Police Embrace Social Media As Crime-Fighting Tool

(CNN) -- We leave small clues about our lives all over the Internet like fingerprints.

Take Melvin Colon, who is facing charges of murder, along with weapons and narcotics-related crimes. The suspected New York gang member posted public photos on Facebook that showed him flashing gang signs but made private more incriminating posts, including references to past violent crimes and threats against others.

Unfortunately for Colon, one of his Facebook friends agreed to give police access to Colon's "private" information, and on August 10, a federal judge ruled Colon lost all claims to privacy when he shared those details with friends.

"Colon's legitimate expectation of privacy ended when he disseminated posts to his 'friends' because those 'friends' were free to use the information however they wanted -- including sharing it with the government," the judge wrote.

Leveraging Facebook is just one of many ways law enforcement officials are gleaning evidence from social media to help them solve crimes.

Police look at what information is public and sometimes create fake online identities to befriend suspects and view their private information. Authorities also can request private data directly from social networks with subpoenas or warrants, or make an emergency request for user information if they think there's an imminent threat of danger.

These techniques are slowly catching on across the country. According to a recent survey of 1,221 federal, state and local law enforcement who use social media, four out of five officials used social media to gather intelligence during investigations. Half said they checked social media at least once a week, and the majority said social media helps them solve crimes faster. The online survey was conducted by LexisNexis Risk Solutions and had a 2.8% margin of error.

The survey found that Facebook is the most fruitful social network for law enforcement, followed by YouTube.

Gathering public data

One pioneer in this emerging area is the city of Cincinnati, where police dismantled a local street gang and arrested 71 people in 2008 following a large nine-month investigation that used social media to identify key members. Collaborating with the University of Cincinnati's Institute of Crime Science, the police created databases of information scraped from social networks, existing police records and phone records, then used software to analyze the data and establish links between suspects.

As with most police departments, Cincinnati's social-media efforts began small, with a few officers checking online profiles on their downtime. Then police teamed up with the university and received training from social-media experts.

"A 22-year-old girl, who knew more about Facebook than Mark Zuckerberg did, taught us how to mine Facebook for info," said Capt. Daniel Gerard, who runs the department.

As they soon discovered, criminals were using social networks to blab about the crimes they were plotting, set up drug deals, brag about wrongdoings and even upload incriminating videos.

Criminals who can't resist bragging online are a boon to police and prosecutors across the country. In one 2008 case, Ronnie Tienda Jr. was convicted of a gang-related murder in Texas based largely on incriminating words and photos he had posted publicly on his MySpace pages.

Some "public" information takes a bit of maneuvering to find. Someone can have their Facebook settings as private as possible, but their friends or relatives might not be as savvy, allowing police to collect information by looking at what a suspect posts on their friends' public pages. Drug dealers have been known to post innocuous public updates that include location information so clients -- and unwittingly, law enforcement -- know where to find them, police said.

Police even have been using Facebook as a way to help victims identify suspects.

Going undercover on Facebook

A more controversial approach to getting information from social networks is going undercover online -- creating fake profiles to befriend suspects.

"We do have some covert accounts for targeted enforcements," said Cincinnati's Gerard.

Facebook, where almost 9% of accounts are believed to be fakes or duplicates, frowns on this practice, however.

"It just undermines the integrity of our whole service if we allow people to use false accounts," said Joe Sullivan, Facebook's chief security officer, in an interview with CNN last month. Creating a fake profile is against Facebook's terms of service, even for law enforcement. Sullivan said there is no context in which Facebook allows fake identities, and that it has a "large commitment" to finding and disabling false accounts.

While these fake accounts may violate a social network's rules, they are not illegal. And evidence collected in this way can still hold up in court.

"In other, nondigital circumstances, these types of practices have been upheld," said Hanni Fakhoury, a staff attorney at the Electronic Frontier Foundation, an Internet civil-liberties organization, in an email. "For example, the police oftentimes pose as young girls to capture people for soliciting a minor to engage in sexual activities. Or they pose as a potential drug buyer in order to arrest individuals on drug crimes."

The LexisNexis survey found most law enforcement officials have no qualms about creating fake profiles for investigations, with 83% saying they thought it was ethical.

