Police in the United States are increasingly relying on controversial surveillance practices that require technology companies to hand over large amounts of user data in order to identify criminal suspects.
So-called “reverse” searches allow law enforcement and federal agencies to force big technology companies like Google to hand over information from their vast repositories of user data. These orders are not unique to Google, and any company with access to user data could be forced to hand it over, but the search giant is one of the most vulnerable to police requests for access to its database of user information. is one of the recipients of this.
For example, authorities may submit to tech companies information about all individuals who were in a particular location at a particular time based on cell phone location, or information about all individuals who searched for a particular keyword or query. You can request as such. Thanks to a recently released court order, authorities have indicated they can collect personal information about everyone who watches a particular YouTube video of hers.
Reverse lookups effectively thread a digital dragnet through user data held by tech companies to catch the information police are looking for.
Civil liberties groups say court-approved orders of this type are overbroad and unconstitutional because they could force companies to hand over information about completely innocent people unrelated to criminal charges. It is claimed that Critics worry that such court orders could allow police to prosecute people based on where they go or what they search on the internet.
So far, even the courts have not agreed on whether these orders are constitutional, and a legal challenge is likely at the U.S. Supreme Court.
Meanwhile, federal law enforcement officials are already pushing this controversial legal practice further. In one recent case, prosecutors asked Google to hand over information on everyone who accessed a particular YouTube video in order to track down a money laundering suspect.
In a recently unsealed investigative motion filed in Kentucky federal court last year, prosecutors allege that Google was not authorized to use Google accounts or IP addresses that accessed YouTube videos for one week from January 1, 2023 to January 8, 2023. “We were asked to provide records and information related to the address.” 2023. ”
As part of the sting operation, the money laundering suspect shared a YouTube link with law enforcement, who sent back two more YouTube links, according to the petition. The three videos seen by TechCrunch have nothing to do with money laundering, but had a combined total of about 27,000 views at the time of the search request. Still, prosecutors sought an order forcing Google to share information about everyone who watched those three YouTube videos that week, perhaps with the goal of compiling a list of people as prime suspects. It is assumed that the person visited some or all of the prosecutor's offices. 3 videos.
This particular court order sought access to connection logs about who accessed the videos, rather than the high-level search warrants that courts can use to force tech companies to hand over content, which would require traditional investigation. It was easier for law enforcement to obtain than a warrant. Someone's private message.
A federal court in Kentucky granted the search order under seal and blocked its publication for one year. Google was barred from disclosing the request until last month, when the court order expired. Forbes first reported the existence of the court order.
It's unclear whether Google has complied with the order, but a Google spokesperson told TechCrunch that they were not sure.
Liana Pfefferkorn, a researcher at Stanford University's Internet Observatory, said this is a “perfect example” of why civil liberties advocates have long criticized these types of court orders that give police access to citizens' intrusive information. “Example,” he said.
“The government essentially dragged YouTube into service for the federal government to act as a honeypot for ensnaring criminal suspects by triangulating who viewed the videos in question during a specific time period.” Pfefferkorn said of the recent order targeting YouTube users. “However, by seeking information about everyone who watched any of the three videos, as well as a geolocation reverse search warrant, the investigation is targeting dozens or hundreds of others who are not suspected of wrongdoing.” may also be targeted.”
Seeking a digital haystack
Reverse court orders and warrants are largely a problem created by Google itself, in part because the tech giant has access to vast amounts of information about its users, including browsing history, web searches, and even detailed location data. This is due to the fact that we have been collecting data for many years. Recognizing that big tech companies hold vast amounts of users' location data and search queries, law enforcement agencies are now targeting individual users as well as granting broad access to tech companies' databases. began to succeed in persuading courts to do so.
Court-authorized search orders allow police to request information from technology and telephone companies about people whom law enforcement believes are involved in crimes that have occurred or are about to occur. But instead of trying to find a suspect by looking for a needle in a digital haystack, police are searching for clues, even if they contain the personal information of innocent people. It is supposed to ask for a portion.
Using the same techniques that request the identities of people who view YouTube videos, law enforcement agencies can ask Google to identify all individuals who were at a particular place and time, or who searched the Internet for a particular query. You can also request that we hand over data that identifies you.
A geofencing warrant, as it is more commonly known, allows police to draw a shape on a map around a crime scene or place of interest, indicating that someone using a cell phone was in the area at some point. requests large amounts of location data from the Google database. .
Police may also use so-called “keyword search” warrants, which can identify all users who searched for a keyword or search term within a time period, usually to find clues about suspects investigating crimes in advance. can.
Both of these warrants are valid because Google stores detailed location data and search queries for billions of users around the world.
Law enforcement agencies may champion surveillance and collection technology with an uncanny ability to capture even the most elusive criminal suspects. However, many innocent people have been mistakenly caught in the web of these investigations, and in some cases as criminal suspects, simply because they had phone data that put them near the crime scene.
Google's practice of collecting as much data as possible about its users makes it a prime target and a top recipient of reverse lookup warrants, but these controversial court orders Google isn't alone. Tech companies large and small that store large amounts of readable user data could be forced to hand over to law enforcement. Microsoft, Snap, Uber, and Yahoo (which owns TechCrunch) have all received reverse orders of user data.
Some companies choose not to store user data, while others scramble the data to make it inaccessible to anyone but the user. This prevents companies from handing over access to data they don't have or don't have access to, especially when laws change daily, such as when the U.S. Supreme Court overturned the constitutional right to access abortion. .
Google is gradually shutting down its ability to respond to geofencing warrants, specifically by moving where it stores user location data. Instead of centralizing vast amounts of users' precise location histories on its own servers, Google will begin storing location data directly on users' devices, forcing police to obtain data directly from device owners. There is. Still, Google has so far left open the possibility of receiving search requests asking for information about users' search queries and browsing history.
But as Google and other companies are finding out the hard way, the only way for companies to avoid handing over customer data is to not have it in the first place.