Sexting continues to be a thing. And, as we have covered various stories revolving around people sending pictures of their naughty bits to one another, much of the consternation in the public tends to be around children partaking in sexting. And I can see their point. While I tend to laugh at prudishness in general, it would probably be best for all involved if underage youngsters weren't texting each other provocative pictures of themselves with reckless abandon.

So what is a parent to do if their children are found to be doing just that? One might think that going to both the child's school and authorities to ask for help in stopping this behavior would be in order, right? Well, for one parent in Australia, doing just that landed him a conviction for child pornography and sex offender registration, even as essentially the entire legal system acknowledged that he was just trying to be a good father.

A man who found out that his 15-year-old stepdaughter was sexting her boyfriend proceeded to download the evidence to bring it to the school and the police to ask them to intervene. Oh dear, readers. You know where this is heading. Intervene they did. Now the dad has been convicted on child pornography charges and placed on the sex offender registry. This, despite the judge understanding exactly why the man, Ashan Ortell, 57, held onto the images.

"There is no suggestion of any exploitation of them by anybody," ruled Judge Jane Patrick, over in Australia, which is becoming as daffy as the United States. "You made no attempt to conceal the images. In fact, you were so concerned that you contacted the authorities about the images."

And then the judge proceeded to levy the conviction for child pornography upon Ortell. Why? Well, because Ortell made copies of the images he'd found his stepdaughter sending around on a USB stick and brought them to the school and police. The police apparently warned him to delete the images or risk prosecution, before reportedly failing to do much at all to address the behavior about which Ortell was concerned. Because of that, he kept the images, ostensibly so that he could address the behavior with other parties that might help him intervene. And that's when he was prosecuted for child pornography.

Let's be clear here: everyone agrees that Ortell did not keep the images for lewd reasons. There is a complete consensus, up to and including the judge who convicted him, that Ortell is merely a concerned parent attempting to do the right thing. Yet here we are. Legal systems routinely take intention into account with regards to charges, prosecutions, and rulings. Yet that failed to happen here, because context and nuance go right out the window when it comes to certain topics that have been overhyped in the public discourse as some kind of impending doomsday. Sexting amongst children is one of those topics.

Need more proof? The local police department has reached out to parents as a result of this whole fiasco with advice that wouldn't have helped in this case.

The ridiculous advice the Victoria police are giving to parents in the wake of this case is: Talk to your children about sexting "and encourage them not to communicate with people they don't know."

Well, okay. How would that have helped? The girl was definitely communicating with someone she did know: her boyfriend. I'm also guessing that talking to your kids about sexting is like talking to them about abstinence. A few may pay heed, but many won't.

The fact that sexualized pictures of "children" (anyone under 18 qualifies in federal child porn statues) are rampant and often consensual should somehow be reflected in the laws. Instead, low-level sex offenses are becoming the low-level drug offenses of this century: Something we overreact to in a charade of concern and, in the process, turn decent people into criminals.

Child pornography is not an issue to be taken lightly, to be sure, but making a mockery of the public's concern by convicting a well-meaning parent isn't the answer to anything at all.

The DOJ wants the Second Circuit Court of Appeals to revisit the decision it handed down in July -- the one that's preventing it from forcing Microsoft to hand over data stored on its servers in Ireland. The DOJ hoped the court would read the Stored Communications Act as applying to the location of the company served with the data request, rather than the actual location of the data. The Appeals Court disagreed with the lower court's finding -- one that dragged in the Patriot Act for some reason -- pointing out that the purpose of the SCA was to protect the privacy of communications, not to facilitate the government in obtaining them.

The government has filed a petition [PDF] for a rehearing of the case, obviously in hopes of a reversal. Jennifer Daskal of Just Security has posted several reasons why the DOJ's desired interpretation of the Stored Communications Act is dangerous, along with other problems arising from this decision.

To begin with, the decision raises new logistical issues, both for the government and the private companies served with these warrants.

According to the government, companies like Google and Yahoo! now need to ascertain the location of sought-after data “at the moment the warrant is served.” If the content is stored abroad, it is now “beyond the reach of a Section 2703 warrant, even when the account owner resides in the United States and the crime under investigation is entirely domestic.”

