Sondra Prince of Watertown, New York was a social media queen. She had a Facebook page with pictures of herself splayed out on a brand new BMW. She displayed her personal information, including pictures of her children, her license plate number, and some at least sexually suggestive photographs.
This was a silly thing for Prince to do, as she was marginally involved in a drug ring in upstate New York, and putting this kind of personal information online clearly placed her and her children at risk.
In fact, her boyfriend — the one who got her involved in drugs in the first place — was physically abusive, and could have used the personal information she posted online, had he not been sentenced to 16 years in federal prison.
Sondra also used the Facebook page to friend other potential criminals, and to communicate with people with whom she might have been engaged in criminal conduct.
Problem was, Sondra never set up the Facebook account.
The account was apparently set up by the Drug Enforcement Agency, with the knowledge and approval of the United States Attorney’s Office for the Northern District of New York. BuzzFeed has reported that the case is currently under review by the Department of Justice. It has significant implications for privacy and civil liberties.
Cops Lie
Anyone who has watched even one episode of any of the dozens of “Law and Order” series knows that cops lie. I don’t mean that cops commit perjury. I mean that cops are entitled to lie as part of their investigation.
There are big lies and little lies. That old ruse of asking someone, “hey dude, you’re not a narc, are you?” under the assumption that a cop would have to say, “damn, you got me — yes, I am” would be sorely mistaken.
Cops can go under cover, lie about who they are, and what their motives are. They can lie to people under investigation, tell them that they are not the subject of an investigation, claim that a witness has identified them, falsely report the results of lab tests, and in extreme cases, can even falsely enter into plea agreements with defendants, promising not to prosecute them in return for cooperation. (You see, only prosecutors can enter plea agreements, so these contracts are void — the cops get the benefit of the bargain, but don’t have to keep their end of the deal.)
Cops set up sting operations, fictitious identities, fictitious websites, and other ruses in support of their investigations. While not exempt from the perjury laws, much of what the police do, if done by normal citizens (or even private investigators) would be a crime. They routinely engage in false and deceptive practices, lie to induce someone to cooperate, and lie about the consequences of cooperating and not cooperating.
So during a traffic stop, they can lie to the driver about a report of someone seeing a “person of your description” engaged in some criminal activity, they can (falsely) tell the driver that someone reported seeing them with a gun or drugs, they can (falsely) tell the driver that, if they don’t consent to a search of their car, the car will be impounded and seized and searched, or that if they DO consent to a search, they will be permitted to go on their way.
Laws like the Computer Fraud and Abuse Act, 18 U.S.C. 1030 and others contain police “opt out” provisions, noting: “This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States.” So hacking is illegal, as is exceeding the scope of unauthorized access to a computer, unless it is part of a “lawfully authorized” activity.
Cops are exempted from a bunch of other criminal statutes as well — either expressly or by implication. They can possess illegal weapons, drugs, contraband, child pornography, etc., either because the statute says so, or because in doing so they have no criminal intent. They can’t conspire with others to commit a crime because they have no real intention of doing so.
So conceivably, the police could have set up a sting operation using a false identity to attract criminals — something they routinely do in child porn cases. Facebook and other website “Terms of Service” (ToS) require the use of real identities, with Facebook’s ToS stating, “Facebook users provide their real names and information, and we need your help to keep it that way. Here are some commitments you make to us relating to registering and maintaining the security of your account: You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission.”
In other cases, the Justice Department has contended in Court that violation of these Terms of Service constitutes the “unauthorized access” into the computers of the social media site — and a felony. The Justice Department strenuously argued that it was a felony to post pictures of someone without their consent, to establish a social media presence without providing accurate information, and to promote activity that was “false and misleading.”
Oh, but not when THEY do it. Because remember, the Computer Fraud and Abuse Act which makes “exceeding unauthorized access” a crime doesn’t apply to them.
Consent?
