It is commonly said that if you do not want digital information found, then you should not create any. A challenge however is that there is a class of digital information, called metadata, that often is not created by you but is nonetheless associated with you. While content is any information that can be published or posted online, such as tweets, photos, videos, ebooks, Facebook posts and games, to name a few, metadata is something entirely different.
At first metadata was used to help describe content. It was automatically assigned by the software or app developer to help make the content easier to sort, index and later find. Location tags for example, are a common form of metadata. When content is posted online, the location of the sender may be attached to the content. A person posting a picture of a beach to his Facebook account will reveal to his network that he is in Cabo San Lucas, Mexico and that the picture was taken two days ago at 3:30 PM.
Metadata is expressive now, meaning it reveals information about the individual’s behavior and ultimately identity, regardless of whether the individual wants to be known or the behavior identified, based on the content the individual creates, and what the individual searches or buys online. Thus a user who posts a picture of a positive pregnancy test, shops for prenatal vitamins and performs an online search for baby furniture can be inferred to be female and pregnant.
While content or an individual’s words are protected by expression, association, privacy or copyright laws, metadata and expressive metadata are not. In fact, an individual typically does not own his or her metadata or expressive metadata. In addition, no expectation of privacy attaches to metadata or expressive metadata. Hence, an individual’s metadata and expressive metadata can be accessed and reviewed by anyone, including law enforcement, without the individual’s consent and more importantly without a search warrant.
Here’s an example: The Associated Press was able to show – using metadata – that Rep. Aaron Schock (R. Illinois) used taxpayer and campaign funds for flights on donors’ private planes and other expensive travel and entertainment charges, including a massage company and tickets to a sold-out Katy Perry concert in Washington. “The AP tracked Schock’s reliance on the aircraft partly through the congressman’s penchant for uploading pictures and videos of himself to his Instagram account. The AP extracted location data associated with each image then correlated it with flight records showing airport stopovers and expenses later billed for air travel against Schock’s office and campaign records.”
Metadata is all very useful for many reasons, but if law enforcement and other third parties can use metadata for the same or even more effective purposes as privacy-protected “personal information”, and yet legal protections afforded to metadata are less than as to other content, then the cost of metadata’s utility is concessions on privacy. That, too, might be fine if the distinction between metadata and other content is meaningful, but as shown by the story of Rep. Schock, often the distinction is not meaningful.
No Expectation of Privacy Attaches to Metadata
Privacy advocates like the Electronic Frontier Foundation and the Electronic Privacy Information Center are concerned about the volume and intrusiveness of data being collected because of the unlimited and unchecked potential entities have to build databases about your behavior. Because the individual does not create the metadata or the expressive metadata, the individual can do very little to prevent access to their information doing away with privacy and potentially opening up the person to criminal liability, because metadata and expressive metadata is really useful in criminal investigations.
Generally, individuals are protected from unreasonable searches and seizures by the Fourth Amendment of the U.S. Constitution. In order to search and seize specific items from a physical location, law enforcement officials must first obtain a search warrant. While executing a search warrant, if additional evidence or contraband is discovered, such evidence or contraband may be seized by law enforcement officials, even if it was not specifically mentioned in the search warrant. See Chimel v. California.
Numerous Fourth Amendment challenges to seizures revolve around the question of whether a person has a reasonable expectation of privacy with the item sought or seized by law enforcement. See Katz v. United States. For example, the U.S. Supreme Court held in United States v. Miller and Smith v. Maryland that there is no reasonable expectation of privacy for business records held by third parties. This “third party doctrine” makes records held by third parties discoverable by law enforcement without a search warrant.
When the item sought is digital information federal statutes have excluded metadata and expressive metadata from Fourth Amendment protection, doing away with the requirement for a search warrant to access metadata and expressive metadata from third parties, under the third party exception to a warrantless search. The key legislation in support of the exception are as follows:
- The Electronic Communications Privacy Act of 1986 (ECPA) and the Stored Wire and Electronic Communications and Transactional Records Access Act, as amended by the FISA Amendments Act of 2008 and the Foreign Intelligence Surveillance Act of 2008 USA Patriot Act of 2001 and USA Patriot Improvement and Reauthorization Act of 2005, authorizes warrantless searches of metadata as long as the data is relevant and material to an ongoing criminal investigation. Law enforcement may receive device or account address and other metadata without a warrant.
