Facebook's Abortion Warrant
The problems start way before the chats.
I spent much of the past week at DEF CON, and one of the main themes this year for those of us with limited technical ability and no interest in listening to feds talk in vague ways about foreign cybersecurity policy was abortion and medical privacy.
Over three days I heard at least 4-5 references to the Facebook abortion warrant story, something that was all over my feeds before I left. I have a love-hate relationship with this story because it has so much to say about the coming fight, both in the operation of the law, the processes of law enforcement, and how media is likely to cover it. The news is almost uniformly depressing, but at least we’re talking about it! And keeping attention and pressure on the cruelties is at least the first step in fighting it.
Nevertheless, as a criminal lawyer I found the way the story was reported and retold to be somewhat confused and focused on the least upsetting parts of what happened. The tech angle is the sexy part of the story, but it’s a mistake to let it overshadow the other, more basic outrageous stuff that led to the warrant in the first place.
The background
A teenager was pregnant, she did not want to be. Her and her mother had conversations about this situation, and about taking pills that would cause her to no longer be pregnant, over Facebook Messenger. Law enforcement somehow found this out, and asked Facebook to turn over the content of these messages. Facebook did as the court ordered. The outrage is largely focused on the fact that Facebook (Meta, sure) handed over messages to law enforcement when they asked.
This concerns a pre-Dobbs incident, but now that we’re past it we can say that the Roe framework also sucked, and plenty of needed abortions in this country were illegal prior to June 2022.
Meta, somewhat uncharacteristically, directly responded to this outrage. The response was perhaps the dumbest thing I’ve ever read:
Vice got copies of both search warrants related to this case—god bless—and published the full documents in its story. I have read the warrants and I can tell you that as a lawyer/person who has read the news in the last six months, page 2 of the first warrant affidavit starts talking about a girl and a stillborn child and specific dates for when this girl was pregnant. Nobody needs to use the word “abortion” for me to deduce what’s going on here. So either Meta has lawyers who don’t read search warrants before responding or they are incapable of critical thinking, and neither is a very flattering thing to admit about your legal department via harried PR statement.
But the fact that what Meta was responding to was a search warrant—not a subpoena or a request, but an order from a court—is a very important detail a lot of people are skipping over.
Meta probably should have simply stopped at law enforcement sent them a valid search warrant. They complied because that is how the law works. I, a person who has a lot of critiques of the way Big Tech handles data and willy nilly hands it over to law enforcement, largely have that critique because I think that tech companies should not hand over their users’ data to the government without a warrant. I also think the law should require a warrant in a bunch of situations it does not. But there was a warrant in this case! The detective gathered a lot of information (more on that later), went to a DA, and then to a judge, signed a sworn statement about the facts that amounted to probable cause to believe a crime was committed, and a judge signed off on using the legal process to compel Meta to hand over this data. The process of opposing this warrant wouldn’t just be saying no, it would be an expensive legal To Do and, like, I just don’t have the expectation that Facebook is going to engage in what basically amounts to civil disobedience by fighting a random Nebraska warrant in court.
I wish that Meta didn’t keep this data in the first place, because then they wouldn’t have had anything to hand over in response to a search warrant, but as life is today they handed over what they had because the law compelled them to and I’m not overly bothered by that action.
The three ways tech companies hand over information
I think an important distinction to make here, which is muddled in the discussion of this story, is the mechanisms by which tech companies like Meta hand over their users’ data to law enforcement. There are basically three different ways, they’re not the same, and depending on which mechanism is used to obtain information, I would be various levels of Mad about what happened:
Law enforcement portals/”emergency requests”: Law enforcement portals are basically just special websites where cops can ask a company to give them information for no reason other than they want it and they say it’s important. The company is not required to hand over information in response to this kind of request, but they often do because
they are bootlickersthere are corporate incentives to having the government think favorably about you. There usually has to be some sort of “this is an emergency someone is in danger” claim, although the accuracy of anything going on in the law enforcement portal is suspect. I would be Big Mad if Facebook handed over private messages in an abortion case as a result of this kind of request.Subpoenas: Subpoenas are a step up from just having a detective email Meta and say hey give me this private info, thanks. Generally, for a private corporation, a subpoena has to be signed by a lawyer who has implied power from the court because they are working on a case (a DA, a defense attorney, etc.). It could come from a grand jury, too, but that’s for another day. For example, in a criminal case I can ask a phone company for my client’s phone records, and probably the complaining witness’s. I cannot ask for my client’s mother who lives across the country’s phone records just because I’m curious. For a subpoena for a private company, I as the attorney can issue it, I usually don’t have to go to a judge. There are also a lot of weird quirks in subpoena law, though, and companies can make you jump through hoops before they comply. An attorney has no power to make them comply, so if they refuse, the attorney has to go to a court to ask the judge to pretty please get involved to make them comply. From personal experience, Meta is very competent at avoiding complying with subpoenas when they don’t want to, so I would also Medium Mad if they handed over these private messages without putting up any sort of fight. But still! It’s a legal process. I wouldn’t be so surprised if they complied.
Search warrants: Search warrants have the most legal requirements. A detective goes to a DA, says I want this info, the DA and maybe also the detective goes to a judge and swears under oath to all of the investigation that they have done and hopes that these facts amount to what the judge considers “probable cause” to issue the warrant. In practice, judges, especially in state court, often rubber stamp warrants and don’t actually ask many questions when a detective comes to them and says “we want these Facebook messages because there are Crimes Afoot because some confidential informant told me so.” I spend much of my life arguing that judges shouldn’t have issued warrants based on the information presented to them. BUT, from Meta’s perspective, the judge issued it, it’s a legally valid court order. It’s not a request. If the government gets a warrant they can legally search the thing listed in the warrant, even if it’s a home or a private digital account or whatever you might think is very private and off limits (even a safe!), and that’s like hundreds of years old settled law. Was the warrant too broad? Did they search beyond the scope of the warrant? Was the info insufficient to issue the warrant in the first place? These are always good questions to ask. Meta theoretically could have gone to court to challenge the warrant based on these questions, but the reality is that unless you really know the case and know the situation, you’re not going to spend the time and the money and the political capital to do that. I don’t expect Meta to be at the forefront here.
