S - fd.org

Transcription

S - fd.org

Facebook, MySpace, The Joys/Dangers of Internet Social
Networks and How to Use Them as Litigation Tools
Kelly Scribner, Assistant National Litigation Support
Administrator, Office of Defender Services, Training
Branch, Oakland, CA
Alex Roberts, National Litigation Support Paralegal, Office
of Defender Services, Training Branch, Oakland, CA
&
Lou Newberger, Chief Federal Public Defender, Southern
District of West Virginia
•
•
•
•
U.S. v. Voneida, 2009 WL 2038633 (2009)
U.S. v. Scheuerman, 2009 CAAF LEXIS 812, 7-8 (C.A.A.F. 2009)
U.S. v. Drew, 259 F.R.D. 449 (CDCA 2009)
U.S. v. Suarez, 2010 WL 4226524 (2010)
Social Search Sites
• pipl.com
• wink.com
• yoname.com
• zabasearch.com
• archive.org/web/wegb.php
search.org/programs/hightech/isp/
Contains a variety of ISPs and similar
information services, specifically contacts
at the legal departments for law
enforcement service of subpoena, court
orders, and search warrants
U.S. Department of Justice
Criminal Division
Washington, D.C. 20530
CRM-200900732F
MAR
3 2010
Mr. James Tucker
Mr. Shane Witnov
Electronic Frontier Foundation
454 Shotwell Street
San Francisco, CA 94110
Dear Messrs Tucker and Witnov:
This is an interim response to your request dated October 6, 2009 for access to records
concerning "use of social networking websites (including, but not limited to Facebook, MySpace,
Twitter, Flickr and other online social media) for investigative (criminal or otherwise) or data
gathering purposes created since January 2003, including, but not limited to:
1) documents that contain information on the use of "fake identities" to "trick" users "into
accepting a [government] official as friend" or otherwise provide information to he government
as described in the Boston Globe article quoted above;
2) guides, manuals, policy statements, memoranda, presentations, or other materials
explaining how government agents should collect information on social networking websites:
3) guides, manuals, policy statements, memoranda, presentations, or other materials,
detailing how or when government agents may collect information through social networking
websites;
4) guides, manuals, policy statements, memoranda, presentations and other materials
detailing what procedures government agents must follow to collect information through socialnetworking websites;
5) guides, manuals, policy statements, memorandum, presentations, agreements (both
formal and informal) with social-networking companies, or other materials relating to privileged
user access by the Criminal Division to the social networking websites;
6) guides, manuals, memoranda, presentations or other materials for using any
visualization programs, data analysis programs or tools used to analyze data gathered from social
networks;
7) contracts, requests for proposals, or purchase orders for any visualization programs,
data analysis programs or tools used to analyze data gathered from social networks.
8) guides, manuals, policy statements, memoranda, presentations, or other materials
describing how information collected from social-networking websites is retained in government
databases or shared with other government agencies."
While processing your request, we located one record totaling 33 pages. After careful
review of this document we determined to release this item in part. We are withholding portions
of the record pursuant to the exemption in 5 U.S.C. 552(b)(6)which permits the withholding of
personnel and medical files and similar files the disclosure of which would constitute a clearly
unwarranted invasion of personal privacy. The withheld material consists of work telephone
numbers and e-mail addresses of DOJ attorneys.
We will continue to search for any additional documents that may be responsive to your
request. We estimate that it make take approximately fourteen days to complete the processing
of your request.
Although your FOIA request is the subject of litigation, I am nonetheless required by
regulation to inform you that you that you have a right to an to an administrative appeal of this
partial denial of your request. Your appeal should be addressed to: The Office of Information
Policy, United States Department of Justice, 1425 New York Ave., NW, Suite 11050,
Washington, DC 20530-0001. Both the envelope and the letter should be clearly marked with
the legend "FOIA Appeal." Department regulations provide that such appeals must be received
by the Office of Information Policy within sixty days of the date of this letter.
Sincerely,
Rena Y. Kim, Chief
Freedom of Information/Privacy Act Unit
Office of Enforcement Operations
Criminal Division
Obtaining and Using Evidence from
Social Networking Sites
Facebook, MySpace, Linkedln, and More
John Lynch
Deputy Chief, Computer Crime
Computer Crime & Intellectual Property Section
Jenny Ellickson
Trial Attorney
AGENDA
SSSSSS^'
Introduction to Social Networking Sites
Overview of Key Social Networking Sites
Additional Legal and Practical Issues
li, Compe
urt Crime& Intellectual Property Section
Introduction to Social Networking
OF ONLINE SOCIAL NETWORKS
1997
SixDegrees.com
2003
Friendster, Linkedln
2004
MySpace
2005
Facebook
2008
Twitter
li, Computer Crime & Intellectual Property Section
POPULAR SOCIAL NETWORKS
Worldwide: Facebook
U.S. and Canada: MySpace, Linkedln, Twitter
Europe: MySpace, Twitter, Hi5, V Kontakte
Latin America: Hi5, Orkut, Tagged
Asia: QQ, Friendster, Xiaonei, Orkut, Mixi, Hi5
Middle East and Africa: Maktoob, Hi5
LDM
SM Cyworld
£ Facetaook
SI Friendsfer.,
IS'
19 Hi£
B Hyves'-i^ ^• Iwivsfr-**"'
H Lide
S Makloob
B Mixi
• MySpace
• Nasza-klssa
S Odnoklassniki
@ One
• Orkut
• QQ
Sky rock
" V Kontakte
11 Wtetch
H Zing
wmvitcosix
%
.MB
ft?
O-if
Creaiod on Many Eyas (http-.ffmaay»cy«s.eom'!<S)fBM
Image c o u r t e s y Vincenzo Cosenza fwww.vincos.it), data based on Alexa and Google Trends
POPULARITY IN THE UNITED STATES
Most-visited websites in the U-S. (August 2009)
1. Google
2. Yahoo
3. Facebook
4. YouTube
5. MySpace
•• •
13. Twitter
•
•
•
27. Linkedln
Source: Alexa.com - August 12, 2009 list of Top 100 websites in United States.
THE BASICS
Most
•
•
•
•
•
social-networking sites allow users to:
Create personal profiles
Write status updates or blog entries
Post photographs, videos, and audio clips
Send and receive private messages
Link to the pages of others (i.e., "friends")
How
•
•
•
can LE obtain data from these sites?
Some info may be public
UseijECPA to get info from providers 0
Undercover operations? ( ?
UTILITY IN CRIMINAL CASES
Evidence from social-networking sites can \ J
Reveal personal communications
Establish motives and personal relationships
Provide location information
Prove and disprove alibis
Establish crime or criminal enterprise
Also: instrumentalities or fruits of crime.
AGENDA
FACEBOOK
Founded in 2004, primarily catering to students
Now over 250m active members worldwide
Over 10b photos in Oct 2008; adds over 1b monthly
Applications run on Facebook platform
True names encouraged but not guaranteed
Privacy model is highly granular; present different
information to different groups or individual users
Messaging includes mail, real-time chat, "wall"
Now used in private background checks
Koobface - virus/worm vector
I
FACEBOOK
Demi Moore J Faeebook - Microsoft Internet Explorer provided by Criminal Division
{¡^jjjjf
Rie
ft-vi.iâj
gdit
Viäw
http://www.faceboo(c.com,'d£mirnoore
Favorites
Tocfs
tm
±L
ideJp
Qh Convert • J5?Se/ect
v
D " # ~ £>Ea3« v ©Tfiols ^
icebookto connectwrth Demi Moore.
Demi Moore
WaH Info Photos YouTube Box
fío t e s
Just fvBJIS
Demi M o o r e Is checking out the S p r e a d * trailer
Apple - Movie Trailers - Spread
SPRGADfcz ¡resh. f i i a i r&tv i*:*. i i th« frsii
di'ipgyg y&jt '.^¿yto3 Sfe c-r pricks* In Los Ang^feo. Co*i
fir*toy - ~Tur«yv«iyWe" abwat e $cnj«iUG y ^hc. s'mm
WW»! si orite tc- I e x a c i i y as hs
...
V
h*
•Atìit foii
yjnt 25 at i:2£pm
06 ring, Jasmynr Richard and 1,927 oHierslte this,
i p VI&v a8 437 comments
Demi M o o r e Pis help get the word out 1 In a Americans is at risk of hunger. Join a
community that cares. Go to v^w.faceb0ok.com/kelioggcares and become a FAN
to hefp end US hunger. Watch the video befow that w e crested with all ofYOUH Let
