In December 2010, the U.S. Department of Justice subpoenaed Twitter for information on several people associated with WikiLeaks, seeking the users’ full contact details (phone numbers and addresses), account payment method if any (credit card and bank account number), IP addresses used to access the account, connection records (“records of session times and durations”) and data transfer information, such as the size of data file sent to someone else and the destination IP. While only five people were individually named in the subpoena, by seeking “destination IP” addresses of all transfers from these Twitter accounts, the government is effectively seeking potentially-identifying information of over six hundred thousand Twitter users, namely those who were “followers” of these WikiLeaks-associated accounts.
Twitter fought the subpoena’s accompanying gag order, and has earned a partial victory that allowed Twitter to make the order public. [Some surmise that the wording of the order — asking for size of “data files” — suggests the same order was made to other ISPs or online providers, but there is no evidence that anyone other than Twitter has objected.] Upon learning of her inclusion in the subpoena, Birgitta Jonsdottir, a member of Iceland’s parliament, sought the help of the EFF and filed a motion challenging the government’s attempt to obtain the records, asking the court to vacate the order. The motion argued the government’s demand for the records violated First Amendment speech rights and Fourth Amendment privacy rights of the Twitter-account holders.
In March 2011, Judge Theresa Buchanan, in the Eastern District of Virginia, ruled against that motion, arguing that because the government was not seeking the content of the Twitter accounts in question (.pdf), the subjects did not have standing to challenge the government’s request for the records. She further argued that “because petitioners voluntarily conveyed their IP addresses to Twitter as a condition of use, they have no legitimate Fourth Amendment privacy interest.” The judge was unpersuaded by the petitioners initial suggestion that they did not read or understand Twitter’s Privacy Policy, and that any conveyance of IP addresses to Twitter was involuntary. In a footnote of the motion, she wrote quite plainly: “Internet users are bound by the terms of click-through agreements made online.”
Christopher Soghoian has posted a critical analysis of this portion of the judge’s ruling, noting that while the judge states in her order that “[b]efore creating a Twitter account, readers are notified that IP addresses are among the kinds of ‘Log Data’ that Twitter collects, transfers and manipulates,” that isn’t entirely true. Soghoian comments:
It would be far more accurate to say that before creating a Twitter account, users are presented a link to a privacy policy, which includes a statement six paragraphs down about IP address collection. Users are further told that by clicking on a button to create the account, that they acknowledge that they read the linked privacy policy, although Twitter does not actually take any steps to make sure that users clicked on the link or scrolled through the content on that page.
Of course, it wouldn’t really matter if Twitter forced people to click on the privacy policy, or scroll through the page, because everyone knows that consumers won’t actually read through the text.
This final point is critical: “everyone knows that consumers won’t actually read through the text.” Soghoian’s post includes numerous studies that show users rarely read terms of service or privacy policies, as well as quotes from both FTC officials and US Supreme Court Chief Justice Roberts acknowledging the fact that these policies are difficult to read and understand.
Building from his original post, Soghoian has penned an amici brief (pdf) to the court, which presents the following argument:
Amici urge the court to not dismiss petitioners’ Fourth Amendment privacy interests based on their mouse clicks. Research has shown that consumers rarely read and even more rarely understand privacy policies. In fact, the mere presence of a privacy policy is often misunderstood by consumers to mean their privacy is protected. While “clickwrap” acceptance of terms may constitute a contract under certain circumstances, this legal construct for private obligations has limited bearing on whether a user’s expectation of privacy against government intrusion is objectively reasonable and protected by the Fourth Amendment.
I’m among the signers* of this brief, and would like to thank Chris for his continued efforts on protecting privacy online.
*Amici are academics and researchers from the fields of computer science, psychology, and law who focus on online privacy:
(Amicisubmit this brief in their individual capacities. The affiliations listed are for identification purposes only.)
- Dr. Kelly Caine, Principal Research Scientist in the Center for Law, Ethics and Applied Research in Health Information and the School of Informatics and Computing, Indiana University
- Danielle Keats Citron, Professor of Law, University of Maryland School of Law
- Dr. Serge Egelman
- Jerry Kang, Professor of Law, UCLA School of Law
- Dr. Aleecia M. McDonald
- Frank A. Pasquale, Schering-Plough Professor in Health Care Regulation and Enforcement, Seton Hall Law School, Visiting Fellow, Princeton University Center for Information Technology Policy
- Len Sassaman, Researcher, Katholieke Universiteit Leuven (Belgium)
- Jason M. Schultz, Assistant Clinical Professor of Law, Director, Samuelson Law, Technology & Public Policy Clinic, UC Berkeley School of Law
- Wendy Seltzer, Associate Research Scholar, Center for Information Technology Policy, Princeton University
- Christopher Soghoian, Graduate Fellow, Center for Applied Cybersecurity Research, Indiana University
- Dr. Michael Zimmer, Assistant Professor, School of Information Studies, Co-Director, Center for Information Policy Research, University of Wisconsin-Milwaukee
MichaelZimmer.org 