35 ms·

Google is giving data to police based on search keywords, court docs show

421 points by 0xmohit 6y ago

Heatherknox 6y ago
Each time I call my husband office they keep telling me my husband has a 3pm appointment and this has been happing for a while now, am always worried about my husband leaving the office by 3pm yet he wont open up to me about the contract he has been trying to seal, then I hired jeajamhacker@gmail.com to make the investigation for me without any notice, I got access to my husband phone remotely after going through his text messages and all I found out that there is a lady my husband always see by 3pm then i went further because jeajamhacker@gmail.com also provided me with my husband deleted messages and I saw that my husband makes love to this lady everyday and when he comes home he stave me from sex but am so thankful to jeajamhacker@gmail.com for the best services he rendered to me.
fattegourmet 6y ago
data points mentioned in the article: address search; device location data. Innocent till proven guilty, right?
coldcode 6y ago
Not an acceptable practice under the Constitution of course it will require court cases to stop or narrow these. Geolocation searches (being in the wrong place/wrong time) are bad enough, but everyone searching for "X" could capture thousands or even millions of people.
- shadowgovt 6y ago
  I think it's a little unclear whether it's Unconstitutional. Google's logs of what users did on its service are Google's property, not proeprty of the users. It's like asserting the cops can't issue a warrant to your bank to look for transactions to Capone Real Estate Holdings, Inc... Of course they can.
  - soraminazuki 6y ago
    So assuming that your argument holds, warrants mean nothing when private companies own everything and you don’t. Doesn’t sound like what was intended when the constitution was written.
    - shadowgovt 6y ago
      No, I don't think the Constitution was written to account for a world where corporations own everything and individuals don't. Updates may be in order.
      - arnoooooo 6y ago
        I don't think the people who downvote this comment have really thought about whether they own their phone, their computer, their printer, their ebooks, their car, their software... We have come to an era where you "buy" things but then can't repair them, can't modify them, ant even can't use them anymore once the maker decides so. Most modern machines are actually leased, not bought.
  - notJim 6y ago
    Why should it be this way though? Under GDPR, citizens have certain rights over their own data, which is meant to protect their privacy. Shouldn't we have something similar here?
    - shadowgovt 6y ago
      I think America puts the bar at a different place than Europe on this topic.
mtgx 6y ago
> But a recently unsealed court document found that investigators can request such data in reverse order by asking Google to disclose everyone who searched a keyword rather than for information on a known suspect. "Just let us scour through the data to see who committed a crime." How is this not a fishing expedition? Does the 4th amendment not mean anything anymore in the US? Are judges still this clueless about such obfuscated requests from the police?
- shadowgovt 6y ago
  The keyword in this case was a postal address. It smells a bit analogous to pulling a street-corner security camera's feeds and looking at everyone who passed through an intersection to correlate with other data the cops have.
ColanR 6y ago
Makes me think of my own duckduckgo usage. I wonder if Google is the only search engine being leaned on, or if they're just the only one with any publicity around the shared data.
- ISL 6y ago
  I expect that DDG would make a huge stink about being compelled to do any such thing (Google, too. If people think the government is watching their internet searches, they'll go somewhere else.).
  - comboy 6y ago
    Unless they publish some canary they may not be able to do that.
    - ISL 6y ago
      Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.
      - srtjstjsj 6y ago
        Spoiler alert: Congress did.
        ISL 6y ago
        It can try, but that doesn't make the law constitutional.
    - LinuxBender 6y ago
      There are some differing opinions on the effectiveness of a canary. [1] The legal team where I work have the same opinion as Moxie's lawyers. [1] - https://web.archive.org/web/20141027143819/https://github.com/WhisperSystems/whispersystems.org/issues/34 https://web.archive.org/web/20141027143819/https://github.co...
blakesterz 6y ago
"Think of the ramifications in the future if everyone who searched something in the privacy of their own home was subject to interviews by federal agents," Spodek said. "Someone could be interested in how people die a certain way or how drug deals are done, and it could be misconstrued or used improperly." The problem is most people don't think like that. Most people think "why do I care, I search google for sourdough recipes and to see what the heck sus means. The chances of me getting in trouble because I did this is really low." And then they read something like this from the same place... "After investigators linked Williams to the arson through the keyword warrant, they sent Google another warrant specifically for his account, finding that he looked up phrases like "where can i buy a .50 custom machine gun," "witness intimidation" and "countries that don't have extradition with the United States." And they'll say "See, see! This works, this should be legal it catches bad people, look at what this guy was doing" Enough people think like that, and there's no pressure to make this practice illegal, no pressure from the public to get laws passed because while some people look at this practice and see their lives being made worse, many people look at this and see themselves being protected from bad guys.
