Data Privacy in the Information Age: Constitutional Concerns

Monday, October 23rd, 2017 at 9:52 pm, by Benjamin Cermak

We currently live in the information age; with the rise of new technologies comes increasing access to the outside world. With devices such as smart phones and tablets, it’s now even easier to share thoughts, ideas, and information with others. This newfound capacity comes with a price, however. Major corporations like Facebook and Google routinely harvest users’ information and sell it to third party advertisers. Security breaches like the recent Equifax hacking illustrate the perils of sending and storing information in the 21st century. Unfortunately for consumers, hackers and major corporations aren’t the only threat to their data. Indeed, recent legal developments in the data-privacy landscape suggest that the government itself could pose a great threat to individual privacy.

Government Access

Shortly after President Trump’s inauguration on January 20th, violence erupted in downtown Washington D.C. The rioting resulted in thousands of dollars in damage to local property and over 200 arrests. A group of activists used the website www.disruptj20.org to organize the protests. In July, the United States Attorney’s Office for the District of Columbia issued a broad, sweeping search warrant to DreamHost – the web hosting company behind the “disruptj20” movement.

The search warrant called for mountains of user data, including the emails, email addresses, and IP addresses of over 1.3 million users who had merely visited the website over the last 9 months. Somewhat surprisingly, the data requested was completely untailored to the January 20th investigation; the government simply demanded a broad swath of private data related to political affiliation protected by the First Amendment. DreamHost resisted the initial warrant in court.  However, as of October 10th, Judge Morin of the D.C. Superior Court has ruled in favor of a more tailored approach requiring user-identity redaction and a predetermined set of search criteria for investigation. This method protects against unnecessary disclosure of sensitive personal data related to innocent users’ political activity – a protected form of speech under the First Amendment.

In a related matter, the Department of Justice also issued several warrants to Facebook, seeking user information related to the activists of disruptj20. The warrants requested sweeping access to specific activists’ friends, private messages, photos, and more as well as information on the 6,000+ people who have “liked” the disruptj20 Facebook page. The DOJ also asked for a gag order, although they later rescinded their request in mid-September after vigorous opposition. The ultimate fate of the Facebook warrants, however, is still being contested in court.

Constitutional Safeguards

In both the pending DreamHost and Facebook actions, the government signaled that it was willing to skirt a fine line of constitutionality in the pursuit of private user data. The Fourth Amendment—which protects against “unreasonable search and seizures”—is a major obstacle for any regime attempting to broadly fish for user data. Indeed, the government’s initial warrants in the Facebook investigation are likely far too broad to survive a Fourth Amendment review. Consider the limited utility of a government investigator reviewing a person’s Facebook photos or their “likes”; this type of search may run afoul of the Fourth Amendment for lack of tailoring.

Courts have consistently held that overbroad or general warrants are prohibited so as to prevent law enforcement from “rummaging” around in someone’s personal belongings without adequate cause.[1] The line becomes somewhat blurred, however, when “intangible” belongings like electronic data enter the equation. The Ninth Circuit acknowledged the difference in a recent case involving an allegedly overbroad Facebook search warrant, noting, “Over-seizing’ is an accepted reality in electronic searching because ‘[t]here is no way to be sure exactly what an electronic file contains without somehow examining its contents.”[2] Ultimately, it remains uncertain how courts will interpret the Fourth Amendment in light of the internet age. Nonetheless, recent developments illustrate the need for judicial oversight in evaluating the breadth of electronic search warrants.

In the recent DreamHost and Facebook cases, the First Amendment also justifies judicial scrutiny. Indeed, the Supreme Court has ruled that the right to anonymous free speech is protected by the First Amendment.[3] The right to anonymous free speech arguably amplifies when that speech is political in nature. Thus, when the government asked DreamHost to supply intimate information about users who had merely visited the website, Judge Morin of the D.C. Superior Court required that all disclosed information be adequately redacted. Some have speculated that overbroad and untailored electronic search warrants could enable the government to compile a registry of active political opponents. This type of state-sponsored monitoring would chill political activity—internet users are unlikely to visit politically affiliated websites if they run the risk of landing on a government watchlist. This threat is compounded if courts grant gag orders—such as the one requested in the Facebook matter—preventing websites from telling specific users that they’ve been targeted in an investigation. Ultimately, this an impermissible outcome under the First Amendment. Going forward, courts must remain vigilant and tailor electronic search warrants to only include information directly relevant to the government investigation.

It remains uncertain how well courts will balance the government’s interest in thorough investigation with the rights of innocent internet users with active political affiliations. The government incurs a significant burden in oversight; in tailoring the DreamHost warrant, Judge Morin acknowledged that the court would have to review individual documents before they are disclosed to the government. Even then, as the Ninth Circuit acknowledged, there remains a possibility that innocent users’ information will slip through the cracks into the government’s hands. This is the reality of the information age; while government prosecutors issue sweeping search warrants, courts can only do so much to ensure that innocent users’ identities aren’t compromised in the investigation.

[1] United States v. Ulbricht, 858 F.3d 71 (2d Cir. 2017).

[2] United States v. Comprehensive Drug Testing, Inc., 621 F.3d 1162, 1176-77 (9th Cir. 2010) (en banc) (per curiam).

[3] McIntyre v. Ohio Elections Comm’n, 514 U.S. 334 (1995).