Are companies such as Facebook and Vodafone ushering in a new era of transparency on surveillance? Increased reporting by these organisations on information requests from governments around the world gives hope this is the case.
By Alicia Wanless
Facebook recently released data on the number of government requests it recieves for user information. The social media giant has been beleagured by accusations that Facebook acts as a back door facilitating government surveillance in the wake of Edward Snowden NSA leaks. In what appears to be a public response to privacy concerns, Facebook is making government information request statistics publicly available in a bid to “bring transparency” to how the social network deals with such requests around the world.
The reports reference requests from 111 countries from January 2013 to the end of June 2015 and are available in 6 month increments. According to the reports, Facebook received 41,214 requests for User Data in the first half of 2015, up 18% from the previous reporting period. These requests referenced 57,551 User Accounts and on average 42% received some information from Facebook. Alas, beyond these statistics, Facebook does not provide further details on the nature of the requests and what sort of information was provided. Likewise, some countries do not have data for the complete reporting period.
Taking a deeper dive into the data, however, we analysed the 55 countries which had data reported from January 2013 through to June 2015. What follows are highlights from this analysis.
Total Requests for all Countries from 2013 – 2015
Number of Requests
Given the Snowden leaks, it is perhaps unsurprising that the country making the most requests of Facebook is the United States. Since January 2013, government officials in the U.S. have made a total of 71,382 requests for Facebook User Data, referencing 111,192 User Accounts, increasing 42% from the first reporting period to the last.
India made the second most numerous requests over the total reporting period with 21,990 referencing 28,362 User Accounts.
The U.K. moved into the third spot in terms of number of requests for Facebook User Data in 2015, increasing from January 2013 at a rate of 52.5%. The number of requests from the U.K. for the total reporting period was 11,741, referencing 14,612 User Accounts.
Number of User Accounts Referenced in Requests to Facebookfrom 2013-2015
Requests VS Facebook Users
The number of requests and references to User Accounts means little on its own. Considering these statistics in the context of Facebook users provides some perspective.
Estimated Facebook Users by Country
For example, of those countries analysed, the United States also has by far the most Facebook users with 100,000,000, (1) nearly twice the number of Brazil, which has the second highest number of estimated accounts. In comparing the total number of User Accounts referenced in these requests against the estimated number of Facebook users in the United States, the rate amounts to only 0.10% of all users.
This rate is suprisingly low when considering the allegations made about the social network offering a back door for surveillance – and indeed, does not take into account that a User Account might have been referenced more than once across reporting periods as such details are lacking from Facebook reporting.
In India, with the second highest number of requests for information, the total number of User Accounts referenced amounts to just 0.06% of all estimated Indian Facebook users. Likewise, in the United Kingdom, that rate is but 0.08%.
In France and Germany, which both had fewer overall requests than either India or the United Kindgom, this percentage is slightly higher: 0.11% and 0.13%, respectively.
Percentage of User Accounts References vs Total Facebook Users
The highest percentage of User Accounts referenced in requests to Facebook in relation to estimated Facebook users was in the tiny country of Malta at 0.39%. Since 2013 a total of 500 requests for Facebook User Data where made by Malta, referencing 623 User Accounts. It might seem a paltry sum in comparison to American requests, but taken in the context that Malta has an estimated 160,000 Facebook users, it means that a greater percentage of Maltese are affected by these requests than are Americans – assuming that the nature of these requests only impacts a country’s own citizens.
Lawful Intercept vs. Facebook Requests
Facebook is not the first company to respond to allegations of supporting surveillance by publishing government request data. In 2014, Vodafone launched its Law Enforcement Disclosure Report, which made data around lawful interception publicly accessible. In this report, Malta again emerged as a leader in requesting access to user information.
According to Vodafone’s disclosure, the company supported a total of 3773 requests from Maltese law enforcement agencies for access to communications data in 2013. Unfortunately, at the time of Vodafone’s reporting, Malta did not publicly share statistics related to lawful interception. Given Vodafone’s market share in Malta during that period (47.49%), however, it can be estimated that the total number of requests for information to communications service providers could have been as high as 5773 in 2013. Such lawful intercept requests were significantly higher than those requests made by Maltese officials to Facebook during the same period.
Maltese Requests for Information – 2013
While reporting on lawful interception varies from country to country – and in some places is non-existent – several other states displayed a similar pattern to Malta in the variance between communication intercepts and requests to Facebook for data.
Publicly available statistics on German lawful access in 2012 indicate that the practice of interception is practiced more than approaching social networks such as Facebook for information. While 5,678 orders were issued to execute surveillance in Germany, 19,616 intercepts were initiated, and 3,445 past intercepts were extended. The closest available reporting period on requests for information from Facebook is 2013 with 3,573 referencing 4018 User Accounts.