m e know how you like i t . >,
mm
s u a
H »foLbwlrflVideo, prrijced in KataJyst h pas tramp with
I b? Ocfiii Mra % fca-tees umwm «la!
tófoppard directed b
¿Y people inoied ÍÚ ^--J h-.r---'^
Os
îPiiïs Hcorri posted <m the» «unteti« T«itte finde aw
^(ibotì.
iiïi!"-",fea prend supplì«; -.vi
. Please did. gis veik-.v K^Hoac sbo
tap assoit tHs irirsíH» orne bi dont**toíwéri»
í ditïèriîyre.
© Internet | Protected Mods Off
100%
FACEBOOK
FACEBOOK
who
oi< rjcci>L?ok
m""""""
i r i n d t h i. ugi't-aitr
\ou Tntia v. il al
..„„»A-,. -»•'*•">« <r,
b<-
3 Who Cart See This?
& Who Can Find You m1 Facebook?
Friends
0
Everyone on Facebook
ti
Q Friends of Friends
fne-sis arid
Friend s
-h !':' is: '2i S' C Hi'-
this.
O Only Friends
@ Friends of Friends
p
frssiEts csii see
£j!%friendE eas see this,
KS-T S-tìii til
O Some Friends
o C"-OnlyhFriendsc-"." ics- m
Choose. specific fri6."r ¡is vvho tjw 56« tinsm
© Only Me
Or«fy v»a -and seisci-gd mstworte <w* »«» this.
Networks
/
j
;
m
m
'•¿a
»1
Networks
All of Vly Networks
Some of My Networks.«,
None of My Networks
f~ N one of MTNetyrorks"^" " j f f i f
Cancel
utt is available outside of.Föteboök*
n
3J
Ml
ü
11
u
^ © Except These People
É
• Type the name of a friend or friend list..
Cancel
GETTING INFO FROM FACEBOOK
Data is organized by user ID or group ID
Standard data productions (per LE guide):
Neoprint, Photoprint, User Contact Info,
Group Contact Info, IP Logs
HOWEVER, Facebook has other data available.
Often cooperative with emergency requests.
7
MYSPACE
Founded 2003, now owned by Fox Interactive Media
2006: Most popular SN; passed by Facebook in 2008
Currently tens of millions of active users monthly
True names less encouraged than Facebook
Messaging through messages, chat, friend updates
Application platform rolled out early 2008
Young user base, history of child safety concerns
Privacy is currently less granular than Facebook
MYSPACE
i ^ p . T o p Model
i
http://www.my5pace.corn/glamazoril.
File
Edit
View
Convert
tì?
•»•
<&.
Home
Favorites
look
*',
co I El IwiOmi
H1.
fi
'I
Help
Select
0}
Top Model Michelle (Michelle Fairplay) | M|ySpace
Browse Psnote
Find
friends
locai
Huste
Video
Games
Ë3 '
#
' & E a g e - i i | Tools-r
Login
Unter
Model Michelle
Sign Up
w w w. myspace.comptamazcn1
Send Message
evi Favorite bands MiitansiresiGo checkthem
out\maz'mg? Mood: amorous @ st c-:1B PM Jul 2<vlsw msts
Addita Friends
C§> Add Comment
Miche e Fairpiay
23 ( F mate
Virgin a, US
Last ' «gm: 2M1/2ÖQ9
Status and Mood
MfchEle Fairplay My new Favorite bandH Miilionairesi Go checfcthem oat..amazing!
Mood: amorous @ it
Fit Jul 24
Michelle Fairplay rvs lost a 1/2 Inch off my hips"
Mood: exhausted (§) at!:02PlSJr:ri5
Michelle Fairplay is eating Special K and working out..
Hood: taijhied© il ¡»:«i ,=tf Ji! ts
Michete Fairplay Is getting ready to sign a contract that could change my life?. Hello Shanghai ChlnaS
Mood: accomplished
it 12:«
Jsi 5
Just Got Pakl Lets Get Laid
\:MlUJOMMR6S. (cai us
I
Michelle Fairplay maybe packing her bags 3con...giggle...
I.lood: accomplished© at ii:24 B.< Jul 7
Interests
General
#
Internet | Protected Mode: Off
<3UOO?<
0
MYSPACE
Izzybelle
lust Am>
Sometime
&LAÖ*VA1AN.A
Acc^ber
W
Isabelle
Wonders
Jl j,%B[if*e tei!
JÉ*
wm
b.EX >" FCJOH
&
rraz,trice
^
Ii «CG trico
Laura
GaLaV%
i W ^ a
jennifer
babygirl nieve
GETTING INFO FROM MYSPACE
Many profiles have public content.
Data is organized by FriendID -f see LE guide.
MySpace requires a search warrant for private
messages/bulletins less than 181 days old
• Also considers friend lists to be stored content'
Data retention times
User info and stored files - indefinitely
5
^
IP logs, info for deleted accounts - 1 year J
/
Market leader in "micro-blogging"
Began in mid-2006 as "status message" service
Ubiquity and ease of updating, but limited space
Breaking news, real-time updates: USAir, Iran
Most multimedia handled by 3d party links
Simplified privacy model: updates public or private
Direct messages are private; sender can delete
Short URLs used to serve malicious links and code
TWITTER
mUE&J
""—-fe••
¿ J a l f
:
Edit
^Convert
S
<&
•
' ~
~
¿¿£
.li .
.: h t t p : / / t w i t t e r . c o m / d i a b l o c o d y
~s3fa&aaB!B
£ile
.
View
* §
—
Favorites
Jools
¡iiiinnnrr
Help
Select
I Q Brook Busey (diablocody) o n T w î t t e r
®
fH
-
S
'
#
-
© P a g e '
# T o o l s -
Verified Account
Hame Brook Busey
Bio Blame it on the a-a-a-aalcohol.
130 90=507
fcisovjincf folinv.'e-rs
# u n popularsto res
1,595
I KÄwfsaas (rosi -.-ä' -b
Halved Foods #ynpopularstores
7 iriniMe
ircf-i
RT @seraflnowicz I love the Transformer who changes into a hotel
lobby - Receptfcon
11 irfeutes sts irctvi '.vsf@fceUyoxforo @lotiisvirtel I think kids should be taught the True
Alphabet: R,S,T,N,L and E.
I endorse this sentiment heartily. RT @tainnwiison fart noise
stout 1 heur agj Han -'««b
View All..
© PS
. S fwa of äisb i~cod>'j -U-c-st?
Potatoes, Tabasco and Dos Equis for ray hangover.
stout» m;ars. fern .v' e-D
@ Internet | Protected Mode Off
«(.100% -
GETTING INFO FROM TWITTER
The good news
• Most Twitter content is public
• Private messages kept until user deletes them
The bad news
• No contact phone number
• Only retain last login IP ^
• Will not preserve data without legal process
• Stated policy of producing data only in \
response to legal process (i.e., no 2702) J
• No Law Enforcement Guide
\
LINKEDIN
Business-focused with enforced limits to interaction
Profiles focused on education and work experience
Use for criminal communications appears limited
But can be used to identify experts
Can check background of defense experts
Privacy model similar to Facebook
Profile information is not checked for reliability
LINKEDIN
j n V J i y K I http://wvwY,linlc£din.com/in/b3rackob3m3?PHPSESSID=3acd0526a08c81agfc560b34Q
T
1 ^^SmH.îiI ¡na—ì
File
Edit
View
r~T*mriri.rrt." r. -n-irrn-r-mmi "
Favorites
Tools
SwnÀ/.-i
-""nil i'r •••••—.iirr ¡.•i'.Vir.iü»snTiiiii iiri'n^riiirlii;i'iiÎM\rrnïïi^TT7iT7TT:iiiVifafiiLim'miTïîmîiyinnnnrTi^tiiVH'inTr^ —rrm-
p
Help
% Convert - Q Select
•
Current
Past
President at United States of America
US Senator at US Senate (tL-D)
Senior Lecturer in Law at University of Chicago
Law School
State Senator at Illinois State Senate
Education
Connections
Industry
Websites
Harvard University
Columbia University in the City of New York
Occidental College
(p?l 500+connections
Government Administration
• White House website
• Join Barsens Linkedln Group
. MyRSSfeed
©
•
Public profile powered by:
y » Page »
Linked | | |
Create a public profile: Sign In or Join How
View Barack Obama's full profile:
• See who you and Barack Obama know In
common
• Get introduced to Barack Obama
• Contact Baractc O&ama directly
View Full Profile.
j
Name Search:
Search for people you knowfrom over 40 million
professionals already on Linkedln.
Done
@ Internet | Protected Mode: Off
Tools •
-!l
Social networking sites increasingly adopting
federated identity schemes
o OpenID, Facebook Connect
Facebook, MySpace, Yahoo!, and Google actas1
iderrtityja^
mode
Example: A user can log in to a Facebook account
using Google credentials
o After a link is established between two accounts, Google
will check and vouch for identity of its user
o Authentication information split from activity information
o In turn, a Facebook login may be used to authenticate to
sjtesjusiag "Facebook Connect"
/
If^ttn^tion^ is necessary, must determine identit
provider - not simply the domain.
-
a
TERMS OF SERVICE I PRIVACY POLICIES
Social networks have extensive terms of
service and privacy policies
J
o Most permit^^^e
LE
^^
o All specify exceptions to respond to legal process
and protect service against fraud/damage
^
can failure to follow TOS
render access unauthorized under 1030?
U.S. v: Drew-
o Employment policy cases tend to say yes
o But concerns that transforms TOS into private
criminal code for site misconduct
Legal and Practical Issues
DOES THEPPA APPLY?
Growth of social networks raises questions
of breadth of PPA
o Is Facebook/Twitter a "similar form of
communication" to a newspaper, book,
broadcast? (Ashton Kutcher? CNNbrk? Iran?)
o No easy answers, but look to intent to \ <?
communicate news to sizable audience
o In many cases, Guest v. Le/s rule will be
sufficient; CCIPS can help with analysis
