9 ms·
When the cops subpoena your Facebook information, here's what FB sends the cops
- jstalin 15y agoThat's the last straw. I haven't done anything with my Facebook page in a while, but now I'm just going to delete it.
- xxbondsxx 15y agoGoogle / Microsoft / the rest of the internet does this too. Keeping track of these records is required by law
- ThaddeusQuay2 15y ago"Keeping track of these records is required by law." What law? Which records? There are websites, such as those which provide anonymous web access, which say that they don't keep any records, or keep IP addresses only, or keep records for no more than 30 days, or whatever. Are they lying to us, or are they intentionally breaking some law? Exactly how can I be forced to keep any kind of log, for any period of time?
- JoachimSchipper 15y agoAs I understand it, keeping logs is optional. However, if you keep logs and receive a subpoena, you must turn over whatever logs you have.
- xxbondsxx 15y agoNot optional depending on your country: http://en.wikipedia.org/wiki/Telecommunications_data_retention http://en.wikipedia.org/wiki/Telecommunications_data_retenti... It's a really complicated legal issue, and the last thing you would want to do as an international company is shoot yourself in the foot by deleting "evidence".
- ThaddeusQuay2 15y agoFB is an American company, and the crime of which the article speaks happened in the US, and the article you cite says: "The United States does not have any Internet Service Provider (ISP) data retention laws similar to the European Data Retention Directive. All attempts have failed:" THEREFORE: Under what law was FB required to retain the data, which was eventually handed over under subpoena?
- fromhet 15y agoI may be wrong, and if so, please correct me. But I think i remember something about Facebook having european offices in Ireland, so for us Facebook users in the European Union it's the Irish and EU laws they have to abide. But I havent got a clue about what law regulates theese things.
- xxbondsxx 15y agoYour thinking is along the right direction; see my reply to your parent comment
- xxbondsxx 15y agoSince Facebook follows the popular "Double Irish Arrangement:" http://en.wikipedia.org/wiki/Double_Irish_arrangement http://en.wikipedia.org/wiki/Double_Irish_arrangement The location of its legal tax headquarters is up for debate; Additionally, Facebook has corporate offices all over the world in different countries: https://www.facebook.com/careers/locations https://www.facebook.com/careers/locations Italy, India, Canada, New Zealand, Belgium, etc. Clearly it's not just a "US" company and only has to follow "US" laws.
- ThaddeusQuay2 15y agoTaxes are not involved in the question. When it comes to US cases, FB only has to follow US laws. Therefore, data generated by US-based users should not be retained.
- DenisM 15y agoThere is no law in US that requires keeping records for websites.
- xxbondsxx 15y agoThese websites don't operate only in the US: http://en.wikipedia.org/wiki/Telecommunications_data_retention http://en.wikipedia.org/wiki/Telecommunications_data_retenti...
- hvass 15y agoWhat exactly surprised you?
- itg 15y agoWhile most people on hn probably know about this, you would be surprised at what the general public would think about this story. I hope it gets spread further in the media so more people know exactly what fb(and other social networking sites) keeps tabs on and what info they give out to law enforcement.
- crusso 15y agoDo you think it will matter? That Farmville thing ain't gonna play itself.
- jstalin 15y agoNot surprised, but once in a while having something in your face brings it all home.
- cowkingdeluxe 15y agoI've never had a Facebook account, but it surprises me that they store deleted posts. I'm also surprised it didn't contain private messages (I'm guessing you can do this on FB?).
- andrewflnr 15y agoYes, Facebook has a private message feature, recently merged with live chat.
- sliverstorm 15y agoDo you feel FB did something wrong here, and if so could you elaborate? I don't see this as much different from subpoenas of phone records, for example.
- WiseWeasel 15y agoWell for one, they handed a bunch of personal details on the friends of the suspect, and the police department published them unredacted. Being friends with a suspect can be problematic, apparently. No one wants to be known as the FB friend of a serial killer.
