Max Osterman was 18 when he connected with a drug dealer on Snapchat who used the handle skyhigh.303. Max would message him whenever he wanted to buy Percocet, and they would meet. After about a year, and just days after their last exchange, Max collapsed. The pills he ordered had been laced with fentanyl. He died from the overdose in February 2021 at his home in Broomfield, Colorado.
The dealer continued selling prescription painkillers until 2023, when he was jailed on two drug distribution convictions. When handing down the sentence, the judge said he was responsible for four deaths, yet he never faced charges for supplying the pills that killed Max.
“Snapchat never gave this critical evidence, never took action, never stopped the dealer who had been selling drugs on their platform for years before Max’s death and even after,” said Kim Osterman, his mother. “It took three separate requests from law enforcement for Snapchat to even respond, and when they did, they claimed there was no information.”
A police report reviewed by the Guardian shows a delay in obtaining data from the dealer’s Snapchat account, which investigators said they needed to definitively link him to Max’s death. The report also states that Snapchat did not provide law enforcement with any content from Max’s account apart from his user information. When Colorado detectives first sent Snap Inc, the app’s parent company, a production of records request for account information on skyhigh.3o3, it took more than two months to receive a reply. When the response did arrive, Snap said it would not comply, citing a grammar technicality in the order. The inclusion of a “/”, the company argued, made the request “ambiguous”, according to a field case report from the Broomfield police department. The company eventually sent detectives information on the drug dealer’s account, skyhigh.303, in response to several separate warrants law enforcement filed in the year after Max’s death. No content from Max’s Snapchat account was ever provided to law enforcement, the police report states.
The Guardian has reviewed four cases where Snap Inc and Meta have delayed or declined to comply with warrants and subpoenas requesting information related to serious crimes linked to their platforms. Eight law enforcement officers interviewed have said multiple cases reviewed by the Guardian are emblematic of a wider problem they face with the companies, which often delay or decline to comply with warrants and subpoenas requesting information related to serious crimes on their platforms. According to court records, police reports and interviews with law enforcement officials, these refusals and lags can derail investigations into crimes ranging from fentanyl deaths to child sexual exploitation.
A Snap Inc statement reads: “Our deepest sympathies go out to the families who have suffered such heartbreaking loss. A critical part of our efforts to help keep our community safe includes our longstanding and crucial engagement with law enforcement to help bring criminals to justice for the harm they cause our community. In both instances, Snap responded to multiple legal requests relating to the cases, so the suggestion that we did not support these investigations is simply inaccurate.”
Meta said in a statement: “We strongly disagree with the assertions made in this story, and our fast cooperation with law enforcement led to arrests in the cases in question. Last year, we received over 9,000 emergency requests from US authorities and resolved them within an average of 67 minutes – and even more quickly for cases involving child safety and suicide. To protect user privacy, it’s important that we follow appropriate legal processes and request clarifications where necessary, but we work to support law enforcement as much as we can.”
The spokesperson added that Meta produced data in 88% of the nearly 75,000 requests it received from US authorities between July and December last year.
In a statement, the International Centre for Missing and Exploited Children (ICMEC) called for clearer rules, faster processes and collaboration between law enforcement, lawyers and tech leaders reaching across the aisle.
“Every day of delay puts a child at risk. It can exacerbate damage and even cost lives. We can’t afford to let the delays continue,” said Shawnna Hoffman, chief executive of ICMEC and a former legal technology expert witness. “But the problems now are real, and if cooperation and alignment can’t rapidly make these processes happen faster, then we would in principle support new regulations to force greater urgency.”
Crime and no punishment
When platforms are not responsive, suspects can go unidentified and arrests can be postponed, giving perpetrators more opportunities to offend and putting the public at risk, said eight federal and state law enforcement officials, speaking on the condition of anonymity, as they were not authorised to speak to the media.
“These suspects are often transient. They might be at college for a semester, or just crashing with a friend, and by the time we get the data, they’ve already moved on,” said one officer with the Internet Crimes Against Children (ICAC) taskforce, a national network of law enforcement agencies dedicated to combating online child exploitation. “If we’d had the information in time, they would have been arrested. Instead, we show up and hear, ‘They moved out a few weeks ago.’”
For ICAC officers pursuing cases of online exploitation, two companies stand out for their lack of cooperation: Meta and Snap. Investigators say some refusals are based on minor technicalities. “It can be something as minimal as a dash or comma,” said another ICAC officer. “It feels like they’re playing legal games. We’ve had objections from companies over clerical details that delay cases for a while.”