While France does not publish statistics on surveillance, it has been estimated that in 2012 35,000 intercepts were executed there. During the closest available Facebook reporting period, 3,208 requests for Facebook User Data were made in 2013, referencing 3,443 User Accounts.
Perhaps most surprising are the stats on Russian requests. Facebook notes that Russian officials made a total of just 5 requests since 2013 to June 2015 – none of which were successful. While VKontakte and Odnoklassniki are the social media networks of choice in Russia, Facebook still has an estimated user base there of 2 million. From a country that is widely accused of excessive surveillance, this seems like a very low rate of requests. Indeed, some estimates have put rates of lawful intercepts in Russia as high as 540,000 in 2012.
Conversely, the rate of Facebook requests compared to lawful interception is much higher in the United States. In 2014, 3,554 intercepts were executed in the United States, versus 29,707 requests for Facebook User Data during the same reporting period, referencing 45,398 User Accounts. The average success rate of American requests in 2014 was 75%, suggesting that while Facebook is cooperative, it is not necessarily an open “back door” for U.S. surveillance.
US & UK Requests for Information – 2014
Likewise, authorities in the United Kindom made more requests to Facebook than conducted intercepts over a similar reporting period. During 2014, Facebook was approached 4,476 times by British authorities, referencing 5,509 User Accounts. During that same period 2,705 intercepts were executed, however, data related to communications (such as who made a call to whom and when) was accessed 517,236 times.
Why the Discrepancy between Lawful Interception and Facebook Requests?
There are several reasons why statistics between lawful interception and accessing Facebook vary between countries.
Change brought with the internet has been fast and furious. In many countries, law enforcement agencies have struggled to keep up. It is possible that for many law enforcement agencies, conducting surveillance on social networks such as Facebook might still be a bit too digitally forward for many investigators. After all, how do you really know that a target was the one who typed that Facebook message, and not some pretender? Digital evidence requires a greater degree of specialisation to prove, and this might be offputing for some frontline investigators. In countries where this type of investigation is more common, the requests to Facebook might be higher.
The sheer volume of online communications can be daunting. The average American spends 40 minutes on Facebook every day – this could be much higher for a heavy user. Wading through the typical social media feed is mundane at best. Investigators might still be finding traditional communications data to yield far better leads during criminal investigations than Facebook exchanges.
In countries with higher rates of Facebook requests than lawful intercepts, it could be a testament to a more stringent and costly process for acquiring a judicial authorization for interception, explains Clayton Rice a criminal lawyer specializing in wiretap cases as well as search and seizure law. In Canada (which had just 123 lawful intercepts executed in 2013), cases requiring interception are extremely costly into the million-dollar range involving dozens of police officers, civilian intercept technicians and monitors. The difference between countries might also be a matter of legal requirements, says Mr. Rice:
“In Canada, a wiretap may only be granted if the police establish investigative necessity. That is, that other investigative means have been tried and failed or are unlikely to succeed. The high cost and legal requirements contribute to the lower numbers in countries like Canada and the United States although the numbers have generally been on the rise. In some countries where the legal threshold is low, the police may more easily obtain wiretap orders and that may increase the frequency.”
Canadian Requests for Information 2013
There might also not be a need to ask Facebook for information. Other documents leaked by Edward Snowden suggest that the NSA has spoofed Facebook servers in the past to inject target computers with malware. And if commercially avilable spyware can enable parents to monitor a child’s Facebook activity, surely the capability exists for governments to use similar malware on remotely affected computers. This is to say nothing of wider network surveillance. In countries were law enforcement and intelligence agencies are highly cooperative, the need to even ask Facebook to cooperate could be utterly unnecessary – as such communications are already monitored directly.
Hats off to Facebook (& Vodafone)
As the internet becomes more and more a part of our every day lives, understanding the implications of surveillance is crucial. The Snowden leaks have provided considerable insight into the potential scope of surveillance, but transparency from organisations such as Facebook and Vodafone can help deepen our understanding of the current situation and the risks associated with it. Such reporting efforts should be applauded, and organisations seeking to be transparent should be assisted in making more information publicly available.
Data on access to our information and communications from sources such as social networks and communications services providers enable citizens to better hold governments to account, ultimately strengthening – it is hoped – democracy. Indeed, increased transparency and the subsequent trust that would follow are two things many countries need more of in the wake of the Snowden leaks.
- As uniform Facebook user stats were not available for all 55 countries analysed, estimates for target audiences within those countries as provided by Facebook’s Ad Manager were used for fair comparison. These estimates are not the most accurate given Facebook’s approach to rounding up to the next highest number in the tens of thousands or greater. ↩