Source: https://wikimediafoundation.org/about/transparency/2019-2/frequently-asked-questions/
Timestamp: 2020-08-05 16:48:47
Document Index: 795748306

Matched Legal Cases: ['§2510', '§ 2701', '§ 3121', '§1801', '§ 2511', '§ 3121', '§ 1651', '§ 2703', '§ 2702']

Our perspectives on policy
Does the Wikimedia Foundation have different standards for granting requests for user information depending upon who makes the request? How are these requests processed?
What happens when you receive a request for nonpublic personal information from abroad?
What do you mean by “information produced”?
What’s the difference between “information produced (partial)” and “information produced (all)”?
What do you mean by "informal non-government request"?
What do you mean by "informal government request"?
What do you mean by "civil subpoena"?
What do you mean by "criminal subpoena"?
What do you mean by “administrative subpoena”?
What do you mean by “search warrant”?
What do you mean by “court order”?
What do you mean by “international court order”?
What do you mean by “national security request”?
What is a “wiretap” or a “pen register”, and why doesn’t the Wikimedia Foundation list them in its Transparency Report?
Have you ever received an order under the All Writs Act?
What do you mean by “user accounts potentially affected”?
What do you mean by “user accounts actually affected”?
What do you mean when you say “user accounts notified”? When would you not tell a user that their nonpublic personal information is being disclosed as a result of a legal process, such as a subpoena?
What do you mean by “preservation request”?
What do you mean by “emergency disclosure”?
What do you mean by “Right To Erasure”?
How are requests for user data calculated differently by the Wikimedia Foundation as compared to other organizations?
What is the Wikimedia Foundation doing to help improve laws related to disclosure or surveillance of user information?
Help! I’m being sued because of something I did on the Wikimedia projects. What should I do?
Does the Wikimedia Foundation ever remove content?
What makes a DMCA takedown notice “valid” or “proper”?
What do you mean when you say a project was “targeted” by a takedown, alteration, or DMCA request?
All sorts of identifying information, public and nonpublic, gets requested. Requests tend to be very broad in nature, in order to capture as much information as possible. However, most information on the projects is public: for instance, talk pages or information relating to a page’s edit history. We store very little nonpublic information. Some of it is collected automatically (such as the IP address of the user's device or their proxy server and user agent information), while other types of nonpublic information are optionally provided by the user (such as an email address). With some narrow exceptions, nonpublic information that includes personal information of any particular user is only kept for a short amount of time. You can learn more about the types of information we collect and how long we retain that information in our Privacy Policy and Data Retention Guidelines.
No. Regardless of who is requesting user data—be it an individual, a government, or a law enforcement officer—the Wikimedia Foundation only discloses nonpublic user information in accordance with our Terms of Use, Privacy Policy, and applicable U.S. law, including the Electronic Communications Privacy Act (ECPA) (18 U.S.C. §§2510-2522, 18 U.S.C. §§ 2701-2711, and 18 U.S.C. §§ 3121-3127). We typically do not produce information as a result of a request unless we have received proper legal process. Submitted requests must be reasonable, specific and relevant. Requests must include contact information for the requester, and a specific deadline. Finally, requests must be legally valid and enforceable under United States law, in the form of a court order, subpoena, warrant, or request served under the mutual legal assistance treaty or letters rogatory process.
Additionally, we may disclose information in response to emergency requests in accordance with ECPA (18 U.S.C. 2702(b)(8)) when there is a credible and imminent threat of death or serious bodily harm. These requests must meet specific criteria, including detailing the nature of the emergency, why it is believed to be imminent, and the specific information requested and how it is necessary to prevent the threat from being carried out.
Per our Requests for User Information Procedures & Guidelines, we require requests originating from outside of the United States to follow the mutual legal assistance treaty (MLAT) process or letters rogatory process, so that a U.S. court will issue the required U.S. legal process to the Wikimedia Foundation. The MLAT process involves a network of treaties between countries, which require them to aid each other in obtaining information used for enforcing laws. Letters rogatory are a type of request issued by a court in one country to a court in another country, usually seeking assistance to serve process or gather evidence.
