In charging nine teens for the bullying of Phoebe Prince, the South Hadley High student who killed herself in January, prosecutor Elizabeth Scheibel took a swipe at Facebook and Craigslist. "A significant obstacle, and delay for investigators in this case has been the inexplicable lack of cooperation from Internet service providers, in particular, Facebook and Craigslist," said Scheibel, the Northwestern district attorney in Massachusetts.
Was it fair for Scheibel to go after these sites? The competing demands on sites like Facebook and Craiglist to turn over information to law enforcement and to protect their users' content raise big, relatively unsettled questions about privacy rights. Courts haven't really ventured into this territory yet. But in the Prince case, Scheibel's frustration with Facebook and Craigslist seems unwarranted.
Federal law prevents sites from turning over user content without a search warrant (based on probable cause), which Facebook says Scheibel didn't provide. "We responded to the initial request (received in mid-February) quickly with the information that the law allows," Facebook policy communications director Barry Schnitt e-mailed me. That's limited to basic subscriber information, he explained: The name of the person the prosecution asked about, payment information, his or her IP address. "For other information requested by the prosecution, Federal law requires a search warrant. We made the prosecution aware of this repeatedly." (Schnitt also said, "I'd point out that we offer law enforcement a special form for emergencies and the authorities didn't use it." That part made me feel only sympathy for the DA, because I've never met a "special form" online that I like.)
Facebook is probably right in its reading of the relevant federal law, the Electronic Communications Privacy Act, which governs digital communications like the Internet and cell phones. According to Kevin Bankston, senior attorney for the digital rights organization Electronic Frontier Foundation, prosecutors "need a warrant for any content generated by the user that's not readily accessible to the general public if it's less than 180 days old." After 180 days, you can get the content with a subpoena. I called Scheibel's office a couple of times to ask why she didn't secure a warrant, but I didn't hear back. To show probable cause, she would have had to demonstrate a reasonable belief that evidence of a crime would be found through the search she wanted to do.
Why do we have this rule? "For the same reason we should be able to use the phone or send an e-mail without worrying that the government will access it without probable cause," Bankston said. "We live in a society that allows us to take advantage of technology, and use it privately, without worrying about government invasion." That seems pretty clear and, depending on your politics, of course, probably sounds like a good thing. But Bankston says that courts haven't actually ruled yet on how the protection of user content in ECPA applies to social network sites. There's a pro-privacy ruling from the U.S. Court of Appeals for the Ninth Circuit, holding that the pager company Arch Wireless shouldn't have turned over the text messages of a cop to his employer. (Another aspect of the case, City of Ontario v. Quon, is on appeal to the Supreme Court.) But sites like Facebook, of course, are different. There are the messages you send to one other person on Facebook, the posts that all of your friends can see, and the posts or pages that you make public. (Here's my page for this series on bullying, which has been very lively this week.)
Do you have the same privacy expectations for all of these uses of Facebook? Bankston argues that even a public page or post that you later take down isn't readily accessible, so the answer is yes. You could also take the position, however, that once a post is made public, the poster can't expect it to revert to being private again—someone else can store it before he or she removes it. Debates like this—and clashes like the one between Facebook and Scheibel—suggest that ECPA isn't clear to everyone. A group called Digital Due Process got press this week for pushing for stronger federal privacy protections for digital content. The group's members include the Electronic Frontier Foundation, the ACLU, AT&T, Google, and Microsoft. Facebook hasn't signed on yet, EFA's Bankston said.
If police and prosecutors can't get the online content at issue for building a case against the teenagers accused of criminally harassing and stalking Phoebe Prince without a search warrant, that means school officials and parents can't get it either. Once posts that had been public have been deleted, they're not easy to recover. This is one of the lessons that Mike Donlin, who works on technology and violence prevention for the Seattle school district, tries to impress upon everyone he talks to about cyberbullying—kids, parents, teachers, administrators. "When you see something ugly online, you don't want to keep it. But don't just hit delete" he says. "Save the URL, make a screen shot, print it out. Stick it in a folder if you don't want to look at it. When it comes up again you have something tangible to show." You have evidence, in other words, of the abusive behavior should you need it later.
It's a simple point, Donlin says, but in the moment of surprise or consternation over nasty content, kids, parents, and teachers often don't think to save what they're looking at. One mother who e-mailed me from Canada, however, had the presence of mind to do just that. She friended one of her daughter's friends on Facebook, which allowed her to follow along as a group of girls (and eventually boys) ganged up on another girl, for defending a friend whom the group had mocked because she'd lied about her health. (If it sounds convoluted, that's because it's middle school.) The mother sent me all 255 posts, written in staccato bursts in the afternoons after school over four days. The whole thing is an awful read, peppered with IM-speak (LMFAOOOOOO!!) and lines like "No threats cause ill get in shit ... but i REALLY wouldn't say that if i were you ... which im not cause im not FAT ... but i wouldnt say that ... ASK YOUR FRIENDS BITCH.! They learned lessons." The girl who was the group's target went from standing up to them in her early replies to groveling for forgiveness. And at the end, the ringleader wrote, Yoo. !! Delete ALLLLL comments that you posted guys … .. I don't want any friends getting in shit."
At that point, the mother who was watching this unfold printed out the exchange and brought it to the principal at her daughter's school, St. Patrick's Intermediate School in Ottawa. When I called the principal, William Walsh, he didn't call me back but sent an e-mail describing the episode as a "minor incident" and saying that "All the students, staff, and parents involved were satisfied and dealt with at the time in a professional and confidential manner." The mother who sent me the posts, not surprisingly, disagrees. She wasn't satisfied by the minimal punishment she says the school doled out—six girls were suspended for three days. And more than that, she said the principal never showed the exchange to the parents of the girls involved. "I don't understand that," she said. "Parents can't fix the problem if they don't know what their children are doing."
What did the parents of the teenagers accused of harassing Phoebe Prince know about the three months of bullying that the district attorney says took place? That's a question, like the one about which adults at the school knew what was happening, that the town of South Hadley is just beginning to address. They may have had no idea what their kids were doing on Facebook and Craigslist. It's probably a good thing, legally speaking, that social network sites won't turn over the teenagers' postings without a search warrant. But that doesn't mean parents, and kids who are bystanders, can't track it themselves.