In charging nine teens for the bullying of Phoebe Prince, the South Hadley High student who killed herself in January, prosecutor Elizabeth Scheibel took a swipe at Facebook and Craigslist. "A significant obstacle, and delay for investigators in this case has been the inexplicable lack of cooperation from Internet service providers, in particular, Facebook and Craigslist," said Scheibel, the Northwestern district attorney in Massachusetts.
Was it fair for Scheibel to go after these sites? The competing demands on sites like Facebook and Craiglist to turn over information to law enforcement and to protect their users' content raise big, relatively unsettled questions about privacy rights. Courts haven't really ventured into this territory yet. But in the Prince case, Scheibel's frustration with Facebook and Craigslist seems unwarranted.
Federal law prevents sites from turning over user content without a search warrant (based on probable cause), which Facebook says Scheibel didn't provide. "We responded to the initial request (received in mid-February) quickly with the information that the law allows," Facebook policy communications director Barry Schnitt e-mailed me. That's limited to basic subscriber information, he explained: The name of the person the prosecution asked about, payment information, his or her IP address. "For other information requested by the prosecution, Federal law requires a search warrant. We made the prosecution aware of this repeatedly." (Schnitt also said, "I'd point out that we offer law enforcement a special form for emergencies and the authorities didn't use it." That part made me feel only sympathy for the DA, because I've never met a "special form" online that I like.)
Facebook is probably right in its reading of the relevant federal law, the Electronic Communications Privacy Act, which governs digital communications like the Internet and cell phones. According to Kevin Bankston, senior attorney for the digital rights organization Electronic Frontier Foundation, prosecutors "need a warrant for any content generated by the user that's not readily accessible to the general public if it's less than 180 days old." After 180 days, you can get the content with a subpoena. I called Scheibel's office a couple of times to ask why she didn't secure a warrant, but I didn't hear back. To show probable cause, she would have had to demonstrate a reasonable belief that evidence of a crime would be found through the search she wanted to do.
Why do we have this rule? "For the same reason we should be able to use the phone or send an e-mail without worrying that the government will access it without probable cause," Bankston said. "We live in a society that allows us to take advantage of technology, and use it privately, without worrying about government invasion." That seems pretty clear and, depending on your politics, of course, probably sounds like a good thing. But Bankston says that courts haven't actually ruled yet on how the protection of user content in ECPA applies to social network sites. There's a pro-privacy ruling from the U.S. Court of Appeals for the Ninth Circuit, holding that the pager company Arch Wireless shouldn't have turned over the text messages of a cop to his employer. (Another aspect of the case, City of Ontario v. Quon, is on appeal to the Supreme Court.) But sites like Facebook, of course, are different. There are the messages you send to one other person on Facebook, the posts that all of your friends can see, and the posts or pages that you make public. (Here's my page for this series on bullying, which has been very lively this week.)
Do you have the same privacy expectations for all of these uses of Facebook? Bankston argues that even a public page or post that you later take down isn't readily accessible, so the answer is yes. You could also take the position, however, that once a post is made public, the poster can't expect it to revert to being private again—someone else can store it before he or she removes it. Debates like this—and clashes like the one between Facebook and Scheibel—suggest that ECPA isn't clear to everyone. A group called Digital Due Process got press this week for pushing for stronger federal privacy protections for digital content. The group's members include the Electronic Frontier Foundation, the ACLU, AT&T, Google, and Microsoft. Facebook hasn't signed on yet, EFA's Bankston said.