EFF Asks Pennsylvania’s Top Court To Stop Cops From Googling For Suspects
Law enforcement officers learned long ago that if all they have is a crime scene and no likely suspects, there was no reason to wear out shoe leather beating the streets for alleged criminals. They don’t even need to leave the office. All they have to do is produce a subpoena for certain third-party records and/or convince a judge that the only “probable cause” they need to demonstrate is the probability Google houses the data they seek.
In some cases, investigators used Google to identify devices carried by people in or around crime scenes in hopes of finding probable suspects. This option — the geofence warrant — has proven extremely popular in recent years. The constitutionality of these warrants — which require Google (and it’s almost always Google) to search its entire repository of location data — is still up in the air.
So is the constitutionality of another Google-centric law enforcement option which also requires Google to search all of its data to find the stuff cops are looking for. These are keyword warrants and they work in reverse: instead of showing probable cause to search people’s Google search histories, investigators simply present Google with a warrant demanding information on anyone who used certain search terms.
The law is still unsettled here. The EFF is hoping the law will be a bit more settled, but on the side of the Constitution, in a case currently being considered by the Pennsylvania Supreme Court.
Everyone deserves to search online without police looking over their shoulder, yet millions of innocent Americans’ privacy rights are at risk in Commonwealth v. Kurtz—only the second case of its kind to reach a state’s highest court. The brief filed by EFF, the National Association of Criminal Defense Lawyers (NACDL), and the Pennsylvania Association of Criminal Defense Lawyers (PACDL) challenges the constitutionality of a keyword search warrant issued by the police to Google. The case involves a massive invasion of Google users’ privacy, and unless the lower court’s ruling is overturned, it could be applied to any user using any search engine.
It’s an important case. As the EFF notes, this is only the second case of its kind to reach the highest level of a state court system. It has filed a brief [PDF] that not only points out how these warrants far exceed the bounds of the “general warrants” that prompted the creation of the Fourth Amendment, but how dangerous it would be to allow government entities to, in essence, initiate searches of every Google user’s search terms using nothing more than a single warrant.
As the EFF points out, people are far more willing to share intimate thoughts and desires (as expressed in the form of search queries) with Google than with their fellow human beings. Google makes no judgments. It simply goes looking for what it’s being asked to look for.
Unfortunately, the government generally doesn’t even know what it’s looking for when it demands Google perform searches of hundreds of millions of users’ search terms on its behalf.
Keyword search warrants are unlike typical warrants for electronic information in a crucial way: they are not targeted to specific individuals or accounts. Instead, they require a provider to search its entire reserve of user data and identify any and all users or devices who searched for words or phrases specified by police. As in this case, the police generally have no identified suspects when they seek a keyword search warrant. Instead, the sole basis for the warrant is the officer’s hunch that the perpetrator might have searched for something related to the crime.
On top of this hunch that someone may have searched for something, investigators add several more guesses. Not only do they not know who they’re searching for, they don’t know what search terms were used. This creates a dragnet — one cast by Google in an effort to comply with the warrant’s demands.
Several known keyword warrants have, as in this case, sought to identify everyone who searched for a specific address or variations of the victim’s name. However, in other cases police have investigated other search queries, such as the name of someone else related to the case. In at least two known cases, the search queries have been far broader. In response to a series of bombings in Austin, Texas, police sought everyone who searched for words like “low explosives” and “pipe bomb.“ And in Brazil, Google challenged a warrant for everyone who searched for the name of a popular politician who was assassinated and the busy street in Rio de Janeiro where she was killed.
These warrants are problematic and they have little to do with the ideals represented by the Fourth Amendment, like probable cause, specificity, and minimizing intrusions on citizens’ personal lives. And, like any dragnet, they’re capable of implicating innocent people.
Because keyword warrants require Google to search its entire data repository, they have the potential to implicate innocent people who happen to search for something an officer believes is incriminating. Here, Google identified responsive queries from fourteen different IP addresses within the eight days covered by the warrant. Keyword warrants could also allow officers to target people based on political speech and by their association with others. Police used multiple geofence warrants to identify people at political protests in Kenosha, Wisconsin, and Minneapolis after police killings in those cities. Similarly, with keyword warrants, officers could seek to identify everyone who searched for the location or the organizers of a protest.
On top of the Fourth Amendment problem, keyword warrants create a First Amendment problem. Users could start censoring their own searches in hopes of avoiding being swept up in law enforcement dragnets. And because even investigators don’t know who or what they’re searching for, some users may decide to avoid searching for anything that might be considered indicative of criminal activity.
The lower court saw no problem with the warrant, reasoning the data sought by the warrant was covered by the Third Party Doctrine, rather than the Fourth Amendment or the state’s own constitution. As for the “willingly shared with third parties” aspect of the Third Party Doctrine, the lower court said Google users were well aware their search terms could be shared with law enforcement. After all, they’d all agreed to Google’s terms of service, which stated data would be stored by Google and handed over to the government if properly requested.
The EFF points out this broad interpretation of the Third Party Doctrine would, if adopted by the state Supreme Court, allow the government to collect all sorts of content and data from any service provider using nothing more than a non-specific warrant or (in some cases) subpoena.
Because all service providers impose TOS similar to Google’s, the lower court’s analysis, if correct, would apply to digital data maintained with any service provider, not just Google. Further, because providers’ terms apply to all content they store, not just search queries, this analysis would apply to any and all emails, files, photos, attachments, and other electronic “papers and effects” stored with any of those providers. Not only would that conclusion vitiate Fourth Amendment protections for the hundreds of millions of people who use these services, it would mean that a private company’s TOS trump Fourth Amendment protections for all content maintained with the provider. This is inconsistent with public expectations, well-recognized Fourth Amendment case law, and the stated positions of every member of the Supreme Court in Carpenter. If adopted by this Court, it would undermine fundamental privacy protections in communications media used by nearly all Americans.
The warrant at issue here is particularly bad, which should hopefully nudge the state Supreme Court to find it unconstitutional or, at the very least, establish ground rules for similar warrants.
[T]he warrant in this case was based on nothing more than an officer’s speculation that the perpetrator may have used a search engine sometime within the eight days prior to the crime to look for the victim’s house. The only stated connection to Google for this hunch was that its search engine is dominant, suggesting that if the perpetrator had conducted such a query, Google might have a record of it. The affidavit includes no facts to support these speculations. As the affidavit notes, the affiant “believed” that the perpetrator “was very familiar with the victim” and that both the victim and her residence were “not randomly targeted.” Given these beliefs, it is just as likely, if not more so, that the perpetrator knew the victim and would not need to use a search engine to identify her or her house.
Whichever way the state Supreme Court chooses to view this, it will set precedent. It is only the second case involving these warrants to make it this far in state courts and its decision will be used to craft challenges (or defend against them) all across the nation. Until a federal court with significant reach rules on this issue, what’s said in Pennsylvania will set the tone for the nation’s law enforcement agencies. It’s an important case. All we can do is hope this court recognizes this new form of “general warrant” for what it is.