- macspoofing 6y ago
  >The problem is most people don't think like that. But what is the problem here anyway? If there's a crime at a location, police detectives will investigate anyone that has any connection to that location. That someone may have searched for that location is certainly relevant to the investigation, but it doesn't imply that those individuals are automatically a suspect. In fact, they will be quickly ruled out.
  - candiodari 6y ago
    Mostly there are zero suspects. These subpoenas are, as you point out, ways to find more suspects. There's just one issue: they also often only turn up ONE suspect. And here's the thing with people and police: everybody lies. The victim of the crime lies. Suspects lie (but the thing is: suspects lie whether or not they've committed a crime, this is not a difference between innocent and guilty). Witnesses lie (don't want to get caught, and yes the police encourages this, at wrong parking. Police will encourage them to lie, because they can't ignore a confession of wrongful parking and they understand they'll lose cooperation if they write them a ticket for their trouble). And of course the police officers themselves lie. Whatever hope you have of finding the underlying truth in such a haystack less than a few years of work ... forget it. And then comes Google with "concrete evidence". Something that is actually true. Very likely not related to the crime, but true. So you can probably understand that this would introduce quite a big bias against a "suspect", when their real connection to the crime is "someone was shot, and this guy googled 'gun' 2 days before". Furthermore, this gives them something to put to a judge or a jury, when before they had nothing, or nothing coherent. Do you really think at this point a police officer, judged by the number of cases solved, bad guys put away, just walks away without at least applying very strong pressure on whoever was fingered ?
duxup 6y ago
The police had a warrant for the information. Whatever is going on here Google doesn't seem to just be forking over mass data at any request, at least not as far as this story goes. I would argue the issue here is that such a warrant was granted in the first place.
- CivBase 6y ago
  > I would argue the issue here is that such a warrant was granted in the first place. I agree that the warrant itself is a huge problem, but I think there's another significant issue here. Google may have just been complying with the law, but that doesn't meant they had to be quiet about it. Unless they had a gag order, they should have publicly stated that the US government was compelling them to hand over search records. From the article: > Google declined to disclose how many keyword warrants it's received in the last three years. They did not say anything about a gag order and, given Google's track record on privacy, I'm not inclined to give them the benefit of the doubt here.
  - duxup 6y ago
    The warrant was sealed. I think that means there's a fairly high chance they were told to keep quiet (legally). Not 100% sure but it seems likely. Maybe things have changed but IIRC the past Google has fought to be able to disclose publicly the extent of some requests made by the government.
    - CivBase 6y ago
      Can they not even say what they're not allowed to say? When prompted about how many warrants they've had, why not just respond with "We are not legally allowed to answer"? And what is the justification for a gag order like that in the first place?
      - duxup 6y ago
        "Can they not even say what they're not allowed to say?" In the past they couldn't even say that. I believe Google and Microsoft have litigated over that point specifically. I don't recall if they won or not.
carapace 6y ago
I remember being mildly startled when I realized I no longer use Google to google. https://duckduckgo.com/spread https://duckduckgo.com/spread
- Smoosh 6y ago
  or https://about.qwant.com/ https://about.qwant.com/
fierarul 6y ago
What I found fascinating is that Google is digitally signing the data given to authorities. This is more than any free or paid user can obtain. You have a green padlock in your URL but can you prove in court you received a given email? No, because a SSL connection is transient and you can't replay it to show that Google's certificate digitally signed that email in GMail.
- inetknght 6y ago
  > can you prove in court you received a given email? No, because a SSL connection is transient and you can't replay it to show that Google's certificate digitally signed that email in GMail. A TLS session replay is unnecessary. If you've got the email with its headers intact then you can prove that you received that email. You might want to learn what email headers are available to you. You'd be interested in learning about ARC-Seal, ARC-Message-Signature, ARC-Authentication-Results, and DKIM-Signature. Those headers will let you cryptographically validate that a message is authentic -- that the email is unaltered as Google received it from whoever sent it. You'll also be interested in learning about Key Transparency: the signatures are created using Google's PKI which should be listed in any public key transparency log. That will let you prove that the signatures you validated were created using something that only Google knows.
  - upofadown 6y ago
    >...that the email is unaltered as Google received it from whoever sent it. Well technically whatever sent it. That stuff is all about the identity of mail servers, not individuals.
- advisedwang 6y ago
  > can you prove in court you received a given email You can subpoena Google for the records. It would probably be easier to rely on that in court than cryptographic proof, as the legal system understand that much better.
- throwaway0x00ff 6y ago
  > a SSL connection is transient and you can't replay it to show that Google's certificate digitally signed that email in GMail. Actually, there the TLSNotary[1] protocol that allows you to use the https connection as a means to sign the web content your browser received. There is the PageSigner browser extension that uses TLSNotary to sign webpages. However, it seems like this project wasn't given a lot of love this last few years. Good news is version 2.0 has been released just a week ago[2], with support for TLS 1.2, but with a major drawback for me: it now trusts a server generating the TLS keys for the notarized page. Sure, it's an "oracle" server not controlled by PageSigner but still operated by Amazon. [1] https://tlsnotary.org/ https://tlsnotary.org/ [2] https://tlsnotary.org/wp/?p=45 https://tlsnotary.org/wp/?p=45
abvdasker 6y ago
this is a clear case where using a VPN goes a long way towards protecting someone from surveillance and law enforcement overreach
- vmception 6y ago
  A vpn at best just increases the costs for multi-country collaboration, but doesn't prevent it. This is the federal government, not some local municipality. Even your favorite swiss bunker vpn can be subpoena’d or tapped extrajudicially and you would never know
  - abvdasker 6y ago
    I think that's wrong on a couple counts. First, the main concern with this type of collection based on search terms is that it has a high likelihood of picking up users who are totally innocent. If many of those users are obscured by VPNs, that raises the bar considerably for law enforcement to de-anonymize each of them (most, if not all, of whom LE knows will be total dead ends). Second, concerning a VPN being tapped by US law enforcement agencies, I think depending on the country in which it's being operated, that is more or less likely. These companies' entire businesses rely on the perception of security, so government interception of their communications would be an existential threat to them. I think it's also likely that interception (and crucially, use of intercepted materials as evidence in criminal prosecution) would probably get out sooner or later, just as it has in the above story. The idea that federal law enforcement has access to everyone's communications everywhere all the time probably overstates their capabilities. As I understand it, there still remains a pretty big difference between the government's active/targeted vs passive/dragnet surveillance. A VPN is probably still useful for defending against the latter.
    - vmception 6y ago
      Everything you wrote requires ignoring the entire last decade. But fine, for an illustrative example lets use this article as an example. The government asked Google for IP addresses, then the government did an additional thing to determine the phone number was tied to the person they indicted, whether that was due to a Google account or requiring them to go to the cellular provider. Nobody in this thread is arguing about the false positives snatching innocent people, just the VPN part. With a VPN the same government would have gone to Google, then to the VPN company, then to the cellular provider. VPN didn't help the customer, just slowed the government down. You also wouldn't know if passive surveillance was being done on the VPN provider, which has been shown to happen to ISPs before from the Snowden leaks 7 whole years ago, which was about things that were even older. The NSA and FBI used National Security Letters to directly tap the servers indefinitely, and the CIA would just pay companies to directly tap the servers. They can be more easily coervice domestically, but other countries, even countries without automatic cooperation treaties are eager to help US investigators and have. You wouldn't know if Proton/ExpressVPN/Nord you name it were passively sharing data, if they began keeping logs if at one point they say they didn't, if you were the active target, etc.
0df8dkdf 6y ago
Time to move away from Google and self-host!
- criddell 6y ago
  I don't think it's reasonable for every person to run their own web crawlers.
0df8dkdf 6y ago
Is there a resources for all the google alternative for self-hosting? There has being a lot of for analytic. What about gmail? calendar. Tutanota, protonmail are ones came to mind.
soraminazuki 6y ago
I guess this is what happens when a single company has a monopoly over the search engine market. This couldn't have happened if law enforcement had to request information from say, hundreds of search engines in order to carry out keyword warrants.
- Terretta 6y ago
  It’s interesting to try to unpack why this “monopoly” bothers technologists a lot less than, say, one of a half dozen vertically integrated digital stores for gaming and app devices such as Switches, Xboxes, and iPads.
jariel 6y ago
