corporate websites and LEA

Two birds recently did a presentation at the People's Summit celebrating the 10 year anniversary of the WTO protests. We discussed the dangers of using corporate tools to do organizing work, in particular, the fact that you don't know what they do with your data. Thanks to some anonymous comments in a blogger's post about his research regarding a U.S. mobile phone company's release to law enforcement of its customers' geographic location information, we now have some answers.

Large companies have entire departments devoted to dealing with law enforcement subpoenas and warrants, and the anonymous posters provided copies of the guidebooks that several large corporations provide to assist law enforcement with their requests. The leaked manuals include those for Facebook, Yahoo!, MySpace,, Comcast, and PayPal. Each manual provides helpful hints for law enforcement regarding the specific data available (some of which may be obtained with a mere subpoena and without any judicial scrutiny), and even sample request language to use in different circumstances. For example, according to the leaked manual, facebook retains information about the IP address of every computer that accesses their website for 30 days. This means that, unless you use countermeasures, facebook can know the exact location where you logged on to your account. Because this IP address information does not include the contents of communications, a U.S. prosecutor can seek the information without any judicial oversight.

With a court order, facebook will release even more information about you. They've even developed an application called "Neoprint" to deliver a handy packet of information about subscribers, including profile contact information, mini-feed, friend listing (with friend's facebook ID), group listing and messages.

There is little oversight of surveillance conducted in the U.S. of online service providers because the U.S. Department of Justice does not report the number of IP address requests that they have issued, even though a 1999 law requires reports. There is also no reporting requirement for court orders issued under the Stored Communications Act which governs the release in the United States of all of your electronic data stored online.

One of the scary things about all of this is that the US actually has better data protection laws than many other countries. Also, unlike our comrades in the EU, the US does not currently require online providers to keep logs, This means that people organizing everywhere should be aware that if you are using corporate providers, your data is at risk.

While this information should not be surprising, it illustrates the importance of supporting alternatives and educating each other about the risks of using corporate tools for organizing work. For more information, read the blog post,

Acknowledgement

The text was originally adopted from the newsletter of RiseUp.net