The following operations order issued in September 2012 by the New York Police Department and is considered a model for police agencies around the country in crafting their own policies for using social media in investigations.  The PDF was constructed from the only publicly available images of the document and, consequently, is of low resolution.

Use of Social Networks for Investigative Purposes – General Purpose

• 5 pages
• September 5, 2012

Data contained within social network sites may assist law enforcement in gathering timely information in furtherance of crime prevention, preservation of public order, and the investigation of criminal activity, including suspected terrorist activity. These guidelines are promulgated, in part, to instill the proper balance between the investigative potential of social network sites and privacy expectations.

Therefore, effective immediately, when a member of the service requires the use of social network websites to conduct investigations or research, the following procedure will be complied with:

I. Purpose

To conduct social network-based investigations and research.

II. Scope

Data contained on the Internet within social network sites may assist law enforcement in gathering timely information in furtherance of crime prevention, including the preservation of public order and the investigation of criminal activity, including suspected terrorist activity. To effectively fulfill these duties, it may be necessary for members of the service to access social network sites using an online alias. No prior authorization is ever required for information contained on publicly available internet sources.

III. Definitions

Exigent Circumstances—For the purpose of this procedure, circumstances requiring action before authorization can be obtained, in order to protect life or substantial property interest; to apprehend or identify a fleeing offender; to prevent the hiding, destruction or alteration of evidence; or to avoid other serious impairment or hindrance of an investigation.
Online Alias—An online identity encompassing identifiers, such as name and date of birth, differing from the user’s actual name, date of birth, or other identifiers.
Online Alias Access—Internet-based searches involving the search and acquisition of information from sites that require an email address, password, or other identifiers for which an online alias is utilized.
Public Domain Data—Information accessible through the Internet for which no password, email address, or other identifier is necessary to acquire access to view or collect such information.
Social Network Site—Online platform where users can create profiles, share information, or socialize with others using a range of technologies.

Procedure

When a member of the service requires access to a social network website for investigative or research purposes:

Member of the Service

1. Confer with supervisor, if access to public domain data requires the use of an online alias/online alias access.
a. No conferral or authorization is required for general research, topical information or other general uses that do not require the acquisition of an online alias/online alias access.

If application for online alias does not involve suspected terrorist activity:

Supervisor

2. Evaluate request to determine whether an online alias would serve an investigative purpose, and if so, prepare Typed Letterhead requesting an online alias to bureau chief/deputy commissioner concerned.

3. Include on Typed Letterhead:

a. Purpose for the request (i.e., type of investigation, etc.)
b. Tax registry number of requesting member
c. Username (online alias)
d. Identifiers and pedigree to be utilized for the online alias, such as email address, username and date of birth.
e. Do not include password(s) for online alias and ensure password(s) are secured at all times.
f. Indicate whether there is a need to requisition a Department laptop with aircard.

4. Review photograph to be used in conjunction with online alias, if applicable.

a. Consider the purpose for which the photograph is being used and the source of the photograph.

b. Attach a copy of the approved photograph and indicate on Typed Letterhead how photograph was obtained.

5. Forward request to commanding officer for review.

Commanding Officer

6. Review request(s) and consider the purpose and whether granting approval would serve an investigative purpose.
7. Endorse request(s) indicating APPROVAL/DISAPPROVAL within one day of original request and if APPROVED, immediately forward approval to bureau chief/deputy commissioner concerned, through channels, for informational purposes.
8. File copies of requests in command.

Member of the Service

9. Maintain record of online alias in case records management systems or appropriate Department records.
Bureau Chief/Deputy Commissioner

10. Maintain folder for each APPROVED online alias.

a. Designate an administrator for the online alias.

If application for online alias involves suspected terrorist activity:

Supervisor

11. Immediately contact Intelligence Division, Operations Desk supervisor and provide details regarding proposed investigation.
Intelligence Division, Operations Desk Supervisor
12. Determine if investigation should be conducted by the Intelligence Division and proceed accordingly.
13. Notify requesting supervisor to proceed with investigation if it has been determined that the investigation will not be conducted by the Intelligence Division.

Supervisor

14. Comply with steps “2” through “10”, as appropriate, if investigation will not be conducted by the Intelligence Division.

