In fact, not only can’t Facebook tell you that the cops are reading your postings, they can’t even challenge the court order compelling them to produce your friend’s records (and therefore yours) to them. Under the Court’s ruling, companies like Facebook, Google, Microsoft, Twitter and ISPs and broadband providers now have to act as cops, executing search warrants (including out of state search warrants) on themselves, and have no legal authority to question the authority, scope, or lawfulness of the warrant.
To make matters worse, they can’t ever tell you that they have produced the records, so you can’t challenge the warrant either.
On April 5, the New York State Court of Appeals – that State’s highest court – held that Facebook, a recipient of hundreds of identical warrants approved in connection with a state investigation of disability insurance fraud, could not move to quash or limit the scope of the warrants served on it because – well, just because.
There’s no procedure in New York law for “quashing” a search warrant. As a result of the decision, entities like Google, Facebook, Twitter, Microsoft, and others will be forced to give up your data, even if the “warrant” authorizing its seizure is facially invalid, overbroad, unsupported by probable cause, calls for production of protected or privileged information, infringes civil rights or liberties, or calls for production of records well beyond the scope of the jurisdiction of the court that issued it. Worse, they may never be allowed to tell you – their customer – that they have done so.
It’s not just that it turns your provider into an agent of the police. It’s that it turns them INTO the police. Mindless actors who must produce any and all records demanded – no matter where they are or how burdensome it is to produce, and no matter whether or not the process by which they are demanded is lawful. And it means that consumers have no way of knowing if their records – even intimate records – have been produced (legally or illegally), and have no remedy for such production unless the cops decide both to arrest them AND to use the evidence seized against them.
In essence, the New York Court ruled that ISP’s and providers can’t challenge the fact that they have been turned into automatons for the police. Just shut up and get used to it.
A Primer on Production
There are several ways that law enforcement agencies can get evidence. First, they can just ask for it – voluntary production. Second, they can get a court order for certain kinds of evidence – tracking devices, historical cell records, trap and trace records, etc. These “orders” merely require the cops to certify that the evidence is “relevant” to a criminal investigation, not that there is probable cause.
The two most relevant ways to get evidence is the subpoena and the search warrant. A subpoena – from the Latin – “under penalty” – is a kinda/sorta court order – frequently issued with the seal and stamp of a court, but where no judge ever sees it or knows it has been issued.
An administrative subpoena is issued by an agency or department under its own authority – no judge needed. A grand jury subpoena is “issued” by the court under the name of the grand jury, but actually just typed up by the cops or prosecutors, again with no judicial knowledge of intervention. A subpoena duces tecum is a subpoena compelling the recipient to produce documents, records, or physical objects that are within the recipient’s “possession, custody, or control.” As long as the recipient is subject to the jurisdiction of the entity issuing the subpoena, they have to produce relevant records in their possession, custody and control. It’s a cost of doing business.
When an entity gets a subpoena, it has options. It can just pony up the records. It can ignore the subpoena and wait for the government to move to compel its production. It can write to the prosecutor and ask to limit the scope of the subpoena. It can move to quash or modify the subpoena. It can assert legal protections or privileges with respect to compliance. It can assert that production is unreasonable, oppressive, or burdensome.
There are lots of reasons not to comply with a subpoena. Maybe the grand jury issuing it does not have the legal authority to investigate what it is investigating? Maybe the subpoena calls for production of attorney-client or doctor-patient privileged records. Maybe the subpoena calls for First Amendment protected “associational” activities (like the NAACP’s membership lists).
In the case of a subpoena, it’s not self-executing. The recipient has an opportunity to challenge it. The benefits of a subpoena to the prosecution are the fact that (1) you serve it on an entity and they have to find the records rather than you having to find them; (2) you don’t need “probable cause” to issue a subpoena – just that the records relate to a lawful investigation – and in many cases that they might lead to uncovering relevant records even if they are not themselves relevant; (3) you don’t need to know where the records you want are, just who might hold them. If the subpoena is too broad, the other side will complain and begin the negotiation.
A search warrant is a different kettle ‘o fish. A search warrant is an order issued by a court after making a finding that probable cause exists to believe that (a) a crime has been committed; and (b) there is evidence relevant to that crime at the place to be searched.
Place to be searched is key – a search warrant is an order issued to the police authorizing or commanding THEM to conduct a search in a particular place, for a particular thing at a particular time in a particular location. The police don’t “serve” a search warrant – they execute it.