The court's interpretation of the SCA theoretically means Google will never again have to turn over requested emails to law enforcement.

Moreover, in the case of Google, this data is also outside the reach of a MLA request “because only Google’s US-based employees can access customer email accounts, regardless of where they are stored.” (p.6) In other words, US law enforcement cannot access the data because it is outside the reach of the US warrant authority. And foreign governments cannot because they lack jurisdiction over the US-based employees that control the data. No law enforcement official can access it anywhere.

That being said, Daskal points out that the government also feels that just because it has a warrant, it should be able to demand the production of communications wherever, whenever. This flat assertion that warrants trump privacy in every case is every bit as one-sided as the DOJ's theory that Google now has the option to rebuff warrants at its sole discretion.

The DOJ's fears aren't entirely unfeasible. Companies that sell their communications tools with privacy-heavy sales pitches could simply offshore their data storage to put it out of reach of SCA-citing warrants, turning the 2nd Circuit's ruling into a middle finger to US law enforcement.

If this is going to be fixed in any sort of way that doesn't turn this into a one-sided victory for service providers or the government, it's probably going to need to be through legislation. The court's revisitation of the issue (courts have generally been favorable to rehearing requests from the US government) may come to that very conclusion.

Indeed, the DOJ has already begun pushing for a legislative solution, albeit one that heavily favors the government. The DOJ wants existing Mutual Legal Assistance Treaties (MLATs) modified so the FBI, etc. can continue to compel the production of communications stored overseas without tripping over reluctant US service providers or statutory limitations built into the SCA.

As Daskal notes, Congress is better off addressing this issue sooner rather than later. Should the court reverse its decision and allow the FBI to demand communications from foreign data centers using nothing more than a warrant issued by a local magistrate, other countries far less concerned about US privacy protections will be sure to utilize the same tactics.

Yet I continue to have concerns about the result of a governmental win: the government gets free rein to compel any US-based provider to disclose any user’s data, without any constraint based on things like the location or nationality of the target. This is a rule that will be watched, and likely mimicked, by others.

Consider the broader implications: The United States would (or at least should) be concerned if foreign governments unilaterally demanded the unilateral production of US citizens and residents data. And in fact current US law prohibits US-based providers from responding to those demands—requiring that the foreign governments instead employ the MLA process and ultimately obtain a US warrant based on the US standard of probable cause. Foreign government also have an interest in controlling access to their residents data. Those interests ought to be taken into account.

Unfortunately, Congress doesn't really have a great track record when it comes to legislative fixes for tech issues. We have a more technologically-adept set of legislators than we've ever had previously, but there are still many who won't see the forest of implications for the law enforcement trees. But the situation may become much, much worse if left unattended.

David Ulevitch, the founder of OpenDNS (now owned by Cisco), apparently discovered that the dirty minds at the California DMV see "lust" in information security. How else to explain that the DMV rejected his request for a vanity plate for the license plate "1NFOS3C": As you can see, the DMV rejected it because it "has a sexual connotation, or is a term of lust or depravity. Now, that probably has you shaking your head. What possible "sexual connotation" is there in "information security" shortened and with a few numbers instead of letters? One response to David's tweet suggests the DMV read it as "in fo' sex" which brings an entirely new way of thinking about information security... Though as another response shows, the way to get bad words by the California DMV is apparently to use a mirror in designing your vanity plate:

The government's embrace of transparency -- an uncomfortable hug forced on it like a drunken uncle at a wedding reception by the passage of the USA Freedom Act -- has paid off for a local computer concern. Google is now able to speak in non-specifics about one (1) National Security Letter it has received.

The national security letter issued to Google was mentioned without fanfare in Google’s latest bi-annual transparency report, which includes information on government requests for data the company received from around the world in the first half of 2016.

Google received the secret subpoena in first half of 2015, according to the report.

Here's the original wording from the report, which follows actual specifics about new countries Google can add to the list of entities demanding user info from it (Algeria, Belarus, Cayman Islands, El Salvador, Fiji, and Saudi Arabia):

[P]ursuant to the USA Freedom Act, the FBI lifted a gag restriction on an NSL issued in the second half of 2015.