- sliverstorm 15y agothey handed a bunch of personal details on the friends of the suspect Doesn't a serious investigation normally involve an investigation of people close to the suspect? police department published them unredacted Not FB's fault.
- WiseWeasel 15y agoNot FB's fault. That may be, but it certainly makes a case for not using FB in the first place.
- sliverstorm 15y agoI do agree, if you want information to be kept private you should keep it private.
- pvarangot 15y agoOh. Now we have Trostsky and Stalin on HN!
- runn1ng 15y agoHuh. That's funny. One would think what special secret information facebook has on its users - where they are, what do they click to over the site, what sites do they visit even outside the FB site, but nope, it's just that - the data people wrote to the system themselves, voluntarily. Maybe with their public IP, sometimes. Maybe I am skipping something, but there is nothing one wouldn't reasonably believe Facebook has on you and would give to the police. edit: oh. I did miss the browsing history section. ...yeah. That is kind of creepy.
- epoxyhockey 15y agoOne should note that this request was satisfied in 2009. That leaves 3 years of extra innovation that you don't know about.
- runn1ng 15y agoVery true. All the "likes" and the united Messages are both younger.
- xxbondsxx 15y agoIt's incredibly ironic that The Phoenix censored out identifying information of Markoff's friends, but left all the event / profile ID's in the browsing history section. You can easily go back to a 3 year old event: http://www.facebook.com/events/46300108330 http://www.facebook.com/events/46300108330 And view who attended, or view the profile he viewed on February 18th 2009: http://www.facebook.com/profile.php?id=16104623 http://www.facebook.com/profile.php?id=16104623 Kind of creepy to say the least. I'm surprised they made such a huge mistake. Knowing which profiles he stalked before committing his crime is even more sensitive than just friendship connections in my opinion.
- dasil003 15y agoIt's not ironic, it's just sloppy.
- sliverstorm 15y agoThey acknowledged it wouldn't be perfect redaction, and isn't the whole un-redacted thing publicly available now anyway?
- sneak 15y agoWhat about extrajudicial requests like NSLs? I bet they get far more of those.
- haberman 15y agoI recently served on a jury for a violent crime, and as a juror being able to see evidence like cell phone records and closed circuit video was incredibly valuable. Cases that would have otherwise been a matter of "he said, she said" can have corroborating evidence that makes it much easier to be convinced beyond a reasonable doubt. I wondered how prosecutors managed to convict at all before these kinds of electronic records were available. I'm not downplaying privacy concerns, but when you can see thing from the other side too it's easier to see it as a set of trade-offs that need weighing. It's not a black and white issue. EDIT: Also remember that evidence can help the falsely accused just as easily as it can help victims of crime. Phone records can give a person an alibi that would otherwise have been very difficult to prove.
- loverobots 15y agoI see your point but it's hard to explain a "human body decompose" Google search, when years later a [family member] disappears and the cops suspect family (as is normal.) But I was watching a CSI episode and ....might not fly. Especially if you searched for large bags a few months later. Search engines are much worst given that you search for information and ask questions about everything.
- haberman 15y agoYou have to remember that jurors are normal people who have no vested interest in the case either way. As a juror you feel a heavy weight of responsibility, because you know that people's futures are in your hands. If a person is convicted, it is because 12 random people unanimously agreed beyond a reasonable doubt that the alleged crimes happened. Your lawyer would have a chance to stand in front of the jury and say "of course my client was trying to learn about what happens when a human body decomposes; his family member was dead and he wanted to learn the truth." Jurors are normal people who understand normal arguments.
