WikiLeaks: Court Upholds US Subpoena For Twitter Records
In a 21 page opinion, US Magistrate Judge Theresa Buchanan of the Eastern District of Virginia District Court has just granted the United States Department of Justice subpoena demand for records in the WikiLeaks investigation.
Three people associated with WikiLeaks – Jacob Appelbaum, Birgitta Jonsdottir, and Rop Gonggrijp – had petitioned the court to vacate the subpoena and to unseal the court pleadings. The court held:
For the foregoing reasons, petitioners’ Motion to Vacate is DENIED. Petitioners’ Motion to Unseal is DENIED as to docket 10- gj-3793, and GRANTED as to the 1:11-dm-00003 docket, with the exception of the government attorney’s email address in Twitter’s Motion for Clarification (Dkt. 24), which shall be redacted. Petitioners’ request for public docketing of the material within 10-gj-3793 shall be taken under consideration. An Order shall follow.
The three WikiLeaks individuals had argued the subpoena violated constitutional protections for free speech and association; the court disagreed. Appelbaum, Gonggrijp and Jonsdottir have already stated they will appeal.
You can read the full opinion here. I will be updating the post as I read the decision.
In December of last year, the US government, upon ex parte motion, moved the EDVA Court to enter a sealed Order (“Twitter Order”) pursuant to 18 U.S.C. § 2703(d) of the Stored Communications Act, which governs government access to customer records stored by a service provider. The Twitter Order, which was unsealed on January 5, 2010, at the request of Twitter, required Twitter to turn over to the US subscriber information concerning the accounts and individuals: Wikileaks, rop_g (Gonggrijp), ioerror (Appelbaum), birgittaj (Jonsdottir), Julian Assange, and Bradley Manning. Of those targets, the three individuals – Appelbaum, Gonggrijp and Jonsdottir objected and this decision has been pending since that time.
The first key to the case is the court found no standing for the petitioners since “content” was not being sought by the government:
The Court holds that targets of court orders for non-content or records information may not bring a challenge under 18 U.S.C. §2704, and therefore, petitioners lack standing to bring a motion to vacate the Twitter Order.
As to the substance of the government’s request for subpoenaed information, the court also found the petitioner’s claims non-compelling:
Notwithstanding petitioners’ questions, the Court remains convinced that the application stated “specific and articulable” facts sufficient to issue the Twitter Order under §2703(d). The disclosures sought are “relevant and material” to a legitimate law enforcement inquiry. Also, the scope of the Twitter Order is appropriate even if it compels disclosure of some unhelpful information. Indeed, §2703(d) is routinely used to compel disclosure of records, only some of which are later determined to be essential to the government’s case. Thus, the Twitter Order was properly issued pursuant to §2703(d).
As to the First Amendment claim, the court didn’t like that much either:
The Court finds no cognizable First Amendment violation here. Petitioners, who have already made their Twitter posts and associations publicly available, fail to explain how the Twitter Order has a chilling effect. The Twitter Order does not seek to control or direct the content of petitioners’ speech or association. Rather, it is a routine compelled disclosure of non-content information which petitioners voluntarily provided to Twitter pursuant to Twitter’s Privacy Policy. Additionally, the Court’s §2703(d) analysis assured that the Twitter Order is reasonable in scope, and the government has a legitimate interest in the disclosures sought.
The First Amendment claim was bound to fail; far more disturbing and significant, however, is the ease with which the court dismissed the Fourth Amendment claim:
Here, petitioners have no Fourth Amendment privacy interest in their IP addresses. The Court rejects petitioners’ characterization that IP addresses and location information, paired with inferences, are “intensely revealing” about the interior of their homes. The Court is aware of no authority finding that an IP address shows location with precision, let alone provides insight into a home’s interior or a user’s movements. Thus the Kyllo and Karo doctrines are inapposite. Rather, like a phone number, an IP address is a unique identifier, assigned through a service provider.
Part and parcel of the court’s process here involved a determination that when Twitter users create a Twitter account, they do so under the knowledge and information that IP addresses are among the kinds of “Log Data” that Twitter collects, transfers, and manipulates and, therefore, should recognize that internet service provider’s notice of intent to monitor subscribers’ emails diminishes expectation of privacy. Effectively, because subscribers willingly give their IP addresses to service providers, like Twitter, as a condition of participation, they waive any Fourth Amendment privacy interest. That has pretty broad impact on the internet far beyond simply this case, even if it is not inconsistent with where the law in this area has been, and is headed toward, for a while now.
