law_enforcement_guidelines

viewhistorytalk

Guidelines for Law Enforcement

Effective as of March 31, 2016

These guidelines provide U.S. law enforcement with information about Reddit, Inc. (“Reddit”), its business and user records, and the legal process required to compel Reddit to produce information regarding Reddit users in the course of criminal and civil investigations.

This guide is for informational purposes only. It is not a commitment by Reddit to take specific action in given circumstance and creates no contractual obligation.

Reddit takes the privacy of its users seriously. Reddit therefore insists on compliance with procedural requirements, scrutinizes requests and legal process for facial validity and legal sufficiency, and objects to legal process, when appropriate. Although Reddit provides these guidelines, Reddit does not waive and expressly reserves all available rights and objections and your compliance with these guidelines do not necessarily equate with compliance with the relevant legal requirements.

What is Reddit?

Reddit operates several products and services, including reddit.com, redditgifts.com and any associated Reddit mobile applications. The most popular product is reddit.com, which provides an online forum where people can create communities (known as “subreddits”) in which users can communicate online. Each subreddit has its own page, subject matter, users, and moderators. Users post stories, links, and media to these communities, and other users can comment and can “upvote” or “downvote” a post. Most Reddit content is publicly available to you without needing to seek any assistance from Reddit.

The information that is collected by Reddit varies depending on what services the user utilizes. For example:

  1. if the user signs up to post on the website, Reddit does not require its users to provide their name or contact information (including, but not limited to, email address), though users can choose to do so. Reddit does not verify the validity of information submitted.

  2. if the user signs up to Reddit Gifts, the user may be asked to provide Reddit with personal information such name, address, telephone number, age, personal interests, and email address. The user may also be required to provide log-in information for an existing Reddit Account or to create one before using Reddit Gifts.

More information about Reddit and its services is here.

What Account Information does Reddit have?

Except for when a user is signing up to Reddit Gifts, Reddit generally collects minimal information from users and may have little or no non-public information available regarding a user. Where Reddit has information about a user that information can be separated into three basic categories:

  • Basic subscriber information. This includes a Reddit subscriber’s name, address, IP logs, username or other subscriber identity, and billing information (if any).

  • Other non-content records or information about a user or the user’s conduct on Reddit. This may include message headers, user preferences and certain activity logs.

  • Communications content. This may include the content of posts, comments, and messages, as well as other information regarding the substance of a Reddit user’s communications on Reddit (such as upvotes/downvotes, posts/subreddits viewed, and/or search terms). Most Reddit content, aside from private messages between users, is publicly accessible and therefore available to you without Reddit’s assistance.

Except for the IP address used to create your account, Reddit will delete any IP addresses collected after 100 days.

For more information about the information Reddit collects, please see Reddit’s privacy policy and the privacy notice for Reddit Gifts.

Does Reddit have access to user-generated photos or videos?

Reddit hosts some image uploads (i.e., redditmedia.com images), however Reddit is not the sole hosting provider for images that appear on the platform.

Data Retention Information

User Account Information is retained by Reddit in accordance with Reddit’s privacy policy; some information is collected by Reddit automatically and some information is provided to Reddit at the user’s discretion.

What information exists once a user has deleted their user account?

Once a user has deleted their account, the profile will no longer be visible to other users of the platform and it will become publicly disassociated with any posts or comments that were made during the time the account was active. However, posts, comments and messages will still be visible, unless such content was deleted.

Certain information about a user profile may be retained by Reddit as required by law or for legitimate business purposes. Please contact us (at the email address below) if you require information on a user that has deleted their user account.

How do I make a preservation request?

We do not retain data for law enforcement purposes unless we receive a valid preservation request before a user has deleted that content from our platform or before the Preservation Period expires.

Consistent with 18 U.S.C. § 2703(f), Reddit will preserve records for up to 90 days pending issuance of legal process if it receives a written preservation request in the form noted below:

  1. Signed by the requesting official;
  2. Include the Reddit user name and the URL of any relevant Reddit posts;
  3. Identify the records to be preserved;
  4. Identify the time period for which records are to be preserved (maximum 90 days);
  5. Confirm that valid legal process is forthcoming;
  6. Have a valid return official email address; and
  7. Be sent on law enforcement letterhead to lawenforcement@reddit.com with the subject line reading “Preservation Request - u/[insert relevant username here]”.

Unless Reddit receives an additional preservation request, Reddit will after 90 days release the preservation and the preserved records will be subject to Reddit’s normal retention or destruction schedules.

Will users be notified of a preservation request on their user account?

No. However, users will be notified of any subsequent legal process that is not accompanied by a valid non-disclosure order issued by the court.

Requests for Reddit User Account Information

Requests for user account information from law enforcement must be directed to Reddit in San Francisco, California. Reddit will respond to valid legal process which is issued in compliance with applicable law.

Facial Validity and Legal Sufficiency

Reddit reviews legal process to ensure facial validity and legal sufficiency under applicable laws and regulations, such as the federal Stored Communications Act, 18 U.S.C. § 2701, et seq., and the California Electronic Communications Privacy Act, Cal. Penal Code § 1546, et seq. (“CalECPA”).

All legal process and requests for user information must be

  • narrowly tailored,
  • specifically identify the account at issue (e.g. u/[insert username]), and
  • specifically identify the information sought (e.g. basic subscriber information) which cannot otherwise be obtained online.

Reddit cannot respond to invalid, overbroad, or vague requests. Reddit also reviews all legal process and requests to ensure they are not objectionable for other reasons, such as requests that seek confidential or proprietary information, privileged information, or information protected from disclosure under the First Amendment to the U.S. Constitution.

Legal Sufficiency - Federal Law Enforcement Officers

The Stored Communications Act establishes the following requirements:

Administrative, Trial, or Grand Jury Subpoena Section 2703(d) Order Search Warrant
Basic subscriber information Basic subscriber information. Other non-content records or information about a user or the user’s conduct on Reddit. Basic subscriber information. Other non-content records or information about a user or the user’s conduct on Reddit. Communications Content.

Legal Sufficiency - State Law Enforcement Officers

Requests and legal process from state law enforcement officers must comply with relevant state laws governing access to user records. For example, CalECPA requires the following:

Subpoena Search Warrant
Name, address, online contact information, services used, length of service All other content and non-content information (i.e., IP logs, message headers, location information, content).

Will users be notified of a request for information on their user account?

Yes, unless Reddit is prohibited from doing so by statute or a valid court order, Reddit’s policy is to provide notice of requests and legal process seeking a subscriber’s information to that subscriber. Reddit will generally give the user a reasonable period of time to file an objection to production (for example, under Cal. Penal Code § 1546.4(c)) before producing responsive records. Where a statute or court order prohibits notice for a limited time period, Reddit provides notice upon expiration of that period.

In emergency, exigent or counterproductive circumstances (e.g., emergencies; account compromises), Reddit may exercise its discretion not to provide a user with notice of a request for their account information prior to production to law enforcement. However Reddit reserves the right to provide notice to affected users after production has occurred.

Production of Records

We provide responsive records in electronic format. In accordance with 18 U.S.C. §2706, reimbursement for the costs associated with production may be requested.

Witness Testimony

Reddit does not provide expert witness testimony and does not have witnesses on call who are available to testify.

Emergency Disclosure Requests

If you believe that an emergency poses an immediate threat of death or serious bodily harm requires disclosure without delay of Reddit’s business records, please complete this Emergency Disclosure Form and send it to Reddit from an official federal or state governmental email address to lawenforcement@reddit.com with the subject “Emergency Disclosure Request - u/[insert user name]”.

Reddit evaluates these requests on a case-by-case basis and may request additional information to verify the nature of the request and requestor’s identity. It does not commit to producing records under any set of circumstances or within a particular timeline. To seek to compel Reddit to produce information, please obtain and personally serve valid and sufficient legal process.

Will users be notified of an emergency request on their user account?

As previously discussed here, should user account information be produced in reply to an emergency request, Reddit may exercise its discretion to delay notice to users.

Foreign law enforcement requests

If you are not U.S. law enforcement, emails sent to lawenforcement@reddit.com may not be responded to if they are not in English language. A Mutual Legal Assistance Treaty request or letter rogatory may be required to compel the disclosure of the contents of a user account.

Contact Information

U.S. law enforcement must submit copies of requests and legal process directed to Reddit via email to the email alias lawenforcement@reddit.com. If you need to contact Reddit about potential or pending legal process or request, this email address is the best way to do so, including for emergencies. U.S. law enforcement can also mail courtesy copies of legal process or requests to 548 Market Street, #16093, San Francisco, CA 94104-5401. Requests and legal process can be served on Reddit via its agent, Corporation Service Company, 2710 Gateway Oaks Drive, Suite 150N, Sacramento, CA, 95833.

The lawenforcement@reddit.com email address is to be used for Law Enforcement Officers, only.

Reddit provides these addresses as a convenience, and does not waive its rights to insist on personal or proper service of legal process.

Changes

We may change these Guidelines for Law Enforcement at any time, without any notice.


revision by sodypop— view source