In the United States, police departments are increasingly turning to a controversial surveillance practice in order to identify criminal suspects. This practice involves requesting large amounts of user data from technology companies.
This tactic, known as “reverse” searches, allows law enforcement and federal agencies to demand access to big tech companies’ caches of user data. While this demand is not specific to Google, the search giant has become one of the main targets for police seeking to obtain information on users.
For instance, authorities have the power to request information on any individual who was in a certain place at a specific time based on their phone’s location, or who searched for a particular keyword or query. A recent court order revealed that authorities even have the ability to obtain personally identifiable data on all individuals who watched certain YouTube videos.
Essentially, reverse searches create a digital dragnet that extends over a tech company’s collection of user data in order to capture the information that police are seeking.
Civil liberties advocates argue that these court-approved orders are overly broad and potentially unconstitutional, as they have the potential to compel companies to turn over data on innocent individuals with no connection to the alleged crime. Critics fear that these orders could allow police to prosecute individuals based on their location or internet search history.
The legality of these orders is still being debated, with disagreement even among the courts. This will likely lead to a legal battle before the U.S. Supreme Court.
In the meantime, federal investigators are continuing to push the boundaries of this controversial practice. In a recent case, prosecutors requested that Google provide information on all individuals who accessed specific YouTube videos in an effort to track down a suspected money launderer.
A search application filed in a Kentucky federal court revealed that prosecutors were seeking data on users’ Google accounts or IP addresses who accessed the videos between January 1, 2023 and January 8, 2023.
The application stated that, as part of an undercover transaction, the suspected money launderer had shared a YouTube link with investigators and they had exchanged two more links. These videos, which have no relation to money laundering, collectively garnered around 27,000 views at the time of the search application. However, prosecutors were still seeking an order to obtain information on every individual who watched these videos during that week, likely in an attempt to narrow down the list of individuals to their main suspect.
Unlike a traditional search warrant, which requires a higher standard of evidence, this particular court order was easier for law enforcement to obtain because it focused on connection logs rather than the contents of private messages.
The court order was approved under seal by the Kentucky federal court, and its existence was not made public until the order expired a year later. Forbes initially reported on its existence, and it is unclear whether or not Google complied with the order.
Riana Pfefferkorn, a research scholar at the Stanford Internet Observatory, believes that this is a prime example of why civil liberties advocates are concerned about this type of court order and its potential for granting police access to intrusive information.
“By asking for information on everyone who viewed any of the three videos, the investigation also sweeps in potentially dozens or hundreds of other people who are under no suspicion of wrongdoing, just like with reverse search warrants for geolocation,” said Pfefferkorn.
This controversial practice has largely arisen due to Google’s extensive collection of user data, including browsing history, search queries, and detailed location data. Recognizing that tech giants possess vast amounts of this type of information, law enforcement has been successful in convincing courts to grant broader access to tech companies’ databases.
This process begins with a search order, which allows police to request data from a tech or phone company on an individual believed to be involved in a current or future crime. However, instead of searching for a specific individual, police are increasingly requesting large amounts of data in order to sift through for potential clues.
For example, geofence warrants involve drawing a perimeter around a crime scene or location of interest and requesting data on anyone whose phone pinged within that area during a specific time period. Similarly, “keyword search” warrants target individuals who searched for a specific term during a designated time frame.
These tactics rely on the fact that Google stores vast quantities of location data and search history for billions of users worldwide.
While law enforcement may defend this approach as a powerful means of catching elusive suspects, it has also resulted in innocent individuals being caught up in these data requests, often mistakenly being identified as suspects themselves. Google and other tech companies are finding that the only way to avoid turning over user data is to not collect it in the first place.
In an effort to protect user privacy, Google is in the process of shifting its storage of location data from centralized servers to users’ devices, requiring that police request data directly from the device owner. However, Google has not yet changed its policy on responding to search orders related to search queries and browsing history. Other companies that do not store user data or encrypt it to make it inaccessible to anyone other than the individual user are also less susceptible to these types of warrants.
In the end, it seems that the best way to combat these potentially problematic court orders is to minimize the collection of user data in the first place.