The last substantive area of the order addresses the demand for international comity by Birgitta Jonsdottir, who is currently a member of Iceland’s Parliament. The court was having none of that either:
Here, the Twitter Order does not violate this provision. It does not ask Ms. Jonsdottir to account for her opinions. It does not seek information on parliamentary affairs in Iceland, or any of Ms. Jonsdottir’s parliamentary acts. Her status as a member of parliament is merely incidental to this investigation.
All in all, you would have to characterize the decision, substantively, as a complete loss for the Jonsdottir, Appelbaum and Gonggrijp. The only rewarding thing that appears easily on the surface here is that Twitter was successful in initially getting notification to the individuals so that they could at least file challenges. Save for that, not much fun here.
Link to opinion seems broken.
That’s why I use Startingpage
The court is startlingly uninformed and behind the times; otherwise it could have taken judicial congnizance of facts that wholeheartedly support petitioners’ claims. Nearly three years ago, a world-renowned MIT researcher was demonstrating routine methods by which “reality mining” yielded intimate social networking data, and pinpointed users’ space and time locations via cellphone data routinely logged by service providers. He could document and distinguish between friends, acquaintances and co-workers from their cellphone data, and predict where and with whom a subject would next meet. Twitter is most commonly accessed via cell phones.
The idea that data logging from phones and other telecoms devices yields only minimal systems information, rather than intimate personal information, is wildly out of date.
The MIT researcher I referred to is Sandy Pentland. A short discussion of “reality mining” is here, from a 2008 article in Technology Review.
It gives this understated definition of “reality mining”:
And this understated description of the data cellphones yield and what researchers can do with it:
Those Apple, AT&T and Sprint boxes in petitioners’ pockets, that they might use to phone home, send a text message to Tahrir Square or a Twitter out to the world give up real time data and have as much computing power as a PC.
It’s like wearing a wire 24/7.
The court is also saying that regardless of the level of personal data being revealed by data logs, US law doesn’t consider it “personal” or “private” and that it can be accessed, mined and interpreted for private corporate use and profits, and further, that the USG can access it and duplicate that analysis or outsource it to those already in the business.
That’s certainly the position of the government, telecoms and security and market analysis industries. It’s particularly helpful to them because inferring accurate facts and predictions requires a large pool of data, tracked over as much time as possible. That is, inferences drawn on data from my cellphone, usually on me or within feet of me, for a month are limited. They become more accurate when the time scale becomes three years and when the data includes that from my friends, family, acquaintances, co-workers, neighbors, etc., in widening loops of separation.
I doubt, however, if that lack of privacy expectations represents the views of individuals. Many people have no idea such information exists or that such accurate inferences about intimate, individualized behavior can be drawn from it, or any idea about how much money is made by doing it.
“US law doesn’t consider it “personal” or “private” and that it can be accessed, mined and interpreted for private corporate use and profits, and further, that the USG can access it and duplicate that analysis or outsource it to those already in the business.”
And when the government is confined by law, albeit less frequently than ever, it merely turns to the private sector, which has more latitude under the law in data gathering, to acquire the information. There’s seems to be no law against that. Kinda sounds like racketeering, but..
thanks John.
From Greg Mitchell:
“apposite” means relevant, appropriate, fitting. So “inapposite” means irrelevant or inappropriate.
Surprise! Surprise!
Pretty arrogant for a majistrate. Must be campaigning for a Republican president to appoint her to an Appeals court. Her opinions mean nothing in any precedential sense. And to say that an IP address reveals no location information just shows how woefully ignorant she is. Read a blog or even a newspaper once in a while, Stupid! How does someone so dense even get appointed to a functionary job like that?? A Majistrate, after all, isn’t supposed to interpret law, but merely assess facts and evidence, and it’s clear she’s not real handy with facts.
Link works fine for me
No Script seems to be blocking access.
Earl, I could find nothing unusual. If you are still having problems, let me know so I can notify the techs (As Hawkeye & Trapper would say “The Pros From Dover”).
