There is no shortage of sad stories involving the loss of one's dignity, job, or significant other, thanks to some embarrassing picture, bit of information, or errant one-liner cluelessly tossed into the fast moving bitstream of some social media network. When we hear these stories, we cluck at such oversight, shake our heads in amazement, or whisper to ourselves some version of "there but for the grace of ... go I."
But when we learn that revealing tidbits are being culled from social networking sites by someone wearing a badge and used as "evidence" in the course of a federal investigation, the discussion ratchets up to a different level altogether.
That the Feds are trolling social networking sites looking for scraps of information to help break a case should come as no surprise; several stories this year have chronicled how federal agents have used sites like Twitter and Facebook to obtain information. However, because social media is a new and largely unregulated environment, law enforcement is advancing into the field unchecked. We need to start laying down some guidelines for law enforcement access to social networking data.
So far, however, agencies won't even allow the discussion to begin. "Although the Federal Government clearly uses social-networking websites to collect information, often for laudable reasons, it has not clarified the scope of its use of social networking websites or disclosed what restrictions and oversight is in place to prevent abuse," says a law suit filed earlier this month by EFF and the Samuelson Clinic at the University of California, Berkeley. The suit is filed against a half-dozen government agencies for refusing to respond to a Freedom of Information Act request asking for agency policies that apply when using social networking sites for investigations, data-collection, and surveillance.
Before we go too far, let's agree on the obvious: what you put on Facebook and allow the whole world to see is public information and people shouldn't be surprised to find that anyone from the deputy sheriff to the FBI might be accessing it. However, information that you place on Facebook to share only with a select group of friends is private and should be available to law enforcement only with a judicial warrant. Current law does not clearly protect private postings and should be updated to provide adequate protection.
And what happens if you "over friend" your information? What happens if you "friend the world?" Here the law is even less clear. The threat of police entering social networks undercover deserves special attention. Without strict guidelines, undercover "friending" could quickly make the Net a "no privacy zone."
We can build privacy rules incrementally. For example, fishing expeditions should be headed off; there should be no routine monitoring of Twitter feeds without a tip or a lead that suggests criminal activity or a threat to national security. The FBI has better things to do, and every minute spent monitoring innocent activity is one less minute that can be spent chasing down a real lead.
In terms of undercover access, there is already a kind of playbook for how Internet operations should be carried out, in the form of the FBI's own guidelines for undercover operations in the physical world. These guidelines, which govern all FBI criminal investigations outside of the national security context, contain some useful concepts that could be adapted for Internet-based investigations, such as: Headquarters approval for sensitive operations, including investigation of possible criminal conduct by a political or news organization; time limits that end unproductive monitoring; and consideration of privacy implications before the undercover activity begins.
The debate over the breadth of these guidelines will likely be a difficult one; there are many variables to consider. But nothing will happen if law enforcement agencies refuse to even talk about their practices. The courts, Congress and those in the Obama Administration committed to openness should all push for disclosure of current practices, so the process of setting reasonable laws and guidelines for this new environment can begin in earnest.