By Jeff Benson
First of two parts.
Law enforcement recently tapped social media to find, arrest and charge two criminal suspects. The actions raise many privacy concerns, experts say. This report details how the FBI leveraged social media data to find a suspect in the torching of two Philadelphia police vehicles during the recent social-justice protests.
The police car sat outside Philadelphia City Hall on May 30, its windows smashed, its side emblazoned with graffiti. The nationwide protests against George Floyd’s death that month were in full swing.
A demonstrator approached with a flaming shard from a shattered barricade in her hand. She set the police sedan alight, and then did the same to an agency SUV.
The woman, though masked and goggled, had several distinguishing characteristics: a peace sign on her arm and a blue shirt that read “Keep the immigrants, deport the racists.”
Those identifying markers, coupled with her online activity, were the clues the FBI needed to identify her as Lore-Elisabeth Blumenthal and arrest her. She’s awaiting trial on arson charges. If convicted, she faces up to 80 years in prison.
“As you share something with one or two other people, let alone 500, it’s no longer private.”
Matthew Tokson, University of Utah College of Law.
Criminal justice and legal experts tell Digital Privacy News that law enforcement agencies have wide powers to monitor online activity as part of investigations.
Citizens, they say, especially those taking part in protests, should have little expectation of privacy on social media. Their actions can be used as corroborating evidence for any crimes they commit in the open.
“It’s not clear the court would consider anything you put on Facebook private,” Matthew Tokson, an associate professor at the University of Utah College of Law, told Digital Privacy News. “That’s still sort of to be determined.
“And a lot of cases suggest as soon as you share something with one or two other people, let alone 500, it’s no longer private.”
In the Philadelphia case, the FBI used surveillance videos and photos uploaded by attendees to zero in on the woman’s appearance.
They traced her bespoke shirt to an Etsy shop. Perusing order histories, they found a user based in Philadelphia and went through a rabbit hole of online stores and social media sites where similar usernames appeared until they had a LinkedIn video of Blumenthal at work in a massage studio — peace sign clearly visible.
The Philadelphia Police Department declined to comment. The FBI, Etsy and LinkedIn did not respond to requests for comment.
Giving Up Privacy
Such online investigations are perfectly legal, according to Chip Snyder, deputy director of Creative Security Investigation Inc. and a former deputy state’s attorney in Maryland.
“When you put your trash out on the curb to be picked up … you have given up all right to privacy,” he told Digital Privacy News.
Snyder said he had prosecuted several drug cases based on drug paraphernalia and utility bills found in garbage cans. The same principles apply to online privacy: “For the most part, on social media, at least in my experience to date, it doesn’t exist.”
According to Tokson, law enforcement likely has more power than that — from the ability to subpoena subscriber information to infiltrating groups online.
“When you put your trash out on the curb to be picked up … you have given up all right to privacy.”
Chip Snyder, Creative Security Investigation Inc.
“In the offline context … you can have an undercover agent befriend someone, go into their house, and record them if they talk to you,” usually without a warrant,” he said.
“If they can go into your house as an undercover agent, social media’s a lot less private than that.”
‘Goldmine’ for Police
All of that can make fact-finding very simple for investigators.
“Social media is a goldmine for law enforcement, in particular because people do incredibly stupid things,” Mike Katz-Lacabe, research director at Oakland Privacy and the Center for Human Rights and Privacy in California, told Digital Privacy News.
“They post pictures of themselves with stuff they got from looting,” he added. “Or they post pictures of themselves with guns when they’re on parole.”
In cases like Blumenthal’s, others can post the pictures for you. Even without a name attached, authorities have many tools at their disposal to track identities.
The most obvious are the surveillance cameras that allow investigators to follow people’s movements and identify possible associates. That information can then be cross-checked with online data, magnifying the tools’ power.
Constant Surveillance
The expectation of constant surveillance is what bothers some privacy advocates, including Katz-Lacabe. Investigations based on social media are fair game, he said, but broad data-mining and indiscriminate snooping shouldn’t be.
“I really can’t begrudge police looking at my account at the point where I become a suspect,” Katz-Lacabe told Digital Privacy News.
“What I do have a problem with is this mass surveillance of everyone on the belief that, ‘Eventually, some of these people are going to commit a crime — and then we’ll have this information.’”
While citizens may be unable to sidestep the glare of on-the-street surveillance, especially amid protests, they can take online hygiene steps to avoid becoming entangled in a warrantless investigation.
“Social media is a goldmine for law enforcement … because people do incredibly stupid things.”
Mike Katz-Lacabe, Center for Human Rights and Privacy.
Katz-Lacabe explained that privacy-conscious social media users can check their settings so that they’re restricting access on Twitter or Instagram to approved followers and limiting their Facebook posts to friends only.
While this doesn’t rule out police snooping, he cautioned, it does add a layer of distance.
Public Actions, Little Privacy
For Blumenthal, identified via her LinkedIn account, which she used to attract customers, that advice is little comfort.
But the alleged arson was committed in the open, in front of clicking camera phones and an online audience, suggesting that the culprit believed she wouldn’t be tracked.
“We have an old adage of misplaced trust,” Snyder told Digital Privacy News: “You tell somebody something that you probably shouldn’t have told them.
“And there’s an awful lot of open, misplaced trust.”
Thursday: Facebook hires a cybersecurity firm to help the FBI track a child predator.
Jeff Benson is a Nevada-based writer.
Sources: (external links)