What MySpace will tell the police about you -- leaked documents

Interested in finding out what information MySpace will turn over to police and intelligence agencies about you? Cryptome, the site that has leaked "spy" manuals about Microsoft, Facebook, and Comcast, has posted what it claims are company documents that describe what MySpace will turn over to the police. It makes clear again that your private Internet life is an open book to those with a court order or subpoena.

Laws require MySpace to turn this information over to the police, in the same way it requires other sites to reveal this information. So what they're doing is not illegal. But reading the documents is a revealing window into how little privacy you have if legal authorities want to delve into your Internet use

The "MySpace.com Law Enforcement Investigators Guide" is dated June 23, 2006, so it may have been superseded by more a more recent document. It's a 16-page document that describes how law enforcement agencies can make requests from MySpace, and details exactly what it available, and how to interpret the information.

In the "Non-Public Information Generally" section, the document describes the broad kind of private information MySpace will turn over to law enforcement agencies, such as IP logs, private messages that people have sent and received, private journals and blogs, private information people have supplied to MySpace during registration, and so on. Here is an excerpt:

In addition to the user information publicly available in user profiles, MySpace also collects and stores certain information that, depending on the information at issue, may be available only to MySpace (IP logs), only to the user and MySpace (private messages), or only to the user, those friends the user has permitted to view the information, and MySpace (blogs or journals marked "private"). Some of the information is provided by the users themselves upon registration or when updating profiles. Other items are collected by the site automatically or involve private communications exchanged between MySpace users. Depending on the type of information sought, ECPA [Electronic Communications Privacy Act] may require the use of a different form of legal process, the period MySpace retains the information may differ, and the user may have the ability to determine whether the information remains available.

Later on, it describes in detail exactly what is available. Here's what it has to say:

a. Basic user identity information

When users create a MySpace profile, they can provide certain identity information to MySpace that is not made publicly available. Similarly, some basic identity information will be private if the user creates a private profile. Much of this information may be produced in response to a grand jury or administrative subpoena pursuant to 18 U.S.C. § 2703(c)(2). Please note that the information provided by the user may not necessarily be accurate. Users do not need to confirm their email address, nor is this information verified by MySpace. This information includes: Date profile created; First and last name provided by user; User ID; E-mail address provided by user; Zip code provided by user; City and Country; Account creation date and time; and the IP address at time of sign-up.

b. IP address logs (recorded at time of log-in)

MySpace's system records the IP address assigned to the user at the time the user accesses his or her profile. MySpace’s IP logs show the IP address, and the date and time of the log-in (PST). MySpace may produce historic IP logs in response to a grand jury or administrative subpoena under 18 U.S.C. § 2703(c)(2). Please note that many IP addresses are provided temporarily by the user’s internet service provider.

MySpace also has the ability to capture log-in IPs prospectively, and can do so upon receipt of a Pen Register/Trap and Trace Order under 18 U.S.C. § 3121.

c. Private user communications (messages in inbox or sent mail)

MySpace permits users to exchange private mail messages with other MySpace members. These communications are sent from and held for users on MySpace servers. ECPA generally restricts disclosure of private user communications less than 180 days old except in response to a search warrant. 18 U.S.C. § 2703(a).

d. Stored user files (photos, videos, blogs, classifieds)

MySpace has a number of features that allow users to upload and store data on MySpace. This data may take the form of private profile information such as photos or videos uploaded to their profile, private journals or blogs, the identities of their friends, classified advertisements, messages posted on the MySpace forums or in MySpace groups, and address book and calendar contents. Many of these items are maintained on publicly available areas of the MySpace site, and most of these items may be deleted or removed by the user who posted them. Under 18 U.S.C. § 2703(b)(2), MySpace may generally disclose private stored files in response to a subpoena or court order where the government provides prior notice to the subscriber (or delays notice under 18 U.S.C. § 2705).

e. Other general records or information

MySpace also collects certain information supplied by users that is not specifically covered as basic subscriber information under 18 U.S.C. § 2703(c)(2). Such information may be disclosed under ECPA pursuant to a court order under 18 U.S.C. § 2703(d). This information includes the user’s date of birth, gender, hometown, and occupation, as well as historical private message header information.

The document then describes how long MySpace retains your records, during which time they're available to law enforcement agencies who request them in the proper way. Here are the highlights:

* IP address logs for each account are kept for up to 90 days.

* Private sent messages are kept for 14 days.

* Private inbox messages are kept until the user deletes them --- after that, they cannot be recovered.

* Private messages in trash mail are kept 30 days or less.

* For deleted accounts, "User identity and date in the user profile is generally available for up to ten days after account deletion. Other stored files, such as photos, may be lost at the time of account deletion."

* Also for deleted accounts, "User ID, IP Address and Login date stamps are retained for up to 90 days after account deletion." No mail, either inbox or sent mail, is available for deleted accounts.

Preston Gralla provides analysis of these leaked documents:

Copyright © 2010 IDG Communications, Inc.

 
Shop Tech Products at Amazon