Digg this story   Add to del.icio.us   (page 1 of 2 ) next 
Your Space, My Space, Everybody's Space
Mark Rasch, 2007-05-23

It has recently been reported that Attorney’s General’s from about a dozen U.S. States, including Connecticut, Georgia, Hawaii, Idaho, Mississippi, Maryland, New Hampshire, North Carolina, Ohio and Pennsylvania have demanded that News Corporation’s social networking site MySpace voluntarily deliver to the AG’s a list of all sex offenders who have registered for or used the MySpace social networking service.

Noting the possibility that sex offenders might use the service to find and solicit other members for sex, the chief state law enforcement officers merely demanded that MySpace pony up the records. When MySpace, citing its own privacy policies and federal privacy laws, refused to produce the records without a subpoena, the Attorney’s General initially went on a public relations campaign against the social networking site – almost calling them complicit in child abduction and sexual predation. This case points out the problem of establishing an online privacy policy and then trying to stick to it under pressure from the very agencies that enforce the policies.

It is clear that people – both registered sex offenders and others – use social networking sites like MySpace and Facebook to meet other people. It is also clear that these sites can be used by individuals interested in violent criminal activity – including sexual predation, abduction and other crimes, to further criminal activity. The question is however, the extent to which the operators of the sites should step into the shoes of law enforcement and identify not just those who are engaging in criminal activity on the site, but also to identify FOR law enforcement those who might later engage in criminal activity based upon the fact that they had committed crimes in the past.

A Privacy Policy

MySpace, like most websites, has a privacy policy that sets out, in general terms, what information it collects and what it can and may do with that information. Indeed, the terms of these privacy policies are generally enforced by federal agencies like the Federal Trade Commission, or State Attorney’s General under unfair or deceptive trade practices statutes. In other countries, enforcement of data privacy agreements may be within the purview of federal or local data privacy commissioners. The MySpace policy, is fairly loose, and gives MySpace a good deal of latitude about what it can do with what it collects. The policy states that:

Sharing and Disclosure of Information MySpace.com Collects . . . MySpace will not disclose personal information to any third party unless we believe that disclosure is necessary: (1) to conform to legal requirements or to respond to a subpoena, search warrant or other legal process received by MySpace.com, whether or not a response is required by applicable law; (2) to enforce the MySpace.com Terms of Use Agreement or to protect our rights; or (3) to protect the safety of members of the public and users of the service. …

So, MySpace can use or disclose information about you – including your IP information, subscriber information, even the contents of MySpace IM or e-mail if it wants to enforce its policies, protect its rights, or if there is a threat to the safety of the public. Why then was it appropriate for them to demand that the AG’s get a subpoena for the sex offender information?

The AG’s Response

Partially in response to public criticism, and partly to act as a “good corporate citizen" MySpace recently started using an online name, address and criminal history verification service provided by Sentinel Tech Holding Company http://www.sentryweb.com/ to help them determine if people who joined the site using their real names, real addresses, and real e-mail addresses were convicted of sex offenses. Clearly MySpace was trying to do something about the problem of sexual predators using their service. If they found a convicted and registered sex offender, MySpace would kick them off, and they would remain off the service (at least until they could figure out how to use a fictitious email address.) The sentry service does not purport to determine the nature of the restrictions on the person convicted – the terms of parole or probation, etc., only the fact that they were convicted. Nevertheless, if you were a convicted sex offender AND the Sentinel software detected you, MySpace would kick you off.

Note that there was nothing in the MySpace terms of use that said that convicted sex offenders couldn’t use the service, and nothing in federal or state law prevents convicted sex offenders from using social networking sites. If you are convicted of a crime – any crime, and given probation or parole, the Judge has some latitude in restricting what you can do after release – including limiting your use of computers of computer networks, requiring that you report your computer use, or even permitting the local probation officer to examine the contents of your computer or computer use (assuming you're on your OWN computer and adhere to the terms of your probation.) These restrictions however, generally disappear after a convict has fully completed their sentence, including any probationary term. Some states are trying to push requirements that limit sex offender’s use of computers by statute, (something MySpace reportedly supports) or require that minors using social networking sites obtain parental permission, but MySpace already in theory restricts use to those over 14. The MySpaceTerms of Use merely states that:

Use of and Membership in the MySpace Services is void where prohibited. By using the MySpace Services, you represent and warrant that (a) all registration information you submit is truthful and accurate; (b) you will maintain the accuracy of such information; (c) you are 14 years of age or older; and (d) your use of the MySpace Services does not violate any applicable law or regulation. Your profile may be deleted and your Membership may be terminated without warning, if we believe that you are under 14 years of age.

Nothing here about convictions, probation, or sex offenses. But remember, you don’t have a RIGHT to use MySpace. It’s a private website. As a general rule they don’t have to let you on, although they might have liability if the precluded "membership" based upon some prohibited classification – e.g., race or national origin, but that is not entirely clear. Indeed, in creating state "registered sex offender" laws, many states mandated that they not be used for certain discriminatory purposes. Indeed, the Connecticut sex offender registry explicitly states that “any person who uses information in this registry to injure, harass or commit a criminal act against any person included in the registry or any other person is subject to criminal prosecution." So MySpace might be within its rights to kick off sex offenders if it wants to, although they are under no legal obligation to do so, or for that matter, to police their site for improper activity. It reportedly has already removed about 7,000 profiles of registered sex offenders.

This wasn’t enough for the AG’s. They insisted that NewsCorp’s MySpace – after kicking the people off – turn over information to the cops about the number of registered sex offenders who used to be on the sites, and other information. MySpace indicated that it was happy to produce the information – just give us a subpoena. The AG’s response was not initially to walk down the hall and draft up and print a subpoena, but rather to lambaste MySpace for adhering to its privacy policy, and for complying with the federal Electronic Communications Privacy Act.

Privacy Law

The Electronic Communications Privacy Act, 18 USC 2702, limits the legal authority of "a person or entity providing an electronic communication service to the public" to disclose either the contents of electronic communications (e-mail or IM) or subscriber information, noting:

. . . a provider of remote computing service or electronic communication service to the public shall not knowingly divulge a record or other information pertaining to a subscriber to or customer of such service . . . to any governmental entity.

Of course, the statute contains certain relevant exceptions, including when the cops are armed with a subpoena, search warrant or administrative subpoena or when:
. . .the provider reasonably believes that an emergency involving immediate danger of death or serious physical injury to any person justifies disclosure of the information;

The statute also allows the service provider to turn over records to the National Center for Missing and Exploited Children http://www.missingkids.com/ when there is a crime involving the distribution of child pornography. But nothing about providing information about registered sex offenders just cause the cops were curious.

Now let’s be clear on something. MySpace always intended to shut down the registered sex offenders. MySpace always intended to share the relevant information with law enforcement. The question was whether they would do it without a warrant.

Story continued on Page 2 



Mark D. Rasch is an attorney and technology expert in the areas of intellectual property protection, computer security, privacy and regulatory compliance. He formerly worked at the Department of Justice, where he was responsible for the prosecution of Robert Morris, the Cornell University graduate student responsible for the so-called Morris Worm and the investigations of the Hannover hackers featured in Clifford Stoll’s book, "The Cuckoo’s Egg."
    Digg this story   Add to del.icio.us   (page 1 of 2 ) next 
Comments Mode:


 

Privacy Statement
Copyright 2010, SecurityFocus