With over 200 million Facebook users in the United States, almost every Investigator will be writing Facebook search warrants in their career. Facebook, a product of Meta Platforms Inc., is their flagship social media platform that has dominated the internet since it’s creation in 2014. As the platform has evolved over the years, new features have been added. With new features comes new evidence sources.
Understanding Facebook
According to a Pew Research study, seven-in-ten adult Facebook users in the US say they visit the site daily. With each visit, more and more information about the user is collected. Every action that the user takes like posting a photo, sending a message or liking a post is recorded and can provided to law enforcement with a search warrant. Additionally, simply logging into the site will record the user’s IP address, potentially identifying their location.
Facebook IDs and Vanity Names
Meta Platforms Inc., then Facebook, purchased Instagram in 2012. Since then, Meta has been slowing realigning the Facebook backend to work in a similar way as Instagram. This makes sense from a developers standpoint. One person having two different IDs or two blocks of code that accomplish the same thing but are written in completely different ways results in confusion and redundancy.
When investigating a Facebook account, the most important task is to properly identify the account. Meta Platforms like Facebook and Instagram have vanity names and users names. This is an important distinction because when writing Facebook search warrants, Meta cannot locate a profile based on their vanity name alone.
The vanity name, or display name, helps other Facebook users know who the profile they are visiting belongs to. A tell tale way too know you are looking at a vanity name is by checking for spaces. The profile below shows both the vanity name and the users name. In this example, Maverick Data Systems is the vanity name. When writing Facebook search warrants, this name cannot be used to identify the account.
The address bar contains the Uniform Resource Locator (URL) which contains the profile username. In this example, the profile username is WarrantBuilder. When serving your search warrant to Facebook, it is important to note the last date that you saw www.facebook.com/WarrantBuilder as active.
Locating the User ID
Even more important than the profile name is the user ID number. These ID number can never be changed and are not recycled. If the Facebook profile you are investigating suddenly disappears, chances are the account was not deleted. It is more likely that their profile name was changed. If you did not take note of the user ID number, and you don’t know what the owner changed the name to, you may never be able to locate the profile again.
There are third-party tools and websites that will help you locate the user ID number, but it is important to know how to locate this yourself. You may not be able to verify that a random website got the number right! Finding the ID is easy, but does require an extra step.
To begin, you need to be on the Facebook profile that you are investigating.
- Right click and select Show Page Source
- CTRL + F to open the Find search bar.
- Search for “userID”
As shown below, the user ID number is 100063635499732. You will also see the profile name light to the right of the userVanity value. To double check your work, you can append the userID number to the address Facebook.com. It will look like www.facebook.com/100063635499732 and will take you to www.facebook.com/WarrantBuilder.com.
NOTE: A quick note about usernames or IDs and all the junk that follows them. Frequently you will see the username or ID followed by /mibextid= with 6 or seven letters and numbers. The mibextid is a parameter that is used to track the source of the traffic to the URL. For example, if you click on a link to a Facebook page in an email, the mibextid is used to track which email you clicked on. When writing warrants to Meta, it is advised to omit the mibextid. Essentially, select everything after the username/ID.
Facebook Activity Evidence
There is a wide variety of records that can be collected from Facebook profiles. Meta Platforms Inc. uses some specific terminology when referencing user account data. When writing Facebook search warrants, an officer should almost always ask for Neoprint and Photoprint data.
Neoprint Data
A user’s Neoprint is an expanded view of a given user profile and consists for the following:
- Profile contact information
- Status update history
- Mini-feed
- Wall posts
- Notes
- Shares
- Friends list
- Groups that the user is a part of or manages
- Events, both attended or that the user plans to attend
- Videos
Photoprint Data
A user’s Photoprint is a compilation of all photos uploaded by the user that have not been deleted, along with all photos uploaded by any user which have the requested user tagged in them.
Basic Subscriber Information
Basic Subscriber Information consists of the profile user ID number, provided email address, date and time that the account was created including the IP address used at the time of creation, recent logins, and the mobile phone number with an indication of it being verified or not.
Facebook App Evidence
Facebook users that install the Facebook app on their mobile phones provide even more information to Meta Platforms Inc. in the form of location based data. By installing the app, users allow for enhanced tracking in exchange for additional Facebook features. Giving the app access to features of a phone means giving Meta Platforms Inc. the ability to see your location at all times.
This opens the door to many investigative possibilities like seeing if your suspect was at a crime scene or doing a Facebook “ping” to locate the devices the user is logged into. Because the Facebook app has access to the device’s GPS, the locations reported back to Meta are much more accurate than phone tower records.
Writing Facebook Search Warrants
For California law enforcement, it is important to note that any search warrant for Facebook records must be CalECPA compliant. When identifying your account, always remember to use the profile name or user ID and never use the vanity name. The key items to request are Basic Subscriber Information and the Neoprint. If your Investigation involves additional aspects of Facebook, like Marketplace, Groups, Pay or Dating, be sure to request those separately as they will not be included in a basic return.
Serving your search warrant to Facebook
Meta Platforms Inc. does require law enforcement to register for an account with their Law Enforcement Online Request system. Register using your official agency email at www.facebook.com/records/ for an account. If nobody from your Agency has registered for an account, the process may take about a day to complete, so it’s smart to request access early.
Once logged in, the portal asks several case related questions such as case number, date the warrant was signed, when requires are required by, and questions about a non-disclosure order. It will also require you to provide the profile name or user id as well as the date that you last saw the profile.
Learn more about writing search warrants for social media and technology with our Understanding Search Warrants series about Technology Search Warrants.
