Skip to content
Naked Security Naked Security

Facebook can’t say ‘No’ to New York, says New York

Facebook can't "plead the Fourth Amendment" on your behalf, says a New York appeals court - you have to do it yourself.

Here’s the story so far.

Back in 2013, New York (the state, not just the city) decided to take on a bunch of public servants it said were fraudsters.

The state alleged that close to 400 employees, including police officers, were benefits cheats, claiming illnesses and disabilities they didn’t have.

By all accounts, this wasn’t just a case of a few staff throwing a few sickies.

Reuters reports that the state has already recovered nearly $25,000,000 in paid-out benefits, an average of more than $60,000 each for everyone fingered in the investigation.

Some of those under investigation even allegedly used the 9/11 terrorist attacks as a bogus reason why they were unable to function normally.

Unsurprisingly, part of the evidence – an important part, one imagines – involved information published on social media.

(Simply put, if you’re incapacitated enough that you can’t get out of bed, you’re not supposed to be snapped on the beach playing volleyball with your buddies.)

As Reuters wryly put it:

Prosecutors said Facebook pages showed public employees who claimed to be disabled riding jet skis, playing golf and participating in martial arts events.

As you can imagine, that meant a raft of “please hand over user data” warrants served on Facebook.

In 2014, Facebook complied with the warrants, but only under protest.

The appeal

The social networking giant then mounted a legal appeal, effectively on behalf of all its users, to argue that this sort of broad-brush warrant should not be allowed because it amounts to “unreasonable search.”

That sort of thing is explicitly prohibited by the US Bill of Rights (specifically, by the Fourth Amendment to the Constitution).

In the end, apparently only 62 of the 381 people in the investigation were actually charged, giving some credibility to Facebook’s position.

But a New York Appeals Court has found against Facebook.

Interestingly, the Appeals Court doesn’t appear to have given an explicit green light to the warrants themselves, but rather to have concluded that the admissibility of the evidence was not for Facebook to challenge.

In other words, Facebook was duty-bound to hand over the data, and it was up to each defendant to argue, in each individual case, whether the data gleaned from Facebook could be used or not.

Facebook, reasoned the court, couldn’t play the inadmissibility card on behalf of all, or indeed any, of its users.

What next?

Apparently, Facebook is planning to appeal the outcome of the appeal, so you can expect this saga to continue for as long as each side’s lawyers have the will (and the funding) to continue.

Where do you stand on this?

Should Facebook and others be sticking up for everyone, implicitly including the crooks amongst us, in order to keep investigators tightly focused?

Or is 62 out of 381 (with $25,000,000 allegedly recovered into the public purse, don’t forget) a suitable sort of prosecution-to-search ratio?

14 Comments

Personally, I believe that if you,re going to lie to the employer, don’t be dumb enough to rub their noses in it.
Gov’t chiefs tend to be humorless on that point.

Reply

I think the scammers deserve to be caught. It really makes it hard for legitimate claims to be processed and paid when greedy and lazy people mess it up with their fraudulent claims. They should not only pay it back I think they should do community service or jail time.

Reply

Its getting more dangerous for us to post online every day. I know this may be a legit cause, but this will lead to bigger things. Before you know it, we will lose all our freedoms. That’s the point of this argument.

You cant even safely blow off steam, or say certain joke online any more without extreme consequences. Saying the word pirate on Steam is a bannable offense now as I have learned. Just an example of how bad things are getting.

This is why cases like this are important. Its not what the bad guys did, its what freedoms are being violated for the sake of a good cause which will later lead to no freedoms under good or bad reasons.

Reply

I again received a pop-up ad for instant Tech Support (for Sophos) when I opened this link.

Reply

Hi Brock, can you give us a bit more information on this if possible? What link did you click on? Our main website (https://www.sophos.com) offers chat support. Is that what you’re referring to? Feel free to email the information over to us on tips@sophos.com. Thanks.

Reply

just wonder how much they spent prosecuting each and other administrative fee’s. Did they already spend the $25M getting it back?

Reply

Not enough information to comment on the legitimacy of Facebook’s claims in this case. By their nature, search warrants are about discovery, so one never knows what will be found. The fact that a majority of the searches did not turn up enough evidence to prosecute the owners of the accounts does not mean there was not sufficient reason to investigate them. Without knowing what evidence led to issuing the warrants, it’s impossible to know whether the searches were justified. Clearly there was widespread fraud, and I assume some of the fraudsters were not dumb enough to post evidence of their fraud, and therefore were not prosecuted (yet).

Reply

If you are on a beach, you are in the public domain. Then you freely or a friend posts a pic of you. That pic could end up just about anywhere, why does the gov need a warrant, if the imagine is in the public domain.
Cheaters usually get caught because they are stupid enough to think
stealing is OK.

Reply

I don’t think they were merely after photos that had been made public, but for additional information they could get about people who were already considered suspects, for example because of pics taken by a friend that had been made public.

For example, imagine that I suspected you because you had tweeted a photo showing you and a buddy “on a road trip to the beach with our jetskis” when you were supposed to be recovering from surgery. Now imagine I went to your Facebook page, and your friend’s page, and saw a few photos of the two of you at the beach with your jetski, but none that showed you actually riding it. Hmmm…suspicious, but not proof. So I might go to the court and say, “I think it’s reasonable to search this guy’s Facebook data, please authorise me to get access to his account. Oh, and his friend’s account, too because people often take pictures of each other.”

Reply

I don’t consider any online social media activity or data to be private, which is why I have never given Facebook my phone number. Regardless, I still reserve to myself the right to choose who gets to see it. Now, I currently have my default set to “public” for 99% of what I post — but still, the thought of the government simply telling Facebook to “hand it over” without first having sufficient evidence against me to obtain a warrant feels like… well, it sort of feels like the police coming to my front door and bursting into my living room with no warrant. Just because my living room isn’t a particularly private space doesn’t mean I think just anyone should be allowed to barge into it without at least asking me, and obtaining a warrant if they have sufficient reason to believe that I’m concealing evidence of a specific crime there.

Should the government be allowed to go on fishing expeditions through our social media without a warrant naming specifically what evidence they’re seeking? I would say from my gut — Absolutely NOT!

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!