ASKfm Guide For Law Enforcement

1. Background

ASKfm is an online social network that enables people to send questions to each other and answer them, when they want to. ASKfm is available as an iPhone or Android application (available through the Apple Store or Google Play), as well as a desktop website. The ASKfm service provides a way for users to ask each other questions in an anonymous or non-anonymous fashion.

In accordance with our Privacy Policy and Terms of Use ASKfm Europe Limited (“ASKfm”) collects and hosts information created by users and/or concerning user accounts, which may include personal information, when users use its services (collectively ‘user data’).

In certain circumstances we may be required by law, or in very limited circumstances we may in good faith believe it is necessary, to provide user data to law enforcement agencies. The purpose of this guide is to inform law enforcement agencies about the way to obtain information from ASKfm and the specific legal processes necessary to obtain such information. ASKfm is committed to cooperating with law enforcement investigations to the extent consistent with applicable law. In addition to this guide, law enforcement agencies may also contact ASKfm with questions or in emergency situations by emailing lawenforcement@ask.fm.

As ASKfm is an Irish entity and data controller, disclosure of user data is governed by Irish laws, including the Data Protection Acts 1988 and 2003, the Criminal Justice Act 2011 and the Criminal Justice (Withholding of Information on Offences Against Children and Vulnerable Persons) Act 2012. For ASKfm users in the U.S., U.S. law enforcement only should see section 4, for more information about legal process in the United States arising from the storage of ASKfm user data in the U.S.  Both U.S. and non-U.S. law enforcement requests should be sent to lawenforcement@ask.fm in accordance with sections 6 of this policy.

2. User Data Types

ASKfm does not respond to law enforcement requests which are overly broad in nature. Furthermore, when cooperating with law enforcement agencies ASKfm will assess whether the request relates to content or non-content information.

ASKfm considers ‘content’ information as relating to the substantive content of communications (such as user questions and answers); and ‘non-content’ information as relating to basic user information (such as name, registration duration, email address, registration IP address, etc.), as well as to user transactional logs.

ASKfm collects and stores user information in two ways. This depends on whether a user registers with ASKfm and is considered a “registered user,” or whether a user utilizes ASKfm without creating an account or providing any information other than information that is automatically collected as explained in the section below in which case the user is described as a “guest user.”

Information ASKfm may collect from users includes: name, username, password, email address, postal address, phone number, mobile phone number, payment information, gender, birth year, and other information they provide or post on ASKfm or allow ASKfm to access when they do certain things, such as:

  • Sign up and complete ASKfm’s registration form;
  • Create or edit user profile;
  • Login to the services;
  • Submit questions or answer questions;
  • Contact our customer support team or use our reporting mechanisms;
  • Enter a sweepstakes or contest or register for a promotion;
  • Participate in voting or polling activities;
  • Request certain features (e.g., newsletters, updates, or other products);
  • Connect with the services or otherwise allow us to access certain information about you via a social media service; or
  • Post user-generated content to or on our services.

Please note that not all the above mentioned information is required to create an account, and that user-provided information is not always independently verified by ASKfm.

3. Irish Legal Requirements and Process

A. Mandatory Process

Where ASKfm receives a mandatory Irish law request, by valid legal process, it may be compelled to produce certain user data it hosts. Absent an emergency, ASKfm does not disclose user content information to Irish or non-Irish law enforcement agencies except pursuant to a valid search warrant or court order, which in the case of non-Irish law enforcement requests must be made by first contacting the Central Authority in your country, who will then contact the Office of International Affairs at the U.S. Department of Justice to make a request pursuant to 28 U.S.C. § 1781 et seq (the ‘MLAT’).  The Central Authority in your country may submit the request to:

Office of International Affairs
U.S. Department of Justice
1301 New York Avenue NW, 8th Floor
Washington, DC 20005
Phone (202) 514-0000
Fax (202) 514-0080

Upon service of such valid and mandatory legal process, ASKfm may be legally compelled to provide content and non-content user data.

B. Voluntary Cooperation – Non-Mandatory

Where ASKfm receives requests for non-content information from Irish or international law enforcement agencies, in the absence of the service of valid and mandatory legal process under Irish law, ASKfm may in limited circumstances provide non-content information. This non-content information may be disclosed where ASKfm forms a good faith belief that the request is justifiable (under ASKfm’s policies), having assessed it on its merits and taking into account the relevant parts of ASKfm’s Privacy Policy and Terms of Service.  In making this assessment, ASKfm will apply the follow analysis:

  • Does the request accord with legal standards in the jurisdiction from which it is made?
  • Is the request intended to protect ASKfm’s users or ASKfm or the public?
  • Is the request consistent with internationally recognised norms, such as freedom of speech?

However, except in the case of emergency situations (as described further below), ASKfm will not disclose content information in the absence of the service of valid and mandatory legal process, unless otherwise obliged to do so by Irish law.

