In a setback for privacy advocates, an appeals court on Tuesday ruled that law enforcement can order tech companies to hand over data on hundreds of users in one swoop – and the companies can’t challenge the warrant or even warn users about the search.
The case in question involves an investigation by New York prosecutors into state employees who scammed the disability system. The investigation, which saw 134 people indicted, was partly based on scanning Facebook for posts that showed the employees doing sports or other physical activities.
While police regularly make Facebook (FB) a part of criminal investigations, the way New York prosecutors obtained data is striking. Instead of applying for individual search warrants, they instead use a single affidavit as the basis for demanding Facebook root through the accounts of 381 users. And to avoid tipping off the suspects, the prosecutors also asked for a gag order to prevent Facebook from telling those users about the search.
This wide and sweeping order for hundreds of users led Facebook to challenge the warrants. Others shared Facebook’s concern. The ACLU, alongside other tech companies like Google and Microsoft, joined Facebook in asking a judge to declare the bulk warrants were an unconstitutional search and seizure.
The challenge didn’t get far, as a judge last year rebuffed Facebook, and forced the company to hand over the information. Tuesday’s ruling saw a state appeals court confirm that Facebook didn’t have a right to challenge the warrants in the first place. The court said the only recourse was for the Facebook users to object to the warrants during the subsequent criminal proceedings.
As law professor Orin Kerr points out, the court’s reasoning is correct from a criminal procedure standpoint. The point of a warrant in the first place is for a judge to decide that there’s probable cause for a search in the first place and to set out terms limiting the search. (This is a higher bar than subpoenas and other investigation tools, which typically let users mount a challenge before the fact.)
For now, the upshot is that a court could still find the bulk warrants in the New York investigation to be illegal. But that’s not much consolation for privacy advocates since, in the meantime, Tuesday’s ruling could embolden other law enforcement agencies to embark on broad fishing expeditions of their own – asking for hundreds or even thousands of user accounts in one sweep from Facebook, Twitter, Microsoft or any other social media company.
Tuesday’s ruling also goes against the grain of recent decisions by the Supreme Court, which has expressed growing concern over the erosion of privacy in the digital age.
Facebook has said it may bring a further appeal in the New York case, which would be a good thing. In the meantime, judges and lawmakers need to consider measures to make it more difficult for lawmakers to trawl for hundreds of users with a single request.
Here’s a copy of the ruling with some of the relevant parts underlined:
