Facebook is notoriously tight-lipped about its internal processes. But a recent murder investigation inadvertently reveals the kind of user information Facebook provides when subpoenaed by law enforcement.
In this case, Facebook turned over information about Philip Markoff, the alleged “Craigslist Killer,” who was arrested for murder but killed himself before going to trial. It illustrates in vivid detail just how much of your personal online life can become public with the power of a subpoena—even when you go through pains to hide it. This case involves Facebook, but virtually every online company will turn over information when it is properly subpoenaed.
According to a thorough account of the investigation published in the alt-weekly Boston Phoenix, Boston police were investigating a murdered woman who offered “erotic services” on Craigslist when they discovered a Hotmail account created solely to message her.
A Suffolk County (Massachusetts) district attorney subpoenaed Microsoft for the Internet Protocol address associated with that email, then Comcast for the name and home address of the person associated with that IP address—Markoff.
Once they had his name and IP address, the BPD found Markoff’s Facebook account, and the District Attorney issued another subpoena: this time to Facebook, for additional information on Markoff.
The subpoena asks for practically everything associated with a Facebook account: his email address(s), IP logs, private messages, all photos where he’s tagged, groups he’s registered, list of his friends, and other users’ comments under all of these.
In response, Facebook provided all that information—and a little more. The subpoena reveals that Facebook keeps a clear record of users’ every login. According to company policy, Facebook can keep users’ information for 180 days after they delete it. The subpoena indicates they keep information precisely that long.
There were two categories of information Markoff had deleted that Facebook provided to police.
The first is messages Markoff deleted from his wall. Both are seemingly innocuous: one says “happy Birthday!!” and the other “can you support my march of dimes. I am going to be a stork (baby delivery!!) so please support our premature babies!”
The second is the names of two people Markoff unfriended, marked “Friends deleted by this user.”
Perhaps most surprising is that Facebook keeps a record of times a user logs in. There’s a list of 225 times Markoff accessed pages from his account, including the times, dates, pages and IP addresses.
Photo by ivoryelephantphotography