- loverobots 15y agoTrue but: - You have to have money for lawyerS, and lots of it. Most people are already deep in debt and if they don't work for a few months they are out of their apartments. Now imagine having to come up with, say $50K cash, within a week, while in jail. And $50k is nothing. If the court appoints you one, he'll probably push to make a deal so you serve 12 instead of the gazillion years all the charges end up to. The deal of the century. He has another 11 defendants to defend this month. - You are in the defendant's chair, and for every juror that takes the oath and presumption of innocence seriously there is another one that assumes you did something ("Why else would they pick on him?") - Prosecutors, police, detectives and jurors are people, full of human faults. To go home in time for Easter one might be persuaded to vote guilty instead of holding up. It's not unheard for the cops and prosecutors to want 'someone' in jail for X crime, keeps the public reassured and helps their career. - Unless you're mega-wealthy you're outmatched. The state uses virtually unlimited amount of your tax dollars to hire the best DNA experts and pathologists and you, John Q, can't match them. On the stand detectives have perfected how to testify and use anything to fit their agenda: "he cried /he didn't cry /he cried too little /he cried hysterically (sounded fake) or his cries were too perfect, as if calculated to deceive..." That huge fight with your wife will be told as a possible motive but no one is there to tell about the hugs and kisses 15 minutes after. Oh, you've been "poking" your high school sweetheart of FB and been talking about the "good old times"? So yes, our justice system is relatively fair but if you get screwed the stats mean nothing, you're toast.
- ChuckMcM 15y agoIt makes one wonder how many people will create a fictional facebook 'experience' which is to say spend time building up an alternate identity in various social sites so that in the event they are charged with a heinous crime they can confuse the jury and make it seem 'out of character.' Surveillance works best when it isn't scripted.
- eternalban 15y ago> building up an alternate identity in various social sites I wonder when we will see the startups that offer this as a personalized service. It can be equally responsive to law enforcement, should actual legal processes are involved, but for any other actor besides the law, the illusion can be real.
- pyrhho 15y agoIn Vinge's novel Rainbow's End, there is a group called the Friends of Privacy which basically exists to obfuscate and inject noise into the identifying information found online.
- schiffern 15y agoI really need to read this. If anyone needs convincing, Vinge published a similar story for free in IEEE Spectrum, complete with the "Friends of Privacy," called Synthetic Serendipity. http://spectrum.ieee.org/computing/networks/synthetic-serendipity http://spectrum.ieee.org/computing/networks/synthetic-serend...
- auxbuss 15y agoIt's "Rainbows End". The absence of the apostrophe really is important, since it completely changes the meaning of those two words.
- trotsky 15y agoThat kind of thing definitely goes on in the intelligence community
- loverobots 15y agoWow, so our dear friends and FB save even our deleted posts?? What the...
- vectorpush 15y agoIt's conceivable that law enforcement could legally obtain any information that is stored on any disk, even the disk inside your local machine.
- phillmv 15y agoI skimmed the document. Nothing terribly damning, or that you wouldn't suspect that FB would hand over. No, the part that creeps me out is when they start being able to hand over my political preferences and ideological bents and how likely I am to consume drugs based solely on how I am friends with. "Your honor, members of the jury, the evidence is clear: based on phillmv's social graph, he's 83% likely to be a stark raving socialist capable of committing precisely this sort of crime. As we all know, Facebook cannot lie!"
- drostie 15y agoWell, there is one thing "terribly damning," and that's the "Deleted Wall Posts" bit. This was also discovered when someone in Europe requested all of the data that Facebook has on him: that stuff which he had deleted had never actually been deleted, but was instead stored with a flag "deleted=True" which was checked by the database queries. In principle, at least for short time scales, this is not a bad idea -- you should try to make most or all of your database manipulations reversible, just in case someone steals someone else's account (or other similar abuses). But for long time scales, you would really expect that it would eventually get purged -- and as far as anybody knows, it never is.
- Xuzz 15y agoYou can't purge backups: if the servers were allowed to go in and remotely modify the off-site backups to purge deleted data, then an intruder could do the same thing for all data. So you can't permanently delete data in the backups. When subpoenaed, Facebook would have to go back through the backups and find the user-deleted data anyway: they still have it under their control. So there's really no difference in marking a "deleted" flag or purging the data from the production servers: they are not (and should not, and arguably cannot be) able to the data from backups. This is true for all web services. I'm not even getting into about the support and user anger cost by permanently deleting user data. But it's clear to see that this — while an intuitive idea — is not practically possible for most web services.
