Founded in 2015, Howard Human & Civil Rights Law Review (HCR) is a student-managed, faculty-supervised law review published by the Howard University School of Law.  HCR focuses on issues related to human rights, civil rights, and international law.

See More on the Howard University School of Law Website here



Your Password is Null and Void: Law Enforcement’s Bold Intrusion Of User Intellectual Property Rights Via Social Media. How Your Facebook Post, Pictures, And Check-Ins Are Being Monitored And May Be Used Against You

December 30, 2016




        Over the last few months, various police departments across the country have been outed for secretively documenting and tracking social media user activity during civil rights demonstrations, such as, Ferguson, Baltimore, and most recently Standing Rock, North Dakota.[1] With the ability to zero in and monitor a topic or hashtag such as “Black Lives Matter” law enforcement, unsuspectingly to many users, can access and track any user’s post, status, or check-ins for what they deem to be “suspicious or threatening behavior,” and at their discretion - without probable cause - investigate, seize, and arrest individuals based upon their online activity.


       For some, news of drastic actions taken upon by law enforcement is alarming to say the least. Such actions convincingly present a case of unreasonable intrusion of one’s personal effects and privacy in direct contention with one’s 4th amendment rights, and implicate targeted viewpoint based speech and association to others seemingly in direct contention with one’s 1st amendment rights. Notwithstanding so, it appears likely that no cause of action nor reprimand of law enforcement’s actions by city officials, the Department of Justice, or the President himself - all of whom have recently weighed in on delicate issues between police and communities - is in sight. Why not??? Well because such ‘snooping’ undertaken by law enforcement, however bold and intrusive it appears to be, is permissibly legal. And it is you, according to the Court, who authorizes law enforcement to peak into every post, photo, status, check-in, and even your private messages, by your own actions in voluntarily posting such material into cyberspace.


        This article discusses the uncomfortable reality of surveillance and investigatory practices, currently practiced by law enforcement throughout the nation utilizing social media. The Fourth Amendment protects one’s reasonable expectation of privacy in their communications[2]; however, the Supreme Court has yet to weigh in on the Fourth Amendment’s relationship within the context of communications made via social media.[3] As a result, courts have grappled with applying traditional non-cyberspace rulings and interpretations of a “reasonable expectations of privacy” in physical settings such as surveillance of one’s home[4] and communications made via telephone[5], to that of cyberspace communications. This article argues that there is a reasonable expectation of privacy in Facebook postings and therefore any information sought by law enforcement must be require a warrant and corresponding probable cause. Part I introduces and describes Facebook, including its different features, uses, privacy policies, privacy settings, and intellectual property rights one possesses in their pictures and media postings on Facebook. Part II discusses Fourth Amendment case law detailing the reasonable expectation of privacy standard[6] and where Courts may look to determine whether Fourth Amendment violations are present when law enforcement search Facebook profiles. Part III applies current Fourth Amendment case law decisions and argues how a court should analyze police searches of Facebook profiles. Part IV concludes.




        Social networking websites have become a preferred method of communication among many individuals in recent years.[7] Millions of Americans use social networking websites and the most popular site, Facebook, has a membership of over one billion users worldwide,[8] of which over 50% percent visit the website daily.[9] Facebook allows users to share photos, status updates, their location, and other media with their “friends.” The medium of sharing such information with friends is an online profile that users create upon registering. This profile allows users to post various forms of information, such as their contact, school, or professional information, as well as their personal relationship status. Users may send private messages to other users, and significantly, information shared on a profile is viewable only to friends, or else to the general public at the discretion of a user’s personal settings.


