Privacy Framework for Monitoring Social Media

1. Privacy Framework for Monitoring Social Media Professor Peter Swire Ohio State University& Future of Privacy Forum National Academy of Sciences Public Response to Alerts & Warnings Using Social Media February 24, 2012

2. Two Perspectives on Government Watching Social Media • It’s Public. • People have posted on FB, Twitter, blogs, etc. • Of course the government should be situationally aware • It’s good to use modern information tools to learn and respond to crises

3. Second Perspective • It’s creepy. Ich. • The government reading/scanning/analyzing all of that stuff on social media? • Part of my permanent record? • Creating a “Terrorist Risk Score” or “Political Opponent Risk Score”? • 1972 Democratic Convention • Levi Guidelines, Privacy Act, FISA

4. Overview • Constitution: 4th Amendment • Public • Consent • Statutes • Privacy Act, Wiretaps and Stored Records • Subset of legal actions • What is good to do

5. My Background • Moritz College of Law, Ohio State • Future of Privacy Forum project now on government access to personal information • 2009-2010, National Economic Council • 1999-2001, Chief Counselor for Privacy, OMB

6. 4th Amendment • Warrant, with probable cause • No unreasonable searches or seizures • Clear limits on entering an individual’s house, car, etc. • Social media, though, don’t require a search warrant to see

7. “In Public” • Major reason that is OK for government to look at social media • Can read newspapers • Can follow an individual down the street • Not a “search” or “seizure” • A foundation of DOJ/DHS actions for years

8. Jones GPS Case & “In Public” • Supreme Court, 9-0, said warrant needed to put a GPS tracker on a car • Car “in public” • Majority emphasized physical attachment • Four or five justices questioned whether “in public” is enough to make surveillance OK • “Mosaic” theory and what are the limits on government surveillance

9. “Consent” Exception to 4th Am. • Another foundation of 4th Am: individual can consent to a search or seizure • You can agree to have the cop enter your house • Social media and individuals have consented • “User generated content” posted by users! • Users have “opted in” to posting blog, Twitter, many posts on Facebook • So, consent has been given!?

10. Was It Really Consent? • Bellovin study • Vast majority of FB users did not have their settings the way they thought they were • Widespread misunderstandings • More generally • Fraction of people who think posts on FB are going to the government? • Has there really been consent to that?

11. Statutes: The Privacy Act • Privacy Act of 1974 • Agency, such as DHS, issues a System of Records Notice • DHS has done so for situational awareness • Law does place limit on sharing with other agencies • If procedures are followed, not strict constraint on data collection and use

12. Statutes: Wiretaps • Strict limits on government interception of phone calls • Extra-strict search warrant • Content of private communications very sensitive • Doesn’t literally apply to reading public posts, but shows sensitivity of reading content

13. Statutes: Stored Communications • Stored Communications Act applies to records held by a third party • Would apply if you subpoena FB, Twitter for records • Medium level of strictness to get data • Shows medium level of sensitivity for content of stored records

14. Statutes: Pen Registers • This is the to/from information • Who you called, texted, emailed • Pen register – the ones you sent to • Trap and trace – the ones who sent to you • Needs judicial order, but easy standard to get • This routing information not as sensitive • But, very useful to law enforcement • Friends list on FB

15. Current Mystery: Location Information • Split in lower courts now whether need a warrant to get a person’s cell phone location information • Big battle brewing • Sensitivity of location • Cell phone and track a person in unprecedented ways • Pictures posted to Net often have time/date/place

16. Subset of What is Legal • Not everything legal is good to do • You know this – you teach it to your kids • Current DHS self-restraint • Basically, monitor public officials and traditional media types on social media • Careful not to track individuals • FBI tracking words (bomb) but not people • That didn’t prevent painful hearing last month

17. Tests for What is Good to Do • Friends and family test • New York Times test

18. Conclusion • Achieve these goals • Follow the constitution and the law • Do what is good to do • Be alert to the risk of undermining a good program by creeping people out • And • Use new tech effectively