- drostie 15y ago
- rabidsnail 15y agoHas anyone tried the last session cookie in the access log? It's probably been invalidated, but then again...
- ghshephard 15y agoNot visible on an iPad. Rare you run into a newspaper that ignores that part of their audience.
- alanh 15y agoHere’s a PDF version I created: http://dl.dropbox.com/u/105727/fb-subpoena-db/fb-subpoena.pdf http://dl.dropbox.com/u/105727/fb-subpoena-db/fb-subpoena.pd... Or view as a web page with JPEGs: http://dl.dropbox.com/u/105727/fb-subpoena-db/index.html http://dl.dropbox.com/u/105727/fb-subpoena-db/index.html (What is more absurd than releasing information like this in SWF format and only SWF format…?)
- justhw 15y agoI am 3 seconds away from deleting my account, but before I do that I would like to know if fb actually deletes my account and everything I've generated on there. I have a feeling that they just insert a "deleted=True" in the database. In that case I don't want to delete my account, because I'm merely giving up my right to log in. So, do they completely remove my account information, or do they just mark me deleted?
- a3_nm 15y agoThe information probably still exists somewhere. The best you can do is probably to stop using your account.
- deleted 15y ago[deleted]
- justincormack 15y agoI presume you deleted it, but they do say they will delete it. I may try a data protection request to see if they have as I deleted my acount a long time back.
- jfoster 15y agoAre you deleting your account because of this? What you do with your account is for you to decide of course, but it shouldn't really come as a surprise that facebook has this data (they show it on the site) or that they would comply with a subpoena. The surprising bit for me is how much data is missing from this.
- Foy 15y agoDon't forget about Max Schrems from Austria. He got Facebook to send him on their data on him (at least most of it) I couldn't find the original news article I read when it first came out but here seems to be a good summary of what he found out: http://www.youtube.com/watch?v=kJvAUqs3Ofg http://www.youtube.com/watch?v=kJvAUqs3Ofg While this may not be identical to what cops would receive from a subpoena request, it shows at least part of what Facebook knows about you.
- draebek 15y agoDid anyone else notice the 172.23.8.44 "login IP" on the third page? What does it mean that the login IP is a non-routeable address? Is that some kind of IP in use inside FB's network?
- parimm 15y agoIs it possible that a client behind a NAT logged into facebook and facebook recorded the clients local IP address?
- soulclap 15y agoWhere are the private messages though? Did Facebook hold them back? Should be the most interesting (and well, most private) bits. (Sorry, I am in a bit of a hurry right now and only had a quick look at the article and the provided document.) And a bit off-topic, but related: does anyone know if Twitter actually deletes direct messages or are they just not visible on the website any more?
- jfoster 15y agoYeah, PMs and comments seem to be missing. Probably a whole lot of other stuff, too.
- TazeTSchnitzel 15y agoResembles the contents of the zip file you get if you click the button on Facebook to download your entire personal data (yes, it exists. It generates huge HTML pages of all your messages, wall posts, photos etc)
- tacogordito 15y agoAm i correct in seeing (page 54) that Facebook logs every single mouse click you make within facebook? That's pretty intense.
- smsm42 15y agoWhy not? Most companies do - since most webservers are configured to log every request by default. Of course, with facebook volumes they probably don't use "default" solutions for anything - but logging every click is a norm for most sites.
- avallark 15y agoIf you are frantically looking around for a link to "DELETE" your facebook account, here it is : https://www.facebook.com/help/contact.php?show_form=delete_account https://www.facebook.com/help/contact.php?show_form=delete_a... I did this just a month ago.
- MichaelGG 15y agoInteresting that things like photo tagging is stored in a changing timezone (some are PDT (UTC-7), some are PST(UTC-8)), whereas for the access logs, they state that everything is PST. Why would they be storing/using time in a timezone anyways?