For content requests received from abroad, we evaluate the request to determine if it presents an applicable legal requirement in our jurisdiction and, if so, we respond to it appropriately. If it does not, we help requesters understand Wikipedia and provide them with information to work productively with the volunteer community.
If you are the subject of a subpoena, it is highly recommended that you consult your own lawyer immediately. There are a number of organizations that will fight on a user's behalf, like the American Civil Liberties Union (ACLU) or the Electronic Frontier Foundation (EFF). If you need help finding an attorney, the Wikimedia Foundation may be able to put you in touch with some of these organizations or help you secure an attorney at reduced or pro-bono rates. In rare cases, assistance may also be available under our Legal Fees Assistance Program or Defense of Contributors Program. Additionally, in certain situations, the Wikimedia Foundation may challenge a subpoena on a user’s behalf if it is unnecessarily broad or burdensome, or if we believe the subpoena threatens the free speech of users on the projects. For more information about subpoenas, see our Subpoena FAQ.
When we say “information produced”, we mean that as a result of a legal process (such as a subpoena) that was legally valid, some or all of the nonpublic user information requested by that legal process was produced by the Wikimedia Foundation to the requesting party. “Information produced” also applies to rare emergency situations where we voluntarily disclose personal information to law enforcement, or produce such information in response to an emergency request, in order to prevent imminent bodily harm or death.
When we say "informal non-government request", we mean a request for user information from a non-governmental entity that does not involve a formal legal process. For example, this would include a situation where a corporation sends us a letter or an email requesting nonpublic information about one of our users.
When we say "informal government request", we mean a request for user information from a governmental entity that does not involve a formal legal process. For example, this would include a situation where a government sends us a letter or an email requesting nonpublic information about one of our users.
When we say "civil subpoena", we mean a legal process received by the Wikimedia Foundation from a third-party individual or organization requesting nonpublic user information that usually relates to a legal dispute between two or more individuals or organizations. Civil subpoenas generally do not require review by a judge or a magistrate.
When we say “criminal subpoena”, we mean a legal process received by the Wikimedia Foundation requesting nonpublic user information that is typically issued by a government attorney or grand jury, in connection with an official criminal investigation.
When we say “administrative subpoena”, we mean a legal process received by the Wikimedia Foundation requesting nonpublic user information that has been issued directly by a government agency, without judicial oversight.
When we say “search warrant”, we mean a warrant issued under the procedures of the United States’ Federal Rules of Criminal Procedure or equivalent state warrant procedures, based upon a showing of probable cause that specific information held by the Wikimedia Foundation may be related to a crime. Search warrants are generally reviewed by a judge or a magistrate.
When we say “court order”, we mean an order issued by a court directed at the Wikimedia Foundation. If an order has been issued by a court of competent jurisdiction, we will evaluate the request. For example, court orders for user data may be issued under various U.S. federal and state laws, such as section 2703(d) of the Electronic Communications Privacy Act (“ECPA”). As another example, some court orders may require the Wikimedia Foundation to alter or remove content from Wikipedia. In this category, we count court orders that come from a court in the United States.
For the avoidance of doubt, we believe a warrant is required by the 4th Amendment to the United States Constitution, which prohibits unreasonable search and seizure and overrides conflicting provisions in ECPA. We believe that ECPA needs to be updated so that equivalent protections are granted to electronic communications and documents that have already been granted to the physical documents one keeps at home or in their office. To that end, we are a member of the Digital Due Process Coalition to help in that effort.
When we say “international court order”, we mean an order directed at the Wikimedia Foundation and issued by a court outside the United States. Some court orders may request user data; others may request that the Wikimedia Foundation alter or remove content from Wikipedia. We evaluate each order to determine if it presents an applicable legal requirement in our jurisdiction. If so, we respond appropriately. If not, we help the requesters understand how Wikipedia works, and provide them with information to work productively with the volunteer community. We ask all parties outside of the United States who request nonpublic data on Wikimedia users to go through the MLAT or letters rogatory process (see “What happens when you receive a request for nonpublic information from abroad?”
“National security requests” include national security letters and orders issued under the Foreign Intelligence Surveillance Act (50 U.S.C. §1801 et seq.).
