- Government agencies can gain access to online behavior through warrants, subpoena, court order.
- Even a deleted Facebook account remains in backup logs for up to 90 days.
- Most search engines use cookies to keep user data for 180 days.
A quick Google search for a lunch spot? There’s a record of that.
Arranging a vacation? Someone knows where you’re planning to go. And do you check in with Facebook? The social network tracks all the sites you visit that have “like” buttons or allow you to sign in with Facebook – pretty much all of them.
If Internet giants can record so much about you, who can look at this electronic diary?
The government can access any emails, chats, searches, events, locations, videos, photos, log-ins and any information people post online with a warrant, which the United States Foreign Intelligence Surveillance Court can grant secretly.
The revelation of Prism, a secret government program for mining major Internet companies, suggests the government could have direct access to Internet companies’ servers without a warrant.
Every company whose data was mined — Google, YouTube, Yahoo, Facebook, Apple, Microsoft, Skype, PalTalk and AOL — denied knowing about the program or providing direct access to their servers.
Each social media company has different standards and levels of access to private information that it will provide to the government.
Facebook, for example, only requires a subpoena for basic subscriber records, such as credit card information, name, length of service, email addresses and recent IP addresses of log-ins and log-outs. A subpoena usually only requires the signature of a court clerk, not one of a judge or magistrate.
Facebook requires a warrant for messages, photos, videos, wall posts and location information. Much harder to secure, the government must get the signature of a judge or magistrate for a search warrant. And it has to provide details on the information it seeks and the places to be searched, as well as facts that demonstrate a logical reason to believe that evidence in crimes would be found in those places.
Facebook also tracks other websites you visit that have Facebook features, such as the ability to sign in with Facebook or the “like” button. They can tell when you’re on the site, the site URL and your user ID.
Deactivation of Facebook accounts does not remove any of the information they have stored on you. If you delete a Facebook account, which takes a month to do, some information remains in backup logs for up to 90 days.
Twitter, which was not involved in any Prism reports, requires a warrant for private communications such as direct messages. The company will disclose other private information about its users through subpoenas and court orders, though it will notify users before doing so unless law or court order prohibits it.
Google automatically stores certain information such as search terms, websites visited as a result of searches, IP addresses, private videos and location information, which can all be accessed if the government has obtained a warrant. Even if users have no account with Google, it can store their searches based on IP addresses.
If users have logged in and given them permission, search engines can keep users’ search information indefinitely, though users can clear that history in their settings. Most will keep information on users’ searches for 180 days through cookies, which can be deleted, then will anonymize search information after 18 months.
All of those companies specifically state in their privacy policies that they will not respond to overly broad or vague government requests for information.