UK Government Is Engaged in Large-Scale Surveillance of Social Media
New US And EU Laws Bring Risks To Privacy
The UK civil rights group Big Brother Watch has published a major new document about the UK government’s surveillance of social media.
Entitled “Ministry of Truth”, the 106-page report explores no less than five shadowy units within the UK government: the Rapid Response Unit, the Counter Disinformation Unit, the Government Information Cell, the Intelligence and Communications Unit, and the 77th Brigade, part of the British Army.
Although each of these units has different priorities and roles, they all have in common the use of social media to gather detailed information about individuals, including journalists and politicians, and to shape public opinion.
Why UK Authorities Surveil Social Media
The “Ministry of Truth” report explores the activity of five units engaged in social media surveillance, and provides examples of their activities. Their evidence is obtained using freedom of information requests and similar transparency tools.
Most dramatically, a whistleblower provided Big Brother Watch with first-hand insights about the British Army’s 77th Brigade, commenting: “domestic monitoring of citizens online seemed not to be driven by a desire to address the public’s fears and concerns, but to identify levers for compliance with controversial government policies.” The report spells out the harm these activities cause to privacy:
When bodies such as the [Counter Disinformation Unit] are instructed to (in the words of one minister) “identify misinformation and work with social media firms to get it taken down”, the surveillance of citizens’ online expression will be required on a significant scale. As Big Brother Watch research has found, that has included monitoring the expression of high-profile figures, including democratically elected politicians, journalists and human rights campaigners, on discussions regarding public policy.
…
The absence of information about the work of these government units can only lead us to speculate on the scale and nature of surveillance that is taking place. What is clear is that where this surveillance is not limited, proportionate or set out in law it is likely to constitute a significant interference with the right to privacy.
This is not a matter of UK government agencies using covert techniques to obtain information about citizens. All the activities described in the Big Brother Watch report draw on public posts made on mainstream social media networks. These are, by definition, available to all. The problem is that UK government units are exploiting that ready access to carry out targeted surveillance of individuals when there is no suggestion that the latter are involved in illegal activities.
Tech Companies to Enable Surveillance for Research Purposes
Another new report, this time from the Center for Democracy & Technology (CDT), identifies a related threat to privacy arising from the personal information contained in social media posts. This goes beyond the casual data mining of public posts, and is a result of recent moves to allow researchers to gain insights into the dynamics of social media, and into their impact on individuals, social groups and society as a whole, by giving them privileged access to bulk data.
Perhaps the best example of this idea is the EU’s Digital Services Act (DSA), discussed previously on our blog. Article 40 of the DSA will require companies that are designated as “very large online platforms” or “very large online search engines” to provide suitably vetted researchers with access to data, subject to certain conditions. As the CDT report “Defending Data: Privacy Protection, Independent Researchers, and Access to Social Media Data in the US and EU” explains, one of the complicating factors in this area is that while the DSA entered into force in November 2022, many details are still unclear.
These will be set using so-called “delegated acts” – additional specifications issued by the European Commission. One of the most important open questions concerns how the new right to access social media data will be reconciled with the EU’s overarching General Data Protection Regulation (GDPR). That’s a reflection of the fact that many social media posts contain personal information that is therefore subject to the GDPR. Other unresolved issues noted by the CDT include:
whether certain data may be categorically excluded from access by independent researchers, or what mechanisms very large online platforms may be expected or required to use to provide researchers with access to data. It is also not clear whether researchers outside the EU will be permitted to apply for the status of “vetted researchers” or whether data created by or about users outside the EU may be provided to researchers.
It’s Not Too Late to Protect Social Data
In the US, efforts to provide independent researchers with access to stores of social media data are not so far along. However, the CDT points out that there are a number of bills under consideration that would achieve this. These include the Platform Accountability and Transparency Act (PATA), the Digital Services Oversight and Safety Act (DSOSA), the Kids Online Safety Act (KOSA), and the Social Media Disclosure and Transparency of Advertisements (DATA) Act. The main focus of the CDT report is the following:
the potential for law enforcement agencies to use tools made available to the general public, or to be openly registered as researchers for those access mechanisms, or to affiliate themselves with researchers as part of consortia with access to platform data.
The report considers different models for access to social media data, and the options with respect to notice to or consent from users for sharing that data, their legal status and privacy implications. The report concludes with a series of recommendations for policymakers in both the US and the EU, designed to protect the privacy of social media users, and to prevent the authorities abusing the new access rights designed for researchers, not for law enforcement.
The recommendations are particularly valuable given that they are being offered while the relevant laws are still being formulated in detail. Let’s hope legislators take note and include the suggested additional protections for privacy that the CDT and others are proposing.
Featured image created with Stable Diffusion.