A wiretap order (see The Wiretap Act, 18 U.S.C. § 2511 et seq.) is an order that requires the real-time interception of the content of telephone or internet communications. A pen register order (see The Pen Register Statute, 18 U.S.C. § 3121 et seq.) requires the real-time interception of non-content information associated with telephone or internet communications (such as routing information). We have never received a wiretap or pen register order relating to activity on the Wikimedia projects. Should we receive such an order, we will disclose it in this report if allowed to do so by law.
No. The All Writs Act (28 U.S.C. § 1651) allows federal courts to issue all orders “necessary or appropriate in aid of their respective jurisdictions”. The Act has been used as a basis for orders requiring technology companies to access password-protected information. Thus, some technology companies and organizations may report All Writs Act requests in their transparency reports. We have not received such an order. If we do, and we are legally able to do so, we will include it in this report.
This number represents the number of unique user accounts implicated by requests for user data and whose data would have been disclosed if we had granted every request we received. This number may not reflect the number of unique individuals implicated by requests for user data, since an individual may have multiple accounts across all Wikimedia projects, and we record each user account separately. As a result, this number might overestimate the number of individuals implicated by user data requests.
This number represents the number of unique user accounts whose nonpublic information was disclosed as a result of the Wikimedia Foundation receiving a valid request for user data. This number may not reflect the number of unique individuals whose data was disclosed as a result of a valid request for user data, since an individual may have multiple accounts across all Wikimedia projects, and we record each user account separately. As a result, this number might overestimate the number of individuals implicated by user data requests.
A preservation request is an order from the U.S. government under the Electronic Communications Privacy Act (18 U.S.C. § 2703(f)). It requires us to retain information that would otherwise be deleted, anonymized, or aggregated within 90 days, according to our Data Retention Guidelines. If we receive one of these requests, we are legally required to retain the specific information indicated. However, we will not turn this information over to the requesting party unless they subsequently follow our Requests for User Information Procedures & Guidelines, and obtain a legal order, such as a subpoena or warrant, for the information in question. A preservation request requires us to preserve something. We will never produce information in response to a preservation request, and simply because we have preserved information does not mean that the party will follow the proper steps and obtain an order requiring us to produce it later.
An “emergency disclosure” includes two types of disclosures: voluntary disclosures, and emergency requests. “Voluntary disclosure” refers to a case in which we become aware of statements on the projects that threaten harm to the user who made the statements and/or other individuals, and—on our initiative—choose to disclose nonpublic user information to a law enforcement agency. Such disclosures are rare; they are made only in accordance with the exceptions outlined in our Privacy Policy, such as to protect you, ourselves, and others from imminent and serious bodily harm or death.
An “emergency request” is a request made when law enforcement has contacted us because of an imminent threat to life or limb, and we have decided to release information according to the process described in our Requests for User Information Procedures & Guidelines and the Electronic Communications Privacy Act (see 18 U.S.C. § 2702). When we feel that a law enforcement request does not rise to this level, we classify it as an “informal government request” instead.
The Right to Erasure, sometimes called the Right to be Forgotten, is a right under the laws of various countries that allows individuals to request that certain information relating to them be delisted or removed. We receive requests relating to Wikimedia project content, which cite the Right to Erasure as the reason why project content should be altered or removed. We believe in a Right to Remember. Everyone should have free access to relevant and neutral information of public concern. For more information about our concerns, see our August 2014, October 2016, July and November 2017 and September 2019 blog posts about intervening in a related case.
In our transparency reports, the Wikimedia Foundation includes all types of requests for user information it receives, including governmental and non-governmental requests as well as informal and formal requests. Some other organizations, including several of those appearing in the “Compared to other companies” graph in our report, only disclose requests originating from governments. Please visit the transparency reports of Facebook, Google, Twitter, and LinkedIn for more details about the types of requests they receive.
Our core values of freedom of speech and access to information can be threatened by laws that compromise user privacy. For this reason, the Wikimedia Foundation has joined the fight against online surveillance.