Using proper channels

Facebook told CNN there is no secret backdoor access to its network for any law enforcement agency, not even federal investigators. Police seeking access to private information on Facebook must go through official channels.

Each social network has established a policy for how it turns over data when requested. Most require a subpoena or a warrant, depending on the type of details being requested and how long it has been hosted on the site.

When police suspected a Minnesota man, Darrin Anderson, of using a fake Facebook page to talk to underage girls in 2006, detectives had to obtain a search warrant for the profile. Facebook turned over 2½ years of data associated with the then 31-year-old's profile, including more than 800 chat conversations, primarily with girls under 18. The Facebook profile was used as evidence in court, and Anderson pleaded guilty to traveling with the intent to engage in illicit sexual conduct and was sentenced last year to 12 years in prison.

Some social-media companies attempt to notify users when their information has been requested, while other companies might fight requests in court.

Twitter has been the most resistant to turn over user information. The company made headlines this year when it refused to turn over a suspected Occupy Wall Street protester's tweets and location information to the Manhattan district attorney when subpoenaed. The legal battle is still ongoing.

"Twitter users own their Tweets. They have a right to fight invalid government requests, and we continue to stand with them in that fight," Twitter's litigation lead, Benjamin Lee, tweeted Monday.

In case of an emergency

If there's an emergency such as a credible threat of violence, authorities can try to gain immediate access to someone's social-network data by filing an emergency request.

While they are not legally required to comply with these requests, many companies, including Facebook and MySpace, have 24-hour hotlines to handle emergency issues. Facebook says its hotline is staffed by a team of paralegals and lawyers who screen every request. Law enforcement officers must fill out a form explaining the emergency and what information is needed.

"It's a really high standard for an emergency situation like that. It can't be a situation where an hour or two doesn't matter," Facebook's Sullivan said.

There are no publicly available statistics on how many emergency requests Facebook complies with or turns down.

In early August, an anonymous Twitter user posted a string of tweets threatening to open fire at a New York theater hosting former boxer Mike Tyson's one-man Broadway show. "I got 600 people on my hit list and that's gonna be a mass murder for real," read one tweet.

Detectives submitted an official emergency request to Twitter to identify the user. But Twitter rejected the request, saying it did not fall under its parameters for "when it appears that a threat is present, specific and immediate."

The police then got a subpoena from the district attorney's office, forcing Twitter to comply with the request and turn over the information.

Debating the Fourth Amendment

In the case of Colon, the alleged gang member, his attorneys claimed his Facebook posts were protected under the Fourth Amendment, which shields people's homes and effects against unreasonable searches and seizures. But a federal judge disagreed, saying Colon forfeited any expectation of privacy when he shared online postings with friends.

In other words, the online world is just like the offline world in many respects: Your friends can inform on you to police, and detectives can go undercover to catch you in the act.

Users don't have Fourth Amendment protection rights when they store information with a third party, such as a website, legal experts said. But Fakhoury and civil-liberties groups such as the Electronic Frontier Foundation want to challenge the idea that people have no right to privacy for information stored online, especially when it comes to location data. (Even when a post or photo doesn't include public location information, the social network can track its location by seeing the IP address from which it was shared.)

The Electronic Frontier Foundation also would like to see more social networks stand up for their users when law enforcement requests information. The foundation is trying to educate the public about how information can be viewed and obtained.

"People post without realizing the consequences, and any change to preserve privacy has to start with greater awareness by users," Fakhoury said.

Catching up with modern technology

Despite the widespread adoption of social media, the courts and police are still playing a game of technological catch-up. Only 10% of the law enforcement officials surveyed by LexisNexis said they had received formal training on how to use social media for investigations.

A typical example of social-media evidence in court has been a black-and-white photocopy of a printout of a screenshot taken of a profile page. Private companies such as X1 Discovery help law enforcement and prosecuters capture metadata and follow a chain of custody so their cases have a better chance of holding up in court.

For police, however, keeping up with new technology will continue to be a challenge. According to Gerard, crime is still down in the Cincinnati neighborhood where his department dismantled a street gang four years ago, but police are seeing more gangs use social media and the Internet to expand their reach beyond traditional areas.

"They're reaching out across the city and working in conjunction with other gangs. They working together much better than before," Gerard said. "We have to learn from their example."