A shot across the bow

At Computers, Freedom and Privacy last week, Google's DC policy guru Alan Davidson revealed that the company has between 1-20 employees working full time to respond to requests for private customer information from law enforcement. He also revealed that Google asks for financial compensation from the Government for the time required to satisfy these requests -- he noted that this practice is permitted by law.

Google is not alone in this. All major Internet companies receive thousands of requests per year, and as a "matter of policy", they all refuse to discuss this, or to give the public even a rough idea of how many requests they get.

A recent Newsweek article comes the closest, revealing that Facebook gets between 10-20 requests per day from law enforcement agencies.

This silence needs to end. We need transparency, sunshine, and some accountability. If users realized how often their data is disclosed to police, and how often it occurs without a warrant or any judicial oversight, many would be shocked.

So -- if you work in the privacy, legal or policy department of a major Internet provider (as I know a few of my readers do), consider this your warning.

You either need to come clean voluntarily, or the information will be forced out. Your customers have a right to know.

My first avenue of attack will be via a number of FOIA requests (see below) -- if that fails, I'll have to ramp things up a bit. The current level of secrecy is simply not acceptable.

---

(Sent to Criminal Division, Department of Justice)

Dear FOIA Officer:

This letter constitutes a request under the Freedom of Information Act (“FOIA”), 5 U.S.C. §552. I am seeking records concerning guidance, reference manuals and sample requests provided to law enforcement agencies by major internet companies, search engines, web mail providers, and social networks.

Background

A recent Newsweek article (http://www.newsweek.com/id/195621) revealed that:

"NEWSWEEK reviewed both Facebook and MySpace documents that let law-enforcement agencies know what information they track and how to obtain it; MySpace's guide is more robust, offering agencies templates with language geared specifically to be admissible in court. Both sites disclose that they cooperate with police in the terms that users agree to when they sign up."

Practically all Internet related businesses have a legal compliance department. Some, like MySpace, are open 24 hours per day, 7 days a week. A list containing contact information for over 100 of these offices can be found here: http://www.search.org/programs/hightech/isp/


The same Newsweek article also revealed that:

"[Facebook] says it tends to cooperate fully and, for the most part, users aren't aware of the 10 to 20 police requests the site gets each day."

It is likely that other major Internet companies receive a similar number of requests. As a result, it is not surprising that the companies have created guides and sample requests for law enforcement agencies, in order to help to streamline requests, and reduce the amount of manpower required to handle each subpoena.

My request

I request any records, including memoranda, handbooks, emails, policies and procedures provided to the Department of Justice by Internet service providers, phone and cable providers, search engines, instant messaging companies, and social networking sites. Such documents likely contain guidance and frequently answered questions related to requests for subscriber information, and may also contain sample subpoenas and search warrant applications.

At the very least, this request shall include documents provided by or relating to Apple, Google, Microsoft, Yahoo, Facebook, MySpace, America Online, AT&T, Verizon, Comcast, Sprint and T-Mobile.

The scope for this request shall include all documents created between January 01, 2005 and May 10, 2009. It is likely that the Computer Crime & Intellectual Property Section (CCIPS) within the DOJ Criminal Division will have the most relevant documents.