A warrant is typically executed in public, during the day, with a copy of the warrant, the inventory of what is taken, and sometimes the affidavit supporting the warrant provided. Any evidence seized outside the scope of the warrant is inherently suspect, and the entire search can be invalidated if the police go well beyond the four corners of the warrant – seizing items not called for in the document, looking in places not authorized. After the warrant is executed, the owner of the records or items seized can file a motion in court for return of the items, asserting that they have been seized illegally, and get a hearing on that motion. So either a bad search, or a bad execution of a search can be litigated.
Finally, a court can order that the recipient of the subpoena not tell the customer that the subpoena has been issued when the police provide actual evidence that such a gag order is essential to prevent the destruction of evidence, threats to witnesses, or flight of defendants – not simply that it would impede the criminal investigation. For search warrants, there are procedures for what are called “sneak and peek” warrants – where the cops execute a warrant without telling the owner, but these are few and far between.
OK. Law school lesson over.
The Frankenwarrant
So one key distinction between a warrant and a subpoena is who executes it. In a subpoena, the prosecutor serves it on the recipient who then conducts the search and review for records. In the warrant, it’s the cops who do the search.
There’s one other key distinction between a warrant and a subpoena. You can only be subpoenaed to produce your OWN records – you can’t subpoena a landlord for the files of the tenant in their apartment even if the landlord owns the apartment and has a right to enter the tenant’s dwelling and inspect it. You can’t subpoena the owner of the building for the contents of a storage unit, or the landlord of an office building for the files of a corporate tenant. But you can conduct a search of the apartment, storage unit of office with a warrant.
Under the provisions of the Stored Communications Act (SCA), Congress attempted to create a hybrid warrant/subpoena. It’s a floor wax and a desert topping! The law provides that “A governmental entity may require a provider of remote computing service to disclose the contents of any wire or electronic communication … without required notice to the subscriber or customer, if the governmental entity obtains a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures) by a court of competent jurisdiction…” Great.
But a “warrant” is not an order to the provider – it’s an order to the cops. The provider who receives a warrant is not required under the law of the state, or under federal rules of criminal procedure to do anything. The warrant says “TO ANY AUTHORIZED LAW ENFORCEMENT OFFICIAL, YOU ARE HEREBY COMMANDED TO…” OK. So Facebook is not “commanded” to do squat.
But the SCA appears to convert this order to the cops into an order to Facebook, stating that “A governmental entity may require a provider of remote computing service to disclose the contents of any wire or electronic communication…” if it has a warrant. This converts the “warrant” into a subpoena.
Or, a Frankenwarrant.
And that’s where the New York State Court stepped in. You see, you can “quash” or modify a subpoena before you have to comply. But since this is NOT a subpoena, according to the New York court, you can’t quash it. You can also assert privileges or challenge the authority of a subpoena. No dice – it’s a warrant. So Facebook is out of luck.
O.K. It’s a warrant. So the cops are required to execute the warrant, right? No, sorry – it’s a subpoena. Um, then the cops are required to provide notice and specificity of the place they are searching, right? Nope. See, it’s really a subpoena.
Oh. So the cops have to leave an inventory of what was taken, and deposit the seized items with the clerk of the Court in the County in which the warrant was issued, right? Nope, it’s not a warrant. Oh, so the cops can only execute the warrant in the County in which it was issued or in adjacent counties, right? Nope, it’s not a warrant.
O.K., so there’s a limit on the time in which the warrant can be executed, and a how long the warrant is valid after being issued? Nope, for these purposes, it’s not a warrant. OK, but at least the restrictions on “sneak and peek” warrants still apply, right? Nope. ‘Cause it’s not a warrant. OK, but at least I get to know that the warrant has been issued and executed, right? I mean, just like I would if the cops kicked in the door, right? Nope… sorry about that.
Oh, and the fact that the records of your use of Facebook are your records stored at Facebook rather than Facebook’s records? Oh, for those purposes, the order is a warrant.
It’s a floor wax. It’s a desert topping. It’s whatever we want it to be.
So the cops get all of the benefits of a warrant – compulsory process, production of third party content information, no prior litigation or ability to modify or quash, no pre-execution assertion of privilege or burden, and all the benefits of a subpoena – cops don’t have to execute, no risk of cops exceeding the scope of the warrant, and the recipient of the warrant has to pay to conduct the search on themselves!
Schweet!
We Have to be Veeeewy Veeeeewy Quiet
The other aspect of the Frankenwarrant is secrecy. Courts have always had the authority to issue gag orders. Upon a showing of specific and articulable facts indicating that some specified harm will occur, the court could order that the fact of a subpoena or the fact of the execution of a warrant be concealed from the owner of the records. If the government can demonstrate facts to show that providing the statutorily required notice of the warrant will cause risk of flight, destruction of evidence, or intimidation of witnesses, it can ask for, and the Court can order what is called delayed notice of a warrant.
