FBI ‘Can Neither Confirm nor Deny’ That It Monitors Your Social Media Posts | Hacker News Reader

FBI ‘Can Neither Confirm nor Deny’ That It Monitors Your Social Media Posts

aclu.org

73 pointsdeegles43 comments

Why wouldn't they? The publicly exposed data is publicly exposed. Is there any reasonable sense to privacy at that point? The more interesting question is how much data do they get that is "private" without a warrant.

The following are a few examples of how the private data may be being gathered by the FBI, under existing legal structures.

https://www.nytimes.com/2017/01/12/us/politics/nsa-gets-more...

https://en.wikipedia.org/wiki/Room_641A

https://en.wikipedia.org/wiki/National_security_letter

There is also the possibility of voluntary cooperation by corporations, or even corporations selling commercial access to their data (Facebook, Cellular Carriers).

So if they collect and store all this data indefinitely, and in aggregate it could easily be abused to profile innocent citizens for all manner of reasons, can you honestly say that you trust all future government officials to never abuse this data?

Wouldn't be the first time the FBI abused its authority.

https://kinginstitute.stanford.edu/encyclopedia/federal-bure...

I expect the data will be abused. How could it not? I am not defending it. Instead stating it is their job.

It must be nice to have an employer who is OK with your neither confirming nor denying your job responsibilities.

> Is there any reasonable sense to privacy at that point?

Yes there is. This data is mined without reasonable suspicion, and shared with all parties, including contractors (commercial companies).

Surveillance without suspicion, storing such data indefinately, is chilling to free speech, opposed to protections against unreasonable searches, makes it more difficult to associate and practice one's religion.

People with no intention to commit crimes are in jail or have a record, because they decided to joke among friends, and had just a bit too big exposure, and just too little context. In the Netherlands you may get a house visit from the police if you tweet critical of the town mayor or tweet about protests (of course, they label it "threats" and "inciting civil unrest")

Does reading, saving, and sharing newspaper articles violate the privacy of the journalists who write them?

Public content is public.

A telling association fallacy. Unlike Zuck, I pose that Privacy is not dead. It starts to smell funny though. Of course, I am a realist: Police Officers are using Google Earth to look in the walled gardens of suspicious civilians. It is public data. So if you are already resigning to big data surveillance without reasonable suspicion, then it will only take a few decades before we all move in public under the watchful gaze of a gazillion drones. The erosion has already started with these highly funded real-name real-face social networks.

No fun being the target of surveillance without suspicion, because it increases the chance of bad things happening to you. Nearly everyone breaks the law at times: drive 3 km/h too fast to catch the green light, consume illegal drugs, feed the homeless, download from a torrent, create street art, take home a pen from work, hack a website. And the suspicion may come from following "Edward Snowden" on Twitter, or posting on HackerNews about malware, or being the Facebook nephew/schoolmate of a drug dealing suspect, or walking past a smart billboard in a Che Guevara t-shirt.

The Chinese Social Credit system pales in comparison to a society that is too afraid to use its free speech, too afraid to associate with like-minded people, and too afraid to participate in a political movement that is ahead of its time (such as the Civil Rights Movement), because an AI with the power of over 9000 cops is watching your every move outside of the bedroom (if curtains closed. and public internet cut off. and not transmitting "public is public" heat waves).

Right now, the police is tasking commercial companies to map Facebook friend connections into networks and passes this on to social workers, so they can confront particular youth if they start hanging out with non-motivated teenagers who hang on the street all day. All is meant well, but this gives me the creeps. We did not have to deal with this in the 90s, but we also hung out on the street or, god forbid, on a skateboard. Let's keep Privacy alive for a few more years, legal and regulations move slowly. Read up on FBI vs. civil rights movement 50 years ago, and ask yourself, has technology or the Justice system of the US moved faster? "Public content is public" combined with a tremendous rise in AI technology seems like a recipe for a disasterous dystopia. Or is that the plot of Demolition Man?

> This data is mined without reasonable suspicion

Uh, no. If you post a billboard on the side of the road or hang a letter on a public bulletin board, anyone can freely quote it, take a picture of it, or read it and tell others about it. If you post something on a public internet website, anyone can freely quote it, take a picture of it (err, screenshot), or read it and tell others about it. There's no difference. Public is public is public.