- The Foreign Intelligence Surveillance Act of 2008 permits the National Security Agency to issue National Security Letters to U.S.-based service providers requesting metadata from users anywhere in the world and specifically prevents the service provider from advising the user of the request.
- The USA Patriot Act of 2001 and USA Patriot Improvement and Reauthorization Act of 2005 expanded exceptions to search warrant requirements permitting “sneak and peak” searches that do not require that the subject of the search be notified, and permit roving wiretaps of telephone and other communication devices without naming a specific carrier or time period for collection of the data.
So, metadata and expressive metadata about location records, information about emails – sender/receiver information, date and time sent, opened, and read – text and call logs, held by a third party are accessible to law enforcement without a warrant.
Not So Fast, Thought and Assembly
Another area of concern is when the metadata and expressive metadata are used to limit or infringe upon an individual’s rights to expression and assembly. While legislation has made all metadata and expressive metadata discoverable without a warrant, in at least one case when metadata and expressive metadata are used to limit speech, anonymity, or privacy rights, courts have blocked the government. In Amazon.com LLC v. Lay, the North Carolina Department of Revenue took on Amazon in federal court seeking to collect personally identifiable information to specific purchases made on Amazon.com by North Carolina residents. The US District Court for the Western District of Washington rejected North Carolina’s request as unconstitutional because it violated Internet users’ rights to free speech, anonymity, and privacy, under the U.S. Constitution First Amendment, the federal Video Protection and Privacy Act and Washington State Constitution. In particular, the court wrote:
The First Amendment protects a buyer from having the expressive content of her purchase of books, music, and audiovisual materials disclosed to the government. Citizens are entitled to receive information and ideas through books, films, and other expressive materials anonymously.
George Orwell might be pleased with the government’s use of doublethink when used to protect metadata associated with the protected activities of freedom of speech and assembly. While the legislation has remained the same – the ECPA, the Foreign Intelligence Surveillance Act, and the USA Patriot Act continue to permit warrantless searches of metadata – the application of the laws to freedom of speech and assembly activities has been interpreted differently.
In scenarios where the identity or thoughts of the content creator are requested, the U.S. Supreme Court has consistently held that warrantless searches of thought or assembly information infringe on the person’s First Amendment freedoms of expression and assembly. The leading authorities are these:
- The First Amendment of the U.S. Constitution protects anonymous speech in all forms. See McIntyre v. Ohio Elections Commission.
- The constitutional protections for freedom of expression and freedom of association include a right to privacy with regard to associational information. See NAACP v. Alabama.
- In U.S. v. Rumely, the U.S. Supreme Court held it unconstitutional to convict a bookseller for refusing to provide the government with a list of people who purchased a political book.
- The Video Privacy Protection Act of 1988 places restrictions on demands for records of video rentals and cable records.
Conclusion
Access to the world digitally is a two-way street. Just like a user seeks information about what the web offers, the web seeks information about who is using it. Privacy as a concept, makes little sense on this street because to benefit from digital services, who you are, where you live, and what you need is important to know and record so that you continue to receive information that is relevant to you.
We do not like it when people or entities collect information about us. There is a concern about the information being acquired, why it is being collected, and how it will be used. The best way to remove confusion or this irrational fear whether the entity is public or private is to state clearly what information is collected and how it is used or will be used. Especially in criminal investigations, the justice system works best when the rules and procedures are accessible and known by prosecutor and defendant alike.
The alternative are actions like the country of Belgium, who’s privacy group the Belgium Privacy Commission lost a case against Facebook last week that claimed Facebook was violating people’s privacy because they were monitoring the online behavior of non-Facebook users – a group that never signed up for their service nor consented to be monitored by Facebook. Although dismissed on procedural grounds, substantively privacy advocates may be victors at the end of the adjudication of the matter because the data collection occurred clandestinely. Moving forward, knowing that Facebook collects information from users and non-users alike, permits the user to make choices on whether to access a public Facebook post if he or she is not a subscriber. The solution to private and public data collection is transparency.
