This happens all the time. At reddit we would get requests from law enforcement asking for email addresses and other private information. Luckily in our case we could simply reply that we didn't know, since we didn't require any personal information to sign up and didn't keep IP address logs that long.
But having been on the other side of the coin, investigating computer crime, I can tell you why it happens. It's really easy to make a request for information, and in most cases, the person you're asking will just willingly give it up even though they don't legally have to, either because they want to be helpful or because they don't know about their legal rights. Even if the evidence can't be used to build a case against the person in court, it can still be used to lead down a path towards finding the person and gathering evidence that is admissible.
Can you speak more about your experiences at Reddit, as much as you can? Was bulk information ever requested and what types of issues did it seem like requests came in for? Is other private information just IP addresses or is it passwords and other records (posting history/times/subscriptions) too?
I never saw a bulk request. Usually they were just asking for email address and IP address/access times. The types of issues were usually people who had "admitted" to a crime, and sometimes threats against the President.
The results for more details was in and of itself a problem; The prosecutors were fishing for details on people whom were guilty only of hyperbole. "I would love to see you thrown off a roof" or "That prosecutor should be taken out and shot" are not threats, not even close. They are the very definition of political speech, in grandiose hyperbole. The chilling effects of prosecutors even asking for that information is very real, and very much undermines the cornerstones of american democracy. The gag order escalated it from prosecutorial overreach to something worthy of repeated headlines, but even the request was unwarranted and wrong.
Agreed. But my comment was in regards to the lead comment "This happens all the time. At reddit we would get requests from law enforcement asking for email addresses and other private information. .." Those details have nothing to do with the issue at hand, and hence my objection to the comparison.
> Those details have nothing to do with the issue at hand, and hence my objection to the comparison.
Huh? Reason.com got requests from law enforcement asking for email addresses and other private information. Reddit.com got requests from law enforcement asking for email addresses and other private information. Do you really not see the parallel, even if the Reason.com case is much more egregious for the fact of the gag order?
A federal grand jury subpoena is not the same thing as law enforcement asking for information.
For one, a grand jury is made up of citizens, not members of law enforcement. (Notwithstanding the well-known belief that a "grand jury would 'indict a ham sandwich,' if that's what [the prosecutor] wanted.")
"Asking for information" includes things like a county police department sending a letter on department letterhead asking for information. It also includes the US government through Herbert Yardley asking all of the telegraph companies for their message traffic. There is no legal compulsion behind those requests.
jedberg's original comment confirms that this refers to simply asking, in the hopes that the recipient will pass data over voluntarily."It's really easy to make a request for information, and in most cases, the person you're asking will just willingly give it up even though they don't legally have to, either because they want to be helpful or because they don't know about their legal rights.
A federal grand jury subpoena, on the other hand, has teeth behind it. A recipient is legally obligated to respond to the subpoena, either with the requested information or with a legal challenge.
So no, these are not the same things. Reason.com received an order by a grand jury, not a request by law enforcement.
> Even if the evidence can't be used to build a case against the person in court, it can still be used to lead down a path towards finding the person and gathering evidence that is admissible.
It makes sense to do this, but I can already hear the cries of parallel construction from my bunker 20 floors below sea level.
He wasn't saying it wouldn't be. He was saying that even in an abusive fishing expedition in which prosecutors believed that the evidence generated would be excluded by a semi-competent defense attorney, the prosecution still profits by generating information that helps the rest of the investigation.
But under the (still hotly contested in the Digital Age) "third party doctrine", information held by a service provider (an ISP, a website, a hotel, a cell phone company, etc) law enforcement can request data with just a subpoena. A court may issue the subpoena if the law enforcement agency shows that the information is "relevant to an investigation" and the recipient must comply or show why the data isn't available. There doesn't have to be probable cause. Anything found can be part of the investigation -- there's no parallel construction required. [1]
Today (literally, today), the Supreme Court took a first shot at narrowing the third party doctrine with respect to hotel room records in Los Angeles. [2] The ruling was largely about the procedure a hotel may use to quash (ask a court to reject) the subpoena, but it shows a willingness to cut back on the third party doctrine. The GPS tracker case also had some commentary suggesting a limit to the third party doctrine, but it was ultimately decided based on the physical intrusion of the device.
The third-party doctrine "proper" is about third parties voluntarily giving information to the government, which the government would otherwise have needed a warrant to get. For example, the government could effectively conduct dragnet surveillance of cell-phone records without a warrant if a mobile-phone company chooses to enter into a commercial data-selling agreement with the government: for $x/record, we'll send you all the call data. This has historically been held to just be a voluntary transaction between parties, so doesn't implicate the 4th amendment.
The hotel case you mentioned doesn't seem to involve that; in this case, the hotel is opposing the request, so there's an adversarial posture between the third-party data holder and the government over handing over the data.
It's true that in Smith v. Maryland "[t]he police did not get a warrant or court order before having the pen register installed", so the original case was a voluntary disclosure in that sense. But installing pen registers isn't voluntary at all these days:
Probable cause and a warrant is required when there is a 4th amendment right. The anonymous poster does not have a 4th amendment right over information about his posts in the hands of a third party (in this case, Reason). Reason, of course, does have a 4th amendment right over that information. But a warrant with probable cause is not required for a grand jury subpoena, because the recipient has the opportunity to challenge the contents: http://jolt.law.harvard.edu/articles/pdf/v24/24HarvJLTech543...
But having been on the other side of the coin, investigating computer crime, I can tell you why it happens. It's really easy to make a request for information, and in most cases, the person you're asking will just willingly give it up even though they don't legally have to, either because they want to be helpful or because they don't know about their legal rights. Even if the evidence can't be used to build a case against the person in court, it can still be used to lead down a path towards finding the person and gathering evidence that is admissible.