A previous version of this document published on wikileaks.org was dated June 23, 2006.

MySpace.com Law Enforcement Guide

• 15 pages
• Confidential
• For Law Enforcement Use Only
• November 1, 2007

MySpace.com (“MySpace”) is committed to assisting law enforcement, to the extent permitted by law, in investigations related to unlawful activity. This Law Enforcement Guide is designed to serve that purpose by providing information to facilitate law enforcement requests for user data held by MySpace. The Guide specifies what information is collected by MySpace, how long that information is retained, how to tailor requests to ensure MySpace produces the specific information sought, and the legal process necessary to permit MySpace to disclose different types of information. Finally, the Guide provides contact information for MySpace personnel dedicated specifically to responding to law enforcement requests, including emergency requests.

Because MySpace wishes to prioritize law enforcement requests, it has established dedicated lines of communication reserved solely for law enforcement. This Guide is intended solely for use by bona fide law enforcement agencies and may not be distributed to any other person or organization without the express written authorization of MySpace. MySpace will require verification that the person requesting this Guide is a bona fide law enforcement officer or acting on behalf of a law enforcement agency or prosecutor’s office prior to releasing this Guide.

…

III. Information Collected and Retained, and Legal Process Required

A. Information Overview

MySpace has four basic types of information about its users that may be relevant to a
criminal investigation: 1) basic identity/subscriber information supplied by the user in creating
the account; 2) IP log-in information captured by MySpace from the user’s computer; 3) files
stored in a user’s profile (such as “about me” information or lists of friends); and 4) user sent and
received message content. Depending on the type of information sought, ECPA may require the
use of a different form of legal process, and the period MySpace retains the information may
differ. In order to assist law enforcement in narrowly tailoring its requests and ensuring the
necessary process is provided, we identify below the specific categories of information and
corresponding process required to lawfully produce that information under ECPA. When
drafting subpoenas, court orders, or search warrants, please be as specific as possible about the
profile at issue, and the nature of the information sought. Clearly worded requests will reduce
confusion, enable MySpace to respond more quickly, and ensure that no issues arise under ECPA
limiting MySpace’s ability to comply.

B. Public vs. Private Profiles

Please note that users may choose whether to make certain profile information (e.g., their
“about me” details, blogs, and friends lists) publicly viewable and available to anyone visiting
their profile (including law enforcement), or to keep it private and limited only to the MySpace
“friends” of their choosing. For public profiles, law enforcement may access and save screen
shots of publicly available information without involvement by MySpace. Because users can
change the content on their profile and change the status from public to private at any time,
MySpace encourages law enforcement to preserve content on public profiles themselves by using
screen shots (preserving electronic copies of html files).

C. Identifying the “Friend ID”

As a threshold matter, given the size of MySpace’s user population, it is critical and
required that the ‘FriendID’ of the relevant account be included in the legal process. The
FriendID can be located in the web address of the profile in question.

http://www.myspace.com/index.cfm?fuseaction=user.viewProfile&friendID=6221&Mytoken=2
0050518161358

The above FriendID in this example is ‘6221’. This unique number allows us to locate the
profile. If the profile appears as ‘MySpace.com/Tom’, click on the ‘View More Pics’ link. This
will display the following link:

http://viewmorepics.myspace.com/index.cfm?fuseaction=user.viewPicture&friendID=6221&frie
ndName=Tom&Mytoken=20050829192700

The FriendID can then be located in the URL.

D. Specific Categories of Information Retained and Associated Legal Process Required

1. Basic user identity information

Type of Information Available: date profile created; first and last name provided by user; user
ID; e-mail address provided by user; zip code, city, and country provided by user; account
creation date and time; and the IP address at time of sign-up.
Process required: Grand jury subpoena, administrative subpoena or civil investigative demand
pursuant to 18 U.S.C. § 2703(c)(2); or court order; or search warrant; or user consent.

2. IP address logs

Type of Information Available: Logs showing the IP address assigned to the user and the date
stamp at the time the user accessed his or her profile (PST or PDT, depending on the date of login).
Process required: For historical records – grand jury subpoena, administrative subpoena or civil
investigative demand under 18 U.S.C. § 2703(c)(2); or court order; or search warrant; or user
consent. To capture log-in IPs prospectively – a Pen Register/Trap and Trace Order under 18
U.S.C. § 3121.

3. Private messages and bulletins

Type of Information Available: the contents of private mail messages and/or bulletins sent from
and held for users on MySpace servers.

Process required for messages less than 180 days old: Search warrant under 18 U.S.C. §
2703(a); or user consent.

Process required for messages over 180 days old: Subpoena or court order where the
government provides prior notice to the subscriber (or delays notice under 18 U.S.C. § 2705) for
messages over 180 days old; or search warrant; or user consent.

4. Stored user files (photos, videos, blogs)

Type of Information Available: Profile information including photos, videos, blogs, blog
comments by other users, the identities of their friends, and “About Me” entries.
Process required: A grand jury or administrative subpoena, civil investigative demand; or court
order where the government provides prior notice to the subscriber (or delays notice under 18
U.S.C. § 2705). 18 U.S.C. § 2703(b)(2); or search warrant; or user consent.

5. Other general records or information

Type of Information Available: user’s date of birth, gender, hometown, and occupation, as well
as historical private message header information, excluding subject.
Process required: Court order under 18 U.S.C. § 2703(d); or search warrant; or user consent.

E. MySpace Retention Periods

The retention periods identified below reflect MySpace’s retention of user data in the
normal course of business. MySpace honors all law enforcement preservation requests made
during the period the data is available. MySpace also automatically preserves the data of users
who are identified as registered sex offenders and removed from the MySpace site pursuant to
MySpace’s Sentinel SAFE project.2 Please note that all retention periods are estimated and may
vary depending on system conditions and other circumstances.

…

B. Sample Search Warrant Language for User Information Including Private Messages:

Records concerning the identity of the user with the FriendID ###### consisting of name,
postal code, country, e-mail address, date of account creation, IP address at account sign-up, logs
showing IP address and date stamps for account accesses, and the contents of private messages in
the user’s inbox, and sent mail folders.

C. Sample Preservation Request Letter

(Must be on law enforcement department letterhead)

Custodian of Records
MySpace.com
407 N. Maple Drive
Beverly Hills, CA 90210

Re: Preservation Request

Dear Custodian of Records:

The below listed account/profile is the subject of an ongoing criminal investigation at this
agency, and it is requested pursuant to 18 U.S.C. § 2703(f) that the following information
associated with said account/profile be preserved pending the issuance of a search warrant or
other legal process seeking disclosure of such information: [Specify information to be
preserved]. I understand that MySpace.com will lock the profile/account in question, thereby
rendering the account inaccessible to its owner.

Profile URL:

FriendID:

If you have any questions concerning this request please contact me at [insert e-mail address and phone contact]

Thank you for your assistance in this matter.

Sincerely,

(Your Signature)
(Your Name Typed)
(Your Title Typed)

Share this: