In our inaugural "Who Has Your Back" campaign, we applauded Twitter for being one of the rare technology companies to fight for and defend their users' rights in courts. We're happy to see that they're continuing to stand up to protect the free speech and privacy rights of one of their users.

In February, we wrote about the New York City District Attorney's attempts to subpoena information from Twitter regarding the account of Malcolm Harris, one of the 700 people arrested on the Brooklyn Bridge in an October 2011 Occupy Wall Street protest. After Harris challenged the subpoena in court, Judge Matthew A. Sciarrino issued a written opinion (PDF), denying Harris' motion to quash and ordering Twitter to comply with the subpoena. Yesterday, Twitter filed it's own motion to quash the subpoena (PDF), arguing that complying would violate the law. And we're grateful they did, because Judge Sciarrino's order presents a serious risk to online privacy. 

First, the court ruled that Harris had no standing -- or a demonstrated connection to the legal claim -- to challenge the subpoena. Twitter's terms of service states that users give Twitter a license to use their tweets. According to the court, "Twitter’s license to use the defendant’s tweets means that the tweets the defendant posted were not his. The defendant’s inability to preclude Twitter’s use of his tweets demonstrates a lack of proprietary interests in his tweets."

As Twitter explained in its motion to quash, the judge completely misunderstood Twitter's terms of service, which clearly states users "retain your rights to any Content." The Court also misinterpreted the word "license." To license something means to give someone permission to use or access something. But a license doesn't transfer possession. If you let someone borrow your car, they don't suddenly become the owner of the car just because you've given them permission to use it. This traditional understanding of "licenses" shouldn't change just because something is done online. Twitter or any other social media site doesn't become the owner of your content just because you allow it to use your tweets or other content. After all, a user still has the ability to delete their tweets. And we're not the only ones who think users have standing to challenge subpoenas. Just last week, a federal judge in Illinois ruled two people had standing to challenge a subpoena issued to Verizon and Yahoo! in a civil lawsuit, asking for their email and contact records from various accounts.

Most problematic with Judge Sciarrino's order, however, is the notion that since users have posted their content to a remote server, they will never be able to challenge what happens to their information. That means online companies will have to be the ones to defend their users' privacy rights in court. And though Twitter did that here, the reality is that not many companies have followed Twitter's lead. And if users can't stand up for their rights, and companies won't stand up for them, then the public loses the ability to turn to the judicial system to vindicate their rights. 

The Court's order goes further astray by concluding that Harris' choice to use Twitter necessarily meant surrendering his Fourth Amendment privacy rights. The Court wrote:

While the Fourth Amendment provides protection for our physical homes, we do not have a physical “home” on the Internet. What an Internet user simply has is a network account consisting of a block of computer storage that is owned by a network service provider.  As a user, we may think that storage space to be like a “virtual home,” and with that strong privacy protection similar to our physical homes.  However, that “home” is a block of ones and zeroes stored somewhere on someone’s computer.  As a consequence, some of our most private information is sent to third parties and held far away on remote network servers.  A Twitter user may think that the same “home” principle may be applied to their Twitter account.  When in reality the user is sending information to the third party, Twitter.

Twitter's brief challenges this idea and argues the Fourth Amendment does apply, and we agree. The idea that the we lose our privacy rights because we turn information over to companies that store our information on a server somewhere else has steadily been challenged in recent years. The Sixth Circuit Court of Appeals ruled in 2010 that the Fourth Amendment applies to emails stored by an email storage provider, and law enforcement must get a warrant to obtain this information. Meanwhile, a federal Magistrate Judge in Texas ruled that the Fourth Amendment applies to cell phone tracking records held by wireless communication providers, meaning a search warrant is required to obtain this information. And earlier this year, U.S. Supreme Court Justice Sotomayor's concurring opinion in United States v. Jones -- which ruled that the Fourth Amendment applies to the installation of a GPS tracking device on a car -- noted that it was time to reconsider the idea that an individual has no right of privacy in information disclosed to third parties, commenting that this approach was "ill suited to the digital age." We filed amicus briefs in all three cases, and we especially share Justice Sotomayor's sense that its time to stop treating "secrecy as a prerequisite for privacy." Just because some information is disclosed to a company for a limited purpose doesn't mean we give up all of our privacy rights vis-a-vis the government in that information forever. 

Twitter has been getting well deserved kudos for standing up for one of its users. While the concept of the Internet as a "block of ones and zeroes" may be technically correct, it's not the way we see the online world. The web enables people to spread new ideas, communicate around the globe, and facilitate political action. Yet, to protect its potential, companies need to stand up for their users. We hope more companies follow Twitter's lead.