Congress continues to examine media shield
UNDERCOVER OPERATIONS
n\
Why go undercover on Facebook, MySpace,
etc?
• Communicate with suspects/targets
• Gain access to non-public info
• Map social relationships/networks
Undercover operations after U.S. v. Drew
If agents violate terms of service, is thaiV-x
"otherwise illegal activity"?
WITNESSES & SOCIAL NETWORKS
\
Many witnesses have social-networking pages V
• Valuable source of info on defense witnesses
• Potential pitfalls for government witnesses
Knowledge is power
• Research all witnesses on social-networking sites
• Discovery obligations?
Advise your witnesses:
• Not to discuss cases on social-networking sites
• To think carefully about what they post
J
OTHER COURTROOM ISSUES
Social networking and the courtroom
can be a dangerous combination
• Use caution in "friending" judges, defense counsel
• Warn jurors about social-networking sites
Social networking + mobile devices =
real-time updates on courtroom events
C C I P S Duty Line: 2 0 2 - 5 1 4 - 1 0 2 6
John Lynch
B6
Jenny Ellickson
Q-
DEPRECATED
The author's
user ID.
The author of the tweet. This
embedded object can get out of sync.
Number of tweets
this user has.
Whether this user has geo
enabled (http://bit.ly/4pFY77).
The geo tag on this tweet in
GeoJSON (http://bit.ly/b8L1Cp).
The tweet's unique ID. These
IDs are roughly sorted &
developers should treat them
as opaque (http://bit.ly/dCkppc).
Text of the tweet.
Consecutive duplicate tweets
are rejected. 140 character
max (http://bit.ly/4ud3he).
{"id"=>12296272736,
"text"=>
"An early look at Annotations:
http://groups.google.com/group/twitter-api-announce/browse_thread/thread/fa5da2608865453",
Tweet's
"created_at"=>"Fri Apr 16 17:55:46 +0000 2010",
creation
"in_reply_to_user_id"=>nil,
date.
The ID of an existing tweet that
"in_reply_to_screen_name"=>nil,
this tweet is in reply to. Won't
"in_reply_to_status_id"=>nil
be set unless the author of the
The screen name &
"favorited"=>false,
referenced tweet is mentioned.
user
ID
of
replied
to
Truncated to 140
"truncated"=>false,
tweet author.
characters. Only
"user"=>
The author's
possible
from
SMS.
{"id"=>6253282,
user name.
The author's
"screen_name"=>"twitterapi",
biography.
The
author's
"name"=>"Twitter API",
screen name.
"description"=>
"The Real Twitter API. I tweet about API changes, service issues and
happily answer questions about Twitter and our API. Don't get an answer? It's on my website.",
The author's
"url"=>"http://apiwiki.twitter.com",
URL.
"location"=>"San Francisco, CA",
The author's "location". This is a free-form text field, and
"profile_background_color"=>"c1dfee",
there are no guarantees on whether it can be geocoded.
"profile_background_image_url"=>
"http://a3.twimg.com/profile_background_images/59931895/twitterapi-background-new.png",
Rendering information
"profile_background_tile"=>false,
for the author. Colors
"profile_image_url"=>"http://a3.twimg.com/profile_images/689684365/api_normal.png",
are encoded in hex
"profile_link_color"=>"0000ff",
values (RGB).
"profile_sidebar_border_color"=>"87bc44",
The creation date
"profile_sidebar_fill_color"=>"e0ff92",
for this account.
Whether this account has
"profile_text_color"=>"000000",
contributors enabled
"created_at"=>"Wed May 23 06:01:13 +0000 2007",
(http://bit.ly/50npuu).
"contributors_enabled"=>true,
Number of
"favourites_count"=>1,
favorites this
Number of
"statuses_count"=>1628,
user has.
users this user
"friends_count"=>13,
is following.
The timezone and offset
"time_zone"=>"Pacific Time (US & Canada)",
(in seconds) for this user.
"utc_offset"=>-28800,
"lang"=>"en",
The user's selected
"protected"=>false,
language.
"followers_count"=>100581,
"geo_enabled"=>true,
Whether this user is protected
"notifications"=>false,
DEPRECATED
or not. If the user is protected,
Number of
"following"=>true,
in this context
then this tweet is not visible
followers for
"verified"=>true},
Whether this user
except to "friends".
this user.
"contributors"=>[3191321],
has a verified badge.
"geo"=>nil,
"coordinates"=>nil,
DEPRECATED
The contributors' (if any) user
"place"=>
The place ID
IDs (http://bit.ly/50npuu).
{"id"=>"2b6ff8c22edd9576",
"url"=>"http://api.twitter.com/1/geo/id/2b6ff8c22edd9576.json",
The URL to fetch a detailed
"name"=>"SoMa",
The printable names of this place
polygon for this place
"full_name"=>"SoMa, San Francisco",
"place_type"=>"neighborhood",
The type of this
"country_code"=>"US",
place - can be a
"country"=>"The United States of America",
The place associated with this
"neighborhood"
"bounding_box"=>
Tweet (http://bit.ly/b8L1Cp).
or "city"
{"coordinates"=>
[[[-122.42284884, 37.76893497],
[-122.3964, 37.76893497],
The country this place is in
[-122.3964, 37.78752897],
[-122.42284884, 37.78752897]]],
"type"=>"Polygon"}},
"source"=>"web"}
The application
The bounding
that sent this
box for this
Map of a Twitter Status Object
tweet
place
Raffi Krikorian <[email protected]>
18 April 2010
THE PHILADELPHIA BAR ASSOCIATION
PROFESSIONAL GUIDANCE COMMITTEE
Opinion 2009-02
(March 2009)
The inquirer deposed an 18 year old woman (the “witness”). The witness is not a party
to the litigation, nor is she represented. Her testimony is helpful to the party adverse to
the inquirer’s client.
During the course of the deposition, the witness revealed that she has “Facebook” and
“Myspace” accounts. Having such accounts permits a user like the witness to create
personal “pages” on which he or she posts information on any topic, sometimes
including highly personal information. Access to the pages of the user is limited to
persons who obtain the user’s permission, which permission is obtained after the user is
approached on line by the person seeking access. The user can grant access to his or
her page with almost no information about the person seeking access, or can ask for
detailed information about the person seeking access before deciding whether to allow
access.
The inquirer believes that the pages maintained by the witness may contain information
relevant to the matter in which the witness was deposed, and that could be used to
impeach the witness’s testimony should she testify at trial. The inquirer did not ask the
witness to reveal the contents of her pages, either by permitting access to them on line
or otherwise. He has, however, either himself or through agents, visited Facebook and
Myspace and attempted to access both accounts. When that was done, it was found
that access to the pages can be obtained only by the witness’s permission, as
discussed in detail above.
The inquirer states that based on what he saw in trying to access the pages, he has
determined that the witness tends to allow access to anyone who asks (although it is
not clear how he could know that), and states that he does not know if the witness
would allow access to him if he asked her directly to do so.
The inquirer proposes to ask a third person, someone whose name the witness will not
recognize, to go to the Facebook and Myspace websites, contact the witness and seek
to “friend” her, to obtain access to the information on the pages. The third person
would state only truthful information, for example, his or her true name, but would not
reveal that he or she is affiliated with the lawyer or the true purpose for which he or she
is seeking access, namely, to provide the information posted on the pages to a lawyer
for possible use antagonistic to the witness. If the witness allows access, the third
person would then provide the information posted on the pages to the inquirer who
would evaluate it for possible use in the litigation.
©2009 The Philadelphia Bar Association
All Rights Reserved
1
The inquirer asks the Committee’s view as to whether the proposed course of conduct
is permissible under the Rules of Professional Conduct, and whether he may use the
information obtained from the pages if access is allowed.
Several Pennsylvania Rules of Professional Conduct (the “Rules”) are implicated
in this inquiry.
Rule 5.3. Responsibilities Regarding Nonlawyer Assistants provides in part that,
With respect to a nonlawyer employed or retained by or associated with a lawyer:…
(c) a lawyer shall be responsible for conduct of such a person that would be a violation