Such lags can be especially devastating in cases of online child sexual exploitation and the production and distribution of child sexual abuse material, said members of law enforcement specializing in cases of crimes against children.
In June, a Boston court sentenced Charlese Horton, a registered sex offender, to at least 25 years in prison for kidnapping and assaulting a boy lured to meet them through Facebook. Investigators say solving the case was made more difficult when Meta did not fully comply with the subpoenas they sent as exigent requests for information they urgently needed to identify Horton.
“It can be weeks or months when we send a search warrant for data before companies get back to us,” said a current ICAC commanding officer. “When we are finally able to knock on the door and find the child victim, we determine that there has been additional abuse since we were waiting on that search warrant return.”
Tension between police, privacy and platforms
Subpoenas and warrants form the backbone of these investigations, allowing law enforcement to obtain evidence from social media profiles. Subpoenas can be issued by a court or government agency without needing a judge’s approval. With regards to social media, these legal orders can compel a company to provide basic account information such as a user’s name, email address or IP login records. They generally cannot access private communications. Warrants, which require judicial approval and a demonstration of probable cause, permit investigators to obtain sensitive material, such as private messages, photos and videos.
Part of the tension between police and tech platforms stems from the legal framework that governs digital privacy and access to communications in the United States.
The fourth amendment, which prohibits “unreasonable searches and seizures” by the government, requires law enforcement officials to show probable cause and secure a judge’s approval before accessing private communications. In practice, that means investigators must obtain a search warrant before companies like Meta and Snap release sensitive material such as private messages.
Layered on top of that barrier is the 1986 Electronic Communications Privacy Act (ECPA) and its Stored Communications Act (SCA) provision, which set rules for how companies store and disclose user data. Advocates for digital privacy say this law serves as one of the only federal protections in a country that relies on a haphazard patchwork of statutes to govern online behavior.
Critics say the law is outdated, as it was written decades before social media or smartphones existed and includes ambiguities that tech companies use to slow-walk or reject requests.
“They are looking for reasons not to give information,” said a former commander of a state ICAC taskforce, who spoke on the condition of anonymity. “Big tech is going to protect their companies first. Their priority it’s not to share information. It’s to protect themselves from any liability.”
Officials say this resistance is unique to big tech. Law enforcement officials characterized the response of industries like banking as much quicker, a matter of days rather than weeks or months. While entities that refuse could theoretically be held in contempt, tech firms bank on low appetite from law enforcement to take them on, said law enforcement officials.
“You send a grand jury subpoena to them, and they don’t give anything back,” said a lieutenant from ICAC. “Or sometimes they say, ‘We don’t have anything for what you requested, or we can’t find anything based on your request,’ and they won’t tell you why.”
Speeding up due process
In May, the Colorado governor, Jared Polis, vetoed a state bill on children’s online safety in the face of heavy lobbying from across industries. He cited the bill’s potential to “erode privacy, freedom and innovation” as the reason for his veto. The bill included a mandate for a 72-hour deadline for social media companies to respond to police requests, and to provide direct hotlines for law enforcement.
Testifying in support of the bill before the state’s senate judiciary committee in April, Brian Mason, the district attorney for Adams and Broomfield counties, where Max Osterman lived, stated that social media companies “regularly” failed to respond to legal documents they had been served in Colorado. Warrants, he said, often vanish into “a black hole”.
“They’re massive social media companies that don’t seem to care when they get a valid warrant from a jurisdiction like mine in Colorado,” said Mason.
In child sex-trafficking cases, limited access to digital records not only deepens the trauma for victims but also makes it harder to investigate crimes, members of law enforcement said.
Law enforcement officials note that when cases involve traumatized victims, their cooperation with investigations can be temporary. To avoid the investigation relying solely on the victim’s testimony, law enforcement focuses on building cases through digital evidence.
Even in emergency cases – when police have reasonable grounds to believe someone is in imminent danger and file what they dub an “exigent request”, which is a legal demand meant to trigger immediate compliance – tech companies often pick and choose which requests to honor, according to five members of law enforcement. Investigators say those decisions come at a cost to public safety.
