Facebook's law enforcement 'guidebook' leaked

Facebook has long been both accused and condemned for it's "intelligence capabilities", as it houses more than 800 million users inside and outside the United States.

But leaked documents show how law enforcement and government agencies alike can access Facebook account data, including sensitive and personal data belonging to its 800 million user base.

The series of documents were uploaded to the web, outlining how Facebook deals with law enforcement requests: the so-called "guidebook".

Though Wikileaks' founder Julian Assange once called Facebook "open to U.S. intelligence", from browsing through the documents it appears that the world's largest social network is somewhat cagey in how it responds.

A lot of the guidance in these leaked documents shows process and necessary authority in order to proceed with handing over data. Though Facebook could be seen as a 'goldmine' of intelligence, and certainly with nearly 1 in 7 of the world's population on the site, the social network does appear to have due process.

How it hands over data, and under what pressure, however, is unclear. A court order is a court order after all, and Facebook could spend millions in defying and challenging these in the courts should it wish. Twitter has already proven that it does to a greater or lesser extent, but Facebook is lacking transparency in this area.

It is thought that since 2008, federal judges have authorised at least 24 search warrants pertaining to individuals' Facebook accounts, including private messages, status updates and even rejected friend requests. Even such information as "Neoprint" and "Photoprint" data, terms that Facebook use to describe photo information of uploaded content data that even its users do not have access to, can be accessed by law enforcement officials.

Though many of the documents date back to May 2010, it is thought that these documents are out of date and set to be updated, according to one report.

Some of the differences per date are shown through a 2006 document that notes Facebook will not provide any user data without a "valid subpoena or warrant", whereas in 2010 it states that the social network requires a "valid subpoena or a legal document with equivalent authority issued through your local court system". This could include civil cases, along with criminal investigations, it is believed.

There are three kinds of requests law enforcement can make:

• Preservation requests: which requests that data is preserved for legal reasons for 90 days, pending the service of formal legal process.
• Formal legal requests: where a formal compulsory legal request is issued by law enforcement or government to provide records by law; though response times may vary depending on the warrant issued.
• Emergency requests: where someone is at risk of harm or death, a specific emergency form must be submitted for Facebook to provide urgent assistance.

From these documents, not only will Facebook log a users IP address, the social networking giant will hold them for more than 30 days, as per law enforcement request.

As you can see, though IP logs are "limited" and often "incomplete", this data is still available to determine when posts or content was uploaded:

Some of the data that can be accessed is increasingly personal, such as the "Neoprint" of the users' profile, including: profile contact information, mini-feed data, status update history, shared content, notes, Wall postings, friend listings (including their Facebook ID's), group listings (as well as their Group ID's), future and past events and video listings.

Some content can be held for over 180 days, and Facebook is willing to hand over this data should a subpoena be presented. Though court orders will only display so much, a search warrant will grant law enforcement and government access to "remaining content" outside the "Basic Subscriber Information" access rights.

Interestingly, Facebook's policy on data retention appears to have changed since the 2006 documents, where the social network could not provide any data that was "already deleted by the user", which appears to contradict the findings by an Austrian user, who then later filed a list complaints to the Irish Data Commissioner after he requested his data.

Facebook also states that it works "internationally", and recognises international law enforcement, including the UK and European-based police units Europol and Interpol.

One of the most interesting parts of the documents shows that Facebook "reserves the right" to charge reasonable fees where necessary. Not only do freedom of information requests often require a certain fee, Facebook can charge fees to law enforcement and government outside its jurisdiction areas, such as where it does not have a direct presence.

Though Facebook could be criticised for being an open-book to law enforcement and governments, it does have a seemingly sensitive side. If users are at risk of "potential bodily harm" or subject to "death of a person", an emergency disclosure can be summoned in a bid to prevent harm to a person.

Microsoft has also had its law enforcement documents leaked before, which explained in detail how police and governments can access data pertaining to Windows Live and email records, should a user be breaking the law, or be in harm's way.

Related:

• Facebook not-so-secretly records your stalking habits
• Facebook applications leak users' personal data to third parties
• Wikileaks Assange: 'Facebook open to US intelligence'
• US subpoenas Wikileaks tweets, and why this could affect you
• CNET: Facebook Ireland accused of creating 'shadow profiles' on users, nonusers
• CBS News: Austrian student takes on Facebook over privacy