Is It Legal for Facebook to Disclose Its Russian Election Ads?

This article first appeared on Just Security.

I asked several of the most highly respected legal experts for their views on an issue yet to receive significant attention in the news: whether and to what extent, if any, a federal law—the Stored Communications Act—restricts Facebook's ability to share the content of Russian ads and related information with Congress and the public.

I thought to pose the question since Facebook's General Counsel has now said the company will disclose Russian ads to Congress with a caveat: "in a manner that is consistent with our obligations to protect user information."

Plus Facebook has explicitly stated that it will share the Russian ads with the Special Counsel and Congress but not release them to the public (see Facebook's answer to its Hard Question : "Why are you sharing these with Special Counsel and Congress — and not releasing them to the public?"). Facebook's position is apparently that the Stored Communications Act prohibits certain disclosures.

Here is the question I sent all the experts:

Facebook reported that Russian ads on the platform were viewed by at least 10 million people, and according to researchers at Columbia University, Russian front pages created organic (unpaid) posts, which were shared by Facebook users hundreds of millions, and probably several billions, of times.

Congressional investigators have asked Facebook to provide them the ads, and over 75,000 people have signed a petition calling on Facebook to inform users how they were exposed to Russian products on the platform.

Facebook was reportedly initially reluctant to share the Russian ads with congressional investigators citing the Stored Communications Act (SCA). However, on September 21, 2017, Facebook announced its decision to share the ads with Congress. Facebook's General Counsel said:

The limited information Congress and the intelligence community have shared with us to date suggests that efforts to compromise the 2016 election were varied and sophisticated — and that understanding those efforts requires a united effort, from across the technology, intelligence and political communities.

We believe the public deserves a full accounting of what happened in the 2016 election, and we've concluded that sharing the ads we've discovered, in a manner that is consistent with our obligations to protect user information, can help.

What, if anything, involving Russian activity could the Stored Communications Act preclude Facebook from sharing with (1) congressional investigators, (2) with the American public in general, or (3) with individual users (e.g., notifying intended recipients of communications how they interacted with or were exposed to Russian products)? Any views you have on one or all three of those dimensions would be appreciated.

You may want to include in your analysis whether Russian content (e.g., targeted ads or organic posts) should be considered public communications and thus not covered by the Stored Communications Act, and the applicability of the Act to different forms of communications such as comments by users engaged with Russian content and other forms of engagement.

There is no need to be comprehensive here. Please address whatever dimensions of these questions you think would help inform Congress, tech companies, the news media, and the public.

Expert Views

Randal Milch

Adjunct Professor of Law, New York University School of Law; Distinguished Fellow, NYU Center for Cybersecurity and NYU Law School Center on Law and Security; former General Counsel, Verizon

How could the Stored Communications Act (SCA) prohibit Facebook from providing Congress with the "Russian Ads" one day, but permit it the next?

Applying the SCA can be fact intensive, but its applicability here seems on the surface clear: Facebook offers an "electronic communications service to the public;" the ads themselves are "communications;" and they likely are in "electronic storage."

Accordingly Facebook "shall not knowingly divulge to any person or entity the contents" of those ads, according to the letter of the law. There is no exception for divulging to Congress. So it's easy to see how Facebook could, with a straight face, say it was prohibited from providing Congress with the ads.

But the point of the Stored Communications Act is to protect the privacy of messages that are meant to be private, and this means that there is an alternative analysis. The SCA doesn't cover a communication that is "readily accessible to the general public."

At least one court interpreting this language in the context of accessing Facebook posts noted that "when it comes to privacy protection, the critical inquiry is whether [the person making the communication] . . . took steps to limit access to the information" at issue.

Ads seen by millions of Facebook users selected anonymously by Facebook's ad algorithms are hardly, in the words of another court, "sufficiently restricted that they are not readily available to the general public" through the efforts of the ad buyer.

There is a strong argument that the ads were never meant to be private and have no protection under the SCA. (The same would presumably hold true for organic posts if not more so, since they were not targeted to any particular audience.)

Facebook is very well lawyered and its legal analysis – supporting both non-disclosure and disclosure — likely never changed. What did change, however, is the politics of the situation. Usually there is significant political upside for a social media company to firmly and publicly say "No" to the government.

So "no" was a logical and legally supportable first choice for Facebook.

Sometimes, though, the politics runs the other way. Strong pressure from Democratic Senators and public pressure, as now evidenced by tens of thousands of Change.org petitioners, meant that the importance to Facebook's political constituencies of getting "a full accounting of what happened in the 2016 election" simply was greater than Facebook had forecast. It's good to have options.