Proportionality, legitimacy, process and oversight. If the FBI thinks someone is making a nuclear bomb in some postal code, there should be a process for helping to sort that out, because the risks are existential. For other things, it's more tricky. For smaller issues it shouldn't be in the toolbox.
- jaywalk 6y ago
  If the FBI thinks someone is making a nuclear bomb, they should have much better evidence than Google searches. Nuclear weapons are fascinating, and I'm sure that there are plenty of people all over the country (myself included) who have dug into how they work even though they aren't going to build one.
  - jariel 6y ago
    So 1) It's not always about 'evidence' they may be trying to find someone 2) they may need 'evidence' to provide more aggressive warrants, or possibly obtain the right to make an arrest while they don't have the final evidence and 3) court cases are hard - you need to have everything lined up. Raiding the garage they find materials, someone could can say 'It wasn't me' but when they show searches being made from the Google account ... then that's evidence relating the materials to intent etc.. It's not rocket science to make some rules so we don't end up in dystopia and at the same time can get information we really need. We just have to be smart about it. Edit: case and point, literally as we speak [1] plot to kidnap/overthrow Michigan Governor by armed quasi-militia. There's no doubt technology is used in the thwarting of this. "The FBI became aware of the scheme ... in early 2020 through a social media". [1] https://www.cnn.com/2020/10/08/politics/fbi-plot-michigan-governor-gretchen-whitmer/index.html https://www.cnn.com/2020/10/08/politics/fbi-plot-michigan-go...
- dilyevsky 6y ago
  > If the FBI thinks someone is making a nuclear bomb in some postal code, there should be a process for helping to sort that out Constitutional way to do that would be to fly a drone and see which house lights up ;)
diebeforei485 6y ago
Google makes it pretty easy for basically anyone in law enforcement[1] to get data on users, even without a warrant. 1. https://lers.google.com https://lers.google.com
- heavyset_go 6y ago
  Providers are notorious for just handing user data over when they are asked nicely by law enforcement to do so. No warrant needed in those cases.
  - nchelluri 6y ago
    wow. TIL
- AI_WAIFU 6y ago
  Quick question, what's stopping me from just using this? How rigorous is their verification process?
thisiscorrect 6y ago
It seems like CNET has an angle here. Since when is complying with a warrant "giving away information" as they put it.
adrianmonk 6y ago
I don't think it's helpful for this article to equate searching for a street address and searching for a keyword. One is a lot narrower than the other in the sense that the data which Google delivers to law enforcement is a much shorter list. If the government makes them hand over data about everyone who searched for a keyword, that's more prone to being dragnet surveillance. If the government asks who search for a specific street address, they may have learned about that address through an investigation of a specific crime. Of course, you're free to oppose both, but to me the reasoning to oppose one wouldn't necessarily apply to the other. They are different types of queries.
- whimsicalism 6y ago
  Is there a legal or internal Google policy basis for the distinction that you're setting up? Otherwise, all this indicates is that, in this specific case, Google gave information about an address, but you have no idea that these "keyword warrants" are limited to the "narrow" conception that you put forth. In fact, they explicitly reference a case where this keyword warrant was not used to look for an address, but rather a different search query.
  - perpetualpatzer 6y ago
    >Is there a legal or internal Google policy basis for the distinction that you're setting up? I understand OP to be distinguishing between "overbroad" and "not overbroad" warrants. The legal basis for that distinction is the particularity requirement in the 4th Amendment[0]. Overbreadth is a common point of contention that gets warrants denied/challenged when they probably cover a lot more targets than just the suspected party, for example, in this high-profile geofence search case[1]. An example, if you can prove "the perp lives in this apartment," it's okay to search it. If you can only prove "the perp lives in this apartment building", you can't get a warrant to search the whole building, because you'll definitely wind up searching a bunch of innocent people. The different search query you're referencing was for a specific name during a 38-day period[2]. A man of that name had been defrauded by a person using a fake passport with an image that appeared in Google's image search results for that name (but not Bing or Yahoo's, meaning it was likely obtained from Google). That, like the address, should yield a smallish number of total searcher (depending on the name/address). OP seems to believe that warranted, specific searches aren't as unchecked as "giving data to police based on search keywords" seems to suggest. I'd tend to agree. Given the evidence presented, you could write a similar article saying "Bank of America is giving banking information to police based on Walmart purchases, court docs show". [0] https://law.justia.com/constitution/us/amendment-04/09-particularity.html https://law.justia.com/constitution/us/amendment-04/09-parti... [1] https://www.eff.org/deeplinks/2020/08/new-federal-court-rulings-find-geofence-warrants-unconstitutional-0 https://www.eff.org/deeplinks/2020/08/new-federal-court-ruli... [2] https://www.documentcloud.org/documents/3519211-Edina-Police-Google-Search-Warrant-Redacted.html https://www.documentcloud.org/documents/3519211-Edina-Police...
