Ted Ullyot: Facebook Releases Data, Including All National Security Requests

Over the last week, in press statements as well as Mark’s post last Friday, we’ve repeatedly called for governments worldwide to be willing to provide more details about programs aimed at keeping the public safe. We’ve also urged them to allow companies to divulge appropriate information about government orders and requests that we receive, in a manner that does not compromise legitimate security concerns.

Requests from law enforcement entities investigating national security-related cases are by their nature classified and highly sensitive, and the law traditionally has placed significant constraints on the ability of companies like Facebook to even confirm or acknowledge receipt of these requests – let alone provide details of our responses.

We’ve reiterated in recent days that we scrutinize every government data request that we receive – whether from state, local, federal, or foreign governments. We’ve also made clear that we aggressively protect our users’ data when confronted with such requests: we frequently reject such requests outright, or require the government to substantially scale down its requests, or simply give the government much less data than it has requested. And we respond only as required by law.

But particularly in light of continued confusion and inaccurate reporting related to this issue, we’ve advocated for the ability to say even more.

Since this story was first reported, we’ve been in discussions with U.S. national security authorities urging them to allow more transparency and flexibility around national security-related orders we are required to comply with. We’re pleased that as a result of our discussions, we can now include in a transparency report all U.S. national security-related requests (including FISA as well as National Security Letters) – which until now no company has been permitted to do. As of today, the government will only authorize us to communicate about these numbers in aggregate, and as a range. This is progress, but we’re continuing to push for even more transparency, so that our users around the world can understand how infrequently we are asked to provide user data on national security grounds.

For the six months ending December 31, 2012, the total number of user-data requests Facebook received from any and all government entities in the U.S. (including local, state, and federal, and including criminal and national security-related requests) – was between 9,000 and 10,000. These requests run the gamut – from things like a local sheriff trying to find a missing child, to a federal marshal tracking a fugitive, to a police department investigating an assault, to a national security official investigating a terrorist threat. The total number of Facebook user accounts for which data was requested pursuant to the entirety of those 9-10 thousand requests was between 18,000 and 19,000 accounts.

With more than 1.1 billion monthly active users worldwide, this means that a tiny fraction of one percent of our user accounts were the subject of any kind of U.S. state, local, or federal U.S. government request (including criminal and national security-related requests) in the past six months. We hope this helps put into perspective the numbers involved, and lays to rest some of the hyperbolic and false assertions in some recent press accounts about the frequency and scope of the data requests that we receive.

We will continue to be vigilant in protecting our users’ data from unwarranted government requests, and we will continue to push all governments to be as transparent as possible.

About the Author: Theodore W. Ullyot is an American lawyer and former government official. He is General Counsel to the social network Facebook, where he leads the company’s legal team. In May 2013, he announced that he will step down from his position in July 2013.