So how did the DEA come to set up the account for Sondra? Well, according to the Justice Department, after Sondra was arrested, the DEA agents asked her if they could see her phone. Yup. That’s it.
Sondra thought that she was cooperating with the DEA, and that they might look at the contents of her phone to see who her contacts were, whom she had called, etc. The DEA had other plans. They used the information in her phone, including the pictures they found there, the contacts, the names and email addresses, and her personal information to create the fake Facebook page.
See, a phone is not just a contact list. It’s not really even a phone. It’s not even a computer. It’s a portal into everything. When the police earlier this year wanted the Supreme Court to permit them to search a cell phone without a warrant “incident to an arrest” the Court noted these differences, noting that the data a user views on many modern cell phones may not in fact be stored on the device itself.
Treating a cell phone as a container whose contents may be searched incident to an arrest is a bit strained as an initial matter. See New York v. Belton, 453 U. S. 454, 460, n. 4 (1981) (describing a “container” as “any object capable of holding another object”). But the analogy crumbles entirely when a cell phone is used to access data located elsewhere, at the tap of a screen. That is what cell phones, with increasing frequency, are designed to do by taking advantage of “cloud computing.”
And that’s one of the many problems with the concept the New York DEA agents are relying on here — consent. If a cop asks if they can search my car, I have not meaningfully consented to have them strip the car, remove the quarter panels, dust it for fingerprints and DNA, etc. I have consented to a “search” as that term is commonly used. When I go through the airport magnetometer, handing my computer to the TSA agent, I haven’t authorized the DEA agent to log into my cloud-based accounts, though I have authorized them to examine the Dell device to see that it’s not a bomb.
Now the DEA could have obtained Sondra’s actual consent to set up the Fakebook site. Or had her do it. Even though it would have violated Facebook’s Terms of Service, they probably would have been within the appropriate law enforcement exemption to the CFAA in doing that.
But consent to search — or even consent to “use what you find” is not close to consent to setting up a false persona. Especially where that would put her at risk. The choice of whether or not to cooperate with the DEA, and the scope and extent of that cooperation is Sondra’s choice (well, and her lawyer’s). The DEA can’t just help itself.
What’s even worse, under the federal sentencing guideline 5K1.1 a criminal defendant like Sondra would get substantial credit for having cooperated in the investigation of others. While Sondra got a sentence of probation, it’s by no means clear that she was given credit for her involuntary cooperation in this case.
Clearly we don’t have the entire story here. If the Department of Justice is contending that Sondra consented to the establishment of the fake Facebook site, they need to show something more than that she gave them the phone.
According to the pleadings in the civil suit filed against the DEA, ““Defendants [the DEA] admit that Plaintiff did not give express permission for the use of photographs contained on her phone on an undercover Facebook page, but state the Plaintiff implicitly consented by granting access to the information stored in her cell phone and by consenting to the use of that information to aid in an ongoing criminal investigations [sic].” That’s a huge leap.
Consent must be knowing and informed. Had the government asked for permission to do this, it’s at least possible that Sondra would have said ‘yes.’ Equally possible that she would have said ‘no.’ That’s probably why they didn’t ask. And that may prove to be a problem for the DEA and the US Attorney’s Office.
But maybe not. Courts are loath to place limits on investigative process, and even more loath to make them pay money damages. The doctrine of sovereign immunity means that the State is generally immune from paying damages unless it has waived such immunity or where a statute creates a right of action.
If the courts approve this, we will undoubtedly see more of it. We will see the FBI taking pictures off our Facebook pages, and creating new pages with our information. When the Mossad allegedly assassinated Mahmoud Al-Mabhouh in a Dubai hotel in 2010, the agents reportedly used identity documents from genuine British and Australian citizens as cover.
We can expect US intelligence and law enforcement officials to do more of this in the future. Posing as us and using our personal information as cover for their activities. Cause posing as themselves would be dangerous. We may need legislation to prevent this.