Twitter reveals personal data to police linked to mass threats, as privacy dilemma persistsMartha Rayner in ACEDS, August 15, 2012
One can say a lot in 140 characters, but it is what a person says, by what means and whether it should be afforded privacy that was at the heart of Twitter’s decision last week to disclose the account information of one of its users.
Responding to a subpoena from the Manhattan District Attorney’s office, the social media giant disclosed to New York police investigators the identity of a person who tweeted threats of wreaking havoc on a Broadway theater.
"This s--t ain't no joke yo I'm serious people are gonna die just like in aurora," wrote the person, who was apparently targeting the venue of boxer Mike Tyson’s one-man show. Another tweet said, “I got 600 people on my hit list and that’s gonna be a mass murder for real.”
Twitter rapidly changed course in case
Twitter had denied an emergency request for the data three days earlier. It told investigators by email that while it does “invoke emergency-disclosure procedures when… a threat [appears] present, specific and immediate, this does not appear to fall under those strict parameters….”
The New York City Police Department deployed officers to the theater while it sought a subpoena. Twitter promptly complied with the court order. Police identified the suspect a day later and discovered he was not in New York as the tweets suggested.
Twitter faces criticism from all sides
The case, like many others that arise these days, balances the interests of privacy and free speech with the increasing evidentiary importance of user-generated content in criminal and civil cases. Investigators routinely look to Twitter and its social media brethren to develop suspect profiles and leads, construct or buttress lawsuits, and undermine the credibility of witnesses and claims.
Some say much of this activity, which may reveal intimate details of a person’s life, including location, infringes on personal freedoms. They say social media deserves a degree of anonymity. Government surveillance and the willingness of internet service providers to disclose user data without a search warrant compromises this, they say.
In this case, Twitter is caught between competing camps. It is criticized by some for rejecting initial police requests, despite recent instances of the mass violence these tweets threatened. The tweets, these persons say, threatened bodily harm, which is often considered an exception to free speech. Others condemn the company for complying with the subpoena and say doing so chills free speech on the internet.
Balancing public safety and personal privacy
“Twitter has to balance public safety and personal privacy,” says attorney Bradley Shear, of Bethesda, Maryland, who specializes in social media and internet law. “I am a big believer in free and anonymous speech, but social media companies should have the flexibility to work with law enforcement if it’s in the public’s best interest.”
Attorney Martha Rayner, a professor at Fordham University School of Law, in New York, says any rush to judgment is premature. It is hard to weigh the pros and cons of Twitter’s actions without first knowing what evidence police presented to the company.
“Police have the obligation to show Twitter that there’s an imminent threat,” she says, noting that the three-day gap between the first emergency request and the subpoena suggests one did not exist. “The police are in a position to acquire a subpoena very quickly,” she says.
Twitter’s evolving terms of service allow ‘good faith’ disclosures
Twitter points to its terms of service to deflect scorn from free speech proponents, as well as to guard against potential legal action. A spokesperson for the company, Carolyn Penner, declined comment, but provided a link to the company’s guidelines for law enforcement.
They state, in part, “Twitter evaluates emergency disclosure requests on a case-by-case basis” and that if it receives "information that gives [it] a good faith belief that there is an emergency involving the death or serious physical injury to a person, [it] may provide information necessary to prevent that harm’ if it is available."
User information that is not publicly available, the guidelines say, is not released “except as lawfully required by appropriate legal process such as subpoena, court order, or other valid legal process.”
“Twitter has an all-encompassing out in its terms of service,” Shear says. “It would be difficult for a plaintiff to win a lawsuit for invasion of privacy.”
Congress grapples with private disclosures as security threats loom
Lawmakers in Congress are weighing data privacy and public safety. Often, the debates occur in the context of national security. The US Senate recently voted against a cybersecurity bill (S. 3414, “Cybersecurity Act”) introduced by Sen. Joseph Lieberman (I-Conn.).
The bill would have allowed companies to give private data to law enforcement agencies to prevent cyber crimes or “serious imminent harm.” It was a companion to the Cyber Intelligence Sharing and Protection Act (HR 3523), which was passed by the House of Representatives in April. Both bills met pushback for lacking privacy safeguards and other reasons that stem primarily from opposition of technology firms.
The American Civil Liberties Union, a vocal opponent, attacked the Senate bill for the latitude it gave government agencies, like the National Security Agency, to monitor civilian activities on the internet. Lawmakers responded to the criticisms by adding several protections of confidentiality, including a requirement that civilian – as opposed to military – agencies handle the private data. A Republican filibuster shelved the bill on August 2, but similar legislation is likely to reemerge.
Surge in information requests puts Twitter in difficult position
The New York theater subpoena comes amid a growing demand by government authorities for private social media data. In July, Twitter appealed a New York state judge's order that required disclosure of the user information of an Occupy Wall Street protester pursuant to subpoena. The judge ruled that the protester did not have legal standing to move to quash the subpoena on his own. Twitter says the decision places it in the untenable position of having to fight court orders on behalf of its users or spend large amounts of time and money responding to requests for private data.
Internet companies report a surge in these requests. On July 2, Twitter issued its first "Transparency Report" which states US government agencies have submitted 679 requests for user information in 2012, almost three times the number of requests by other national governments combined.
Twitter produced some or all of the requested user data in three-quarters of the requests by US agencies. Similarly, Google recently reported 6,321 requests for user information by US government agencies in the six months ending December 2011, compared to 5,950 requests in the previous six months. It says it complied with 93 percent of the requests.
Caught between rock and hard place
“These companies are in between a rock and a hard place,” says Ethan Wall, a social media attorney at Richman Greer in Miami, referring to Twitter’s interest in protecting user privacy.
“As social media increasingly catalogues the intimate details of people’s lives, businesses and government agencies are going to want to get at that information,” Wall adds. “Twitter has to face the fact that it’s going to be caught in the middle.”