Johnny555 6y ago
I've made a lot of seemingly suspicious google chats/emails though completely facetiously, like when I dropped off some DVD's at a friend's house near Golden Gate Park, I sent him a Hangout's message like: "I made the drop at the agreed upon location near Golden Gate Park, Please send me the money, small unmarked bills only" I've often joked about "I hope the police aren't reading this", and it turns out that they might be... thanks to Google.
- Andrew_nenakhov 6y ago
  I see what you are doing. Now that you know that Google keeps proofs of your past criminal activities, you're attempting to create a plausible story that would explain communication with your accomplices as a 'joke'. Nice try.
tantalor 6y ago
In these cases, do they actually have evidence a search engine query was made? How do they decide which search engines to subpoena? Do they just subpoena multiple search engines? To search your house for evidence, they must have reliable information showing probable cause of evidence specifically in your house, and not somewhere else. If they don't know where the evidence is, or what it is, they aren't allowed to do the search. But in the arson case, do they have evidence the suspect used Google in the course of the crime? If not, how do they have probable cause for the warrant?
cblconfederate 6y ago
Liberal democracies have forgotten they are liberal . They are democracies with a market and an army. There were monarchies in the past with better individual protections.
- bigbubba 6y ago
  The way the word 'liberal' is commonly [mis]used in America makes me think many people don't even know what it means. I've even had people look at me weird when using it in a non-political context ("I'd like a liberal serving of mashed potatoes please.")
nullc 6y ago
They were doing this decades ago too. Back when I worked for a county government I talked a fair bit with the sheriffs office IT folks. There had been a theft of a $1000 bill from a safe at a residence. They asked from google for a list of all recent searches for "$1000 bill" for the area and received it. Unfortunately the report was enormous and not useful: apparently some TV show (one of those antique roadshow or storage unit shows) had recently featured one. If you're as intellectually curious as me, ... perhaps it's better to not think too much about what your search strings look like without context. It seems to me that keeping a local copy of Wikipedia is becoming increasingly critical for being able to have private thoughts in a world deluged with information.
- makuto 6y ago
  While you're at it, to help with this specific case, you could also get a local copy of OpenStreetMap. That way you can look up and navigate to addresses without touching the internet.
RightTail 6y ago
wonder how long before search terms + facecrime ala (https://www.faception.com/ https://www.faception.com/) + harvested voice data = either arrested on suspicion of future crime or preemptive TOS violation Per Thiel's ("something you know to be true but few people agree with you on") Is it even possible for such a precrime dystopia NOT to exist? Is crypto the way out of this future?
- deleted 6y ago
  [deleted]
tsjq 6y ago
That's coming closer to thought crime
WoefullyInept 6y ago
As a European, this is a no shit sherlock moment for me. Who thought Google searches wouldn't be used?
joshstrange 6y ago
I'm really surprised no one has mentioned the short story by Cory Doctorow "Scroogled" [0] (Not to be confused with the MS ad campaign). It's about US officials using what ads you were served to vet you, not too far off from using your search results. [0] https://craphound.com/scroogled.html https://craphound.com/scroogled.html
- kyuudou 6y ago
  I was about to mention it. Although it's a bit dated I strongly recommend any one in software to read that. It's a quick read and enjoyable. I think the title is a nod to tireless privacy advocate Daniel Brandt, too.
holidayacct 6y ago
Google's value is in its data. Short of encrypting every thing and handing their users the key there isn't much they can do. They aren't going to encrypt everything and they have to comply with the law so why is this surprising?
electrondood 6y ago
Curiosity about a topic is not the same as an intention to engage in that topic in real life. This is why privacy matters. Because you cannot trust the people who collect information about you to interpret that information correctly. You also cannot trust those people to exploit that information for their own purposes.
1cvmask 6y ago
Work at big Internet company and frame people for fun. Or blackmail them. Or make money from bribery. Reminds me of this judge who made a pretty penny and ruined the lives of thousands: https://www.npr.org/sections/thetwo-way/2011/08/11/139536686/pa-judge-sentenced-to-28-years-in-massive-juvenile-justice-bribery-scandal https://www.npr.org/sections/thetwo-way/2011/08/11/139536686...
dest 6y ago
"Ruin my search history" https://www.vice.com/en_us/article/bmvv9w/ruin-your-google-search-history-with-one-click-using-this-website https://www.vice.com/en_us/article/bmvv9w/ruin-your-google-s...
pessimizer 6y ago
Maybe we need librarians to run our search engines, rather than advertising companies with no moral center.