of the Rules of Professional Conduct if engaged in by a lawyer if:
(1) the lawyer orders or, with the knowledge of the specific conduct,
ratifies the conduct involved; …
Since the proposed course of conduct involves a third person, the first issue that must
be addressed is the degree to which the lawyer is responsible under the Rules for the
conduct of that third person. The fact that the actual interaction with the witness would
be undertaken by a third party who, the committee assumes, is not a lawyer does not
insulate the inquirer from ethical responsibility for the conduct.
The Committee cannot say that the lawyer is literally “ordering” the conduct that would
be done by the third person. That might depend on whether the inquirer’s relationship
with the third person is such that he might require such conduct. But the inquirer plainly
is procuring the conduct, and, if it were undertaken, would be ratifying it with full
knowledge of its propriety or lack thereof, as evidenced by the fact that he wisely is
seeking guidance from this Committee. Therefore, he is responsible for the conduct
under the Rules even if he is not himself engaging in the actual conduct that may violate
a rule. (Of course, if the third party is also a lawyer in the inquirer’s firm, then that
lawyer’s conduct would itself be subject to the Rules, and the inquirer would also be
responsible for the third party’s conduct under Rule 5.1, dealing with Responsibilities of
Partners, Managers and Supervisory Lawyers.)
Rule 8.4. Misconduct provides in part that,
It is professional misconduct for a lawyer to:
(a) violate or attempt to violate the Rules of Professional Conduct, knowingly assist or
induce another to do so, or do so through the acts of another; …
(c) engage in conduct involving dishonesty, fraud, deceit or misrepresentation; …
All Rights Reserved
2
Turning to the ethical substance of the inquiry, the Committee believes that the
proposed course of conduct contemplated by the inquirer would violate Rule 8.4(c)
because the planned communication by the third party with the witness is
deceptive. It omits a highly material fact, namely, that the third party who asks to
be allowed access to the witness’s pages is doing so only because he or she is
intent on obtaining information and sharing it with a lawyer for use in a lawsuit to
impeach the testimony of the witness. The omission would purposefully conceal
that fact from the witness for the purpose of inducing the witness to allow access,
when she may not do so if she knew the third person was associated with the
inquirer and the true purpose of the access was to obtain information for the
purpose of impeaching her testimony.
The fact that the inquirer asserts he does not know if the witness would permit
access to him if he simply asked in forthright fashion does not remove the
deception. The inquirer could test that by simply asking the witness forthrightly for
access. That would not be deceptive and would of course be permissible.
Plainly, the reason for not doing so is that the inquirer is not sure that she will
allow access and wants to adopt an approach that will deal with her possible
refusal by deceiving her from the outset. In short, in the Committee’s view, the
possibility that the deception might not be necessary to obtain access does not
excuse it.
The possibility or even the certainty that the witness would permit access to her pages
to a person not associated with the inquirer who provided no more identifying
information than would be provided by the third person associated with the lawyer does
not change the Committee’s conclusion. Even if, by allowing virtually all would-be
“friends” onto her FaceBook and MySpace pages, the witness is exposing herself to
risks like that in this case, excusing the deceit on that basis would be improper.
Deception is deception, regardless of the victim’s wariness in her interactions on the
internet and susceptibility to being deceived. The fact that access to the pages may
readily be obtained by others who either are or are not deceiving the witness, and that
the witness is perhaps insufficiently wary of deceit by unknown internet users, does not
mean that deception at the direction of the inquirer is ethical.
The inquirer has suggested that his proposed conduct is similar to the common -and ethical -- practice of videotaping the public conduct of a plaintiff in a personal injury
case to show that he or she is capable of performing physical acts he claims his injury
prevents. The Committee disagrees. In the video situation, the videographer simply
follows the subject and films him as he presents himself to the public. The
videographer does not have to ask to enter a private area to make the video. If he did,
then similar issues would be confronted, as for example, if the videographer took a
hidden camera and gained access to the inside of a house to make a video by
presenting himself as a utility worker.
All Rights Reserved
3
Rule 4.1. Truthfulness in Statements to Others provides in part that,
In the course of representing a client a lawyer shall not knowingly:
(a) make a false statement of material fact or law to a third person; …
The Committee believes that in addition to violating Rule 8.4c, the proposed conduct
constitutes the making of a false statement of material fact to the witness and therefore
violates Rule 4.1 as well.
Furthermore, since the violative conduct would be done through the acts of another third
party, this would also be a violation of Rule 8.4a. 1
The Committee is aware that there is controversy regarding the ethical propriety of a
lawyer engaging in certain kinds of investigative conduct that might be thought to be
deceitful. For example, the New York Lawyers’ Association Committee on Professional
Ethics, in its Formal Opinion No. 737 (May, 2007), approved the use of deception, but
limited such use to investigation of civil right or intellectual property right violations
where the lawyer believes a violation is taking place or is imminent, other means are not
available to obtain evidence and rights of third parties are not violated.
1
The Committee also considered the possibility that the proposed conduct would violate Rule 4.3,
Dealing with Unrepresented person, which provides in part that
(a) In dealing on behalf of a client with a person who is not represented
by counsel, a lawyer shall not state or imply that the lawyer is
disinterested . . .
(c) When the lawyer knows or reasonably should know that the
unrepresented person misunderstands the lawyer’s role in the matter the
lawyer should make reasonable efforts to correct the misunderstanding.
Since the witness here is unrepresented this rule addresses the interactions between her and the
inquirer. However, the Committee does not believe that this rule is implicated by this proposed course of
conduct. Rule 4.3 was intended to deal with situations where the unrepresented person with whom a
lawyer is dealing knows he or she is dealing with a lawyer, but is under a misapprehension as to the
lawyer’s role or lack of disinterestedness. In such settings, the rule obligates the lawyer to insure that
unrepresented parties are not misled on those matters. One might argue that the proposed course here
would violate this rule because it is designed to induce the unrepresented person to think that the third
person with whom she was dealing is not a lawyer at all (or lawyer’s representative), let alone the
lawyer’s role or his lack of disinterestedness. However, the Committee believes that the predominating
issue here is the deception discussed above, and that that issue is properly addressed under Rule 8.4.
All Rights Reserved
4
Elsewhere, some states have seemingly endorsed the absolute reach of Rule 8.4. In
People v. Pautler, 47 P. 3d 1175 (Colo. 2002), for example, the Colorado Supreme
Court held that no deception whatever is allowed, saying,
“Even noble motive does not warrant departure from the rules of Professional
Conduct. . . We reaffirm that members of our profession must adhere to the
highest moral and ethical standards. Those standards apply regardless of
motive. Purposeful deception by an attorney licensed in our state is intolerable,
even when undertaken as a part of attempting to secure the surrender of a
murder suspect. . . . Until a sufficiently compelling scenario presents itself and
convinces us our interpretation of Colo. RPC 8.4(c) is too rigid, we stand resolute
against any suggestion that licensed attorneys in our state may deceive or lie or
misrepresent, regardless of their reasons for doing so. “ The opinion can be
found at http://www.cobar.org/opinions/opinion.cfm?opinionid=627&courtid=2
The Oregon Supreme Court in In Re Gatti, 8 P3d 966 (Ore 2000), ruled that no
deception at all is permissible, by a private or a government lawyer, even
rejecting proposed carve-outs for government or civil rights investigations,
stating,
“The Bar contends that whether there is or ought to be a prosecutorial or some
other exception to the disciplinary rules is not an issue in this case. Technically,
the Bar is correct. However, the issue lies at the heart of this case, and to ignore
it here would be to leave unresolved a matter that is vexing to the Bar,
government lawyers, and lawyers in the private practice of law. A clear answer
from this court regarding exceptions to the disciplinary rules is in order.
As members of the Bar ourselves -- some of whom have prior experience as
government lawyers and some of whom have prior experience in private practice -- this
court is aware that there are circumstances in which misrepresentations, often in the
form of false statements of fact by those who investigate violations of the law, are useful
means for uncovering unlawful and unfair practices, and that lawyers in both the public
and private sectors have relied on such tactics. However, . . . [f]aithful adherence to the
wording of [the analog of Pennsylvania’s Rule 8.4], and this court's case law does not
permit recognition of an exception for any lawyer to engage in dishonesty, fraud, deceit,
misrepresentation, or false statements. In our view, this court should not create an
exception to the rules by judicial decree.“ The opinion can be found at
http://www.publications.ojd.state.or.us/S45801.htm
Following the Gatti ruling, Oregon’s Rule 8.4 was changed. It now provides:
“(a) It is professional misconduct for a lawyer to: . . . (3) engage in conduct involving
dishonesty, fraud, deceit or misrepresentation that reflects adversely on the lawyer’s
fitness to practice law.
All Rights Reserved
5
(b) Notwithstanding paragraphs (a)(1), (3) and (4) and Rule 3.3(a)(1), it shall not be
professional misconduct for a lawyer to advise clients or others about or to supervise
lawful covert activity in the investigation of violations of civil or criminal law or
constitutional rights, provided the lawyer's conduct is otherwise in compliance with
these Rules of Professional Conduct. ‘Covert activity,’ as used in this rule, means an
effort to obtain information on unlawful activity through the use of misrepresentations
or other subterfuge. ‘Covert activity’ may be commenced by a lawyer or involve a
lawyer as an advisor or supervisor only when the lawyer in good faith believes there
is a reasonable possibility that unlawful activity has taken place, is taking place or will
take place in the foreseeable future. “
Iowa has retained the old Rule 8.4, but adopted a comment interpreting the Rule to
permit the kind of exception allowed by Oregon.
The Committee also refers the reader to two law review articles collecting other
authorities on the issue. See Deception in Undercover Investigations: Conduct Based
v. Status Based Ethical Analysis, 32 Seattle Univ. L. Rev.123 (2008), and Ethical
Responsibilities of Lawyers for Deception by Undercover Investigators and
Discrimination Testers: An Analysis of the Provisions Prohibiting Misrepresentation
under Model Rules of Professional Conduct, 8 Georgetown Journal of Legal Ethics 791
(Summer 1995).
Finally, the inquirer also requested the Committee’s opinion as to whether or not, if he
obtained the information in the manner described, he could use it in the litigation. The
Committee believes that issue is beyond the scope of its charge. If the inquirer
disregards the views of the Committee and obtains the information, or if he obtains it in
any other fashion, the question of whether or not the evidence would be usable either
by him or by subsequent counsel in the case is a matter of substantive and evidentiary
law to be addressed by the court.
CAVEAT: The foregoing opinion is advisory only and is based upon the facts set forth
above. The opinion is not binding upon the Disciplinary Board of the Supreme Court of
Pennsylvania or any other Court. It carries only such weight as an appropriate
reviewing authority may choose to give it.
All Rights Reserved
6
Attachment
Proposed Model Jury Instructions
The Use of Electronic Technology to Conduct Research on
or Communicate about a Case
Prepared by the Judicial Conference Committee on
Court Administration and Case Management
December 2009
Before Trial:
You, as jurors, must decide this case based solely on the evidence presented here
within the four walls of this courtroom. This means that during the trial you must not
conduct any independent research about this case, the matters in the case, and the
individuals or corporations involved in the case. In other words, you should not consult
dictionaries or reference materials, search the internet, websites, blogs, or use any other
electronic tools to obtain information about this case or to help you decide the case. Please
do not try to find out information from any source outside the confines of this courtroom.
Until you retire to deliberate, you may not discuss this case with anyone, even your
fellow jurors. After you retire to deliberate, you may begin discussing the case with your
fellow jurors, but you cannot discuss the case with anyone else until you have returned a
verdict and the case is at an end. I hope that for all of you this case is interesting and
noteworthy. I know that many of you use cell phones, Blackberries, the internet and other
tools of technology. You also must not talk to anyone about this case or use these tools to
communicate electronically with anyone about the case. This includes your family and
friends. You may not communicate with anyone about the case on your cell phone,
through e-mail, Blackberry, iPhone, text messaging, or on Twitter, through any blog or
website, through any internet chat room, or by way of any other social networking
websites, including Facebook, My Space, LinkedIn, and YouTube.
At the Close of the Case:
During your deliberations, you must not communicate with or provide any
information to anyone by any means about this case. You may not use any electronic
device or media, such as a telephone, cell phone, smart phone, iPhone, Blackberry or
computer; the internet, any internet service, or any text or instant messaging service; or
any internet chat room, blog, or website such as Facebook, My Space, LinkedIn, YouTube
or Twitter, to communicate to anyone any information about this case or to conduct any
research about this case until I accept your verdict.
NEW CLIENT SOCIAL MEDIA CHECKLIST
G
Does clt have mobile device (ie. cell phone, iphone, blackberry, etc.)
#
Does clt use mobile device to send text messages
#
Does clt use mobile device to access the internet
#
Does clt use mobile device to access any social networking sites
G
Is clt on Facebook or MySpace (same questions should be asked for both)
#
Does clt accept anyone as friend by default or are do they review requests
#
Does clt allow the public to see their profile and postings (what are clt’s privacy
settings)
#
Is clt friend with anybody involved in this case
#
Has clt already posted or discussed anything related to the case on their page (ie.
messages, links, photos, etc.)
Warn clt not to discuss case on Facebook and explain why (friends may be govt
snitch/Govt can use it against clt)
Warn clt not to discuss case with any potential witness (may be violation of bond;
potential obstruction of justice; potential threats )
Warn clt not to discuss witnesses nor make reference to witness (may be obstruction of
justice; potential threats)
i
i
i
G
i
i
i
G
G
G
G
G
Does clt use Twitter
#
Who does client follow
#
Who follows client
#
Has client tweeted about the case
#
Has client received any tweets about the case
#
Does client allow the public to follow their tweets (what are clt’s privacy settings)
Advise clt re: public nature of tweets and how cannot control where/to whom they are
forwarded
Warn clt not to discuss case on Twitter and explain why (friends may be govt
snitch/Govt can use it against clt)
Warn clt not to discuss case with any potential witness (may be violation of bond;
potential obstruction of justice; potential threats)
Warn clt not to discuss witnesses nor make reference to witness (may be obstruction of
justice; potential threats
Is clt using any other social networking sites
Does client have a blog
Does client go to any blogs regularly and have they left comments - if so, under what
user name
Does client go to any chat rooms - what is their handle (user name)
For all of the above, have any of their discussions been related to the case
#
Get details and give warnings
Handbook on Conducting Research on Social-Networking
Websites in California 1
Created by
David Lee and Shane Witnov 2
Samuelson Law, Technology & Public Policy Clinic, UC Berkeley School of Law
for
The Santa Clara County Public Defender’s Office
Overview
Permissible
In conducting research on social-networking websites,
You May:
1. Use publicly-available information.
own valid social-networking website
2. Use information obtained using your
account.
3. Use information provided by a third-party member of a social-networking
website.
4. Observe the activities of a member of a social-networking website while
she browses the network.
5. Use the account of a third-party member of a social-networking website,
without that member present but with her permission, to browse the
website but not to contact people.
3
You Should Avoid:
1. Using the account of a member of a social-networking website to actively
communicate with others without that member present.
2. Making misrepresentations on a social-networking website, when the
misrepresentations are targeted at an individual in order to get information
that would otherwise be unavailable.
You Should NEVER:
1. Contact (email, message, or “friend” request) the victim or persons
disclosed by the opposing party or other persons represented by counsel
without full disclosure of your professional affiliation.
2. Create a fictitious account.
Not Permissible
1
This handbook is licensed under a Creative Commons Attribution 3.0 license. You many copy, distribute,
transmit, and remix this work as long as the original is attributed to the authors and the public defender’s
office for which it was developed. Details of the license are at
http://creativecommons.org/licenses/by/3.0/us/. Completed on December 1, 2008, the handbook reflects the
laws and ethical opinions current as of that date.
2
Under the supervision of Supervising Attorney Jennifer Lynch.
3
“Avoid” means you should not use any of the listed methods except as a last resort, with careful
consideration of the consequences, in consultation with the supervising attorney.
Introduction
Investigators are limited in their use of social-networking websites 4 for research
by a number of different factors including state and federal law, the website’s terms of
use, and ethical rules. 5 This handbook uses the term “investigator” broadly to include
attorneys or anyone working under an attorney. 6 At times, ethical and legal restrictions
are unclear and the value of the information to be obtained should be weighed against the
potential consequences in consultation with the team investigating the case. Generally, a
conservative approach should be adopted to ensure legal compliance, preserve the
goodwill of the courts and opposing counsel, and to maintain high ethical standards.
You May:
1. Use publicly-available information
An investigator may always access publicly-available information. Publiclyavailable information is information on the internet that can be accessed without needing
to log in. Information found through a search engine as well as information on a socialnetworking website that can be accessed without logging in is publicly-available
information.
For example, an investigator may use a search engine, like Google, to search for
the name of a person of interest. Often, the search result will return a link to the person’s
social network webpage. Viewing information returned from this type of search does not
violate any ethical or legal rules. Furthermore, many profiles on MySpace are publicly
accessible. An investigator could use a search engine or the MySpace search, without
logging in or having an account, to find and access publicly available profiles.
2. Use information obtained using your own valid social-networking website
account
An investigator may create an account on a social-networking website, with
accurate information, and conduct any research she wishes to on that network. An
investigator may ask to join groups and access the profiles of people that are enabled by
joining the group. The investigator may even ask an individual to be her “friend” (for
example, on Facebook) as long as the person is not a witness disclosed by the opposing
party or represented by counsel. 7 Because the social networking websites’ terms of use
4
MySpace and Facebook are two of the most widely used social-networking websites and were researched
for writing this handbook.
5
See, e.g., Cal. Penal Code §1054.8, 18 U.S.C. §§ 2701-2711, MySpace Terms of Use, (June 25, 2009),
http://www.myspace.com/index.cfm?fuseaction=misc.terms, Cal. Bus. & Prof. Code §§ 6068, 6106, 6128.
6
For the purposes of this handbook, attorneys and those working under them are all considered to be bound
by California Rules of Professional Conduct in additional to generally applicable law. “An attorney is
responsible for the work product of his employees which is performed pursuant to his direction and
authority.” Crane v. State Bar, 30 Cal. 3d 117, 122-23 (1981) (finding attorney responsible for actions of
his employees that violated the Rules of Professional Conduct).
7
Cal. Penal Code Section 1054.8 prohibits an investigator or lawyer from interviewing, questioning, or
speaking to someone disclosed as a witness by the other side unless she first clearly identifies herself, her
employer and whether she represents the defense or prosecution. California Rule of Professional Conduct
2-100 prohibits communicating “directly or indirectly about the subject of the representation with a party
the member knows to be represented by another lawyer in the matter.” Making contact with an individual
Handbook on Conducting Research on Social Networking Websites—2
generally require users to “not provide any false personal information,” 8 the profile
should include the investigator’s current employer and job title if the investigator is going
to make friend requests in their official capacity.
If the person is the victim or a witness disclosed by the opposing party, the
investigator may still ask to be an individual’s “friend” as long as she is careful in the
“friend” request to clearly identify herself and the agency she works for and to state who
she represents.
3. Use information provided by a third-party member of a social-networking
website.
If the client or another member of a social-networking website provides an
investigator with information obtained from a social networking website, the investigator
can use that information. This information could include printouts or digital copies of
profile pages, communications between members, photos, or any other information
accessible to the member on the social networking website.
An investigator should not encourage the client or other member to engage in
deception on her behalf in order to acquire information. However, as long as the
investigator did not engage in or encourage the deception, she should be able to use the
information without violating any ethical duties.
4. Observe the activities of a member of a social-networking website while she
browses the network.
An investigator may ask her client, a friendly witness, or someone else to come to
her office to browse a social networking website. As long as the member gives
permission, the investigator can observe and direct her browsing. The investigator may
