With more netizens flaunting their actions and thoughts in the open, social media has become a mainstay in police work. Police departments and federal agencies are aggressively seeking information from social-media companies, beefing up their budgets and providing training to dig for online clues left by criminals and victims in targeted investigations.
They can and do routinely order social-media companies to shut down a Twitter or Facebook page, for example, immediately after a crime has been committed or have relevant information archived before any changes can be made. "It's no different than physical evidence," says Bob Hopper, manager of the Computer Crimes section at the National White Collar Crime Center.
But the issue of properly handling social-media content is also igniting heated debates about privacy and the limits of the current law that spells out how police can legally retrieve personal data. Adding to the confusion is the reality that rules and logistics for obtaining private information are still not firmly established for many police departments. Fewer than half of all law enforcement agencies, 48.6%, have a social-media policy, according to a survey by the International Association of Chiefs of Police.
"You'd hope that even big police departments would have people on staff to know the law," says Mark Rumold, an attorney at the Electronic Frontier Foundation. "But the law is arcane and confusing. And there is a significant debate on what governs what. There's a learning curve they have to go through."
About 88% of law enforcement agencies have used social-media sites — Facebook is the most frequently used, while Twitter is gaining — in monitoring and investigative work, the IACP survey says.
But at a time when police departments are cutting their budgets nationwide, coping with the new technological challenge is also proving to be a budgetary headache.
Thomas of the Cincinnati police department says her office's staffing has grown to seven analysts in two years, but she would like to add more.
Her unit averaged 23 social-media investigation requests a month from various districts two years ago. They now receive more than 100 requests a month. "Word is getting out that we're beneficial for (obtaining) information, but also that you can prove things. That it helps to solidify their case," she says.
Getting access
Social-media companies use standard legalese to spell out their policies for granting access to individuals' online accounts.
Facebook says it provides information for emergencies and to prevent fraud and other illegal activities, as well as for "violations of the Facebook Terms," a legal catch-all provision that gives the company a wide range of options in controlling users' pages.
The Facebook page of Thomas "T.J." Lane, the suspect in the recent shooting deaths at Chardon (Ohio) High School, was shut down because of a post he wrote, possibly foreshadowing his intentions. Facebook declined to comment on specific cases.
After a crime has been committed, "Facebook pages go down pretty quickly," says Rabbi Abraham Cooper, who specializes in monitoring digital hate crimes and terrorism for the Simon Wiesenthal Center. "What right does law enforcement have to shut down the pages? Clearly, the cops will say it is evidence and that they are entitled to it. Cops are routinely doing this without a court order."
Facebook says that its requirement for law enforcement to obtain content is disclosed publicly on its website. For basic subscriber records, such as name and account holder verification, police must provide a subpoena. A warrant showing probable cause is required for stored content, including messages and photos.
"Law enforcement often uses 'emergency situation' to circumvent the warrant requirement," says Ginger McCall, an attorney at the Electronic Privacy Information Center.
Some social-media companies are more reluctant than others to release data, McCall says.
When federal regulators sought private Twitter account information, Twitter fought to notify the users. In November, a judge ruled that federal investigators can collect the private Twitter records and blocked the users' attempt to discover if other Internet companies were ordered to reveal their data.
Privacy advocates also say the 26-year-old federal law that primarily sets the boundaries for law enforcement to obtain electronic communications is too outdated in its application to social media. When the Electronic Communications Privacy Act was passed in 1986, e-mail was stored in a personal computer. And the law required police to obtain a warrant to access some types of messages.
With social-media information now stored in the cloud, on remote third-party servers, content owners have traded in control for convenience. "No one is clear on the legal standard for cloud-stored information," says Chris Calabrese, an attorney at the American Civil Liberties Union.
