Wednesday, March 17, 2010

Friending the FBI

You probably saw the stories that came out yesterday, reporting that law enforcement officers are, as this Yahoo! News story puts it, “following the rest of the Internet world into popular social-networking services, going undercover with false online profiles to communicate with suspects and gather private information”. Most of the stories imply that there’s something illegal about officers’ doing this . . . though they never specify exactly what makes it illegal.

I thought I’d do a post on the topic to analyze some of the potential arguments that could be made as to why this practice violates U.S. law (anyway). I’m going to limit the post to issues arising under the U.S. Constitution because it simply isn’t feasible for me to analyze the arguments that could be made under all of the state and federal statutes that might (or might not) apply here.

Let’s start with a threshold issue: The Yahoo! News story, like several other articles I skimmed, says that in “the face-to-face world, agents can’t impersonate a suspect’s spouse, child, parent or best friend” but they can certainly do this “online, behind the guise of a social networking site”. Does anyone find that surprising? I would hope not.

Online imposture has been going on since at least the 1990s. In 2006 I did a blog post in which I talked about online imposture and noted a fairly benign instance of it that occurred about 10 years earlier. I’ve also done other posts on how the law approaches and/or might approach a civilian’s posing as another civilian, which of course extracts the law enforcement component from the analysis.

Almost 2 years ago, I did a post on a case from Indiana in which a man used Facebook pages in the names of two sisters so he could pose as them online and have virtual sex with men (presumably) he met online. The issue in that case was whether what he did qualified as stalking (which I don’t think it did, and apparently neither did the defense attorney or the prosecutor).

But those cases all involved civilian imposture, i.e., one civilian impersonating another. The issue that arises in civilian imposture is whether or not the poseur committed a crime by pretending to be the other person. As I’ve noted before, a few states make imposture a crime, but most don’t seem to (unless it’s being done for the purposes of identity theft). It’s also possible to pursue that kind of imposture as criminal libel, but, as I’ve noted, that’s usually either not a crime or a very minor crime under state law.

But I digress: Let’s get back to law enforcement imposture. I’m going to assume that when officers pretend to be someone else on Facebook or some other social networking site they don’t try to defame that person or stalk anyone or otherwise engage in conduct that would constitute a crime under state or federal law. I don’t think that’s the issue that’s inciting indignation in the articles about law enforcement imposture.

I think that what’s inciting indignation is a feeling of betrayal . . . which derives from an implicit assumption that you should be able to trust people online . . . that is, trust them to be who they say they are. I don’t know about you, but I don’t buy that assumption. People misrepresent themselves in the real, physical world. Why, then, is there any reason to think they won’t do so – and do so more creatively and more successfully – online?

I’m actually getting to a Constitutional issue. In a post I did last August, I analyzed whether it would violate the 4th Amendment for a law enforcement officer to go online and pretend to friend someone on Facebook or a similar social networking site . . . for the purposes of gathering evidence to be used against them. As I explained in that post, I think it’s clear that the officer could use the evidence he/she elicited because I don’t think this kind of scam would violate the 4th Amendment.

In that post (and you might want to read it for more on all this) I explained that the U.S. Supreme Court has long approved the use of the “false friend” technique. In Hoffa v. U.S., 385 U.S. 293 (1966), the Court said that the 4th Amendment doesn’t protect “a wrongdoer's misplaced belief that a person to whom he voluntarily confides his wrongdoing will not reveal it.” And in U.S. v. Connors, 441 F.3d 527 (U.S. Court of Appeals for the 7th Circuit 2006), a federal appellate court observed, “[w]hen a friend is false, blame the friend, not the government.”

Now, those opinions were talking about strangers pretending to befriend someone who (foolishly) chooses to share incriminating information and/or evidence with them . . . but I see no reason why the result would change just because the officer pretends to be a real life friend of the suspect’s or even one of his/her relatives. Under 4th Amendment law, you assume the risk of betrayal, i.e., you assume the risk of trusting someone. I think that principle, which evolved in the context of real-world communications, should apply with at least equal force online. After all, we all know things aren’t necessarily what they seem in the online context . . . so we should perhaps be even more suspicious there than we are here.

Some of the stories also talk about law enforcement imposters friending someone or otherwise gaining access to information they’ve posted on a Facebook page or other social networking site. In the post I did on the Hoffa issue, I also addressed that issue: If you post information (including incriminating information) online and give people access to it, you’ve surrendered any 4th Amendment expectation of privacy you might otherwise have had in that information.

As I’ve noted in earlier posts, in Katz v. U.S., 389 U.S. 347 (1967), the U.S. Supreme Court held it is a 4th Amendment “search” if law enforcement officers violate a “reasonable expectation of privacy” in a place or thing. Under Katz, a "reasonable expectation of privacy" exists when (i) I think something (a place, an activity) is private and (ii) society agrees that it is, in fact, private. The Katz Court noted, though, that whatever one "knowingly" exposes to public view, "even in his own home or office," is "not a subject of Fourth Amendment protection. If you post information (or images) online and give other people access to them, you’ve knowingly exposed them to public view (in the sense that you’ve lost control of them) and have thereby forfeited any 4th Amendment protection that content might have had.

In that earlier post, I also explained that the social networking person who’s unknowingly shared incriminating information with a law enforcement officer who’s posing as a friend (maybe even a relative) doesn’t have a viable 5th Amendment, privilege against self-incrimination argument, either. The privilege against self-incrimination only comes into play when (i) you are compelled (ii) to give testimony (iii) that incriminates you. For the purposes of this analysis, we’ll assume that what’s posted on the social networking site incriminates the person who posted it (i.e., implicates him in the commission of a crime). We’ll also assume that what was posted was “testimony” because some of it, anyway, consisted of messages and other communications.

