At first glance, the Facebook profile is the perfect deception. Purportedly belonging to brown-haired woman named Sondra Prince, it shows her driving a car, splayed across a white BMW, hugging two young children. If someone were to stumble across the profile, which still exists, there would be little way for them to know the truth: The profile is a fake.

It was created surreptitiously by a Drug Enforcement Administration agent, who seized Prince’s phone in July 2010 after arresting her, mined it for photographs, then used those pictures to forge a fraudulent profile which allowed authorities to impersonate Prince in an investigation into an alleged New York drug ring. Until, of course, Prince found out — and sued.

The result is an ongoing New York federal civil suit that Prince, who also goes by Sandra Arquiett, has filed against the United States and DEA Agent Timothy Sinnigen. The case, which Buzzfeed’s Chris Hamby first reported, has been sent for mediation by the judge in the case. It hints at the murky boundaries of social media privacy and raises questions as to how far law enforcement can go when using new technology to investigate cases. Cops can — and often do — call up a defendant’s Twitter and Facebook accounts to gather additional evidence against them. But can they furtively and independently impersonate someone?

Given the extent to which cops seize picture-laden phones and computers, some experts fear a dangerous expansion of law enforcement’s capacity for subterfuge if it’s allowed to exploit seized materials. “I may allow someone to come into my home and search,” Anita L. Allen, a University of Pennsylvania law professor, told Hamby. “But that doesn’t mean they can take the photos from my coffee table and post them online.” She added: “It reeks of misrepresentation, fraud and invasion of privacy.”

One matter that’s agreed upon by all parties: Sinnigen, who is claiming qualified immunity from the suit, created the profile and posed as her in contacts with at least one fugitive connected to a DEA investigation.

“Sinnigen posted photographs from [Prince’s] phone, to which he had been granted access, to the undercover Facebook page,” an August court filing by the government states. “… Defendants admit [Prince] did not give express permission for the use of the photographs contained on her phone on an undercover Facebook page, but state [that Prince] implicitly consented by granting access to the information stored in her phone.”

Translation: All the pics were fair game. Even ones showing Prince scantily dressed, which Sinnegan used in the fake profile. “Defendants admit that in one photograph of [Prince] that was used on the undercover Facebook page, [she] was wearing either a two-piece bathing suit or a bra and underwear,” the filing states.

The legal wrangle, which a district judge shipped to mediation, has roots in an alleged drug ring in which Prince was involved. “Based upon my investigation, I believe that Sondra ‘Sosa’ Arquiett Prince is the [ring leader’s] girlfriend and is known to the leadership of the organization as ‘the secretary,'” one DEA agent wrote of Prince, who ultimately pleaded guilty to one count of conspiracy to possess with intent to distribute.

The officer alleged Prince was present on “multiple occasions while crack cocaine was manufactured in her apartment. During the summer of 2009, Prince helped process 2-3 ounces of crack cocaine and Prince personally handled [one associate’s] baggies of finished crack cocaine that were ready for sale.”

In July 2010, Prince was arrested — which was when police seized her phone. On it, they found photos.

And, soon after, the profile appeared, speckled with personal touches.

Prince’s alleged boyfriend, Jermaine Branford, went by the nickname “Hovie,” according to court records. So, naturally, after the Sinnegan made a fake profile of Prince, the first message that appeared on her profile said: “I miss Hovie.” Later, he posted several photographs of Prince, one of which showed her with her two young children, and another that depicted her in short shorts laying across a car. “At least I still have this car!” another status update exclaimed. At some point, the fake Sondra Prince gathered at least 11 friends — and still has some of them.

Then Sinnigen began accepting and dispatching friend requests. “Sinnigen maintained the Facebook account for a period of at least three months without [Prince’s] knowledge, during which time the revealing and/or suggestive photographs of [Prince] remained displayed and available on Facebook,” Prince’s complaint states. She is seeking $250,000 in damages.

Law enforcement reports widespread covert use of Facebook during investigations, according to LexisNexis. This isn’t their first fake profile. “We do have some covert accounts for targeted enforcements,” Cincinnati cop Daniel Gerald told CNN in 2012.

But while such a practice may not necessarily violate U.S. law, it runs afoul of Facebook community standards: “Claiming to be another person, creating a false pretense for an organization, or creating multiple accounts undermines community and violates Facebook’s terms.”

“It just undermines the integrity of our whole service if we allow people to use false accounts,” Facebook’s chief security officer told CNN.