In 2013, we joined the Digital Due Process Coalition (DDPC), an organization focused on reforming the United States Electronic Communications Privacy Act (ECPA). ECPA specifies standards for law enforcement access to electronic communications and associated data, thereby providing a degree of privacy to users of digital communication services. However, ECPA was enacted in 1986, meaning that it does not adequately protect users anymore, and only serves to provide inconsistent standards for law enforcement when dealing with “new” technologies. The DDPC’s mission is to simplify, clarify, and unify ECPA standards—providing clearer privacy protections for users, while taking into account changes in technology and usage patterns, and preserving the legal tools necessary for government agencies to enforce the laws and protect the public.
In 2014, we signed onto the Necessary and Proportionate Principles, which support the application of human rights to mass surveillance and set forth basic principles to which governments should adhere when employing modern surveillance technologies. In March 2015, we took an even stronger stand. The Wikimedia Foundation joined eight other co-plaintiffs in filing a lawsuit against the U.S. National Security Agency over its “Upstream” mass surveillance practices, which capture communications passing through the Internet “backbone.” While the claims of all plaintiffs were originally dismissed by the district court, in May 2017, the Court of Appeals for the Fourth Circuit ruled that the Wikimedia Foundation has standing to proceed. Following further litigation at the District Court, the case is now again on appeal to the Fourth Circuit. Please see our December 2019 blog post for further details.
We strongly oppose mass surveillance by any government or entity, and hope that this lawsuit becomes an important step in enacting change. For more information, see our resources page on the case.
All content on the Wikimedia projects is written, uploaded, edited, and curated by people like you from around the world. Volunteer contributors jointly develop and enforce the policies and procedures that govern the content on the projects. This means that users decide what should and shouldn’t be included on the projects, keeping in mind both U.S. law and the particular project’s own policies.
Each community has policies and procedures to handle disputes about whether certain content belongs on a particular project or meets that project’s standards. When a third party has a Wikipedia article written about them and doesn’t like some of the content included in that article, their first step should be to reach out to the community itself, as opposed to the Wikimedia Foundation.
Lawsuits against Wikimedia users are exceedingly uncommon—most disputes about content are resolved by working with the user community through community-driven processes. In fact, individuals and organizations that sue over content they wish to remove from the public eye often end up causing that content to receive greater public attention as a result of the lawsuit, a phenomenon known as the Streisand Effect.
In the unlikely event that you are the subject of a lawsuit, it is highly recommended that you consult your own lawyer. There are a number of organizations that will fight on a user's behalf, like the California Anti-SLAPP Project or the Electronic Frontier Foundation (EFF). If you need help finding an attorney, the Wikimedia Foundation may be able to put you in touch with some of these organizations or help you secure an attorney at reduced or pro-bono rates. Additionally, in rare cases, assistance may also be available under our Legal Fees Assistance Program or Defense of Contributors Program.
The vast majority of questions about content on the projects are ably handled by volunteer contributors. Absent the receipt of a legally valid DMCA notice, the Wikimedia Foundation supports community processes of evaluating and improving project content, and will generally only remove content in exceptional circumstances. For example, we once removed a blogger’s unredacted travel visa after somebody else posted the image with the blogger’s private information exposed.
When material is removed due to a DMCA takedown notice, the uploader of that content or a third party may believe that it did not violate copyright laws. If so, they may send us a DMCA counter-notice, stating their belief that the content did not infringe any copyrights. If the counter-notice complies with the statute, we will restore the content within 10-14 business days unless a lawsuit is filed by the copyright holder. Prior to the July 2016 Transparency Report, we had not received any DMCA counter-notices. Between January and June 2016, we received two. We have received no subsequent counter-notices.
During the July 2012 - June 2013 period, we recorded totals only for the entire period, rather than breaking the totals into six-month terms. In order to provide a better comparison with other reporting organizations, we changed the date ranges for our charts to line up with the timelines used by those organizations starting in July 2013.
Each request received counts as one request in the Transparency Report, irrespective of the number of webpages, content, or users that request deals with. For example, a request for user information that asks for the information of three users counts as one request for user data, and a DMCA takedown request that requests the removal of five images is counted as one DMCA request. Duplicate requests regarding the same matter from the same requesting party are also counted as one request. For example, if a requesting party sends us multiple demand letters to take a particular Wikipedia article down, it counts as one request.