The law requires the FBI to "periodically" review its NSL-related gag orders to see whether the restriction still needs to be in effect. Theoretically, the gag order should be lifted three years after the NSL is issued or the investigation concludes, whichever comes first. Theoretically. I guess we'll see if the gag order floodgates begin opening in 2019.

In addition to finally being able to barely talk about it, Google was also able to move the transparency dial forward exactly one click.

To reflect this, we have updated the range of NSLs received in that period — July to December 2015 — from 0-499 to 1-499.

What Google hasn't done is publish the request itself, something both Yahoo and Signal did once given the green light by the feds. It cited no reasons for withholding the contents. However, it may be unable to fully publish the letter, despite the lifting of the gag order, as The Intercept's Jenna McLaughlin points out.

It’s… unclear why Google wouldn’t immediately publish the document — unless the gag is only partially lifted, or the company is involved in ongoing litigation to challenge the order, neither of which were cited as reasons for holding it back.

In other news, Google saw an increase in FISA-ordered requests for user info, bumping it up by about 5,000 total accounts as compared to the previous reporting period.

Hopefully, Google's ungagged-but-still-secret NSL won't stay secret for much longer. It would be troubling if this were to become Google's standard policy -- the announcement of gag order removals but with no further details forthcoming. Not much "transparency" in the Transparency Report, unfortunately… not if that's how it's going to be handled.

True, much of the opacity is still the government's fault: the not-at-all-useful "banding" that makes NSL numbers impossible to parse (1-499 could mean one NSL… or almost 500 in one reporting period), the gag orders that remain in place forever, etc. But private companies shouldn't take their cues from naturally-secretive government agencies. They're pretty much all we have to provide us with an outside, somewhat unrestricted measure of the government's surveillance efforts.

A big ruling has been handed down by the UK's Investigatory Powers Tribunal, stating that intelligence agencies' (GCHQ, MI5, MI6) bulk data collection has been illegal since its inception.

The ruling said the regime governing the collection of bulk communications data – the who, where, when and what of personal phone and web communications – failed to comply with article 8 protecting the right to privacy of the European convention of human rights (ECHR) between 1998, when it started, and 4 November 2015, when it was made public.

It said the holding of bulk personal datasets (BPD) – which might include medical and tax records, individual biographical details, commercial and financial activities, communications and travel data – also failed to comply with article 8 for the decade it was in operation until its public avowal in March 2015.

This ruling comes at a particularly opportune time -- just as the UK government is putting the finishing touches on another investigatory powers bill: the so-called Snooper's Charter. But not necessarily because this will deter GCHQ from further bulk data collections. In fact, the ruling may give pro-surveillance politicians a better idea of how to make future collections stand up to legal challenges.

On the other hand, the tribunal's examination of the case uncovered some interesting statements by agency insiders who rather presciently noted the press would have a field day if information about the programs were ever made public. (The statement also shows the agency was prepared to head off backlash by questioning the media's truthiness.)

The IPT ruling included the disclosure from an unpublished 2010 MI5 policy statement that the “bulk personal datasets” include material on the nation’s personal financial activities. “The fact that the service holds bulk financial, albeit anonymised, data is assessed to be a high corporate risk, since there is no public expectation that the service will hold or have access to this data in bulk. Were it to become widely known that the service held this data, the media response would most likely be unfavourable and probably inaccurate,” it says.

The ruling is the end result of Privacy International's multiple legal challenges to British spying powers. Even though this is a win for PI, the charity also notes that no ruling was made on how the illegally-obtained datasets should be disposed of… or if they even will be.

The UK government responded to the ruling showing it had "overseen" more than a decade's-worth of illegal data collection with a cheerily tone deaf, "Things are so much better now!"

"The powers available to the security and intelligence agencies play a vital role in protecting the UK and its citizens. We are therefore pleased the tribunal has confirmed the current lawfulness of the existing bulk communications data and bulk personal dataset regimes.

Through the investigatory powers bill, the government is committed to providing greater transparency and stronger safeguards for all of the bulk powers available to the agencies."

It's not the stuff that's gone on for years. That's apparently not important. No, UK citizens need to keep their eyes on the prize: the ten months or so of legal spying UK intelligence agencies have been engaged in, as well as the eventual codification of other possibly-illegal surveillance programs.