Boston police’s investigation into Charlese Horton began after a 14-year-old boy was kidnapped and assaulted at gunpoint in an alley in the city’s Dorchester neighborhood. Four months later, the same boy was kidnapped again. He reported the attacks to police, and two more boys soon came forward with similar accounts. None of the victims knew each other, but all had been contacted through Facebook accounts tied to four aliases the attacker controlled, according to court documents.
Detectives subpoenaed Meta for data on four accounts. Meta refused to honor the exigency requests for two of the accounts being used, without explanation, said two members of law enforcement. That decision, investigators said, probably allowed additional victims to go undiscovered.
“Meta shouldn’t be the arbiter of what is and isn’t exigent,” said one member of law enforcement dealing with the case. “This was the company making its own judgment about whether we had an exigency case.”
A statement from Meta asserts the company fully cooperated with the Boston police investigation.
“Meta scrutinizes every law enforcement request, as bad actors have been known to use social engineering to access government email accounts so they can request information from tech companies,” a spokesperson said.
In a statement, Meta asserted that the two accounts it did not provide information on were actually duplicate requests. Law enforcement officers interviewed, however, dispute that characterization.
Law enforcement has no direct line to communicate with some companies to question decisions or press their case further. For Meta and Snap, requests are routed through a web portal that offers no phone number and no direct access to the employees deciding whether to release evidence, a point of frustration mentioned by almost all members of law enforcement who spoke to the Guardian.
“We make it as easy as possible for law enforcement to submit legal requests via an online portal and provide regular training sessions to the FBI and US local law enforcement on how to send in valid requests,” said a Meta spokesperson. “Our dedicated law enforcement response team in the US is also in ongoing contact with law enforcement to support them on live cases as needed, and our legal teams are regularly in touch with prosecutors and investigators to help with legal issues.”
Sextortion tragedy
When Michigan teen Jordan DeMay died by suicide after being targeted by Nigerian sextortion scammers on Instagram in 2022, Meta initially declined the Marquette county sheriff’s detectives’ requests, filed as exigent, for the transcripts of DeMay’s direct messages on the platform. This meant his family had to wait 48 hours for crucial details about why he died, and the sextortionists were able to continue to target other victims.
“Possibly it wasn’t considered an emergency because Jordan was already dead,” said John DeMay, Jordan’s father. “It was only when the FBI got involved that the warrant was accepted.”
DeMay, who now has a copy of the transcript of the conversation between Jordan and the sextortionists, said it was obvious from the dialogue how urgent the situation was.
“They wrote to Jordan, ‘I’m gonna watch you die a miserable death.’ And, Jordan replies to say, ‘I’m killing myself.’ And they say, ‘Good, do it now,’” said DeMay. “After reading that transcript and knowing that the sextortionist’s account was still active, and somebody had already died, there’s no reason that Meta should have not given that information. There’s zero reason for that.”
In its statement, Meta noted that the justice department had publicly praised the company for cooperating with the FBI investigation into Jordan’s sextortionists. The company did not, however, address the early delays in the case, when the investigation was still being handled by local police.
Dire circumstances, unreadable files
Even when companies do comply with warrants, the information they provide can be of little use. On 19 December 2024, 16-year-old Avery Ping died in Olympia, Washington, of a drug overdose after buying what he thought was ecstasy over Snapchat. The pills turned out to be a lethal mix of fentanyl, amphetamine and methamphetamine.
Avery’s drug dealer had been under law enforcement surveillance since October 2024 in relation to other narcotics cases. Local police sent a warrant for the dealer’s Snapchat account data to Snap Inc on 5 November 2024 and waited 10 days. They did not receive a response from Snap until 25 November, when the company sent a file that law enforcement officials couldn’t open, said Aaron Ping, Avery’s father.
“The detective told me they needed specific software to open it, and Snap didn’t give instructions on this,” said Ping. Ultimately, law enforcement officials could not open the file until early December.
“Snap impeded on a big investigation on the dealer before Avery died. This guy was a prolific dealer, and had surveillance on his house, and they just were waiting for the Snapchat records,” said Ping. “The guy should have been in jail. Avery should be alive.”
Snap Inc did not provide a response to these allegations.
“Every day of delay means children remain in danger who could have been rescued, and there’s no legal consequence for dragging their feet,” said Sacha Haworth, executive director of the Tech Oversight Project. “We need public visibility into how these companies perform. We need mandatory public reporting on response times and compliance rates. Self-regulation has failed – it’s time for lawmakers to act.”
