Social networking sites: What information will they release about you?

Michael Kassner takes a closer look at the kinds of information released by social networking sites about members if requested by law enforcement. Concerned? Or is it just the price of online participation?

It's time to touch a sensitive subject. Under what conditions will Internet sites where people socialize--like Twitter, Facebook, even TechRepublic -- release your personal information? And, will they tell you when they do?

I belong to such sites. So, recent events surrounding Twitter's staff and their being ordered to hand over account details of Twitter members associated with WikiLeaks hit close to home. Especially, after reading this Wall Street Journal blog, where author Paul Sonne mentions:

"WikiLeaks said on its Twitter feed Friday, that it assumes Google Inc. and Facebook Inc. received secret U.S. government orders related to WikiLeaks as well. Facebook didn't comment. Google didn't immediately respond to a request for comment."

We can take that comment a couple of different ways. Was Twitter specifically singled out to release information? Or, was Twitter the only one to publicize getting a court order?

I can't answer those questions. Nor can I dispense any insight on the WikiLeak controversy. What I can do, is provide information as to what social-media outlets like Twitter and Facebook intend on doing if asked to release information about you.

In our control

Events like WikiLeaks show the importance of understanding EULAs and privacy statements, especially those published by social-media sites. Believing that, I have tried to read them, but stopped in frustration. I am not an attorney. So there is a huge gap between my reading and comprehending what is written.

That's bothersome. I would like to understand the details about what and under what conditions sites like Facebook and Twitter will turn over information to law enforcement officials.

The Electronic Frontier Foundation (EFF) is interested in this as well. And guess what? They have lots of attorneys who do understand.

EFF gets involved

The EFF's involvement started when they filed a Freedom of Information Act along with the Samuelson Law, Technology and Public Policy Clinic of UC, Berkeley:

"EFF, working with the Samuelson Law, Technology, and Public Policy Clinic at the University of California, Berkeley, School of Law (Samuelson Clinic), filed suit on December 1, 2009 against a half-dozen government agencies for refusing to disclose their policies for using social networking sites for investigations, data-collection, and surveillance."

In addition, the two parties:

"Asked for copies of the guides the (social-networking) sites themselves send out to law enforcement explaining how agents can obtain information about a site's users and what kinds of information are available."

Thirteen companies responded to the EFF inquiry. And, I applaud their willingness to help. EFF does as well:

"The information we got back enabled us to make an unprecedented comparison of these critical documents, as most of the information was not available publicly before now.

I will let that sink in for a moment. The EFF further mentions:

We received copies of guides from 13 companies, including Facebook, MySpace, AOL, eBay, Ning, Tagged, Craigslist, and others, and for some of the companies we received several versions of the guide."

EFF simplifies

The EFF along with the Samuelson Clinic un-legalized the obtained documents and created an easy-to-use spreadsheet that lists how each company intends to respond to requests for information. The spreadsheet is also available as a PDF file.

As for Twitter's guidelines, the EFF had this to say:

"Although we didn't receive a copy of Twitter's law enforcement guide, Twitter publishes some relevant information on its site, so we have included that in our spreadsheet for comparison."

Law enforcement release forms

Something else that may be of interest, are the release forms participating respondents require law enforcement agencies to fill out before obtaining information. The following list is the kind of information that can be requested from Facebook:

Basic Subscriber Information:
  • User Identification Number
  • E-mail address
  • Date and Time Stamp of account creation date displayed in Coordinated Universal Time
  • Most Recent Logins (generally captures the last 2-3 days of logs prior to processing the request) in Coordinated Universal Time
  • Registered Mobile Number
Expanded Subscriber Content:
  • Profile Contact Information
  • Mini-Feed
  • Status Update History
  • Shares
  • Notes
  • Wall Postings
  • Friend Listing, with Friends Facebook IDs
  • Groups Listing, with Facebook Group IDs
  • Future and Past Events
  • Video Listings, with filename
User Photos: May include photos uploaded by the user and photos uploaded by other users that have the requested user tagged in them. Group Information: Will include the BSI of the group creator/administrator in XML format and the current status of the group. Private Messages: If retained. IP Logs: Are very limited and frequently incomplete, but when available are provided.

That is a significant amount of information. Were you aware of this?

Final thoughts

That is a lot to digest. And why, more than any previous entreaty of mine, I would be grateful to learn what you think, either as a member of a social-networking site or not.

I also want to mention something important to me. It is not my intention to pass judgment on any of the concerned parties, be they public or private. My aim is your awareness.