Java is one of the most widely used platforms and programming languages. It's easy and adaptable. Grab the $39 Complete Java Programming Bootcamp and you'll be on your way to mastering Java. The 10 courses will teach you how to build applications, how to create UIs with JavaFX, how to master data structures and algorithms, and much more.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Hillary Clinton's position on encryption -- like so much of her tech policy -- has been kind of vague and wishy-washy. Saying things that possibly sound good, but could easily turn out to be bad depending on what is really meant. It's sort of the classical politician's answer on things, trying to appease multiple sides of an issue without getting fully pinned down on something that might come back to bite you later.

It started back in November of 2015, when Clinton gave a speech, which put her firmly into the "but Silicon Valley should nerd harder to figure out a backdoor" camp. A few weeks later, she doubled down on the "nerd harder" response in an interview with George Stephanopoulos:

STEPHANOPOULOS: How about Apple? No more encryption?

CLINTON: This is something I've said for a long time, George. I have to believe that the best minds in the private sector, in the public sector could come together to help us deal with this evolving threat. And you know, I know what the argument is from our friends in the industry. I respect that. Nobody wants to be feeling like their privacy is invaded.

But I also know what the argument is on the other side from law enforcement and security professionals. So, please, let's get together and try to figure out the best way forward.

A few weeks after that, she went even further, calling for a "Manhattan Project" on backdooring encryption. As we noted at the time, that made no sense and suggested a complete cluelessness about encryption and the issues related to it.

Now, with the release of the hacked emails from Clinton campaign manager John Podesta, we get to find out that Clinton's staff basically agreed with us that her statements on encryption were ridiculous, and felt that she should not support any effort to backdoor encryption. It started with an internal discussion in response to an inbound request from Politico, where some of her staffers sought to avoid answering the question on backdooring encryption, while admitting internally the reality. Here were the "boiled down" talking points, presented by Ben Scott (a former State Dept official who also ran Free Press for a few years):

1-The bad guys could already get crypto -- we helped the good guys get it.

2-The Internet Freedom investments in these technologies were strongly bipartisan (and remain so).

Those are good points. I wish she'd actually said that, rather than what eventually came out.

The second email comes right after that "Manhattan Project" comment at the debate in the middle of December, and there her staffers discuss what a terrible analogy it is and how they should tell the tech industry that Hillary won't support backdoors, but instead supports using hacking/malware to spy on terrorists (which is a better solution all around, though it raises some other issues).

The email thread starts off with lawyer and Clinton (and former Obama) advisor Sara Solow first highlighting the flip-floppy nature of Clinton's comments, and then followed it up by noting that the "flop" side of (supporting backdooring encryption) is "impossible":

She basically said no mandatory back doors last night ("I would not want to go to that point"). In the next paragraph she then said some not-so-great stuff -- about there having to be "some way" to "break into" encrypted content-- but then she again said "a backdoor may be the wrong door."

Please let us know what you hear from your folks. I would think they would be happy -- she's certainly NOT calling for the backdoor now -- although she does then appear to believe there is "some way" to do the impossible.

Teddy Goff, a political strategist and the digital director for Obama for America during the 2012 campaign, responds, calling it "a solid B/B+" and suggests that someone tell Clinton never to use the Manhattan Project line again. He also highlights the point that Ben Scott had raised a month earlier, and that it was clear that Clinton did not understand, that there is open source encryption out there that anyone can use already, and any attempt to backdoor proprietary encryption won't stop anyone from using those other solutions. Finally, he suggests that having "pledged not to mandate backdoors" will be useful going forward.

i think it was fine, a solid B/B+. john tells me that he has actually heard nice things from friends of ours in SV, which is rare! i do think that "i would not want to go to that point" got overshadowed in some circles by the "some way to break in" thing -- which does seem to portend some sort of mandate or other anti-encryption policy, and also reinforces the the ideological gap -- and then, more atmospherically, by the manhattan project analogy (which we truly, truly should not make ever again -- can we work on pressing that point somehow?) and the cringe-y "i don't understand all the technology" line, which i also think does not help and we should avoid saying going forward.

speaking of not understanding the technology, there is a critical technical point which our current language around encryption makes plain she isn't aware of. open-source unencrypted messaging technologies are in the public domain. there is literally no way to put that genie back in the bottle. so we can try to compel a whatsapp to unencrypt, but that may only have the effect of pushing terrorists onto emergent encrypted platforms.

i do think going forward it will be helpful to be able to refer to her having pledged not to mandate a backdoor as president. but we've got to iron out the rest of the message. i actually do believe there is a way to thread the needle here, which i am happy to discuss; it requires us to quickly pivot from encryption to the broader issue of working with tech companies to detect and stop these people, and not getting into the weeds of which app they happen to use and that sort of thing.

Finally, Solow responds to Goff agreeing that the "some way in" line implies undermining encryption, but suggests that they quietly let the tech world know that they don't mean backdoors, but just mean hacking/malware:

That she says no backdoor, which is good, but then says we need a way in, and then the bad line about not understanding technology. The latter two points make the first one seem vulnerable.

But in terms of wanting a way to break in - couldn't we tell tech off the record that she had in mind the malware/key strokes idea (insert malware into a device that you know is a target, to capture keystrokes before they are encrypted). Or that she had in mind really super code breaking by the NSA. But not the backdoor per se?

There are some obvious concerns with the hacking/malware stuff, but it's at a very different level than breaking encryption. While it's still ridiculous that Clinton won't just come out and say that backdooring encryption gives us both less security and less privacy, it does appear that she has people on her team who get the basics here. That's at least moderately encouraging. It would be better if there were some stronger indication that Clinton is actually listening to them.

Two more rulings on suppression motions in FBI Playpen cases have been handed down. (h/t Riana Pfefferkorn) The ruling [PDF] in Tennessee agrees with the defendant that the FBI's NIT warrant exceeded Rule 41 jurisdiction limits. The following quotes are from the more substantive "Report and Recommendation" [PDF] by the magistrate judge, which has been adopted by the court overseeing the criminal trial.

The undersigned agrees with the majority of courts to analyze the Virginia search warrant that it violates Rule 41(b) because the magistrate judge in the Eastern District of Virginia lacked authority to issue a search warrant to search property located outside of her district.

Defendant’s computer was never located in the Eastern District of Virginia. See Fed. R. Crim. P. 41(b)(1) & (2). Moreover, the FBI was not investigating a crime of terrorism in the Eastern District of Virginia, nor was it attempting to seize property located in a United States territory or foreign state. See Fed. R. Crim. P. 41(b)(3) & (5). The Government argues that Rule 41(b)(4) is persuasive because the NIT is analogous to a tracking device, which was installed on the Defendant’s computer when his electronic transmission “touched down” in the Eastern District of Virginia, where Playpen was hosted. However, as observed by the Western District of Washington, applying Rule 41(b)(4) to the Virginia warrant “stretches the rule too far…"

That being said, the court decides suppression is not the right remedy for this violation:

In balancing the present facts and circumstances, the magistrate judge first correctly concluded that suppressing the evidence in this case would not meaningfully deter future law enforcement misconduct. The defendant’s objections that officers acted deliberately, recklessly, or with gross negligence, and that it should have been apparent to law enforcement that the Virginia magistrate lacked authority to sign the warrant, are simply unsupported by the record.

[...]

To the extent that there was error in this investigation, such error “rests with the issuing magistrate, not the police officer, and ‘punish[ing] the errors of judges’ is not the office of the exclusionary rule.”

Interestingly (and a bit infuriatingly), the court grants good faith to the FBI for its apparent inability to fully comprehend the "intricacies of the jurisdictions of federal magistrates." This gives the FBI credit for pretending to misunderstand the very statutes it's in the process of trying to change. The FBI -- and the DOJ above it -- very much want the jurisdictional limitations of Rule 41 removed precisely for cases like these: where a search and seizure is performed on remote computers located far outside the jurisdiction where the warrant was issued.

The Nebraska decision [PDF] is much, much worse. First, the court finds there's no expectation of privacy in an IP address, even if the defendant has taken affirmative steps to obscure it.