421 points by 0xmohit 6y ago

Each time I call my husband office they keep telling me my husband has a 3pm appointment and this has been happing for a while now, am always worried about my husband leaving the office by 3pm yet he wont open up to me about the contract he has been trying to seal, then I hired jeajamhacker@gmail.com to make the investigation for me without any notice, I got access to my husband phone remotely after going through his text messages and all I found out that there is a lady my husband always see by 3pm then i went further because jeajamhacker@gmail.com also provided me with my husband deleted messages and I saw that my husband makes love to this lady everyday and when he comes home he stave me from sex but am so thankful to jeajamhacker@gmail.com for the best services he rendered to me.

fattegourmet 6y ago

data points mentioned in the article: address search; device location data. Innocent till proven guilty, right?

coldcode 6y ago

Not an acceptable practice under the Constitution of course it will require court cases to stop or narrow these. Geolocation searches (being in the wrong place/wrong time) are bad enough, but everyone searching for "X" could capture thousands or even millions of people.

shadowgovt 6y ago
I think it's a little unclear whether it's Unconstitutional. Google's logs of what users did on its service are Google's property, not proeprty of the users. It's like asserting the cops can't issue a warrant to your bank to look for transactions to Capone Real Estate Holdings, Inc... Of course they can.
- soraminazuki 6y ago
  So assuming that your argument holds, warrants mean nothing when private companies own everything and you don’t. Doesn’t sound like what was intended when the constitution was written.
  - shadowgovt 6y ago
    No, I don't think the Constitution was written to account for a world where corporations own everything and individuals don't. Updates may be in order.
    - arnoooooo 6y ago
      I don't think the people who downvote this comment have really thought about whether they own their phone, their computer, their printer, their ebooks, their car, their software... We have come to an era where you "buy" things but then can't repair them, can't modify them, ant even can't use them anymore once the maker decides so. Most modern machines are actually leased, not bought.
- notJim 6y ago
  Why should it be this way though? Under GDPR, citizens have certain rights over their own data, which is meant to protect their privacy. Shouldn't we have something similar here?
  - shadowgovt 6y ago
    I think America puts the bar at a different place than Europe on this topic.

mtgx 6y ago

> But a recently unsealed court document found that investigators can request such data in reverse order by asking Google to disclose everyone who searched a keyword rather than for information on a known suspect. "Just let us scour through the data to see who committed a crime." How is this not a fishing expedition? Does the 4th amendment not mean anything anymore in the US? Are judges still this clueless about such obfuscated requests from the police?

shadowgovt 6y ago
The keyword in this case was a postal address. It smells a bit analogous to pulling a street-corner security camera's feeds and looking at everyone who passed through an intersection to correlate with other data the cops have.

ColanR 6y ago

Makes me think of my own duckduckgo usage. I wonder if Google is the only search engine being leaned on, or if they're just the only one with any publicity around the shared data.

ISL 6y ago
I expect that DDG would make a huge stink about being compelled to do any such thing (Google, too. If people think the government is watching their internet searches, they'll go somewhere else.).
- comboy 6y ago
  Unless they publish some canary they may not be able to do that.
  - ISL 6y ago
    Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.
    - srtjstjsj 6y ago
      Spoiler alert: Congress did.
      - ISL 6y ago
        It can try, but that doesn't make the law constitutional.
  - LinuxBender 6y ago
    There are some differing opinions on the effectiveness of a canary. [1] The legal team where I work have the same opinion as Moxie's lawyers. [1] - https://web.archive.org/web/20141027143819/https://github.com/WhisperSystems/whispersystems.org/issues/34 https://web.archive.org/web/20141027143819/https://github.co...

blakesterz 6y ago

"Think of the ramifications in the future if everyone who searched something in the privacy of their own home was subject to interviews by federal agents," Spodek said. "Someone could be interested in how people die a certain way or how drug deals are done, and it could be misconstrued or used improperly." The problem is most people don't think like that. Most people think "why do I care, I search google for sourdough recipes and to see what the heck sus means. The chances of me getting in trouble because I did this is really low." And then they read something like this from the same place... "After investigators linked Williams to the arson through the keyword warrant, they sent Google another warrant specifically for his account, finding that he looked up phrases like "where can i buy a .50 custom machine gun," "witness intimidation" and "countries that don't have extradition with the United States." And they'll say "See, see! This works, this should be legal it catches bad people, look at what this guy was doing" Enough people think like that, and there's no pressure to make this practice illegal, no pressure from the public to get laws passed because while some people look at this practice and see their lives being made worse, many people look at this and see themselves being protected from bad guys.

macspoofing 6y ago
>The problem is most people don't think like that. But what is the problem here anyway? If there's a crime at a location, police detectives will investigate anyone that has any connection to that location. That someone may have searched for that location is certainly relevant to the investigation, but it doesn't imply that those individuals are automatically a suspect. In fact, they will be quickly ruled out.
- candiodari 6y ago
  Mostly there are zero suspects. These subpoenas are, as you point out, ways to find more suspects. There's just one issue: they also often only turn up ONE suspect. And here's the thing with people and police: everybody lies. The victim of the crime lies. Suspects lie (but the thing is: suspects lie whether or not they've committed a crime, this is not a difference between innocent and guilty). Witnesses lie (don't want to get caught, and yes the police encourages this, at wrong parking. Police will encourage them to lie, because they can't ignore a confession of wrongful parking and they understand they'll lose cooperation if they write them a ticket for their trouble). And of course the police officers themselves lie. Whatever hope you have of finding the underlying truth in such a haystack less than a few years of work ... forget it. And then comes Google with "concrete evidence". Something that is actually true. Very likely not related to the crime, but true. So you can probably understand that this would introduce quite a big bias against a "suspect", when their real connection to the crime is "someone was shot, and this guy googled 'gun' 2 days before". Furthermore, this gives them something to put to a judge or a jury, when before they had nothing, or nothing coherent. Do you really think at this point a police officer, judged by the number of cases solved, bad guys put away, just walks away without at least applying very strong pressure on whoever was fingered ?