I think the parent comment is pointing out that the government is supposed to be prohibited from collecting information unless it needs to (e.g. reasonable suspicion), no matter if it's public or not.

Specifically, in the U.S., the Supreme Court confirmed that public data can still be protected by a warrant if used to compose a "mosaic" of something within a person's reasonable expectation of privacy.

https://en.wikipedia.org/wiki/United_States_v._Jones

https://en.wikipedia.org/wiki/Carpenter_v._United_States

So, could a private company follow you around and read every tweet you post publicly? Yes. Could a government do the same without a warrant (or even ask the company to give the information to them)? No.

The restriction is on the government, not the data. I guess in Europe, now with the GDPR, this restriction also falls on companies, too.

>In the Netherlands you may get a house visit from the police if you tweet critical of the town mayor or tweet about protests (of course, they label it "threats" and "inciting civil unrest")

Do you have citations for this? I never heard of that (I have relatives in the Netherlands). I assume this would land rather quickly at the ECHR.

https://www.nrc.nl/nieuws/2016/01/20/u-twittert-wel-heel-vee...

Tweet: "The city council of Sliedrecht proposes to accept 250 refugees in the next 2 years. What a bad plan! #Resist"

Result: Police visits his mother's house asking for him, after which they visit his work address and sit him down: "You sure Tweet a lot. We have received orders to ask you to watch your tone. Your tweets may be construed as incitement."

Especially for opponents to immigration, the Dutch police has a special unit and visits lots of homes, either for Tweets or for maintaining a Facebook page about the subject. Currently the focus is on stopping any Yellow Vest protests from taking root in Holland.

Police: "We want civilians to be aware of the effects a post or Tweet on the internet can have in real life. We monitor Tweets and act if we feel these go 'too far'".

Facebook post on own timeline about a plan to host 1.200 immigrants in a town with 16.600 inhabitants: "Let them fuck off, these assholes. We will all go to the town hall."

Police visits home: "You are inciting an illegal demonstration. We demand you remove the post to avoid further trouble.".

Teacher tweeting about the terrorist attacks against Jews in Belgium: "How can you address this serious topic in class, when you have Muslim students that loudly cheer this on?".

3 Police men knock on door 4 hours later: "We are here ordered by the mayor. They were scared senseless at the town house, but don't you think we have better things to do, no? Do you realize that your tweet can also attract believers that want to do you harm, and can find you, just like we found you? Identify yourself."

Mayor after Streisand Effect: "I did not order anything, and this entire situation sucks. I am sorry and called him to apologize. I am 100% for freedom of speech. Internally, the last word about this drama has not been spoken.".

https://www.bndestem.nl/nieuws/excuses-burgemeester-depla-na...

Other examples with police visits:

> LAST CALL!!!! Everyone who is done with taking in more profiteers, especially because our grandfathers and grandmothers can't receive proper care. [...] Do not let them play you for a fool, but stand up for your country, and come to the market next Monday at 19:00!!!!!!!

> 19th of January the council will discuss accommodating 250 refugees in the next two years. We won't let this happen?!

> Raided by police. My god. Had to hand over our mobile phones. Asked if we had Telegram and if one could search for pictures with us wearing a neon-colored outfit (don't dare say the word).

Consider this angle the next time there is a mass shooting, and the attack is foreshadowed by troubling social media posts by the perpetrator. In those circumstances, there are often cries of "why was nothing done to prevent this?"

I'm not advocating a specific side here, only pointing out that the two positions are fundamentally at odds with each other.

You seem to be implying this is inconsistent or hypocritical. These positions are each advocated by different people who passionately disagree with the other side.

Is it not possible for one person to believe both of the following?

1. Law enforcement shouldn't monitor social media posts

2. since they obviously already do this, why aren't they using the information they're collecting to do something useful like stop mass shooters who post about it online ahead of time?

So, you agree with me?

no i just suck at making sentences apparently. See other reply, which made the same point much better.

Why is it not possible to believe both? I believe that governments shouldn't exist, but given the fact that they obviously do, that they should do certain things. There's no necessary conflict in either set of beliefs.

bleh, that's what I was trying to say. Thanks. I tried to update my comment a little bit, i think i just phrased it poorly

> 1. Law enforcement shouldn't monitor social media posts

Why shouldn't LE monitor public social media posts?