With or without Tor, Defendant was sharing his IP address with others—total strangers, to potentially include law enforcement officers—with the hope and belief that the users of the first “node” computer would keep his IP address secret. While Defendant’s choice to use Tor may be evidence of his “actual, (subjective) expectation of privacy” in his IP address, using Tor does not elevate that expectation to “one that society is prepared to recognize as ‘reasonable.’”

Not only that, but the court rules the NIT is not a search (nor a "tracking device," as the government argued in the Tennessee case), even though it had to extract this information from the user's computer.

But deploying the NIT to reveal the IP address was not a computer search. Defendant’s IP address is not a “physical component” of the computer or a file residing on his computer like electronic documents or pictures. Rather, the IP address is assigned to a user by the ISP and typically is “maintained on the internet modem that connects an internet device to the internet.” Thus, the NIT essentially compelled Defendant’s computer to produce its IP address (similar to a return address on an envelope) when the NIT instructed the computer to send other information identified in the Virginia Warrant. And the NIT was deployed only after Defendant sought out and visited the Playpen website. “The FBI did not come looking for Defendant. Instead it waited until he came to them and engaged in illicit activity by downloading content from Playpen.”

And here we have another reason why digital-to-analog so often fails. Comparing the compelled production of an IP address to a return address on an envelope is a non-starter because utilizing the postal service does not require the use of a return address, whereas an internet connection almost always requires an IP address.

Worse, the opinion cites Virginia judge Henry Morgan Jr.'s decision in another Playpen case -- where he asserted the FBI could hack computers with invalid warrants because, hey, computers get hacked all the time.

See also Matish, --- F. Supp. 3d ---, 2016 WL 3545776 at *22-24 (holding that with the prevalence of computer hacking and the “compromise of unprecedented amounts of data previously thought to be private,” all individuals have a diminished expectation of privacy once they log onto the internet.)

The court also finds that the FBI's NIT reach didn't exceed Rule 41 geographical limitations. Instead, the defendant made a virtual "trip" to the warrant's jurisdiction to access content stored on the seized server.

Finally, even if the defendant had raised a Fourth Amendment challenge the court found valid, the good faith exception would have prevailed. As in the Tennessee decision, the court finds the FBI held up its side of the deal by providing the magistrate with an affidavit full of technical language and specifics about the search method to be deployed.

This appears to be the broader finding across the large number of Playpen/NIT cases. The FBI's warrant may be invalid but either there's no expectation of privacy in the information obtained or the good faith exception prevents suppression of the obtained evidence.

The first is less problematic than the latter. While some users may undertake efforts to obscure their IP addresses, their expectation of privacy is no more "reasonable" than that of those who don't. Either the info has an expectation of privacy or it doesn't. The legal justifications used by judges, however, haven't been all that great, with the worst being that having your anonymity stripped and your information absconded with is just the price of doing business on the internet -- whether it's a criminal or law enforcement performing the actions apparently matters very little.

The latter part -- the reliance on the FBI's good faith -- is more of an issue. The FBI clearly knew its NIT would travel far beyond the jurisdiction the warrant was issued in. It apparently felt that it benefited heavily from good faith rulings as it made little attempt to obscure this fact from the magistrate judge it presented its affidavit to. But it still withheld some information, including the fact that it would actually be delivering a malware package that would "phone home" once it reached its destination. Just because the search sort of originated at a seized server in Virginia does not excuse seizures performed all over the nation utilizing a single, jurisdictionally-limited warrant.

On Friday, we wrote about the ridiculous arrest warrant for reporter Amy Goodman for reporting on the protests over the North Dakota oil pipeline. At the time, the charges against Goodman were apparently for trespassing, but late on Friday, the state's attorney alerted Goodman's lawyer that they were now actually trying to charge her with rioting. Say what?

“I came back to North Dakota to fight a trespass charge. They saw that they could never make that charge stick, so now they want to charge me with rioting, " said Goodman. "I wasn’t trespassing, I wasn’t engaging in a riot, I was doing my job as a journalist by covering a violent attack on Native American protesters."

Apparently, the state's attorney, Ladd Erickson, figured out enough about the law to realize that trespassing charges would never stick because there needs to be notice before it's trespassing, and no notice was presented. But Erickson is still really, really confused about how the First Amendment works. He told a local newspaper that Goodman's reporting was illegal because it was sympathetic to the protestors. Really.