also ask the member to save or print information as she comes across it.
Because the investigator is merely requesting that the member browse in a certain
way, she is not impersonating anyone or engaged in deceit. This method is probably the
best way to obtain information that is not publicly available since no deceit is involved.
5. Use the account of a third-party member of a social networking website, without
that member present but with her permission, to browse the website but not
contact people.
An investigator may use the account of her client, a friendly witness, or someone
else to passively browse a social-networking website when given permission by the
account holder. Passively browsing means the investigator may search for and look at
any profiles available to the member’s account she is borrowing. However, she should
not message, email, friend request, or in any other way directly communicate with
anyone one else using the borrowed account.
By signing in to the social networking website, the investigator is to some degree
representing herself to be a different person. Therefore, this technique should only be
used if the previously discussed ones are not available. In particular, this technique may
be appropriate if the client is in custody and thus unable to use the internet.
on a social networking site, such as asking to be that person’s “friend” through Facebook, could be
considered “speaking” to that person although there is no case law on the subject.
8
Facebook Terms of Use, (Aug. 28, 2009), http://www.facebook.com/terms.php.
8
You
Should
Avoid
: 9
You
Should
Avoid:
1. Using the account of a member of a social-networking website to actively
communicate with others without that member present
An investigator should avoid using another social-networking website member’s
account to directly communicate with others via email, messaging, friend requests, or any
other means. Ideally, she should only observe while the owner of the account browses
the network (as described above). Using someone else’s account could be considered a
violation of the terms of use for many social-networking websites. 10 Furthermore, if the
investigator contacts another person directly using the false identity, this may constitute
deception or impersonation and be an ethical violation. 11 There are also other risks of
civil and criminal penalties, albeit remote risks. 12
2. Making misrepresentations on a social-networking website, when the
misrepresentations are targeted at an individual in order to get information that
would otherwise be unavailable
An investigator should not misrepresent herself on a social-networking website in
order to get information that would otherwise be unavailable. The terms of use forbid
members from misrepresenting themselves.13 Furthermore, the ethical rules binding
lawyers and those working under them generally forbid misrepresentations. 14
Misrepresentations could include omitting relevant information from an
investigator’s profile, especially the investigator’s current job and title. 15 Because the
terms of use require users to “provide their real names and information,” 16 the profile
should include the investigator’s current employer and job title if the investigator is going
to make friend requests. It might be considered a misrepresentation if the investigator
omitted employment information and then a person of interest accepted a friend request
thinking the investigator was not involved in the legal case the member was involved in.
An investigator may also be tempted to lie about her city of residence or schools to gain
9
See note 3, supra.
For example, Facebook’s terms of use say “You will not provide any false personal information on
Facebook . . . You will not share your password, let anyone else access your account . . . You will not
transfer your account to anyone without first getting our written permission.” Facebook Terms of Use,
(Aug. 28, 2009), http://www.facebook.com/terms.php. MySpace’s terms of use say “You agree not to use
the account, username, email address or password of another Member at any time or to disclose your
password to any third party.” MySpace Terms of Use, (June 25, 2009),
http://www.myspace.com/index.cfm?fuseaction=misc.terms.
11
Cal. Bus. & Prof. Code §§ 6068, 6106, 6128 prohibit deceit and dishonesty, while requiring that lawyers
only use means consistent with the truth.
12
While this may technically be a violation of the terms of use, the provisions are infrequently enforced
and would likely only be a contract violation. However, there have been attempts to bring charges under the
Computer Fraud and Abuse Act (18 U.S.C. § 1030) for violating terms of use although these have generally
been unsuccessful. See, U.S. v. Drew, 2009 WL 2872855, (C.D. Cal. Aug. 28, 2009), available at
http://www.volokh.com/files/LoriDrew.pdf.
13
Facebook’s terms of use requires that all information provided be “accurate, current and complete.”
MySpace’s terms of use similarly requires that information should be accurate.
14
The California Business and Professional Code orders attorneys to use “means only as are consistent with
truth.” Cal. Bus. & Prof. Code § 6068.
15
The investigator’s role as investigator is so central to her use of the social network profile, that omission
could be seen as a misrepresentation under Cal. Bus. & Prof. Code § 6068.
16
Facebook Terms of Use, (Aug. 28, 2009), http://www.facebook.com/terms.php.
10
access to other networks. While these may be minor misrepresentations, they are
carefully targeted deceptions to gain access to information that would not otherwise be
available. Targeted misrepresentations are probably unethical.17
You should NEVER:
1. Contact (email, message, or “friend” request) the victim or other persons
disclosed by the opposing party or other persons represented by counsel without
full disclosure of your professional affiliation
California Penal Code section 1054.8 prohibits an investigator from
communicating with the victim or any potential witnesses identified by the prosecution
without identifying herself, the full name of her agency, and that she is working for the
client. Asking someone to be your friend on a social-networking website without
disclosing all of the required information in the friend request would probably be a
violation of the statute. Emailing or messaging such a person is also prohibited.
Furthermore, an investigator should never contact anyone who she knows is represented
by counsel about the matter for which the representation was obtained. 18 However,
accessing publicly-available information on a victim, disclosed witnesses, or represented
party is allowed as described above.
2. Create a fictitious account
An investigator should not create a fictitious account on a social-networking
website using a fake name and other false information in order to gain access to other
users’ information. Such behavior involves deception and is therefore unethical. 19
Furthermore, it may be a criminal violation of the website’s terms of use. 20
17
See Cal. Bus. & Prof. Code §§ 6068, 6106, 6128 for laws forbidding deception.
Cal. Rules of Prof. Conduct 2-100.
19
See Cal. Bus. & Prof. Code §§ 6068, 6106, 6128 for laws forbidding deception.
20
Supra, note 11.
18
Published on Friday, January 21, 2011 by Deeplinks Blog / EFF
Social Media and Law Enforcement: Who Gets What Data and When?
by Jennifer Lynch
This month, we were reminded how important it is that social media companies do what they can to protect the
sensitive data they hold from the prying eyes of the government. As many news outlets have reported , the US
Department of Justice recently obtained a court order for records from Twitter on several of its users related to the
WikiLeaks disclosures. Instead of just turning over this information, Twitter "beta-tested a spine" and notified its
users of the court order, thus giving them the opportunity to challenge it in court.
We have been investigating how the government seeks information from social networking sites such as Twitter and
how the sites respond to these requests in our ongoing social networking Freedom of Information Act
(FOIA) request , filed with the help of UC Berkeley's Samuelson Law, Technology & Public Policy
