EFF Sues Federal Agencies to Release Social Media Policies

Dec 7th, 2009 | By Josh Camson | Category: Featured, Lead Article, Privacy

On December 1st the Electronic Frontier Foundation filed a lawsuit against several federal agencies alleging a violation of the Freedom of Information Act (FOIA). The EFF is trying to get the federal government to “disclose their policies for using social networking sites for investigations, data-collection, and surveillance” according to their press release. The complaint alleges that the EFF sent FOIA requests to many branches of the federal government in eff October, and names the Department of Defense, CIA, Department of Homeland Security, Department of Justice, Department of Treasury and the Director of National Intelligence as defendants.

The FOIA request encompassed “all records about federal guidelines on the use of social-networking websites…for investigative…or data gathering purposes created since January 2003.” The request specifically listed:

1.) documents that contain information on the use of “fake identities” to “trick” site
users “into accepting a [government] official as a friend” or otherwise provide
information to the government as described in the Boston Globe article Is This
Lawman Your Facebook Friend? By Julie Masis, published January 11, 2009;

2.) guides, manuals, presentations, memoranda, or other materials explaining how
government agents should collect information on social-networking websites;

3.) guides, manuals, policy statements, memoranda, presentations, or other materials
detailing how or when government agents may collect information through socialnetworking
websites;

4.) guides, manuals, policy statements, memoranda, presentations, or other materials
detailing what procedures government agents must follow to collect information
through social-networking websites;

5.) guides, manuals, policy statements, memorandum, presentations, agreements
(both formal and informal) with social-networking companies, or other materials
relating to ‘privileged user’ access by the Bureau of Alcohol, Tobacco, Firearms,
and Explosives to social-networking websites;

6.) guides, manuals, memoranda, presentations or other materials for using any
visualization programs, data analysis programs or tools used to analyze data
gathered from social networks;

7.) contracts, requests for proposals, or purchase orders for any visualization
programs, data analysis programs or tools used to analyze data gathered from social
networks; and

8.) guides, manuals, policy statements, memoranda, presentations, or other materials
describing how information collected from social-networking websites is retained in
government databases or shared with other government agencies.

The request raises a few good questions. First and foremost: are police departments or government agencies given super accounts on social networking sites that allow them access to information? If so, the site should disclose that information. Most sites state flat out that they will turn your data over to law enforcement agencies or the courts. For instance, Facebook’s Privacy Policy states:

We may disclose information pursuant to subpoenas, court orders, or other requests (including criminal and civil matters) if we have a good faith belief that the response is required by law. This may include respecting requests from jurisdictions outside of the United States where we have a good faith belief that the response is required by law under the local laws in that jurisdiction, apply to users from that jurisdiction, and are consistent with generally accepted international standards. We may also share information when we have a good faith belief it is necessary to prevent fraud or other illegal activity, to prevent imminent bodily harm, or to protect ourselves and you from people violating our Statement of Rights and Responsibilities. This may include sharing information with other companies, lawyers, courts or other government entities.

With a vague privacy policy like this, users should of course refrain from posting anything on the site that they wouldn’t want law enforcement to see.

The complaint also raises a question about what information the government is storing from social networking sites. I would assume they are at least storing any photos or wall postings or updates of any kind that they think will potentially be useful in future investigations.

What do you think? Should the government be allowed to do this? If so, does a website need to disclose that they are letting the government snoop around?

Hat tip to Mike Waraich’s LinkedIn group “Law Enforcement 2.0” about this development.