U.S. Ruling Sets Troubling Precedent for Social Media Privacy

 

On November 10 a U.S. district court judge upheld a ruling that cleared the way for the U.S. government to compel Twitter to release “private” information related to three of its users. The ruling, which brings an end to a protracted year-long series of appeals, may have set a disturbing precedent. It would appear that from now on sites with servers in the U.S. will be obliged to hand over their information to the U.S. government without the need for a warrant. Furthermore, you have no right to access the documents that the U.S. government has provided as evidence that they need to see your “private” information.

 

The judge’s key ruling was that Twitter users “voluntarily relinquished any reasonable expectation of privacy” in agreeing to Twitter’s Terms of Service when creating an account on the site. As such, your “private” information – including Direct Messages, IP addresses, session times and activity – on sites like Twitter is not really private. This has particularly disturbing implications for activists and journalists.

 

In December 2010, following a Department of Justice (DoJ) request, a magistrate judge ordered Twitter to release information it had on users that included Wikileaks; Wikileaks figurehead Julian Assange; Bradley Manning, the former soldier arrested on suspicion of leaking documents to Wikileaks; Jacob Appelbaum, a Tor developer and Wikileaks supporter; Birgitta Jónsdóttir, an Icelandic member of parliament, activist and former Wikileaks spokeswoman; and Rop Gonggrijp, an Internet activist and hacker. The request was made as part of the DoJ’s ongoing investigation into the release of the Collateral Murder video by Wikileaks and the case they’re building against Assange.

 

The information included subscriber names, records of session times and durations, credit card and billing details, data transfer volume, contents of any communication stored by the account and IP addresses for both the user and users they were communicating with. No warrant was issued for the request of this information; the DoJ cited a provision of the Stored Communications Act, a law originally enacted in 1986, as the authority for requesting the information without a warrant.

 

In the case of Jacob Appelbaum, U.S. prosecutors also sent secret requests in 2011 to Google and service provider Sonic seeking IP addresses for Appelbaum and anyone he had communicated with since 2009. They did not seek access to the content of Appelbaum’s emails. Appelbaum was made aware of those requests when Sonic successfully appealed to have the secret requests made public. Google have refused to comment on whether they made any such attempt to appeal the requests.

 

Twitter also resisted the order they received (leading Wired reporter Ryan Singel to remark that they were “beta-testing a spine”). As a result of their appeal in January 2011, a judge ruled that the DoJ subpoena be unsealed, allowing Twitter to inform the “Twitter three” – Appelbaum, Jónsdóttir and Gonggrijp. The three then began a lengthy appeals process represented by the Electronic Frontier Foundation (EFF) and the American Civil Liberties Union (ACLU).

 

On March 11 of this year a federal magistrate judge ruled in favour of the DoJ, but did make public the government’s documents related to the users’ legal challenge. The EFF & ACLU appealed; but last week’s ruling finally upheld that decision.

 

“Internet users don’t automatically give up their rights to privacy and free speech when they use services like Twitter,” said Aden Fine, staff attorney for the ACLU, in a statement. “The government shouldn’t be able to get this kind of private information without a warrant, and they certainly shouldn’t be able to do so in secret. An open court system is a fundamental part of our democracy, and the very existence of court documents should not be hidden from the public,” he said.

 

“With this decision, the court is telling all users of online tools hosted in the U.S. that the U.S. government will have secret access to their data,” said Birgitta Jónsdóttir in the same statement.

 

“When you use the Internet, you entrust your online conversations, thoughts, experiences, locations, photos and more to dozens of companies who host or transfer your data,” said EFF Legal Director Cindy Cohn in a statement. “In light of that technological reality, we are gravely worried by the court’s conclusion that records about you that are collected by Internet services like Twitter, Facebook, Skype and Google are fair game for warrant-less searches by the government.”

 

It remains to be seen how long this precedent will go unchallenged, relying as it does on a nearly two-decade-old law that was never intended to be applied to services that only came into existence in the last five years. Dwayne Winseck, Professor of Journalism & Communication at Carleton University, is one of a growing number of academics who believe the precedent set remains significant and troubling.

 

He wrote on his website: “The decision is remarkably candid in its view that the standard of privacy on the Internet that we should expect is whatever Internet companies’ terms of service policies say it is, rather than a function of constitutional values, law or social norms. Social media users, according to the court, would have to be woefully naive to expect that privacy is a priority value for advertising-driven online media, given that almost the entire business model of major Internet companies is about collecting and selling as much information about audiences as possible.

 

“Such a view reduces privacy to the logic of corporate business models and market transactions. Worse, by turning privacy into the plaything of corporate business models, the court essentially turned commercial Internet companies such as Twitter, Facebook and Google into the handmaidens of the national security state.

 

“[The judge] took the idea of Terms of Service agreements, and people’s low expectations with respect to privacy that come along with that, as a precedent to jump into case law around banks and insurance companies,” Winseck continued in a phone interview. “The problem is that banks and insurance companies have no privileged status when it comes to privacy and speech rights.

 

“[The judge] could have addressed the fact that services like Twitter are increasingly used as an online pubic forum. He could have brought in some ideas of public space, and also people’s expectation of free speech and anonymity in public spaces. The proper measure of something like Twitter is not a bank or insurance company but the press, and the privileges that the press enjoy,” Winseck said.

 

As such the judgement was a missed opportunity according to Winseck, with potentially disastrous consequences.

 

“The discourse could easily have been revamped to include ideas around the production, distribution and consumption of ideas and speech in social media spaces. This would have cast the issues in a completely different light. The judgement was disingenuous in that sense.”

 

Meanwhile Twitter is left with some soul searching to do. According to privacy activist and Open Society fellow Christopher Soghoian, the organization must bear their burden of responsiblity. “Twitter has positioned itself as a fighter for free speech after this incident, and gotten a lot of positive press as a result,” he said in an email. “Remember though, if Twitter didn’t retain the data in the first place, there would be nothing to hand over. Even after the FBI came knocking, Twitter continues to keep this data. Likewise, even after the judge cited statements in Twitter’s privacy policy in arguing that Twitter’s customers have no reasonable expectation of privacy, the firm has done nothing at all to revise those legal terms to beef up its customer’s legal rights,” he said.

 

Having long cast itself as a free and democratic forum with the potential to bring about change in the world, this latest judgement paints Twitter as a corporate business at the mercy of state intrusion. Will users begin to desert it?

 

“People around the world will take note,” said Birgitta Jónsdóttir. “And since they can easily move their data to companies who host it in locations that better protect their privacy than the US does, I expect that many will do so.”