Clinic . As part of our request to the Department of Justice and other federal agencies, we asked for copies of the
guides the sites themselves send out to law enforcement explaining how agents can obtain information about a
site's users and what kinds of information are available. The information we got back enabled us to make an
unprecedented comparison of these critical documents, as most of the information was not available publicly before
now.
We received copies of guides from 13 companies, including Facebook, MySpace, AOL, eBay, Ning, Tagged,
Craigslist and others, and for some of the companies we received several versions of the guide. We have combed
through the data in these guides and, with the Samuelson Clinic's help, organized it into a comprehensive
spreadsheet (in .xls and .pdf ) that compares how the companies handle requests for user information such as
contact information, photos, IP logs, friend networks, buying history, and private messages. And although we didn't
receive a copy of Twitter's law enforcement guide, Twitter publishes some relevant information on its site ,
so we have included that in our spreadsheet for comparison.
The guides we received, which were dated between 2005 and 2010, show that social networking sites have
struggled to develop consistent, straightforward policies to govern how and when they will provide private user
information to law enforcement agencies. The guides also show how those policies (and how the companies present
their policies to law enforcement) have evolved over time.
For example, the 2008 version of Facebook's guide explains in detail the different types of information it collects on
its users, but it does not address the legal requirements necessary to obtain this data. In contrast, the 2009 version
groups this information into three categories (basic subscriber information, limited content, and remaining content)
and describes, under the Electronic Communications Privacy Act (ECPA) , the different legal processes
required to obtain the various data. However, the 2010 version merely says that the company "will provide records
as required by law." Facebook doesn't explain why it changed its language from year to year. While the 2010 guide's
language may allow the company to be flexible in responding to requests under a complicated and outdated statute,
it does so through a loss of transparency into how it handles these requests.
MySpace's guides also show an evolution. The September 2005 and March 2006 versions of MySpace's guides
distinguish between public and private user information, requiring only a subpoena for IP logs, contact information,
and private messages. The June 2006 and November 2007 versions establish several different categories of user
information that require different legal processes, ranging from a subpoena for a user's name to a search warrant for
access to a user's private messages.
Also, in early versions of its guide, MySpace outlines that it will preserve data requested by law enforcement agents
for 90 days. Law enforcement agents can then request a 90-day extension for a total preservation period of 180
days. This changed in the November 2007 guide, where MySpace said that it would "preserve the specific
information identified in the request for up to 180 days and will extend the preservation as necessary at your
request." The November 2007 guide also describes MySpace's Sentinel SAFE project, a previously unmentioned
campaign designed to identify and remove registered sex offenders from the social network. Once MySpace
matches a profile to a registered sex offender, it removes the user from the site and preserves the complete profile.
Law enforcement officers who provide the appropriate legal process can then access the profile. The November
2007 guide goes even further in helping law enforcement-it details how agents can find MySpace information on a
user's computer, such as through IM client logs, cookie data, cached MySpace pages, and stored login information.
The guide doesn't say what prompted these substantial changes, but it is likely linked to the controversy surrounding
alleged sexual predators on MySpace and the agreement MySpace made with several state attorneys general to
do more to protect children.
There were also more subtle differences between the guides. While the guides are written to educate law
enforcement about the type of user information the companies maintain and the legal process required to get it,
some, such as MySpace and Yahoo!, provide law enforcement with sample language for data request letters,
subpoenas, and search warrants. The requesting law enforcement agency can then use the template created by the
companies.
Also, while ECPA allows companies to charge law enforcement for the time it takes to get the requested user
information, only Yahoo!'s guide actually discusses this issue. The Yahoo! guide includes a fee schedule to
approximate how much law enforcement will have to pay to obtain various types of user data from the company. For
example, Yahoo! charges approximately $20 for basic subscriber records or "groups with a single moderator" and
approximately $30-40 per user for the contents of subscriber accounts, including email. Also, where law enforcement
requests deleted content, Yahoo! states it will "seek reimbursement for any engineer time incurred in connection with
the request."
Another difference between the guides shows up in how the companies deal with emergency requests from law
enforcement. Under ECPA, the sites are allowed to disclose information without legal process when the companies
believe there is a threat of death or serious physical injury. Most companies merely note that ECPA permits them to
disclose this information in certain defined situations. However, some companies seem to go above and beyond the
ECPA requirements. For example, MSN states that it "will respond" to these requests "outside normal business
hours," and eBay and MySpace have set up a special hotline or "First Responder" service that can (in eBay's case)
"return calls within 24 hours and process complaints quickly." In all the guides we received, Yahoo!'s was the only
one to remind law enforcement that Yahoo! "is not required" to disclose this information. Yahoo also requires law
enforcement officers to explain why normal disclosure would be insufficient and why the information Yahoo! has will
help avert the threat.
Facebook was the only company to make clear that its strict policies against fake accounts apply to law enforcement
as well. In its 2008 and 2009 guides it notes that it will disable all accounts that provide false or misleading
information, including police accounts, and in its 2010 guide it notes that it will "always disable accounts that supply
false or misleading profile information or attempt to technically or socially circumvent site privacy measures."
Of the guides we received, only Craigslist provides law enforcement disclosure information on its website (Twitter
does too , but we didn't get a copy of its guide in response to our FOIA request). This is unfortunate. Social media
sites' users should be able to see how the companies that hold their data respond to government requests for it.
And, as we know, this affects a large number of real people. Twitter states that it has 175 million users .
Myspace has over 100 million , and Facebook states it has 500 million . Without access to this information, it is
impossible to evaluate how well these companies protect their users' data.
For more information on how social media companies treat their users' data, see our spreadsheet, available in .xls
and .pdf , or the individual guides here .
Article printed from www.CommonDreams.org
URL to article: http://www.commondreams.org/headline/2011/01/21-2

S - fd.org

Transcription

Similar documents

Crime Prevention in the Virtual Community

The bucket boyz Zibabu Toztizok zoundz

Please join us on Facebook: www.facebook.com/einsteinaward

Social Media Evaluation For Joe Bologna`s Restaurant

here - Maryland Recycling Network

Ok, You`re Using Social Media. Now What?

Signtech Open Day - Jersey Chamber of Commerce

Free PDF

appetizer or dessert - Universal Orlando® Resort