Should they also ignore Billy standing on the street corner, shouting about how he's going to shoot up <those ______ers in ________>?

I understand not wanting the police to listen to your phone calls, or read your private messages. I don't understand the police having to shut their ears, and close their eyes, at public messages that you broadcast to the world. Should I be allowed advertise a murder-for-hire business on Facebook, without any risk of the police getting involved involved? Is there some magical property of the Internet that is supposed to protect me from this?

> 2. since they obviously already do this, why aren't they using the information they're collecting to do something useful like stop mass shooters who post about it online ahead of time?

They do occasionally do something 'useful' about it. I have first hand experience.

Last month, in my city, they've arrested an off-his-meds individual in my area, within hours of making specific threats of violence against a number of public establishments. (That he has had a bad history with.)

I'd prefer it if he got medical treatment, for his issues, but the US being what it is, he's far more likely to get five to ten years of jail time, instead.

Of course, oftentimes, they also don't do anything about it. Sometimes, it's because the regional prosecutor can't be arsed to deal with the threats, so they do a catch-and-release. Sometimes, it's because the police themselves can't be arsed to take the threats seriously. I don't have any stats for how frequently these sorts of situations turn out one way, or another.

Someone once made the same point about the warantless wiretaps to me:

“The American people said ‘never again’, and the NSA pwned the whole planet, to try and deliver on that, for $20B/yr. They did an impressive job of an impossible task.”

Honestly, I still feel conflicted — because the truth is that the warrantless spying is what many people wanted, post-9/11.

And the reality was, the intelligence we had under warrants could have helped prevent 9/11. The information wasn’t acted on and wasn’t sufficiently prioritized, but it was available

I disagree those two positions are at odds.

You can be vehemently against social media monitoring by government agencies and warrantless wiretaps and still point out the many times law enforcement and others in a position to help ignore signs of distress.

Moreover, there isn’t proof that this type of monitoring actively stops mass shootings or other attacks. Sometimes it does — for sure (though mostly when communication is happening through email and not social posts) — but we’ve seen plenty of anecdotes where concerning public postings were pointed out to authorities and nothing was done.

The key word here being, "warrantless".

I suspect that the set of people who publicly "appear distressed" (definition of which is entirely subjective) is quite a bit larger than the set of people who commit violence. I also suspect that the former is not necessarily a superset of the latter. In other words, casting a wider net means you'll scoop up a lot of innocent people, with possibly devastating results for them.

> vehemently against social media monitoring by government agencies and warrantless wiretaps

Does reading publicly published information constitute wiretapping?

> we’ve seen plenty of anecdotes where concerning public postings were pointed out to authorities and nothing was done

This is what I'm getting at-- responding to obviously-troubling social media posts seems entirely reasonable after the fact. Perhaps it is? But at the same time it carries an implication of law enforcement pre-emptively acting based on the content of public speech, which has its own worrying implications, as evidenced by the examples in the article.

Earnest question: What's the legal boundary in other circumstances? Can/should law enforcement take action if a person uses a megaphone in the town square to announce they're going to use their AR-15 to kill all the $x people? If they published an op-ed in the local newspaper to the same effect? (If yes, how is facebook/twitter different from a town square / op-ed column?)

There are preventative measures that don't involve warrantless wiretaps. Why do mass shootings occur, in your estimation, in the first place?

Of course they do, it's called OSINT and many agencies around the world collect & monitor social media for archival and profiling purposes...

In United States law, the term Glomar response, also known as Glomarization or Glomar denial, refers to a response to a request for information that will "neither confirm nor deny" (NCND) the existence of the information sought [0].

[0] https://en.wikipedia.org/wiki/Glomar_response

AKA: We can't legally lie, but we also won't tell the truth to avoid damaging our reputation.

Law enforcement are allowed to collect any public data without a warrant.

Is there some reason anybody couldn't collect public data? If it is public what would anyone need a warrant for?

It could be against Terms of Service to collect/store the public data in bulk.

But it would be better if they had to show reasonable suspicion.

> Effective law enforcement often requires undercover work, information gathering and surveillance of suspected criminals. Such surveillance should be based on reasonable suspicion of criminal activity – and ended when that suspicion is dispelled.

