A recent criminal court ruling in Manhattan makes it harder for both users and web companies to contest legal requests for messages and user information after they have been made public. In May, Twitter sought to quash a subpoena for Occupy Wall Street protestor Malcolm Harris's tweets, location, and other data over a 90-day period flanking his October 1st arrest for disorderly conduct on the Brooklyn Bridge. On Saturday, Judge Matthew Sciarrino Jr. upheld an earlier ruling that Harris himself had no standing to contest the subpoena, ruled that Harris had no expectation of privacy in a public tweet, and denied Twitter's claim that the subpoena constituted an unreasonable burden on the company.
In short, only Twitter can fight a criminal court subpoena for user information, and for most requests for once-public information, the company will be expected by the court to hand it over. Unlike a privately sent email, "[t]here can be no reasonable expectation of privacy in a tweet sent around the world," writes Judge Sciarrino Jr.
"Today, the street is an online information superhighway"
Sciarrino also makes it clear that in his opinion, the logic and implications of the ruling are not limited to Twitter alone, but all forms of social media:
Consider the following: a man walks to his window, opens the window, and screams down to a young lady, "I'm sorry I hit you, please come back upstairs." At trial, the People call a person who was walking across the street at the time this occurred. The prosecutor asks, "What did the defendant yell?" Clearly the answer is relevant and the witness could be compelled to testify. Well today, the street is an online, information superhighway, and the witnesses can be the third party providers like Twitter, Facebook, Instragram [sic], Pinterest, or the next hot social media application.
There are several things that are counterintuitive about the specifics of the court's ruling, due to the vagaries of the Stored Communications Act (or "SCA"). Here are a few of them:
Tweets fewer than 180 days old require a search warrant
- Tweets greater than 180 days old are subject to subpoena by a criminal court and can be sought without a search warrant. Tweets fewer than 180 days old do require a search warrant. This is because the SCA considers data less than 180 days old "temporary electronic storage" and subject to stricter legal requirements than older material, which is presumably contemporary. This means that tweets that are still publicly available via Twitter's web site or use of its API are more likely to require a search warrant than older tweets which may no longer be publicly accessible.
- "Content information," i.e., tweets or other messages, are subject to a different standard from "non-content information," including "subscriber information, e-mail addresses… logs maintained by the network server, etc." That is just the non-content information enumerated by Judge Sciarinno, Jr. In a friend of the court brief filed on May 31st [PDF}, the ACLU, Electronic Frontier Foundation, the New York Civil Liberties Union, and Public Citizen contend that this "non-content information" requested by the District Attorney's office also includes Harris's "personal email address, but also the content of his tweets, the date, time, and the Internet Protocol ('IP') address that corresponds to each time he used Twitter over the three-and-a-half month period, and the duration of each of Harris’s Twitter sessions, regardless of whether he posted any tweets during those log-in sessions and regardless of whether any of his tweets were related to the issues involved in the pending prosecution."
Does non-content information include location?In particular, this amici curiae brief contends that such "non-content information" can be used to determine a user's approximate location, login and logout times, what he or she read, and with whom he or she communicated on Twitter even by private direct messages. None of these claims appear to be directly addressed by Judge Sciarinno's ruling.
If the ruling is upheld, it seems unlikely that Twitter and other social media or cloud storage services would be likely to contest a criminal court subpoena subject to the SCA in any but the most extraordinary circumstances.