The suspect’s problem, as far as taking the 5th Amendment privilege is concerned, is that he wasn’t “compelled” to write and post the information online. The Supreme Court has held that if you voluntarily create documents (and whatever content is posted online is analogous to hardcopy documents), you cannot take the 5th Amendment as to the contents of those documents because you weren't compelled to create them. For the purposes of applying the 5th Amendment, if you voluntarily generate comment (oral testimony or writings like letters or emails), you've waived the 5th Amendment privilege as to that content.

Under the 5th Amendment, “compulsion” requires a court have ordered you to give testimony, which means you have to testify or be held in contempt and be locked up until you do. No one made our hypothetical suspect post information online and then share it (unwittingly) with law enforcement officers, so the 5th Amendment doesn’t work, either.

Finally, you might wonder about the applicability of the Miranda rules. As I noted in an earlier post, Miranda is a construct – a set of prophylactic rules the U.S. Supreme Court made up in order to restrict police officer’s ability to use psychological coercion to get people to confess in police interrogation rooms. For Miranda to apply, you have to be in police “custody” which, as noted in that post, means you have to (i) be under arrest or (i) have been restrained by the police in a manner similar to a formal arrest. Since our hypothetical suspect wasn’t in custody when he created the Facebook pages and posted incriminating information online AND gave the law enforcement imposters access to all of that, Miranda doesn’t apply.

One more comment: Some of the FBI-friending articles mention the Lori Drew case, in which she was prosecuted for “exceeding authorized access” to the MySpace system based on her having violated the Terms of Service by creating a fake MySpace account and pretending to be someone else. The judge in that case, of course, eventually held that the charge was not good because it violated Constitutional requirements that the law be clear and understandable (in other words, it was void for vagueness). Even if this was somehow illegal, that would be a matter of criminal liability, i.e., the issue would be whether the officers could be criminally prosecuted for exceeding authorized access to a computer system. As I’ve noted before, the Supreme Court basically says that criminal liability (which triggers the imposition of penal sanctions) is a different matter entirely from the 4th Amendment analysis (a violation of which can trigger the exclusionary rule).


felix said...

One amendment you did miss: the 6th.

Though an unlikely scenario, evidence gathered after the target had been charged/indicted and using such a false friend technique would not be admissible in the prosecutor's case in chief.

Susan Brenner said...

It would not be inadmissible under the 6th Amendment right to counsel as interpreted in Massiah v. U.S. 377 U.S. 201 (1964) IF the police were found to have "deliberately elicited" incriminating statements from a suspect after he had invoked his right to counsel (either by asking to have one appointed to represent him on the charge at issue or by having already retained an attorney to do so).

The Massiah Court's holding as to the inadmissibility of certain evidence does not apply if law enforcement obtains incriminating statements by "luck or happenstance." So anything a person voluntarily posts online, however incriminating it may be, would not be suppressible under Massiah because that would clearly fall under the luck or happenstance principle.

If an officer pretending to be a friend or even a relative actively encouraged the suspect to make incriminating statements online, that would probably constitute deliberate elicitation and the evidence might be suppressed.

In Kuhlmann v. Wilson, 477 U.S. 436 (1986), the U.S. Supreme Court held that putting a prisoner in a cell with another prisoner and letting the plant listen to what the suspect prisoner said didn't constitute deliberate elicitation under Massiah. So if the law enforcement imposter simply listened, that might fall under the Kuhlmann, "passive listening post" exception to Massiah.

The reason I didn't spend time on the Massiah 6th Amendment issue is that it comes up much less often than the issues I discussed in the post . . . simply because officers are usually trying to get people to provide incriminating evidence so they can charge them . . . which then triggers the Massiah right.

WJB said...

The difficulty that anyone has in using information gleaned from social media like Facebook is that they all have Terms of Use policies. Law enforcement is NOT exempt from violating any TOU or Privacy Policy as a condition of use. If you read the one for Facebook, it specifically addresses the use by LEA to gather information using factious profiles. In fact, YOU can't do it as a part of the terms. I doubt the undercover officers are using their real names or their real Facebook profiles to gain access to the profiles of suspects. LEA are generally bound by rules and violations on any scale are scrutinized carefully by the courts. I suspect unless ALL other avenues of investigation were undertaken they would be questioned about violating a policy of the use of a social network to gain evidence.

We start to enter the area of search with or without warrant. If they look for someone on Facebook and use what is publicly available than that may be hard to defend. BUT if they create a bogus account to actively search and then be-friend a suspect or a friend of a suspect then we are treading on an expectation of privacy.

Let's be realistic, would officers agree that for their personal Facebook pages, it is okay for others whom they did not invite to be able to see their family photos etc. OR gave someone access to their profile because they lied about who they were or associated to...Doubtful...
Therefore if someone takes steps to privatize some, part or all of their social network page any interception of that information must be with judicial is just a matter of time before this issue is addressed at the highest court level...

Here is the facebook TOU:!/terms.php?ref=pf

"If you collect information from users, you will: obtain their consent, make it clear you (and not Facebook) are the one collecting their information, and post a privacy policy explaining what information you collect and how you will use it."

Acceptable Use Policy

Privacy and Integrity are cornerstones of the Facebook application and company
philosophy. Our privacy settings allow an individual to control access to their data
on the site. We actively monitor the site for accounts that try and circumvent our
privacy features, either by technical means or by providing false profile
information. In accordance with our terms of service (see, we will disable any and all accounts,
including accounts that may belong to law enforcement, which supply false
or misleading profile information and/or attempt to technically or socially
circumvent our privacy measures.