A.  Facebook’s Privacy Policies


       Before users may register for Facebook, they must agree to the website's mandatory terms of service and privacy policies in order to form a profile and begin use. These terms include: how and when Facebook may collect information from a user's profile and computer, how Facebook may track a user's usage, how Facebook may use the information collected from a user's profile, and how Facebook can disclose information to a third party.[10]


Facebook's Statement of Rights and Responsibilities acts as the user's guidelines to privacy protections, and it states in part:


You own all of the content and information you post on Facebook, and you can control how it is shared (emphasis added) through your privacy and application settings . . . In addition: 1. For content that is covered by intellectual property rights, like photos and videos (IP content), you specifically give us the following permission, subject to your privacy and application settings (emphasis added): you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it.[11]


        The policy explains that information may become public only in limited circumstances  when sharing such information is legally required, permitted by the user, or “reasonably necessary to offer service.”[12] While the preceding information may appear simplistic, they require some emphasis before proceeding further. Plainly, in order to use Facebook, users are required to sign an agreement that allows Facebook to use some of their information when necessary, beyond their control. Notwithstanding so however, it is the users themselves whom have the right to control how their information is shared with other users by use of privacy settings provided by Facebook.


B. Privacy Settings: Default vs. Limited Profile


        Facebook’s privacy settings proscribe how users can view other user profiles, and places users on notice that under default settings anyone with a Facebook account is permitted to view  another’s profile.[13] Thus, under default settings, any person with a profile, including a law enforcement official would be able to view a respective profile, and all information posted thereto.[14] As an alternative, Facebook allows users to create a limited profile. A limited profile allows users to restrict content viewable to other users.[15] When users take the step of creating a limited profile, they ensure that only people they accept as friends are allowed to view their profile, whereas those who are not friends are only be able to see the existence of their profile rather than its contents.  Under limited profiles, users are furthermore allowed to restrict content and access to varying degrees within their friends. An action that distinguishes viewable content for example their classmates may see, versus that of their mother or co-workers.


       Since users with default profiles allow their profiles to be seen by the general public, the argument that any information obtained by law enforcement thereto is proper under the plain view doctrine, is plausible. Contrarily, however, users with limited profiles take the active step to keep the information they post private from the general public and indeed rely on such settings to protect their postings. Section III of this article will discuss why courts should recognize as reasonable this expectation of privacy in their postings.




The Fourth Amendment reads:


The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.[16]


        The leading case governing Fourth Amendment searches remains Katz v. United States.[17] In Katz, the defendant used a public pay phone to place illegal gambling wagers.[18] The FBI had attached an electronic device to the phone booth to listen to Katz’s call, and the officers used the information that they gathered while listening to the call to justify Katz's arrest and conviction.[19] Katz appealed his conviction, claiming that the use of the electronic device constituted a search in violation of the Fourth Amendment.[20] The Supreme Court agreed with Katz, stating that the wiretapping constituted a search because it violated Katz’s reasonable expectation that his conversation would not be broadcast to the world regardless of the lawfulness of Katz's actions.[21] Justice Harlan argued in his concurrence that Fourth Amendment violations must be decided under a reasonable expectation of privacy standard.[22] “There is a twofold requirement, first, that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as ‘reasonable.”’[23] If both requirements are met, police must acquire a warrant, with its corresponding probable cause requirement, to then search in order to not be in violation of the Fourth Amendment.


        While the Katz Court set forth a ‘reasonableness’ test, the majority also deduced that a person has no reasonable expectation of privacy when information is knowingly disclosed to the public or a third party.[24] For example, a man who knowingly avails information to the public via a flyer, has no reasonable expectation of privacy and can expect the government to acquire the flyer and its contents if they are present. However, as in Katz, a man in a public phone booth who has taken the care to shut the door behind him and shield others of his conversation is entitled to the assumption that his conversation remains private.


        The reality of publicly shared information and law enforcement’s means in acquiring it has long been ruled by the third-party doctrine, which generally provides that information released to a third party loses its Fourth Amendment protection, and can be obtained by law enforcement without a search warrant.[25] While warrantless searches are unconstitutional, Fourth Amendment cases have carved out exceptions to the rule;[26] and the release of information to a third party is one such exception.


        Proponents of law enforcement’s actions of monitoring social media profiles would argue that users, by uploading information to Facebook are inherently releasing information to a third party. They would likely rely on the third party doctrine seminal case of United States v. Miller.[27] In Miller, the government investigated Miller for his possible involvement in an illegal whiskey distillery and subpoenaed his bank records, including checks, deposit slips and account statements kept in the bank's ordinary course of business.[28] Miller argued that he had a reasonable expectation; that his bank documents were being kept and maintained for a specific purpose, and should thus be protected as if they were copies of his personal records, made available to the bank for this limited purpose.[29] The court rejected this argument. The court distinguished documents kept in the bank's normal course of business for essential use from “private papers” that would merit protection under the trespass theory of protection.[30] Thus, as the defendant neither owned nor possessed the bank’s business records, no reasonable expectation of privacy existed.[31]


       Likewise, in the case of Smith v. Maryland,[32] the Supreme Court held that a defendant has no subjective expectation of privacy in a search conducted by a pen register.[33] A pen register is a device installed by the telephone company which can track the phone numbers of all calls outgoing from a person's house.[34] The Court refused to recognize an expectation of privacy, stating “all telephone users realize they must ‘convey’ phone numbers to the telephone company” because  they see a list of their long distance calls on their monthly bills.[35] Furthermore, the Court stated  the phone company must use phone numbers to keep billing records for their own legitimate business purposes.[36] Thus the Court held “even if petitioner did harbor some subjective expectation that the phone numbers he dialed would remain private, this expectation is not ‘one that society is prepared to recognize as reasonable.”’[37] The Court, however, distinguished this holding from reasonable expectation granted in Katz by stating that pen registers do not “acquire the contents of communications.”[38]




       While the contours of cyberspace give rise to difficulties in applying the traditional Katz doctrine, commentators have put forth efforts to describe potential analogies between traditional non-cyberspace Katz like rulings to cyberspace communications in question.[39] In one instance, a commentator compared an e-mail to a parcel of sealed first-class mail.[40]


       Though the Supreme Court has yet to weigh in cyber communications the Court of Appeals for the Armed Forces, in the case of United States v. Maxwell did.[41] In Maxwell, the court determined that there should be a limited expectation of privacy in some e-mails.[42] In Maxwell, a concerned citizen contacted law enforcement officials about obscene e-mails he was receiving from another individual.[43] The citizen turned over the e-mails to agents, and the agents later contacted America Online (AOL), an internet service provider, for other files related to the individual who sent the e-mails to the concerned citizen.[44] The police then conducted a search of the AOL records instead of a search of the private home or computer.[45] The court held, in this instance, that there was a reasonable expectation of privacy in the AOL e-mails.[46]


       In Maxwell, the court used analogies to traditional Fourth Amendment doctrine, and compared e-mails to first-class mail[47] and telephone calls.[48] Significantly, the court also reasoned that “the fact that an unauthorized ‘hacker’ might intercept an e-mail message does not diminish the legitimate expectation of privacy in any way.”[49] The court was hesitant to allow an expectation of privacy to be diminished or destroyed merely because it was sent through AOL because this service was needed to send the message.[50] Furthermore, the court used AOL's privacy policy as evidence to backup its reasoning because AOL's stated policy was to only disclose subscribers' e-mail if given a court order.[51] While the court compared messages sent on AOL to the open internet, which the court said had a less secure system and a third party medium, they recognized users expectation of privacy in AOL emails, even though “implicit promises or contractual guarantees of privacy by commercial entities do not guarantee a constitutional expectation of privacy.”[52]


        In the context of Facebook, the equivalence of AOL and Facebook as entities by which users send and retrieve messages is noticeably analogous. What’s more, Facebook messages and status messages are plausibly no different from emails that are sent to intended users, and thus a reasonable expectation to privacy as interpreted in Maxwell is justified. Some may argue that the large number of recipients who may view a message or wall post destroy one’s reasonable expectation to privacy. However, such reasoning is faulty. The number of recipients of a communication does not destroy a reasonable expectation of privacy and one need not look further than daily emails disseminated in mass to purposely designated recipients, e.g. in any given corporation, school, organization, or work office. In all of the aforementioned, information intended solely for particular recipients is disseminated with the expectation that only those recipients will receive such information. It is significantly worth noting that even if such information is then hacked or inadvertently shared, one’s reasonable expectation in privacy in sending such communications may not be negated.


        The privacy policies and promises conferred upon AOL users in Maxwell are also practically identical to those Facebook offers to its own users. Courts should thus find that it is not unreasonable for users to assume that once communications are disclosed via Facebook’s electronic server, that they are protected under a reasonable expectation to privacy, and furthermore that users rely on such an expectation of privacy before posting, sending or retrieving messages. This expectation is further evident in a user’s reliance on a limited profile Facebook provides to users to protect such communications for designated recipients only.


        Thus, as courts more frequently take up fourth amendment violation claims in the realm of cyberspace, courts should hesitate in applying third party doctrine disclosure to Facebook communications to the likes of a bank in Miller, or telephone company in Smith significantly because the intended use by the third party is inherently different. In Miller and Smith, the Courts found that both the bank and telephone company had a legitimate business purpose in using the records disclosed to them. Facebook however serves no legitimate business purpose, nor does Facebook purport to operate in the business of obtaining communications for themselves. Users do not sign up for Facebook to disclose information to administrators for their own use, no differently do they mail letters via the post office with the intention to disclose information to postal employees. Rather, they sign up to disclose information to their friends, in a special endearing way. Rather than a third party, Facebook is thus no more than important medium of communication for users. A medium that appreciatively requires a password for users to access their own profiles and one users expect daily will not be overridden by others through hacking, and certainly not from tracking tactics by law enforcement. Tracking that recently absurdly and indeed sadly, commences upon one’s freedom of speech and association to important civil right causes such as police accountability and the protection of historic indigenous lands from environmental disaster. Yes, #BlackLivesMatter and yes, America is supporting #StandingRock, the use of tax dollars to track activity surrounding such events would be better served elsewhere.




        Facebook allows users to secure their accounts with privacy settings provided by the social networking website. Therefore, Facebook users maintain an expectation of privacy in their conversations, emails, or other types of information posted online. A user expects privacy from any unauthorized user or unauthorized law enforcement agent from viewing their profile and because privacy protection exists, users reasonably rely on such protection to restrict access as they deem necessary. As a result of this reasonable expectation to privacy, probable cause, a subpoena request, and a search warrant should then be necessary in order for law enforcement to access or track a respective user’s limited profile. Any decision by law enforcement to supersede this expectation or Facebook’s own terms of service for that matter, individually or by way of a third party, rather than a formal court order, is a violation of one’s expectation of privacy under the Fourth Amendment.



Rolland Hampton is a 2L at Howard Law. He is originally from Chicago, IL, and graduated from Tuskegee University with a degree in Psychology. He is passionate about civil rights and intellectual property rights.

[1] See, e.g., Jessica Guynn, ACLU: Police Used Twitter, Facebook to Track Protests, USA TODAY (Oct. 11, 2016, 12:44 PM), http://www.usatoday.com/story/tech/news/2016/10/11/aclu-police-used-twitter-facebook-data-track-protesters-baltimore-ferguson/91897034/; Craig Timberg & Elizabeth Dawson, Facebook, Twitter and Instagram sent feeds that helped police track minorities in Ferguson and Baltimore, report says, WashingtonWash. Post ( Oct. 11, 2016), https://www.washingtonpost.com/news/the-switch/wp/2016/10/11/facebook-twitter-and-instagram-sent-feeds-that-helped-police-track-minorities-in-ferguson-and-baltimore-aclu-says/?utm_term=.7fbfec0d9a43; David Kravets, ACLU Exposes Facebook, Twitter, for Selling Surveillance Company User Data, ARS TECHNICA (Oct. 11, 2016), http://arstechnica.com/tech-policy/2016/10/aclu-exposes-facebook-twitter-for-selling-surveillance-company-user-data/.


[2] U.S. CONST. amend. IV.


[3] United v. Maxwell, 45 M.J. 406 (C.A.A.F. 1996)).