“She’s a protester, basically. Everything she reported on was from the position of justifying the protest actions,” said Erickson

That's uh, not how the First Amendment works. And it will be fascinating to see Erickson try to now justify the "riot" claims when the complaint itself admits that Goodman was interviewing protestors. Apparently the judge will decide later today if the riot charges will stand. One hopes that he understands the First Amendment more than the state's attorney.

Surveilling citizens engaged in First Amendment-protected activity? That's just how Geofeedia rolls.

Records obtained by the ACLU show the private company pitched its "firehose" connection to Facebook, Twitter, and Instagram as a way to monitor the situation in Ferguson (during the 2014 protests) and "stay one step ahead of the rioters."

Geofeedia itself didn't do anything illegal. It simply provided a one-stop shop for social media monitoring of public posts. It's the way it was pitched that was a problem. Rather than sell it as a way to keep law enforcement informed of criminal activity, its sales team highlighted its usefulness in monitoring protestors and other First Amendment activity.

The documents the ACLU obtained show the company paid these three social media services for "firehose" attachments -- beefed-up API calls that allowed Geofeedia to access more public posts faster than law enforcement could do on its own.

Instagram had provided Geofeedia access to the Instagram API, a stream of public Instagram user posts. This data feed included any location data associated with the posts by users. Instagram terminated this access on September 19, 2016.

Facebook had provided Geofeedia with access to a data feed called the Topic Feed API, which is supposed to be a tool for media companies and brand purposes, and which allowed Geofeedia to obtain a ranked feed of public posts from Facebook that mention a specific topic, including hashtags, events, or specific places. Facebook terminated this access on September 19, 2016.

Twitter did not provide access to its “Firehose,” but has an agreement, via a subsidiary, to provide Geofeedia with searchable access to its database of public tweets.

Of all of these companies, only Twitter took proactive steps to prevent API calls from being used for proxy surveillance.

In February, Twitter added additional contract terms to try to further safeguard against surveillance. But our records show that as recently as July 11th, Geofeedia was still touting its product as a tool to monitor protests. After learning of this, Twitter sent Geofeedia a cease and desist letter.

Well, it's all over now. It's not just Twitter demanding Geofeedia stop turning its service into an extension of law enforcement's worst urges. It's everyone. The ACLU dumped its documents and, shortly after, the companies dumped Geofeedia.

After reviewing the report, Facebook cutoff Geofeedia’s access to commercially available data from its social platform and from Instagram, which it owns.

On Tuesday, Twitter said they were also cutting off the Chicago social media company’s access.

So much for the business model. Twitter cited its long-standing policy of preventing its service from being used as a surveillance tool -- a policy it exercised earlier this year when cutting off Dataminr's access to its APIs for selling its collected communications to US intelligence agencies.

Facebook simply stated that Geofeedia's API use was "unauthorized," something it probably should have realized well before the ACLU shamed it into cutting off the company's access.

Geofeedia, meanwhile, has stated it will meet with all "stakeholders," which apparently means Twitter, Facebook, and various government agencies. Users of these services haven't been invited to do anything more than vote with their digital feet.

For all the call-and-response, the underlying fact is that Geofeedia didn't have access to anything any individual user didn't. It may have had more of it faster and a front end that made surveillance/monitoring easier, but it wasn't gathering tweets or posts from private accounts or otherwise accessing anything not already viewable by the public.

But its sales tactics were a bit concerning. The company pretty much encouraged law enforcement agencies to engage in some very questionable monitoring.

Using Geofeedia’s analytics and search capabilities and following the recommendations in their marketing materials, law enforcement in places like Oakland, Denver, and Seattle could easily target neighborhoods where people of color live, monitor hashtags used by activists and allies, or target activist groups as “overt threats.” We know for a fact that in Oakland and Baltimore, law enforcement has used Geofeedia to monitor protests.

Geofeedia claims to be interested in protecting the civil liberties of Americans, while at the same time nudging law enforcement agencies towards undermining those protections. Because of that, it's now probably looking at handing out some refunds, seeing as its all-seeing-APIs have been cut off and all it can really offer at this point is part-owner positions in a fast-growing pariahship.