All your face are belong to us: Facebook and the unreasonable expectation of privacy

The most obvious protection of privacy in the United States is found in the Fourth Amendment, which protects persons, homes, papers, and effects from "unreasonable searches and seizures" by the Government. In Katz v. United States, that standard of protection was given form in Justice Harlan's oft-quoted holding that a Fourth Amendment search occurs when the Government violates a subjective expectation of privacy that society recognizes as reasonable. The rationale was that a person who enters a telephone booth and shuts the door before making a phone call is entitled to assume that his conversation is not being intercepted. The telephone booth becomes "a temporarily private place whose momentary occupants' expectations of freedom from intrusion are recognized as reasonable".

But what if there was a sign inside the booth in Katz, saying that the user's conversation would be recorded by the phone company? It is unlikely that the Supreme Court would have held that the defendant still had a subjective expectation of privacy in the content of his conversation. Taking the scenario one step further: what if the defendant in Katz couldn't use the phone until he had affixed his signature to the sign, to show that he had read and accepted its terms? It would defy reality to say that the defendant still retained any subjective expectation of privacy.

The telephone booth of the future

Facebook is that omnipresent, content-recording telephone booth. Originally started as a networking tool for Harvard University students, Facebook claimed its 100 millionth user in August 2008. Facebook continues to increase its user population exponentially and is now valued at over three billion dollars. This is a significant threat to Fourth Amendment privacy, because every one of those users has agreed to the Facebook "privacy policy". This paper argues that each user has thereby abandoned any subjective expectation of privacy.

In its terms of use and privacy policy, Facebook reminds the user that he has knowingly provided his personal information, and that this information will be stored and used for commercial purposes. This would most commonly involve user-specific advertising. Furthermore, Facebook expressly states that this information will be shared with third parties where (1) reasonably necessary, (2) legally required or (3) authorised by the user. Facebook does offer its users the option of restricting information that is available to other users, network members and third-party applications. That is at best a prophylactic solution. It acts as a barrier to stop the information's transmission. But Facebook still owns the sheath and its contents. Like any other prophylactic, those "private" contents can be used by Facebook and shared with third parties in the same manner as any other user-supplied information. Given all of the above, it is fanciful to assert that the Facebook user has any subjective expectation of privacy.

You know about it. Everybody told you so.

The subjective expectation of privacy is further eroded by the unrelenting stream of news warning the public that information on social networking sites is not "private". There is an entry on the topic on Wikipedia.com. Videos have been posted online to warn users that - unlike Las Vegas - what happens in Facebook doesn't stay in Facebook. The New York Times has warned its readers that - like Hotel California - you can check out of Facebook any time you like, but you can never leave. In Canada, four daily newspapers published front-page photographs of a 14-year old stabbing victim that were taken from Facebook, and duly credited the photos to Facebook. The British Government has investigated Facebook for possible violation of its Data Protection Act. Even Congress has asked Facebook to explain its privacy policies. But that might just be the lawmakers trying to protect the sanctity of their own Facebook profiles.

It's the Government, stupid.

One might retort that the Facebook user isn't worried about his privacy. After all, his information is made available only within Facebook and its commercial affiliates. It is a common refrain amongst Web companies with vast stores of user information that Government is the danger to privacy, not them. However, the Government can gain access to a company's data banks with a single subpoena. Facebook has already received subpoenas from the New York and the New Jersey Attorneys General in relation to potential criminal cases.

The Supreme Court doesn't have a problem with the new telephone booth

It would be unwise to rely on the Courts to save the Facebook user from himself. In Smith v. Maryland, the Supreme Court held that telephone numbers (as opposed to the content of the telephone conversation in Katz) are not protected by the Fourth Amendment. The rationale was that telephone users "typically know that they must convey numerical information to the phone company; that the phone company has facilities for recording this information; and that the phone company does in fact record this information for a variety of legitimate business purposes. Although subjective expectations cannot be scientifically gauged, it is too much to believe that telephone subscribers, under these circumstances, harbor any general expectation that the numbers they dial will remain secret."

