When Local Authorities aren’t your Friends
UK local authorities (Councils) are looking at people’s social media accounts, such as Facebook, as part of their intelligence gathering and investigation tactics in areas such as council tax payments, children’s services, benefits and monitoring protests and demonstrations.
In some cases, local authorities will go so far as to use such information to make accusations of fraud and withhold urgently needed support from families who are living in extreme poverty.
Social media can prove a vast trove of information about individuals, including their personal preferences, political and religious views, physical and mental health and the identity of their friends and families.
The privacy settings of the social media platforms you use determines whether local authorities will respect the privacy of your posts, or treat your photos, conversations, likes, friendship or contacts and other information as 'fair game' for them to use. This is an unfair and arbitrary way to decide whose social media they can surveil.
Our investigation has found that:
- A significant number of local authorities are now using 'overt' social media monitoring and this substantially out-paces the use of 'covert' social media monitoring
- If you don't have good privacy settings, your data is fair game for overt social media monitoring.
- There is no quality check on the effectiveness of this form of surveillance on decision making.
- Your social media profile could be used by a local authority, without your knowledge or awareness, in a wide variety of their functions, predominantly intelligence gathering and investigations.
Whilst we may post publicly, we don't expect local authorities to look at our photos and screenshot our thoughts, and use this without our knowledge to make decisions that could have serious consequences on our life. If the council wants to request information about us, we expect proper procedures to be in place.
What's the problem
The growing intrusion by government authorities’ risks impacting what people say online, leading to self-censorship, with the potential deleterious effect on free speech. We may have nothing to hide, but if we know our local authority is looking at our Facebook, we are likely to self-censor. The impact is a reframing of social media platforms, users and data in terms of intelligence gathering and criminality.
Making judgments based on social media is plagued by problems of interpretation. What does it mean when you ‘like’ or share a post on Facebook? Are you endorsing it, raising awareness, or opposing it? What intelligence can be gained from who you interact with and the photos you post?
The persona that we create online may not reflect our lived reality.
We are concerned that not enough consideration has been given to whether posts on social media are a genuine, precise and accurate; the impact of the time and context they are made; the potential for misinterpretation and the social context of a conversation that may take place on social media. These influence the potential for misinterpretation and reliance upon misleading ‘evidence’.
Authorities want to expand the use of this tactic. But there is a failure to record and audit whether checking an individual’s Facebook posts and using the information to make decisions has a legitimate aim, is fair or effective. The absence of public and parliamentary debate means there has been no real consideration about whether this tactic is necessary and proportionate.
If Authorities don’t understand the harms or usefulness of such tactics, but continue regardless, we could end up with automated decision-making based on social media profiling that is unaccountable and dangerously ineffective.
What is social media monitoring
Social media monitoring refers to techniques and technologies that allow the monitoring and gathering of information on social media platforms such as Facebook and Twitter.
In our Freedom of Information request to local authorities we distinguished between 'overt' and 'covert' social media monitoring. The distinction between these two is not always clear cut but it determines what activities can take place without any authorisation.
Covert social media monitoring is likely to:
1. Involve repetitive examination/monitoring of public posts as part of an investigation (according to the Regulators' annual reports)
2. Involve accessing private posts
3. Must be subject to assessment;
4. Is classed as Directed Surveillance as defined by Regulation of Investigatory Powers Act [RIPA]
5. Require a Local Authority to obtain a warrant under RIPA
Overt social media monitoring:
1. Involves public posts on social media that can be accessed by anyone i.e. there are no privacy settings.
2. Involves the casual (one-off) examination of public posts on social networks as part of investigations undertaken or intelligence gathering (according to the Regulators annual reports and the local authority Guidance documents)
3. Is allowable with no additional RIPA consideration.
Social media monitoring includes monitoring of content, such as messages or images posted, and other data, which is generated when someone uses a social media networking site i.e. meta data like location information. Therefore, social media monitoring can include not just the post itself but often meta data such as location and time of the posting. The information can involve person-to-person, person-to-group, group-to-group and includes interactions that are private and public.
The Regulators' Guidance states that:
"Where privacy settings are available but not applied the data may be considered open source" or publicly available; the authority has a reasonable expectation of privacy if access controls are applied...Where privacy settings are available but not applied the data may be considered open source and an authorisation is not usually required. Repeat viewing of "open source" sites may constitute directed suveillance on a case by case basis..."
The Chief Surveillance Commissioner stated in 2011-2012 annual report that:
“Surveillance is covert “if, and only if, it is conducted in a manner that is calculated to ensure that persons who are subject to the surveillance are unaware that it is, or may be taking place.” Knowing that something is capable of happening is not the same as an awareness that it is or may be taking place.”
What's the solution
* There must be an assessment of the legitimate aim of social media monitoring activities including consideration whether they are necessary and proportionate in the different contexts they are being deployed by local authorities.
* There must be a heightened level of transparency around social media monitoring practices by Local Authorities
* Individuals must be informed if social media monitoring activities are being utilised in relation to investigations against them and given the opportunity to object.
* There must be proper procedures in place to ensure that use of social media monitoring is subject to internal checks and balances.
* There must be the ability to internally and externally audit the use of both one-off and repeated viewing social media monitoring tactics.
What is PI doing
In October 2019 Privacy International sent a Freedom of Information Act request to every Local Authority in Great Britain (251 recipients) in relation to their use of social media monitoring.
We have analysed 136 responses, being those that had been received by November 2019. All responses are publicly available on the platform WhatDoTheyKnow.com.
We created a list of recommendations for local authorities.
We have written to the Investigatory Powers Commissioner's Office (IPCO) requesting he consider whether the reliance on arbitrary privacy settings is the correct approach to reasonable expectation of privacy.
