Sophos News

Facebook can’t say ‘No’ to New York, says New York

Here’s the story so far.

Back in 2013, New York (the state, not just the city) decided to take on a bunch of public servants it said were fraudsters.

The state alleged that close to 400 employees, including police officers, were benefits cheats, claiming illnesses and disabilities they didn’t have.

By all accounts, this wasn’t just a case of a few staff throwing a few sickies.

Reuters reports that the state has already recovered nearly $25,000,000 in paid-out benefits, an average of more than $60,000 each for everyone fingered in the investigation.

Some of those under investigation even allegedly used the 9/11 terrorist attacks as a bogus reason why they were unable to function normally.

Unsurprisingly, part of the evidence – an important part, one imagines – involved information published on social media.

(Simply put, if you’re incapacitated enough that you can’t get out of bed, you’re not supposed to be snapped on the beach playing volleyball with your buddies.)

As Reuters wryly put it:

Prosecutors said Facebook pages showed public employees who claimed to be disabled riding jet skis, playing golf and participating in martial arts events.

As you can imagine, that meant a raft of “please hand over user data” warrants served on Facebook.

In 2014, Facebook complied with the warrants, but only under protest.

The appeal

The social networking giant then mounted a legal appeal, effectively on behalf of all its users, to argue that this sort of broad-brush warrant should not be allowed because it amounts to “unreasonable search.”

That sort of thing is explicitly prohibited by the US Bill of Rights (specifically, by the Fourth Amendment to the Constitution).

In the end, apparently only 62 of the 381 people in the investigation were actually charged, giving some credibility to Facebook’s position.

But a New York Appeals Court has found against Facebook.

Interestingly, the Appeals Court doesn’t appear to have given an explicit green light to the warrants themselves, but rather to have concluded that the admissibility of the evidence was not for Facebook to challenge.

In other words, Facebook was duty-bound to hand over the data, and it was up to each defendant to argue, in each individual case, whether the data gleaned from Facebook could be used or not.

Facebook, reasoned the court, couldn’t play the inadmissibility card on behalf of all, or indeed any, of its users.

What next?

Apparently, Facebook is planning to appeal the outcome of the appeal, so you can expect this saga to continue for as long as each side’s lawyers have the will (and the funding) to continue.

Where do you stand on this?

Should Facebook and others be sticking up for everyone, implicitly including the crooks amongst us, in order to keep investigators tightly focused?

Or is 62 out of 381 (with $25,000,000 allegedly recovered into the public purse, don’t forget) a suitable sort of prosecution-to-search ratio?