[4] See United States v. Vargas (W.D. Wash. 2014) (In Vargas, Local law enforcement officers used a long range pole camera to monitor the defendant’s activity in his front yard, in a rural eastern Washington home. The defendant, Lionel Michel Vargas, was a suspected drug dealer, and was believed to be in the country illegally. While under surveillance, officers observed and video recorded Mr. Vargas discharging firearms, which he was unable to lawfully possess. Using the video evidence from the covert surveillance system, law enforcement obtained a search warrant and found four weapons and five grams of methamphetamine. All of which were eventually tossed out by Judge Shea’s ruling. The court held, “…the Constitution permits law enforcement officers to remotely and continuously view and record an individual’s front yard (and the activities and people thereon) through the use of a hidden video camera concealed off of the individuals property but only upon obtaining a search warrant from a judge based on a showing of probable cause to believe criminal activity was occurring.).


[5] See Katz v. United States, 389 U.S. 347, 360 (1967)).


[6] Id.


[7] See Edward M. Marisco, Jr., Social Networking Websites: Are Myspace and Facebook the Fingerprints of the Twenty-First Century?, 19 WIDNER L.J. 967 (2010).


[8] See One Billion Fact Sheet, FACEBOOK, http:// newsroom.fb.com/imagelibrary/downloadmedia.ashx? MediaDetailsID=4227&SizeId=-1 (last visited Dec. 4, 2016)).


[9] See Statistics, FACEBOOK, http://www.facebook.com/press/info.php?statistics (last visited Dec. 10, 2016).


[10] See Privacy, FACEBOOK, www.facebook.com/privacy.php, last visited Dec. 10, 2016).


[11]  Statement of Rights and Responsibilities, FACEBOOK, http:// www.facebook.com/legal/terms (last visited Dec. 7, 2016); see, e.g., Junichi P. Semitsu, 31 PACE L. REV. 291, 2011, From Facebook To Mugshot: How The Dearth Of Social Networking Privacy Rights Revolutionized Online Government Surveillance, 31 PACE L. 291 (2011).


[12] Statement of Rights and Responsibilities, supra note 13.


[13] See FACEBOOK, http://www.facebook.com/privacy.php (last visited Dec. 10, 2016).


[14] Id.


[15] Id.


[16] U.S. CONST. amend. IV.


[17] See Katz, 389 U.S. at 360.


[18] Id. at 359.


[19] Id. at 360.


[20] Id. at 348.


[21] Id.


[22] See id.


[23] Id. at 361.


[24]  Id. at 351; see also id. at 361 (“objects, activities, or statements that he exposes to the ‘plain view’ of considered are not ‘protected’ because no intention to keep them to himself has been exhibited.”).


[25] See Orin Kerr, The Case for the Third-Party Doctrine, 107 MICH. L. REV. 561, 573-75 (2009).


[26] See Arizona v. Gant, 556 U.S. 332, 332 (2006) (“Warrantless searches ‘are per se unreasonable,’ ‘subject only to a few specifically established and well-delineated exceptions.”’) (quoting Katz v. United States, 389 U.S. 347, 356 (1967)).


[27] 425 U.S. 435, 444 (1976).


[28] Id. at 437-38.


[29] Id. at 442.


[30] Id. at 440.


[31] Id.


[32] See Smith v. Maryland, 442 U.S. 735, 736 (1979).


[33] Id. at 742.


[34] Id. at 736.


[35] Id. at 742.


[36] Id.


[37] Id. at 743 (citing Katz v. United States, 389 U.S. at 361).


[38] Id. at 741.


[39] See Note, Keeping Secrets in Cyberspace: Establishing Fourth Amendment Protection for Internet Communication, 110 HARV. L. REV. 1591, 1597 (1997).


[40] Id.


[41] 45 M.J. 406 (C.A.A.F. 1996).


[42] Id.at 419.


[43] Id. at 412.


[44] Id.


[45] Id. at 413.


[46] Id. at 419.


[47] Here, The court drew “parallels” to other mediums, stating that “the sender [of first-class mail] can reasonably expect the contents to remain private and free from the eyes of the police absent a search warrant founded upon probable cause.” Id. at 417.


[48] “Similarly, the maker of a telephone call has a reasonable expectation that police officials will not intercept and listen to the conversation” Id. at 418.


[49] Id.


[50] Id.


[51] Id. at 417.


[52] Id.


Please reload