The FBI Could Be Watching You on Facebook

At the dawn of the Internet, people used coded user names and cartoon avatars to represent themselves online. Today, most users post their real names and literally upload all their personal data and make it publicly available -- photos, videos, notes, even random thoughts now called "status updates."

No doubt about it, Internet 2.0 is a freer, more open place -- a place where people feel quite at ease as they share their lives on the Web with their entire social networks: best friends, family, people they hardly know, and even folks they've never even met.

Social-networking sites have driven this seemingly insatiable need to share, share, and share some more. But because it's all done online and not "in real life" (or IRL, in Web-speak), there remains a sense of anonymity even as we interact on the Internet, a very public place open to anyone with a computer.

But as social-networking grows (Facebook overtook Google in U.S. traffic for the first time ever last week) so do the ways law enforcement agencies use the information we voluntarily share with the online world.

Hardly any popular culture observer can forget the now-defunct but forever-notorious NBC show "To Catch a Predator," which featured law enforcement agents posing as children in order to catch online pedophiles. Policing chat-rooms and message boards catering to pedophiles hardly ruffled anyone's feathers (though broadcasting their misery on network television certainly did), but what if all the sites you used everyday were being closely observed by law enforcement agencies? What if people who weren't suspected of any illegal activity were being watched?

Internal documents released this week by the FBI, Dept. of Justice and the IRS -- all as a result of a Freedom of Information Act (FOIA) suit brought by the Electronic Frontier Foundation (EFF) -- show they are among the likely many other law enforcement agencies that have taken to using the personal data people freely share on social-networking sites to monitor location, investigate social circles and otherwise gather intelligence on individuals of interest. (The Dept. of Defense, CIA, Dept. of Homeland Security, Dept. of Treasury -- which includes the IRS -- and the Director of National Intelligence have not yet responded to EFF's FOIA.)

Investigators at these federal agencies even create false personas online in order to deceive social-networking users to consent to sharing personal data online -- a convenient way of circumventing legal process that would ordinarily have to involve proven probable cause and a warrant.

As law enforcement agents increasingly find reasons to use social-networking sites, questions regarding crime-fighting and privacy arise. The bad news is there are no real good answers regarding what users' rights really are, what social-networking companies are required to do (and not to do), and what regulations ought to  govern the use of these sites in investigative law enforcement work given that there isn't really a legal system designed to supervise social-networking sites. It's a real legal gray area.

According to Mike German, policy counsel on national security, immigration and privacy at the ACLU, while you might expect the Electronic Communications Privacy Act (ECPA) to outline these issues, the law does not cover many of the services social-networking sites offer and the resulting data they store. A lot of this has to do with the fact that ECPA was written in 1986. It's been amended since then -- especially to accommodate the PATRIOT Act -- but it doesn't include references to a lot of the data people now upload onto social-networking sites, like videos, photos, public chats or "walls," and the like. (One social-networking service that is covered by ECPA is direct-messaging or personal messages, which under the law function a lot like e-mail.)