When exigent circumstances exist that would warrant the immediate use of an online alias:

Supervisor

15. Confer with Intelligence Division, Operations Desk supervisor, if there is concern that the investigation may involve suspected terrorist activity.

a. Comply with instructions from Intelligence Division, Operations Desk supervisor.

16. Confer with commanding officer/executive officer, if investigation does not involve suspected terrorist activity.
17. Instruct member of the service to proceed with investigation upon receiving APPROVAL from commanding officer/executive officer.

a. Comply with steps “2” through “10”, as appropriate, and include in Typed Letterhead, the circumstances that led to the determination of exigent circumstances.
Additional Data

Legal Considerations

During the course of an investigation, a member of service may need access to information regarding online accounts maintained by service providers. The federal Electronic Communications Privacy Act (ECPA) governs seizures of electronic evidence. Some information may be obtained with a subpoena; other information requires a special court order; and still other information requires a search warrant. Pertinent sections of the ECPA are as follows:

a. A subpoena is generally deemed sufficient to obtain information such as user information and payment records.
b. Electronic communications, such as email content, in electronic storage for 180 days or less may be obtained only after the issuance of a search warrant, and delayed notification to the subscriber or customer may be ordered if specifically requested in the search warrant application.
c. Electronic communications in electronic storage for more than 180 days may be obtained with a subpoena signed by a judge; however, notice must be provided to the subscriber or customer unless the electronic communications are obtained after the issuance of a search warrant allowing for delayed notification.
d. In anticipation of the issuance of a search warrant, a member of the service may send a request known as a “preservation letter” to an electronic service provider requesting the preservation of electronic records for 90 days, and extend the request for an additional 90 day period.

Note that particular service providers are known to ignore non-disclosure orders (i.e., some service providers will disclose the existence of a search warrant or subpoenas to a subject subscriber or customer.) In general, members of the service should consult with the Legal Bureau before seeking electronic communication through a search warrant or otherwise.
Data obtained through a grand jury subpoena or court order cannot be shared with other law enforcement agencies unless otherwise authorized.

Operational Considerations

When a member of the service accesses any social media site using a Department network connection, there is a risk that the Department can be identified as the user of the social media. Given this possibility of identification during an investigation, members of the service should be aware that Department issued laptops with aircards have been configured to avoid detection and are available from the Management Information Systems Division (MISD). A confidential Internet connection (e.g., Department laptop with aircard) will aid in maintaining confidentiality during an investigation. Members who require a laptop with aircard to complete the investigation shall contact MISD Help Desk, upon APPROVAL of investigation, and provide required information.

In addition to using a Department laptop with aircard, members of the service are urged to take the following precautionary measures:

a. Avoid the use of a username or password that can be traced back to the member of the service or the Department;
b. Exercise caution when clicking on links in tweets, posts, and online advertisements;
c. Delete “spam” email without opening the email; and
d. Never open attachments to email unless the sender is known to the member of the service.

Furthermore, recognizing the ease with which information can be gathered from minimal effort from an Internet search, the Department advises members against the use of personal, family, or other non-Department Internet accounts or ISP access for Department business. Such access creates the possibility that the member’s identity may be exposed to others through simple search and counter-surveillance techniques.

Department Policy

The “Handschu Consent Decree” and “Guidelines for Investigations Involving Political Activity” (see Appendix “A” and “B” of Interim Order 58, series 2004, “Revision to Patrol Guide 212-72, ‘Guidelines for Uniformed Members of the Service Conducting Investigations of Unlawful Political Activities’”) require that any investigation, including investigations on social networks, by the New York City Police Department involving political activity shall be initiated by and conducted only under the supervision of the Intelligence Division. Accordingly, members of the service shall not conduct investigations on social networks involving political activity without the express written approval of the Deputy Commissioner, Intelligence. Any member of the service who is uncertain whether a particular investigation constitutes an “investigation involving political activity” shall consult with the Legal Bureau.

Members of the service who have created and used online aliases prior to the promulgation of this procedure must submit a request to continue utilizing the alias in accordance with this procedure.

Related Procedures

• Citywide Intelligence Reporting System (P.G. 212-12)
• Guidelines for Uniformed Members of the Service Conducting Investigations of Unlawful Political Activities (Interim Order 58, series 2004)

Forms and Reports

Typed Letterhead

3. Commanding officers will ensure that the contents of this Order are brought to the attention of members of their commands.

By Direction Of The Police Commissioner

Distribution
All Commands

Share this: