Those of you who have been following CLP’s involvement in United States v. Facebook know that, in our amicus brief submitted in October, I argued that the proposed settlement between the Federal Trade Commission and Facebook appeared to grant warrantless access to Facebook user data to both the FTC and the Department of Justice and, quoting the language of the settlement, that it did so “without further leave of court.” (CLP Amicus at 8)

Then, in December, Judge Timothy J. Kelley took the (I am told) unusual step of ordering both parties to respond to all the arguments presented by amici. Well, the responses came in last Friday, and the responses to CLP’s arguments were revealing. The government and Facebook apparently have conflicting views about what happens to your privacy under the terms of the proposed settlement order.

Facebook, for its part, spent only two short paragraphs responding to CLP. In its view, CLP’s concerns were unfounded because, first, “Any requests by the DOJ and FTC for user records or communications under the Stipulated Order would still be governed by the Stored Communications Act (the ‘SCA’).” (Facebook Response at 16) and, second, “Facebook does not need to produce personally identifiable information to satisfy the requirements of the Order.” (Id.) (Read Facebook’s entire response brief.)

Both the terms of the settlement order and the government’s response brief seem to contradict Facebook’s first contention. Again, note that the proposed settlement order specifies that the FTC (and the DOJ, which is given the power to stand in the shoes of the FTC for purposes of enforcement) is permitted to request more information from Facebook, “without further leave of court.” (Stipulated order at 28) The SCA, by contrast, even for “communications” stored over a longer period of time, requires at least some “leave of court,” even if only that required for a subpoena. (For those communications stored for a shorter period of time, the SCA requires a warrant.)

The government’s longer response to CLP, by contrast, makes no reference to the SCA or anything else that might prevent it from seeking warrantless access to Facebook user data. In fact, the brief unapologetically claims the right to access such data. After misconstruing CLP’s argument with respect to the applicable law (we argued that even the majority holding in Carpenter calls into question the status of Facebook user data under the Fourth Amendment), the government cites a 2018 D.C. Circuit case holding “that Facebook users lack a ‘reasonable expectation of privacy’ in the Facebook content they voluntarily post on Facebook.” (Government Response at 14) The government also tries to assure us that the “recordkeeping provisions” are not “some sort of Trojan horse through which the government intends to acquire and use Facebook user data for undisclosed purposes,” but are “familiar part of agency enforcement actions and are intended to ensure ongoing compliance with the order.” (Id.) One can’t help but be reminded of the NSA “intending” to monitor foreigners, and yet collecting conversations of innocent Americans.

Further, the government asserts, “there is nothing in the Amended FTC Order that requires Facebook to provide any information about any specific user to the government.” (Id. at 14-15) No, of course not, and CLP never argued this. What we argued is that the Order seems to permit this, especially when it allows the government to demand “other requested information”–quite a broad catch-all, “without further leave of court.” (See CLP Amicus at 8, citing Stipulated Order at 28)

And with respect to personally identifiable data (such as your telephone number), whereas Facebook seems to think it can comply with the Order without turning such data over to the government (see above), the government, citing Smith v. Maryland, proudly asserts the legality of requesting and obtaining warrantless access to it: “a Facebook user’s telephone number is not protected by the Fourth Amendment.” (Government Response at 15) Note that it’s unclear whether the holding in Smith v. Maryland is even applicable to a situation in which someone provides his phone number to a service provider other than the telephone company. More importantly, CLP argues that the Supreme Court’s 2018 holding in Carpenter v. United States–yes, even the majority opinion–calls into question the original holding in Smith!

Most troubling, perhaps, is what the government says in the second-to-last paragraph of its response to CLP:

[E]ven if the Amended FTC Order could incorrectly be read to require production of Fourth Amendment-protected information, the Supreme Court and the D.C. Circuit have for nearly three-quarters of a century repeatedly rejected Fourth Amendment challenges to agency orders requiring document productions–as long as the agency’s requests are reasonable and related to the agency’s investigatory and enforcement powers.

Government Response at 15, emphasis added

So there you have it: the government contends that it is entitled to obtain whatever Facebook user data it wants, so long as the request for such data is “reasonable and related” to its investigation of and enforcement against Facebook with respect to Facebook’s privacy practices. How often is any government request for any sort of data not held to be “reasonable and related” to some power of our ever-expanding government? As I wrote in our amicus brief, if George Orwell were to be reading this today, he’d think he was reading The Onion.

(The government goes on to criticize CLP for not citing this standard, but CLP’s position was made clear in our brief: if the goal is to protect users from Facebook’s bad practices with respect to user privacy, the answer is not to further encroach on user privacy by making their data accessible, without a warrant, to the FTC and the DOJ! The standard quoted by the government, above, does not reference investigation of and enforcement against Facebook users, only against Facebook itself.)

Read the government’s entire response brief here.

While the Government and Facebook seem to have very different ideas about what happens to your privacy under the terms of the proposed settlement, both agree that Judge Kelley should “enter the Proposed Stipulated Order without delay” (Government Response at 16). CLP urges Judge Kelley to continue to take seriously his duty to ensure the Proposed Order’s “consistency with the public interest.” Until a Constitutional amendment such as the one currently being considered in New Hampshire becomes effective nationally, only judges can further clarify the scope of the “third-party doctrine” post-Carpenter and thereby protect our rights (and interests). The government should not be handed warrantless access to Facebook data, simply because of Facebook’s alleged misconduct.

Amy Peikoff of CLP is available for interviews.

Media requests: legalizeprivacy@icloud.com.