The above description applies to Facebook with equal force but with an important difference: the Facebook user doesn't simply convey numerical information. He willingly uploads photographs, exchanges messages and updates his status. By doing so, he tells Facebook what he looks like, who he is communicating with and even his recent offline activity. As the Supreme Court explicitly warned in Smith: a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.

While the Supreme Court has not taken the opportunity to rule on Fourth Amendment privacy for online communications, the decisions of the United States Courts of Appeal strongly suggest that information shared on Facebook will not be protected by the Fourth Amendment. In dealing with the validity of a Government request for email records under the Stored Communications Act, the Sixth Circuit in Warshak v. United States noted that a person would have a greater expectation of privacy if he was using a service provider that promises not to screen e-mail. Significantly, the Sixth Circuit went on to say that that person "might decide that the convenience of free, web-based e-mail is ultimately worth the tradeoff of allowing the service provider to screen his e-mail". In this paper's context, the convenience of keeping in touch with friends translates into a voluntary tradeoff of privacy to allow Facebook to keep and use personal information.

The Ninth Circuit's decision in United States v. Heckenkamp is equally telling. The Court held that the defendant had a subjective expectation of privacy in the stored contents of his computer, even when that computer was connected to a network. However, the Court further held that "privacy expectations may be reduced if the user is advised that information transmitted through the network is not confidential and that the systems administrators may monitor communications transmitted by the user". The Ninth Circuit ultimately held in Heckenkamp that the administrator's search of the defendant's computer was valid and that the information thereby obtained was lawfully handed over to the Government.

If and when this issue comes to Court, it is almost certain that the following plea will be heard: "I didn't read the Facebook privacy policy and terms of use before I signed up". After all, it appears that most people don't read these long and boring documents. To which, the Court's answer will be: "too bad". Or, as the Court of Appeals of New York in Murray v. Cunard S.S.Co. more eloquently put it: the person who omits to read takes the risk of the omission.

Mommy, save me from Facebook

This paper concludes that Facebook poses a grave threat to users' Fourth Amendment privacy rights. Sadly, this paper is also forced to concede that the biggest threat to the average user's expectation of online privacy probably isn't the Government: it's that his mother is also on Facebook, looking at his pics.

-- JasonChan - 09 Dec 2008

Comments are most welcome. For those who are not familiar with the reference, the title of this paper is intentionally un-grammatical: http://en.wikipedia.org/wiki/All_your_base_are_belong_to_us

I found this both exceptionally well written and frankly, somewhat frightening. Especially about the mothers on facebook. I would hesitate to ask, however, are there a number of things going on on facebook that would be relevant in legal proceedings? I don't mean to reduce the impact of your well-crafted argument, I'm just wondering where this lies on the scale of legal risk as compared with, say, gmail.

-- JohnPowerHely - 10 Dec 2008

Thank you very much for the kind words.

I take the view that Facebook is at least as risky as Gmail, because of its messaging system. This quote is taken from the Facebook privacy policy:

"When you use Facebook, you may set up your personal profile, form relationships, send messages, perform searches and queries, form groups, set up events, add applications, and transmit information through various channels. We collect this information so that we can provide you the service and offer personalized features."

So, if a user was using the Facebook messaging (either its email-style or its instant messaging systems) in place of Gmail to converse with another user, those conversations are compromised.

As for the other activities on Facebook, I am reminded of a Department of Justice presentation that I attended several years ago where a Drug Enforcement Administration officer told us that they obtained information of the items that drug dealers were laundering money on by looking at photos on Myspace. Unfortunately, I can't find any reference to it on the Net.

I am also reminded of people who have been tagged in Facebook photographs smoking marijuana. Fellow Singaporeans, be informed: this is evidence of an offence that is punishable in Singapore with up to 10 years imprisonment - even if the drugs were consumed overseas: http://news.bbc.co.uk/2/hi/asia-pacific/522243.stm

-- JasonChan - 11 Dec 2008