Does The Law Protect Users From Social Media Surveillance?

Twitter, Facebook, and Instagram, have terminated their relationship with Geofeedia earlier this month. Geofeedia is a company that the ACLU claims sold that information to police departments, who in turn used the newfound social media surveillance to track activists and to arrest protesters with outstanding warrants.

The revelations came after the ACLU and The Center For Media Justice and Color of Change sent letters to Twitter and Facebook and Instagram, which Facebook owns. Geofeedia, which markets itself to law enforcement as a tool to monitor protests, labeled activist and union groups as “overt threats,” and sold surveillance on users—in violation of the social media companies’ policies. In fact, the surveillance, they say, was racial discrimination targeting, as it did, Black Lives Matter protesters.

“When the government uses technology like Geofeedia to surveil how people are using their social media, it triggers three sets of concern under the US constitution,” says Adam Schwartz, a senior staff attorney at the Electronic Frontier Foundation, a digital rights nonprofit. “The first is racial discrimination. The 14th amendment requires full protection of the laws. What happens with all of these spying technologies over and over again is that it’s people who are black and hispanic and of color who end up being most targeted by these technologies.”

Schwartz cites stingrays, or police devices that mimic cell phone towers by sending a signal to nearby phones and then record the information they get back, as one kind of technology that’s especially targeted against minority groups. In addition, surveillance cameras and facial recognition tools are two technonologies with a disprortionate impact on minority populations. When it comes to social media monitoring of people protesting police misconduct in their communities, that often means focuses specifically on minority groups. Social media monitoring of protest isn’t limited to minorities, but it’s of particular relevance in how Baltimore police used Geofeedia data, where the ACLU revealed police monitoring of Black Lives Matter protesters.

Secondly, says Schwartz the 4th Amendment, “prohibits unreasonable searches and seizures. Whenever the government is spying it raises 4th amendment concerns.” The 4th amendment, which protects citizens from unreasonable searches and seizures without a warrant, might seem an odd recourse when it comes to social media, but there’s a long history of the 4th amendment in surveillance specifically. A series of rulings in the 1960s held that if an individual’s documents had been turned over to a third party, say a telephone company, then the police could go to the third party instead, without a need to get a warrant for the information from the initial person. Yet courts have also ruled, as the EFF argues, that the 4th Amendment applies even if a third party is doing the spying on the individual for a government. It’s a distinction particularly acute in instances of mass surveillance.

“Of course, a lot of this information is what’s out in the open and so so you know it’s what people are putting on the social media that’s visible to the world so government would argue that there’s no 4th amendment interest here,” continued Schwartz. He’s not wrong — A Homeland Security special report on Occupy Wall Street had a feature on social media, and even linked to an interactive Daily Kos map of the Occupy protests. After two American flags were taken down from the Brooklyn Bridge and replace by white flags in July 2014, the NYPD poked around on Instagram to look for clues to the culprits.

Still, says Schwartz, “We think that when you’re talking about scooping up everything on somebody on the world wide web it’s intrusive enough that we ought to be thinking about the 4th amendment.”

Thirdly, there’s 1st Amendment issue. “If people know that the government is watching how they use their social media, including what they say, who they associate with, what protests they’re going to, they’re going to be chilled and deterred from going to those protests.” Schwartz cited recent studies which showed people are less likely to do controversial things if they know the government is watching how they use social media.

Of course, it’s not just the law that prevents police departments from monitoring everything on social media.

“Police are prohibited by just reality, this is billions of tweets and billions of facebook posts,” said Nicole Ozer, Technology & Civil Liberties Policy Director for the ACLU of Northern California, “and also the companies’s own policies prohibit third parties from scraping or automatically access all of its posts, it’s against their terms of service. Ozer co-wrote the letters to Twitter, Facebook, and Instagram. Outing Geofeedia’s violations of terms of service, says Ozer, “shouldn’t require a public records act request by the ACLU for Facebook and Twitter and Instagram to know what their own developers are doing, argues Ozer.

To keep companies from scooping data for surveillance and selling it to police, those companies need to make sure that they’re not just telling third parties not to use their data for surveillance, but that they have policies in place to audit third-party data users, to make sure they aren’t selling it to police.

While most police departments likely don’t have the resources to develop online surveillance tools themselves (and might be legally prohibited from doing so), it’s unclear if they are prohibited from buying surveillance from a third party.

Ozer describes this practice as a “side-door” around legal constraints. Police have previously bought social media surveillance technology using outside grants, such as money from the Department of Homeland Security, which allowed them to put it in place without seeking public approval.

“We only surveyed 63 California agencies, and 40 percent of them had used social media surveillance in the last couple of years,” says Ozer. “In the thousands of documents that we received about these programs, we found no evidence of any public debate, any public notice about what was happening, no debate where the right kinds of questions could be asked about whether police should have this kind of surveillance tool, no agency produced a policy to safeguard civil rights and protect against misuse.”

For that reason, and because social media is often public media, it’s important for users to practice what Schwartz calls “surveillance self defense.” Peer-to-peer communication apps, like Signal and WhatsApp, encrypt messages they send, making it much much harder for a third-party to listen in or request the messages from a third-part. (Telegraph, another peer-to-peer communication app, is set by default to store messages on their servers, making it much easier for law enforcement or other third parties to access that information). It’s harder to cloak your identities on platforms like Facebook that specifically don’t allow you to post under a pseudonym. While Facebook recently made it harder to report someone for using a pseudonym, a new set of strict identification requirements mean people on Facebook are still bound to one, public, easily-identifiable name.

Amie Stepanovich is the Global Policy Counsel and U.S. Policy Manager, at Access Now. The Electronic Communications Privacy Act, she writes, “broadly prohibits companies from divulging user information with few exceptions, including with the consent of the user or if the information pertains to the commission of a crime. The secret nature of these agreements mean users could not have explicitly consented to the disclosure.”

“Even public data,” says Stepanovich, “when aggregated and analyzed in large quantities, can reveal sensitive information about users, including information that they may not be aware of themselves.”

Still, that suggests a legal remedy not yet available. However, the courts do seem to be catching up, according to both Ozer and Schwartz. In 2014, in a landmark decision, the Supreme Court unanimously ruled in Riley v. California, that police cannot search a cell phone without a warrant, except in a few circumstances wherre the immdiate need to save a live may override the need for a warrant in a specific case (itself a complicated subset of law). Riley v. California dealt with the court expanding the sphere of privacy to private items. It showed the court could understand modern technology, but because it’s implications are limited to places already assumed private, there’s not a lot it can do for public or semi-public information, like that on social media.

Courts are realizing that “technology has changed the calculus in terms of the power of police to use technology for incredibly invasive searches,” says Ozer. “The law is slowly updating, but not as fast as the technology has developed.”