Schools, Fake Accounts and RIPAs – advice from the POSH Helpline

In this blog The Professionals Online Safety Helpline look at what to do about fake accounts on social media.

One of our key strengths on the Professionals Online Safety Helpline is our relationship with industry, meaning that when a piece of content is on a site and it shouldn’t be, we can often contact a real person at that site and have it removed. But that is only really one element of “solving” a case.

Increasingly teachers and schools are reporting fake accounts that have been set up by students or people in the wider community. Often these accounts are set up in jest but often become sinister and pose a reputational risk for the school/individual. In the last week we have helped to remove 3 Instagram pages that have been created in the school/establishment’s likeness and then used to spread rumours and gossip.

Getting the page removed is great; it takes the power away from the poster and hopefully also sends a message that the behaviour is not tolerated. But, getting one page removed does not prevent the person behind the page creating a new page. Having an account and all its content taken from them is punishment, but it can sometimes feel like that is not enough. 

Nearly every time we have one of these pages removed we are also asked “can you find out who set the page up?” Unfortunately the answer is always no.
That question makes total sense, in order to do some preventative work you need to know who to do that with, but what you are actually asking is, “Can you ask Instagram to breach data protection laws and defy the privacy of its users in order to give me an IP address/ email of a nuisance account?”

In some situations Instagram and industry in general, will give that information out, but only in very strict circumstances. The only people that can request that information are the police/law enforcement.

In order for the police to even request that information they have to submit something called a RIPA with their request. A  RIPA is, in layman terms, an online version of a search warrant – A RIPA needs to be signed off by a high ranking officer and the paper work is so complex it can take an officer days, or even weeks, to complete (especially if they are already over-stretched).

With all this to consider, you can hopefully understand that the police are very unlikely to go to these lengths in the case of a bit of school bullying and reputational risk.
Even if they do decide to go down this route, there are a few problems with what a RIPA might return. The only useful user information that Instagram holds on a user is their:

Of those, the user could have lied about their name, and used an obscure email address, so the only rich data is the IP address. Now imagine going through all that paperwork and red-tape only to get an IP address that could only lead you back to a shared computer in a library. Not very helpful.

So, we can assume then that the police are not going to go to these lengths for a nuisance account, because even if they did, it could be absolutely pointless.

Here’s the thing, you need to get your Miss Marple on! As a teacher, or even just a member of your school community, you know your students better than the police. You know the friendship groups that have formed, you know which friendship groups seem to have recently had a ruption. You know which two kids are joined at the hip, who walks home with who, who waits with who in the lunch line, who’s had a fall out and who’s made up.

If you are able to, have a dig around the page, look who follows it, who the page is following and who interacts with the posts. You will soon start to spot some friendships groups, and perhaps there is one person missing? If not, this will at least give you a better understanding of which students are aware of the page,  and you can then ask them about it in person, conducting interviews to find out more.

While you may never be able to definitively say who it is or back that up with hard evidence, you will at least know who to target with some extra online safety education/awareness.

People may feel a sense of security hiding behind an anonymous account but the truth is that in this world you are rarely, truly anonymous. People get traced using the dark web, impersonations are uncovered and catfishing only lasts for so long, as my mum always said, “in the end the truth will always out “.

Read more about RIPA; https://www.legislation.gov.uk/ukpga/2000/23/contents/enacted

The DFE has actually given you, as educators more powers than the police, to be used with caution and with a lot of caveats, you could utilise this power in order to help in your investigation; https://www.gov.uk/government/publications/searching-screening-and-confiscation

Here are some more tips about managing your schools online reputation; https://static.lgfl.net/LgflNet/downloads/online-safety/LGfL-OS-Advice-Online-Reputation-Managment-for-Schools.pdf

If you’re a professional working with young people and have an online safety concern, you can contact the helpline on:

helpline@saferinternet.org.uk or call 0344 381 4772* Monday to Friday: 10am-4pm

*Calls cost the same as standard landline starting ’01’ or ’02’. If your phone tariff offers inclusive calls to landlines, calls to 0345 numbers will also be included.

This blog was originally posted on the SWGFL website.