I imagine it’s NoScript blocking a cookie or JavaScript app, but haven’t found which one so that I can deactivate it. I’ll take your word, naturally, on the text and analysis of the judgment.
I would just reiterate my comments, and I’m not a techy, about the volumes of data that can now be obtained, directly and by valid statistical inference, from the cellphone data of a target and every digital device or address (and its tied GPS or cell locator) that cellphone interacts with, access to which this judge thinks is a no-brainer for the government. In addition, that data now confirms or adds to data in easily stored, digitally maintained “Hoover files” on each target. Those files only increase in “intelligence” and commercial value as such data, and data in related and unrelated files, accumulates.
I gather that there is a paragraph addressing the non-applicability of US constitutional rights to non-citizens.
A question: I thought that the First Amendment, at least, applied to everyone, as in all people, not just US citizens. Maybe I thought that because there is such a distinction in our Charter — rights that are basic human rights are said to belong to everyone, not just citizens. (Our section 2 corresponds to First Amendment.) Is there such an understanding of the Bill of Rights?
With US Courts, the government is having a sweet time doing whatever they want to whomever they want: All they have to do is utter “National Security” in their petition and Voila!
Wishes are hereby granted!
“should recognize that internet service provider’s notice of intent to monitor subscribers’ emails diminishes expectation of privacy. Effectively, because subscribers willingly give their IP addresses to service providers, like Twitter, as a condition of participation, they waive any Fourth Amendment privacy interest. That has pretty broad impact on the internet far beyond simply this case, even if it is not inconsistent with where the law in this area has been, and is headed toward, for a while now.”
That’s is the wildest thing I’ve heard all day! So, this judge is saying that nobody has a 4th Ammendment right anymore. Even the judge can have her personal IP address, e-mails, and personal notes made public with no recourse? ShheeeeeeeeIT! That means the military, the government offices, EVERYONE! Sorry, but this ruling is a load.
Would it be inappropriate of me to hope that the various congresscritters who so loudly support this kind of activity by the government find themselves in hot water because of their activities being tracked by their cellphones and their other personal electronic communications?
(Hi, NSA guy!)
Evidently not! It seems that nobody has a right to privacy in any type of communication.
This is a very bizarre view of how the internet works and especially how people interact with it. Most folks live at an address the U. S. Post Office knows to deliver mail to, but the delivered mail has privacy expectations. The IP address most folks have is an address used by the ISP for the user’s equipment to operate on the internet, it is a necessary requirement not an option, without it the ISP cannot let the user on the internet. Just like the Postal Service cannot deliver mail without the address. Most users do not know at all that the IP address they have, how to find it, or how temporary it is (it can be very temporary) they do not know they are giving this information up, nor do they have any willing choice but coercion forced upon them by the nature of the beast, so to speak.
One other technical bit of this that is troubling is that entities like Twitter are content providers, not ISPs. This a big distinction, it is like saying that FDL is an ISP.
Thanks for that. Excellent point. Internet users have no choice: ISP’s assign the address to their machines; it has to be disclosed in order to use the Net, which has quickly become a basic tool of literacy and citizenship. That’s the characterization we give it when thinking of how to assist citizens in developing countries.
Your analogy is good, too, that giving up a mailing address reveals very little, even with Google earth’s ability to peer into your backyard. But revealing ISP addresses and cellphone pinging details and continuous GPS data, reveals infinitely more about an individual. Combined with other digital and traditionally derived hard copy data, that reveals a great deal. Combine it further with Sandy Pentland-style statistical analyses and considerable intimacies are revealed that even the target may not be aware of.
Who has that data, who owns and controls it, how should its use by the government and private corporations be restricted, why are billions in profits made from it but nothing is disclosed or revealed to the individuals who data is being expropriated? In this country, it seems, the government and large corporations and their analysis-driven vendors have their say and their cut, but the individual has no say.
Thanks ever so much for bringing up the PO. That’s exactly what I was thinking. Hopefully, bmaz will address that point, too.
Thanks for doing all the work, bmaz.
ugh
What a day.
Court Rules Government Can Collect Private Records of Twitter Users, ACLU; 3/11/11
Judge Won’t Stop WikiLeaks Twitter-Records Request; Kim Zetter; Wired; 3/11/11
http://www.wired.com/threatlevel/2011/03/judge-denies-on-twitter-case/