] We [eBay] can (and you authorize us to) disclose any information
] about you to law enforcement or other government officials as we,
] in our sole discretion, believe necessary or appropriate, in connection
] with an investigation of fraud, intellectual property infringements,
] or other activity that is illegal or may expose us or you to
] legal liability.

This is a question that I've been following closely, especially as regards the war on terrorism. If an ISP or other online service provider were to discover that one of the names on the "FBI's Most Wanted Terrorists" list showed up in their user list, what are they legally allowed to do? Is the ISP allowed to call up the FBI and say, "Hey, I may have one of the people that you're looking for?" Or do they have to request that the FBI generate a formal subpoena first? How much information can the ISP legally volunteer to law enforcement (name/address/credit card/surfing habits/etc), and at what point should the line be drawn about requiring oversight of which information is released?

Also, which law enforcement agencies should be entitled to which? If an ISP volunteers the full set of info to the FBI, can or should they also volunteer that information to their local police? Or what if a police department from another state contacts the ISP and asks for the info? Or a lawyer from another state? How much burden should the ISP assume in order to confirm that they're getting a bonafide request from a legitimate law enforcement agency? I hear that some ISPs require a subpoena for *any* info request. Another ISP that I've heard about won't release any info unless an agent *personally visits their offices*, which obviously places a huge, expensive (and in my opinion unreasonable) burden on agents attempting to investigate a cyberspace crime which may span across multiple states.

I'd like to see a consistent balance between allowing business to voluntarily help law enforcement with criminal investigations, while at the same time also protecting the privacy of individuals. And while I don't believe that law enforcement has the right to demand any information about anyone at any time, I also think that things can flop in the other direction too, where requiring a court order or personal "face to face" request for the release of certain types of non-sensitive information can be over-kill. I'm not certain myself what the ideal solution is, but I continue to follow the debates with interest.

LawMeme: eBay's Policies on Cooperation with Law Enforcement