This is very rare, and only temporary as an emergency measure. But even with these “delayed notice” warrants, the owner of the information eventually knows that they have been searched, and can resort to judicial process to correct what might be an unlawful search. But they have to know there’s been a search to challenge the legality of the search.
In the New York Facebook case, the Court ruled that Facebook could not itself challenge the search. It also ruled that Facebook could not tell its customers that a search occurred. So the only way someone would know that the cops had the contents of a Facebook account is if they were actually prosecuted by the District Attorney – that is, if they did something to warrant prosecution. The hundreds of innocent people whose postings were provided by Facebook by Court order have no recourse because they have no notice.
And even if a person was prosecuted, the government need not disclose the fact that their Facebook account was accessed. They only have to tell you if they plan to use the contents of the Facebook account, or information derived from that account in their case in chief against you.
In fact, maybe not even then. New York discovery rules require production of evidence of “property obtained from the defendant.” Since the Facebook account was not “obtained from the defendant” but was obtained from Facebook, the government could theoretically never tell the subject about the search.
So Facebook can’t challenge the search – and you may never know.
This is wrong. Facebook is not the police. Facebook should not be doing the job of the police. Facebook, and others are happy to cooperate with the police in many if not most investigations. But they need to be able to tell their customers when the customers’ data is being requested (that is, the data of the customer, not the non-content data that Facebook may have about the customer – that’s for another discussion).
The data subject needs to be able to challenge the use of the Courts to get their evidence – and get a full and public hearing before a court on the legality of the search and/or subpoena. They need to be able to assert jurisdiction, privilege, or other legal authority.
We need to stop the procedure of making Internet providers conduct searches and seizures on themselves. It’s called a Writ of Assistance and is prohibited by the U.S. Constitution. While you can make companies produce their own records, you can’t make them conduct a search for the records of others. You can’t force a landlord to search their tenant, or a building owner to search a business. You can’t force an ISP or social media provide to search their customers’ records. It’s unAmerican. That’s why there’s a difference between a warrant and a subpoena.
That’s probably because search warrants aren’t “served” on someone. They are executed on a place.The first you know that there’s a search warrant is when the cops show up with the warrant and execute it.
On April 5, the Court held that Facebook could not move to quash more than 381 separate “search warrants” for customer information served on it pursuant to New York search warrant law and the federal Stored Communications Act, 18 USC 2703
As a result of the decision, not only can police search the contents of just about any online information, but they don’t ever have to tell you about it, and there’s effectively nobody with the ability to ever object. A great deal of this problem is created by the fact that the SCA creates a kind of “Frankenwarrant” – something that looks like a search warrant issued by a court with probable cause, but acts like a subpoena. For privacy purposes, the Frankenwarrant has the worst of both search warrants and subpoenas.
The case arose out of a NY state investigation of disability insurance fraud by possible 9/11 first responders – police and firefighters. In order to show that people were faking injuries, the cops got 381 identical search warrants directed at Facebook, calling for Facebook “to retrieve, enter, examine, copy, analyze, and . . . search TARGET FACEBOOK ACCOUNT for the . . . [specified] evidence and property, and. . . to bring it before the [c]ourt without unnecessary delay.”
The specified evidence included, among other things, each target account holder’s profile information, contact and financial account information, groups, photos and videos posted, historical login information, and “[a]ny public or private messages.” The warrants prohibited Facebook from notifying its subscribers or otherwise disclosing the existence or execution of the warrants, in order to prevent interference with the investigation.
Facebook believed that the warrants were overbroad, unnecessarily invaded their customers’ privacy, called for information protected by the First Amendment, and otherwise constituted a prohibited “general warrant,” so they moved to quash the search warrant.
The New York Court never actually ruled on whether the search warrant was good or bad. Legal or illegal.
What they ruled was that, under New York law, there’s no procedure to “quash” a search warrant. So Facebook could not resist production – even if the warrant was facially invalid and unlawful. They had to produce the records. And they could not tell their customers (or the other individuals whose privacy was invaded by producing the customer records) that they had complied.
That meant that the customers may never know that the contents of their social network accounts are sitting in some cop’s office in Manhattan. I do mean NEVER. Unless that person is later indicted, AND the police choose to introduce the Facebook evidence against them, AND that person moves to determine where the evidence came from, they will never know that their information was produced. Ever.