All voluntary requests for non-content data from Irish or international law enforcement agencies must comply with the following formalities:

All voluntary law enforcement requests which are not mandatory disclosures must:

i. be made by a dated request addressed to ASKfm Europe Limited;
ii. issued on government or official letterhead, or has a caption identifying the court or agency that issued the request;
iii. signed by a judge or other senior official or officer who provides their title and contact information;
iv. in the case of international law enforcement requests, be consistent with the legal requirements of the issuing jurisdiction;
v. be consistent with Irish law;
vi. identify the target, for which information is requested, by providing as much of the following information as possible:
the account login;
the account email address;
the full name of user as registered with ASKfm; and
the full URL of the question and answer at issue (e.g. http://ask.fm/askfm/answer/119942892554)
vii. specify the types of non-content account information being requested;
viii. specify the legal basis (applicable law) for the request, including the alleged offence (if relevant);
ix. specify why the relevant data is being sought; and
x. specify to whom or how the information being requested is to be delivered.

For the purpose of clarity, this section has no application to U.S.-based demands (see Section 4).

C. Emergency Requests

If law enforcement agencies provide ASKfm with information that gives us a reasonable good faith belief that there is a risk of imminent harm (i.e. death or serious physical injury) to a person, and that we have information in our possession that may avert that harm, we may disclose the information (content and/or non-content) we have where it is needed urgently to prevent injury or other damage to the health of a person. These requests are assessed by ASKfm on a case-by-case basis.

ASKfm may make emergency disclosures of user data to Irish and foreign law enforcement when ASKfm is provided with facts and circumstances from which it can make a determination that there is:

  1. risk of death or serious physical injury to a person or persons;
  2. the risk is imminent such that there is not sufficient time to obtain a valid and properly served Irish court order or MLAT order that would normally be required to compel production of user data;
  3. the user data requested is relevant to the investigation of the imminent risk; and
  4. there is sufficient information for ASKfm to form a good faith belief that producing the requested user data will assist law enforcement in deterring or otherwise addressing the imminent risk.

All requests for emergency disclosures must be made by law enforcement in the same way set out in sub-section B above and we will also need answers to the following questions:

  1. What is the nature of the emergency involving death or serious physical injury?
  2. Whose death or serious physical injury is threatened?
  3. What is the imminent nature of the threat? Please provide information that suggests that there is a specific deadline before which it is necessary to receive the requested information and/or that suggests that there is a specific deadline on which the act indicated in response to Question 1 will occur (e.g., tonight, tomorrow at noon).
  4. Please explain/describe how the information you request will assist in averting the threatened death or serious physical injury?

Please send this information via email as a “.pdf” of a letter on official letterhead or via an official government email account to lawenforcement@ask.fm. Please also include your full name, title, rank, badge number, and a confirmation that the information you have provided is complete and accurate.

D. Preservation Requests

We accept requests from law enforcement agencies to preserve records which constitute potentially relevant evidence in criminal proceedings pending the service of valid legal process. ASKfm will preserve, but not disclose, a one-time temporary snapshot of the then-existing user account record for 90 days pending service of valid legal process. This period may be extended pending an application by a foreign agency via the MLAT process or service of valid and mandatory legal process in the case of Irish law enforcement. ASKfm will not provide any account data (content or non-content) in these circumstances before the service of the appropriate legal process. Please send preservation requests to lawenforcement@ask.fm.

4. U.S. Legal Requirements and Process

A. Process Required to Obtain the Records

In order to release account records on a non-emergency basis, ASKfm requires proper legal process. The legal process required for each type of information is described below in detail.

The legal process submitted to obtain records should include an ASKfm username, email address associated with the account, the full name of the user (as registered with ASKfm) and/or the full URL of the question and answer at issue (e.g. http://ask.fm/askfm/answer/119942892554).  The request should also indicate if results must be returned before a specific date and where results should be returned.

ASKfm accepts service of process via email at lawenforcement@ask.fm and will produce documents in response to out of state legal process such as subpoenas, court orders, emergency requests, consent letters and search warrants without requiring domestication.

Subscriber Information and Access Logs

ASKfm will provide subscriber information and other related transactional information such as access logs in accordance with 18 U.S.C.§ 2703.  ASKfm collects and maintains certain subscriber information when a user creates a new ASKfm account or alters information at a later date. Please note that not all listed information is required to create an account, and that user-provided information is not always independently verified by ASKfm. Subscriber information includes:

  • ASKfm username;
  • Email address;
  • Account creation date.

ASKfm also maintains certain access log data when a user creates an account or accesses their account.
In order to produce such records, ASKfm requires a subpoena (including grand jury or administrative subpoena) or civil investigative demand pursuant to 18 U.S.C.§ 2703(c)(2), or a court order, search warrant or user consent.

Content Data

ASKfm maintains user content data and will disclose such data pursuant to proper legal process in accordance with 18 U.S.C. §2703(a) and United States v. Warshak, 631 F.3d 266 (6th Cir. 2010).
ASKfm collects and maintains various forms of content, including images, unanswered questions and answers.

Such content is maintained by ASKfm as long as the user does not delete such content. A user should not be able to delete content where a preservation request has been previously received by ASKfm.

In order to produce content information, ASKfm requires a valid search warrant in accordance with 18 U.S.C. §2703(a).

Preservation Requests

ASKfm honours requests from law enforcement to preserve information in accordance with 18 U.S.C. § 2703(f). Upon receiving a valid preservation request, ASKfm will preserve all available account information associated with the username listed in the request in an offline file for 90 days, and an additional 90 days in accordance with a preservation extension request pursuant to 18 U.S.C. § 2703(f) for up to 180 days.

ASKfm can only preserve information for active accounts. If a request to preserve information is received after an account has been deleted, ASKfm is not able to honor the request.

Note regarding legal process following preservation requests:

When serving follow up legal process for information that was previously the subject of a preservation request, please specify whether the request is seeking both the information preserved and/or any updated account information. Please also reference any prior preservation requests by date so that ASKfm may respond to your legal process more efficiently.

In order to preserve information in accordance with 18 U.S.C. § 2703(f), ASKfm requires a valid preservation request.

B. Emergency Requests

Pursuant to 18 U.S.C. §§ 2702(b)(8) and 2702(c)(4), ASKfm is permitted to disclose information, including subscriber information and access logs, voluntarily to a federal, state, or local governmental entity when ASKfm believes in good faith that an emergency involving danger of death or serious physical injury to any person requires such disclosure without delay.  ASKfm will disclose records to assist law enforcement in the case of emergencies meeting the law’s threshold requirements.

In accordance with US law, emergency requests from US law enforcement should take the following format:

“Dear Custodian of Records:

I request release of records for username [USERNAME] on an emergency basis pursuant to 18 U.S.C § 2702(b)(7) and § 2702(c). I have provided the answers to the following questions with as much detail as I am able to provide in order to establish a good faith basis for release of records on an emergency basis.

  1. What is the nature of the emergency involving death or serious physical injury?
  2. Whose death or serious physical injury is threatened?
  3. What is the imminent nature of the threat? Please provide information that suggests that there is a specific deadline before which it is necessary to receive the requested information and/or that suggests that there is a specific deadline on which the act indicated in response to Question 1 will occur (e.g. tonight, tomorrow at noon).
  4. Please explain/describe how the information you request will assist in averting the threatened death or serious physical injury?

I attest to the truth of the information provided subject to penalty of perjury.

 

______________________________                    ______________________________
Signature of Officer                              Printed Name of Law Enforcement Officer

______________________________                    ______________________________
Title and Badge Number                              Date

Please send this information via email as a “.pdf” of a letter on official letterhead or via an official government email account to lawenforcement@ask.fm. Please remember to include your full name, title, rank and badge number.

C. User Consent

In accordance with 18 U.S.C. § 2703(c)(1)(C), ASKfm will disclose information based on user consent obtained by law enforcement where sufficient information is provided to verify that the person providing the consent is the actual creator of the account and where law enforcement endorses the authenticity of the consent. ASKfm will not release information if the user is unable or unwilling to provide registration information that corresponds with the information on record with ASKfm. In the event that the information provided by the user does not match the information on record with ASKfm, proper legal process will be required before any information is released.

5. Civil Requests

ASKfm does not voluntarily respond to requests by lawyers or civil litigants for access to other users’ information. ASKfm will only disclose user data pursuant to valid legal process, except where a request is made with the account holder’s explicit consent. This means that ASKfm will only disclose user information in the context of civil proceedings where we are compelled to do so by a properly domesticated and served subpoena or a court order from a court with jurisdiction over ASKfm.

ASKfm has a policy of notifying a user when we receive legal process from a third party requesting that user’s data, except in certain circumstances, including where:

  • providing notice is prohibited by the legal process itself, by court order we receive, or by applicable law;
  • we, in our sole discretion, believe: (a) that providing notice could create a risk of injury or death to an identifiable individual or group of individuals; or (b) that the case involves potential harm to minors. Risk of harm tends to only rarely arise in civil proceedings, therefore ASKfm will require that the civil party involve law enforcement and that law enforcement communicate this concern to ASKfm.  A civil lawyer’s representation regarding a risk of harm in a case without law enforcement involvement will be an insufficient basis on which to withhold user notice.

6. How to Submit Law Enforcement Requests:

In addition to the formalities set out above, all law enforcement requests must:

a) be sent by email to lawenforcement@ask.fm;

b) include in the subject header ‘Law Enforcement Request’; and

c) be in the English language.

7. Policy Changes

This guide may be changed from time to time by ASKfm, and this document should be consulted in advance of making any law enforcement request.

ASKfm Europe Limited

Dated February 2015