A federal agent's creation and use of a Facebook account masquerading as a real woman wrapped up in a coke trafficking ring has prompted questions about how the Justice Department has adapted to the realities of investigation in the digital era.
Sondra Arquiett, of Watertown, New York, was arrested and ultimately convicted of participating in a cocaine distribution ring, run by her boyfriend, from 2008 to 2010. After she was nabbed four years ago, the Justice Department claims that Arquiett allowed agents to use information obtained from her seized cell phone to aid the investigation, but did not authorize the manufacture of a Facebook profile pretending to be her, according to an Associated Press report.
The DEA initially defended its practices in a court filing, calling Arquiett's consent to use the information "implicit consent," but has since issued a statement indicating the agency's plans to review the incident and the practice of creating fake online profiles.
The now-deleted Facebook profile included several images of her, her young son and niece, as well as several messages that she claims were crafted by DEA agent Timothy Sinnigen.
"It's wildly inappropriate for law enforcement to essentially steal a woman's photographs and use her as bait without her consent," Electronic Frontier Foundation staff attorney Nate Cardozo told VICE News. "'Implicit' consent doesn't cut it, especially when photographs of her children were also used."
Creating fake social media profiles based on real people raises a host of questions and concerns about law enforcement's evolving use of technology in investigations.
"I think sometimes social media can confuse people's privacy intuitions," Jay Stanley, senior policy analyst with the American Civil Liberties Union, told VICE News. "We're carrying out conversations that once would have been private, on public forums. That's been a big assist for law enforcement."
The DEA and other branches of law enforcement, used to treat the internet like "pretend world" in terms of how they internally handled operations, oversight, and policy, according to former FBI agent Mike German, a veteran of 16 years who has participated in undercover operations.
As a consequence, because some operations were not subject to the same oversight as the physical world, "doing so creates unregulated behavior that's potentially dangerous," German said. "When you're talking about uses, ruses, and impersonating people online, the risks are the same as in the real world — all reasons we want that oversight. With real world investigations there are numerous guidelines and limits on investigative authority, all of which have oversight."
That's exactly what Arquiett is claiming in a lawsuit against the DEA: The fake Facebook profile caused her "fear and great emotional distress" and made others think she was cooperating with the federal investigation, putting her at risk. She's asking for $250,000 in damages.
The policies about the digital world are changing slowly, German said. Notably, the FBI has established a policy for using common digital tools such as social media. And the Department of Homeland Security has also developed guidelines for using what's called "open source intelligence" or information that's available to the general public — such as social media.
But, given the events surrounding the fake Arquiett profile, it's clear not every branch of the Justice Department has updated its policies.
German refused to discuss undercover investigative methods and techniques, but did say that perhaps the one most significant changes in investigative practices at all levels of law enforcement is the mass scraping of public webpages and social media activity.
Such software is now cheap enough and widely available for law enforcement to purchase, German said. People's activities are increasingly moving online, so scraping software is often used with little or no oversight and regulation, and technology is moving faster than legislation.
"This is the era of digital snake oil salesmen," German said. "As these 'cool' new tools appear, with no oversight or which agencies getting access, there are lingering questions about whether or not they are even effective at catching criminals. In many situations they are simply not effective."
German believes that scraping tools are incredibly invasive to people's privacy, but added that a lot of the information gained isn't actually relevant to any specific investigation. He recommends that to use any of these tools, there should be a specific law enforcement purpose — like a particular suspect.
Follow Max Cherney on Twitter: @chernandburn