched with no recourse.
“It appeared to us from the outset that there would be a large number of people who were never charged in this case,” he said. “The district attorney’s response was that those people would have their day in court. There are more than 300 people that will never have that chance.”
In some ways, this case is a bit trickier than others. When there's probable cause, allowing law enforcement to get a warrant and do a search, makes sense. The real problem here is the incredibly broad nature of the warrants in this case, and the fact that there's really no way to challenge that
factor. Facebook has basically been told it can't challenge it. The 300 people who aren't charged have no way of challenging it. And those that were charged really can only challenge the situation involving their personal circumstances, rather than the overly broad nature of the original warrant.
It seems worth pointing out, by the way, that the warrant happened last July, about a month after the first Snowden revelations. While Facebook notes that it was the massive size of the warrant (more than 10x larger than any previous one) that made the company challenge it, it seems quite likely that the sudden attention on internet companies and their willingness to share personal information with the government played a big role in the decision as well. Chalk another one up to the Snowden Effect.