duxup 6y ago

The police had a warrant for the information. Whatever is going on here Google doesn't seem to just be forking over mass data at any request, at least not as far as this story goes. I would argue the issue here is that such a warrant was granted in the first place.

CivBase 6y ago
> I would argue the issue here is that such a warrant was granted in the first place. I agree that the warrant itself is a huge problem, but I think there's another significant issue here. Google may have just been complying with the law, but that doesn't meant they had to be quiet about it. Unless they had a gag order, they should have publicly stated that the US government was compelling them to hand over search records. From the article: > Google declined to disclose how many keyword warrants it's received in the last three years. They did not say anything about a gag order and, given Google's track record on privacy, I'm not inclined to give them the benefit of the doubt here.
- duxup 6y ago
  The warrant was sealed. I think that means there's a fairly high chance they were told to keep quiet (legally). Not 100% sure but it seems likely. Maybe things have changed but IIRC the past Google has fought to be able to disclose publicly the extent of some requests made by the government.
  - CivBase 6y ago
    Can they not even say what they're not allowed to say? When prompted about how many warrants they've had, why not just respond with "We are not legally allowed to answer"? And what is the justification for a gag order like that in the first place?
    - duxup 6y ago
      "Can they not even say what they're not allowed to say?" In the past they couldn't even say that. I believe Google and Microsoft have litigated over that point specifically. I don't recall if they won or not.

carapace 6y ago

I remember being mildly startled when I realized I no longer use Google to google. https://duckduckgo.com/spread https://duckduckgo.com/spread

Smoosh 6y ago
or https://about.qwant.com/ https://about.qwant.com/

fierarul 6y ago

What I found fascinating is that Google is digitally signing the data given to authorities. This is more than any free or paid user can obtain. You have a green padlock in your URL but can you prove in court you received a given email? No, because a SSL connection is transient and you can't replay it to show that Google's certificate digitally signed that email in GMail.

inetknght 6y ago
> can you prove in court you received a given email? No, because a SSL connection is transient and you can't replay it to show that Google's certificate digitally signed that email in GMail. A TLS session replay is unnecessary. If you've got the email with its headers intact then you can prove that you received that email. You might want to learn what email headers are available to you. You'd be interested in learning about ARC-Seal, ARC-Message-Signature, ARC-Authentication-Results, and DKIM-Signature. Those headers will let you cryptographically validate that a message is authentic -- that the email is unaltered as Google received it from whoever sent it. You'll also be interested in learning about Key Transparency: the signatures are created using Google's PKI which should be listed in any public key transparency log. That will let you prove that the signatures you validated were created using something that only Google knows.
- upofadown 6y ago
  >...that the email is unaltered as Google received it from whoever sent it. Well technically whatever sent it. That stuff is all about the identity of mail servers, not individuals.
advisedwang 6y ago
> can you prove in court you received a given email You can subpoena Google for the records. It would probably be easier to rely on that in court than cryptographic proof, as the legal system understand that much better.
throwaway0x00ff 6y ago
> a SSL connection is transient and you can't replay it to show that Google's certificate digitally signed that email in GMail. Actually, there the TLSNotary[1] protocol that allows you to use the https connection as a means to sign the web content your browser received. There is the PageSigner browser extension that uses TLSNotary to sign webpages. However, it seems like this project wasn't given a lot of love this last few years. Good news is version 2.0 has been released just a week ago[2], with support for TLS 1.2, but with a major drawback for me: it now trusts a server generating the TLS keys for the notarized page. Sure, it's an "oracle" server not controlled by PageSigner but still operated by Amazon. [1] https://tlsnotary.org/ https://tlsnotary.org/ [2] https://tlsnotary.org/wp/?p=45 https://tlsnotary.org/wp/?p=45

abvdasker 6y ago

this is a clear case where using a VPN goes a long way towards protecting someone from surveillance and law enforcement overreach