> However, when conducted without suspicion of criminal activity, especially when targeted at unpopular political groups, or when intended to profile religious, ethnic or racial minorities, it violates the right to be free of unwarranted government intrusion and to exercise free speech, association, and practice one’s religion. The harm to those under surveillance without suspicion is made worse when the information collected about them and their activities is shared by local, state and federal law enforcement, military and security agencies and stored in multiple databases, just in case it might ever become useful.

> In addition to chilling speech, surveillance without suspicion actually makes law enforcement less effective. When authorities are swamped with mountains of irrelevant and inaccurate information, their ability to properly analyze data is compromised. Ultimately, these practices make us less safe.

https://www.aclu-wa.org/pages/surveillance-without-suspicion

Right now, your social media might be mined to classify you as an "anarchist", after which you may be pulled over and arrested when you are driving close to an anti-war protest. To me, that does not sound just at all.

Reading published content is not surveillance. Otherwise you’re surveilling me right now!

It is digital surveillance. I could mine all your opinions from 7963 posts. Find those subjects that trigger a nervous or anxious psychological reaction or subjects that produce bad sentiment. Find out your sleep cycle. Find that one post from 2013 which you have now forgotten. Do the same for the account you most replied to. And then serve you catered (political) ads that are incredibly appealing to your deepest emotions (I was able to heuristically match your laptop with your smartphone, the only part that needed some luck). Or use that information when I am investigating you (with or without reasonable suspicion) or interrogating you (for a death penalty crime with an estimated 4.1 percent of wrongful convictions).

But that would be digital surveillance and I have no reasonable suspicion to surveil you.

> Right now, your social media might be mined to classify you as an "anarchist"

If police want to classify you as that, that's fine. It's meaningless.

> after which you may be pulled over and arrested when you are driving close to an anti-war protest

Arrested for what? Police would only be able to arrest if they have a reason, and being an anarchist / going to a protest is not a reason (in the US, at least).

Please don't spread fear and misinformation.

Please don't accuse me of spreading misinformation. The case was linked on the page I cited.

https://www.aclu-wa.org/docs/chinn-v-blankenship-complaint

> If police want to classify you as that, that's fine. It's meaningless.

No it is not meaningless. Police see anarchists and alt-right activists as "harboring ideas that are subversive to state control", meaning, you get on their shit list.

> Arrested for what?

The police stopped the car after it was identified as carrying 3 anarchists (stop & search under false pre-text) close to an anti-war protest. A police officer then arrested the driver for seemingly being under the influence of weed, without any evidence or probably cause, and had him locked up at the police station.

So while you are correct that being an anarchist going to a protest is not a valid reason, if the police wants you off the streets (because they classified you as being shit), they will use another reason (such as: "He looked under the influence of weed" or another popular one: "contempt of cop", which rarely carry any penalties for the cops and kind of act like Joker cards so they can go with a gut feeling over solid proof or cause)

https://en.wikipedia.org/wiki/Contempt_of_cop

Laying aside the issue of the monitoring of U.S. Citizens versus the monitoring of Europeans, it would seem to me that they'd need something a little more nefarious than a simple data parsing and analytics toolset to access non-public posts, yeah?

I don't Facebook, so I'm not sure if the default settings for Facebook are "Public" or "Friends Only" but I'd imagine that the bulk of what they'd principally be interested in is the "Friends Only" stuff, yeah?

Facebook defaults to friends only the first time you post, but if you change it public the setting will stick and become the default on your next post.

Yes, they are interested in private Facebook data. And no, you can't trust Facebook to not facilitate them if the wallets get opened, or if the police gets creative and starts sending you friend requests.

https://theintercept.com/2018/03/26/facebook-data-ice-immigr...

https://bgr.com/2018/09/25/facebook-police-fake-profiles/

If you pay attention to enough tech talks, “open source intel” is wonk parlance for “we are watching every move for everyone ever, all over the internet, especially in the places where people feel like they can speak freely.”

That term, “open source intel” is dropped with a wink, by every security goon, in at least one slide at every security conference.

Well sure. Doesn't anyone remember what Snowden was known for revealing? Why would anyone think Twitter and Facebook would be exempt from monitoring?

Good. I hope to have a reason to do business with them someday, would probably be very interesting.

(This comment has not at all been informed by the possibility suggested in the title of the submission...)

Reply on news.ycombinator.com