The real problems with this warrant
Okay, so now that I’ve told you about what doesn’t bother me about this story, let’s get to what did: what’s actually in the warrant affidavit (the affidavit is what the DA or police officer swears to with all the facts, the warrant itself often just says what can be searched and what they’re looking for).
The problem I’ve been having for the last few months as a public defender working in digital privacy is that Dobbs has really brought a focus to the importance of digital privacy, and people are obsessed with the ways in which digital footprints imperil physical people in a world in which bodily autonomy is being criminalized. I’m excited that people are paying attention and worried about it, and issues that I care about are coming to the forefront. The problem is that the public defender in me knows that in the overwhelming majority of cases, digital footprints can add to the evidence against a person, but is generally not what is putting people in the criminalized crosshairs. Their neighbor reporting them, their family member reporting them, them answering police questions rather than asking for a lawyer, giving the police permission to search (digital or physical objects) instead of refusing, these are overwhelmingly what is going to form the basis of a prosecution, as it did here.
The reason that the police were able to obtain search warrants in this case is because of two things: first, somebody gave the police this child’s medical records. The search warrant is super vague about how the detective came to obtain very specific medical records about this child’s pregnancy, but he had them and quoted from them. You can’t prove (or even know) someone had an illegal abortion if you can’t prove they were pregnant, so the crux of this case is really the medical records. Who? How? Either a provider or a someone close to this child handed private medical records over to the police. This is, to me, the fundamental horror of this story, rather than the Facebook messages. We should be talking a lot more about medical privacy right now imo, because of attacks on abortion care, because of attacks on gender affirming care, because of the longstanding and ongoing criminalization/family court victimization of poor black and brown women. (We should be talking about mandatory reporting requirements for people who should be trusted providers!!! But that’s another post.)
The second issue is that the detective says he knew to ask Meta for messages because the child showed him some messages on her phone to explain something or the other to him (her and her mother apparently also took the detective to where the fetal remans were buried). So, here, the issue is not that Facebook gave the police private messages but that the people being investigated spoke to the police, likely without a lawyer, and handed over important physical and digital evidence voluntarily. Obviously, when you’re 18 and you’re scared and a cop tells you it’s okay they will help you if you help them, that’s what happens. The police are allowed to be coercive in investigations, and that’s a problem. But I cannot stress enough how, regardless of how hard this is to do in practice, the police here did not have a case if the people involved refused to speak to them. There would be no warrant, no knowledge of private messages, nothing to suggest anything other than a natural end to the pregnancy occurred, no location of fetal remains, nothing. The police are trained to get you to try to talk your way out of getting arrested—more often than not you’re actually giving them the evidence they’re missing to make that arrest. If they have all the evidence they need against you, they’re honestly less likely to ask you about it. It’s your right not to speak to police and you can, should, (will!) ask for a lawyer immediately after finding yourself in a situation in which the police are asking you questions, regardless of whether you think you’re guilty of anything.
Summary of awful things going on here in roughly worst to less bad order
Abortion is not legal on demand without apology
The police decided to investigate a 17-year-old girl in the first place
Someone this girl trusted handed over medical records to the government in service of criminalizing her and her mother
The girl and her mother were not provided appropriate legal counsel before speaking to police
Meta does not have end-to-end encryption on by default and keeps private message data, allowing them to be able to turn over this info to police
Meta complied with what appears to be a basically valid search warrant (from their perspective)
How to protect yourself regardless of what I said above
I will say that there is a lot that happened in this story that nobody reading this newsletter can really control. BUT, that doesn’t mean there is nothing you can do to keep yourself and others safe. You are unlikely to completely shut down everything that anyone could possibly use to track you, but you can take just a few steps to really reduce your exposure should something like this happen to you. I think it’s important to remember that cops and DAs have the same time and resource constraints that anyone else has. Every new subpoena or warrant takes time and effort. It’s pretty easy to make it HARD to gather evidence against you, even if it’s very hard to totally erase any trace of your digital self.
If I was only going to recommend one thing, it would be to call people on the phone, or speak to them in person when talking about something sensitive.
The second, only slightly heavier lift would be to use an end-to-end encrypted chat. It’s really easy! It just requires an app. iMessages is actually not bad if you have an iPhone, but Signal is better. To the extent possible, use it for everything. Don’t do it because you are talking about something that could get you in trouble, do it because if everyone does it by default then it doesn’t matter if you’re aware you’re saying something that could be used as evidence against you or not, your chats are protected. Use the disappearing chat function if possible. Signal the company may not have your chats, but screenshots or even photos of a screen are possible.
All of this said———I think that the outrage over something like this is important and helpful, even if people are not focusing on exactly the details that I would as a lawyer. You can tell by the way that Meta responded that it hit a nerve within the company. Big tech companies should feel the wrath of the majority of people in this country that believe abortion is necessary healthcare, and treating it as anything other than that is unacceptable. So should local DAs and judges. Shaming works! It’s part of a long fight we are going to have in this country, and these sorts of viral outrage campaigns impose a cost on prosecuting, or cooperating with the prosecution of, this kind of nonsense. And that’s worth something, in my opinion.