Yochai Benkler

Professor, Harvard Law School; Faculty Co-Director, Berkman Klein Center for Internet and Society

As long as the demand for information refers to paid advertising, these are political communications under the FEC's 2006 rules. Even though Facebook escaped the full requirements of disclaimers for political ads in 2011 because the Commission could not reach a decision, even that limited no action simply meant that the advertisement is, at most, exempt from disclaimer rules because these are impractical, not because it is not a political communication in the meaning of the Act.

As a political communication, is intended for communication to the public, and should not be covered by the Stored Communications Act.

The proposed Honest Ads bill would make these and all other paid political advertisements disclosed in a public database, just as television ads are, but more efficiently, and like those ads, in principle there is no reason for any paid political advertising to remain undisclosed.

Jennifer Daskal

Professor, American University Washington College of Law

A month ago, Facebook reversed course and agreed to provide "the content of" the 3,000-plus ads that appear to have originated with a Russian-backed entity, "along with related information, to congressional investigators."

Up until that point, Facebook provided the relevant information only to Department of Justice officials working on the Russian investigation, pursuant to a warrant issued based on probable cause.

Up until mid-September, Facebook had argued that it could not turn over the ad content absent the issuance of warrant, pursuant to the requirements of the Stored Communications Act (SCA).

At issue is the SCA's prohibition on disclosing the content of communications (and other non-content communications), absent certain carefully drawn exceptions.

While communications content can be disclosed pursuant to a warrant, congressional committees don't have warrant authority.

Thus, Facebook had to either conclude that the ads did not fall within the non-disclosure restrictions included in the SCA or that some other exception applied.

One option is that the congressional committees issued a subpoena for the information. Whereas a warrant is required for content stored 180 days or less, the SCA permits investigators to compel production of content by subpoena if the data has been stored for more than 180 days.

And while this raises potential Fourth Amendment issues – an important Sixth Circuit case, for example, has concluded that the Fourth Amendment requires the U.S. government to obtain a warrant for emails no matter the length of storage – the situation with respect to ads can be distinguished on two possible grounds.

First, there is an important distinction between ads that are intentionally communicated broadly and private emails; while private emails are entitled to Fourth Amendment protections, publicly communicated ads are presumably not.

Second, the targets of the investigation are Russian account holders who are located outside the country and, thus lack Fourth Amendment rights according to current Supreme Court doctrine.

Absent the issuance of a subpoena, Facebook might have relied on one of the other statutory exception to the prohibition on disclosure. But none seem applicable in this case. In fact, the one potentially plausible exception would require Facebook to the disclosure was a " necessary incident. . .to the protection of [its own] rights or property. "

But that is a stretch. As well as a dangerous precedent to set. It would essentially be saying that disclosure is valid so long a provider's reputation and business interests are sufficiently challenged. Presumably, Facebook is not making that claim.

Alternatively, and more likely, Facebook may have concluded that the ads are not the kind of private communications that the Stored Communications Act is meant to protect. This would then take these disclosures outside the strictures of the Stored Communications Act entirely.

And if that is the claim (which would seem the only plausible justification if Congress did not in fact proceed by subpoena), then there is no reason why Facebook wouldn't also be able to disclose the relevant information to the public as well.

Finally, an additional note on public disclosure. Even if Facebook maintains that the ads are covered by the SCA (and in fact responding to a Congressionally-issued subpoena), it could still provide non-content information to the public.

It could also do more to disclose general information about the ads, including how long they ran, how widely they were distributed, how distribution decisions were made, without disclosing content and without running afoul of the SCA.

Alan Butler

EPIC Senior Counsel

The Stored Communications Act (SCA) was enacted to protect the privacy of customers and subscribers of digital platforms (e.g., Facebook users). The law was not intended to shield advertisers or the platforms themselves from oversight, or to limit users' access to information about the communications they receive.

The SCA limits the disclosure of the contents of communications by digital platforms, and also limits the disclosure of non-content customer records to the government. The primary focus of the investigation into Russia's activities on Facebook has been on advertisements and viral posts spread via the platform, and the underlying principles of the SCA don't really apply to those materials.

Advertisements and viral posts are, by their nature, communications that are broadcast for public consumption and are not akin to the private subscriber messages that Facebook is required by law to protect.

The impact of the SCA on Facebook's disclosure of information about Russian advertisements and other activities is likely quite limited for several reasons.

First, any notifications or disclosures to individual users who received an ad or message would likely be within of the "rendition of the service" and with the consent of the recipients.

Second, the advertisements delivered via Facebook would likely fall outside the scope of protected "communication[s] in electronic storage." And third, any non-content information (the name, address, or location) about the use of Facebook by Russian "front" pages could be disclosed to the public under § 2702(c)(6) and to congressional investigators as permitted under § 2702(c)(3) and § 2703(c).

The SCA certainly protects the privacy of Facebook users' communications, but would not restrict disclosure of most of the information at issue in the Russia investigation, which includes paid advertising and public pages used to spread viral messages.

Ira Rubinstein

Senior Fellow at the Information Law Institute at New York University School of Law; former Associate General Counsel, Microsoft

Facebook is an ECS for the public with respect to information either posted by users, or sent by users of its messaging service. However, I don't think that serving ads qualifies as an activity of an "electronic communication service." Intuitively, ads are intended to be public, they are not intended to be confidential communications to specific, identified parties, such as email, messages, or posts.

Even targeted ads do not meet this 1:1 model. A targeted ad is simply a preselected message that is served to an ad hoc group of users whose attributes match the demographics the advertiser hopes to reach.

Additionally, the definition of an ECS refers to "any service which provides to users thereof the ability to send or receive wire or electronic communications." This immediately raises the issue of whether Facebook is a "user thereof" of the very service it offers to the public.

I would argue that it is not. Otherwise, every routine communications from Facebook operations to its user base–welcome mails, how to mails, new feature notices, update notices, security warnings—would be covered by the SCA and subject to disclosure restrictions. This seems wrongheaded.

Granted, the definition of "electronic communications" is very broad, but the statute has heretofore been interpreted to mean one-to-one (or one-to-many communications, too) involving specific, identified accountholders. Ads strike me as different.

Certainly, display ads are different because they are served to everyone. But even targeted ads are not 1:1 communications. Perhaps they qualify as 1:many communications but are they confidential? Are they intended to be protected by the SCA?

Finally, if Facebook ads are "electronic communications" sent by an ECS, then where do we draw the line? Many websites allows users to set up an account and post comments or pictures and they also serve targeted ads.

Are all of these services—Yelp, the NYT, Expedia, TripAdvisor– electronic communication services merely insofar as they serve ads? Are they then subject to the same analysis? I don't think this is the intent of the SCA.

Chris Calabrese

Vice President, Policy, Center for Democracy & Technology

Facebook is not unreasonable to worry that revealing political advertising could violate the Stored Communications Act. The SCA is a murky and outdated statute and mistakes can subject a company to liability including minimum damages of $1000 per user, per violation as well as punitive damages. Long before this most recent controversy the status of advertising under the SCA was a source of contention.

In Congressional testimony from 2015 the Federal Trade Commission revealed that they often had difficulty in obtaining communications in very similar circumstances: in cases of possibly fraudulent advertising on bulletin board services like Craigslist.

According to the FTC, because the advertising was no longer public but held only on the company's servers, the company felt it status was unclear. Whether it was appropriate to reveal the advertising hinged on whether the ad was held by the company for its own business purposes or on behalf of the user.

Congressional efforts to resolve these types of questions – including a bill passed unanimously in the House of Representatives in both 2016 and 2017 – have yet to bear fruit.

Facebook must also be aware of the broader concerns that come with Congress's request for these ads. The right to engage in political speech free from undue government scrutiny is a core guarantee of both the First Amendment and human rights law.

As a global company we expect Facebook to uphold these human rights norms – the next country to demand information on political speech might be Russia or another country with a poor human rights record. As such, any government request for information on users, especially their political speech, merits close scrutiny.

Jennifer Granick

Surveillance and Cybersecurity Counsel at the ACLU's Project on Speech, Privacy and Technology

Apparently, Russian groups bought ads on Facebook and other social media in an attempt to influence the U.S. election. Ads are beyond normal, including in elections, and this is what ad buys are for—to attempt to influence people to buy, to vote, to believe, to feel a certain way.

Deploying propaganda in one's own country as well as in others, is a long-standing tradition. If democracy can't survive a $100K buy of manipulative or misleading ads, we've got bigger problems than Russia.

Another issue is whether the Stored Communications Act (SCA) prohibits Facebook from disclosing these messages to Congress or others. Almost nothing about the SCA is 100 percent clear, so applying the law is always a matter of legal interpretation.

At this point, Facebook already decided to give the messages to Congress. This was a smart calculation of legal risk. Even if the messages are protected by the SCA, who is going to prosecute or sue for disclosure to Congress? Not the DOJ, and not the Russian ad buyers.

Nevertheless, I think the SCA likely covers the copies of the ads that Facebook retains. The SCA looks at different copies of data and protects them differently depending on where and why they are stored, and what's been done with them. The copies of ads shown to the public are public messages that are not protected by the SCA.

But the copies that Facebook retains that are not displayed are "in electronic storage" with the provider and thus protected by the SCA. The knee-jerk reaction, that once a message has been displayed to others, the statute does not protect any copies of that message was rejected by the Ninth Circuit in Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004).

Ryan Goodman is co-editor-in-chief of Just Security and the Anne and Joel Ehrenkranz Professor of Law at New York University School of Law. He served as Special Counsel to the General Counsel of the Department of Defense (2015-16).