vmception 6y ago
A vpn at best just increases the costs for multi-country collaboration, but doesn't prevent it. This is the federal government, not some local municipality. Even your favorite swiss bunker vpn can be subpoena’d or tapped extrajudicially and you would never know
- abvdasker 6y ago
  I think that's wrong on a couple counts. First, the main concern with this type of collection based on search terms is that it has a high likelihood of picking up users who are totally innocent. If many of those users are obscured by VPNs, that raises the bar considerably for law enforcement to de-anonymize each of them (most, if not all, of whom LE knows will be total dead ends). Second, concerning a VPN being tapped by US law enforcement agencies, I think depending on the country in which it's being operated, that is more or less likely. These companies' entire businesses rely on the perception of security, so government interception of their communications would be an existential threat to them. I think it's also likely that interception (and crucially, use of intercepted materials as evidence in criminal prosecution) would probably get out sooner or later, just as it has in the above story. The idea that federal law enforcement has access to everyone's communications everywhere all the time probably overstates their capabilities. As I understand it, there still remains a pretty big difference between the government's active/targeted vs passive/dragnet surveillance. A VPN is probably still useful for defending against the latter.
  - vmception 6y ago
    Everything you wrote requires ignoring the entire last decade. But fine, for an illustrative example lets use this article as an example. The government asked Google for IP addresses, then the government did an additional thing to determine the phone number was tied to the person they indicted, whether that was due to a Google account or requiring them to go to the cellular provider. Nobody in this thread is arguing about the false positives snatching innocent people, just the VPN part. With a VPN the same government would have gone to Google, then to the VPN company, then to the cellular provider. VPN didn't help the customer, just slowed the government down. You also wouldn't know if passive surveillance was being done on the VPN provider, which has been shown to happen to ISPs before from the Snowden leaks 7 whole years ago, which was about things that were even older. The NSA and FBI used National Security Letters to directly tap the servers indefinitely, and the CIA would just pay companies to directly tap the servers. They can be more easily coervice domestically, but other countries, even countries without automatic cooperation treaties are eager to help US investigators and have. You wouldn't know if Proton/ExpressVPN/Nord you name it were passively sharing data, if they began keeping logs if at one point they say they didn't, if you were the active target, etc.

0df8dkdf 6y ago

Time to move away from Google and self-host!

criddell 6y ago
I don't think it's reasonable for every person to run their own web crawlers.

0df8dkdf 6y ago

Is there a resources for all the google alternative for self-hosting? There has being a lot of for analytic. What about gmail? calendar. Tutanota, protonmail are ones came to mind.

soraminazuki 6y ago

I guess this is what happens when a single company has a monopoly over the search engine market. This couldn't have happened if law enforcement had to request information from say, hundreds of search engines in order to carry out keyword warrants.

Terretta 6y ago
It’s interesting to try to unpack why this “monopoly” bothers technologists a lot less than, say, one of a half dozen vertically integrated digital stores for gaming and app devices such as Switches, Xboxes, and iPads.

jariel 6y ago

Proportionality, legitimacy, process and oversight. If the FBI thinks someone is making a nuclear bomb in some postal code, there should be a process for helping to sort that out, because the risks are existential. For other things, it's more tricky. For smaller issues it shouldn't be in the toolbox.

jaywalk 6y ago
If the FBI thinks someone is making a nuclear bomb, they should have much better evidence than Google searches. Nuclear weapons are fascinating, and I'm sure that there are plenty of people all over the country (myself included) who have dug into how they work even though they aren't going to build one.
- jariel 6y ago
  So 1) It's not always about 'evidence' they may be trying to find someone 2) they may need 'evidence' to provide more aggressive warrants, or possibly obtain the right to make an arrest while they don't have the final evidence and 3) court cases are hard - you need to have everything lined up. Raiding the garage they find materials, someone could can say 'It wasn't me' but when they show searches being made from the Google account ... then that's evidence relating the materials to intent etc.. It's not rocket science to make some rules so we don't end up in dystopia and at the same time can get information we really need. We just have to be smart about it. Edit: case and point, literally as we speak [1] plot to kidnap/overthrow Michigan Governor by armed quasi-militia. There's no doubt technology is used in the thwarting of this. "The FBI became aware of the scheme ... in early 2020 through a social media". [1] https://www.cnn.com/2020/10/08/politics/fbi-plot-michigan-governor-gretchen-whitmer/index.html https://www.cnn.com/2020/10/08/politics/fbi-plot-michigan-go...
dilyevsky 6y ago
> If the FBI thinks someone is making a nuclear bomb in some postal code, there should be a process for helping to sort that out Constitutional way to do that would be to fly a drone and see which house lights up ;)

diebeforei485 6y ago

Google makes it pretty easy for basically anyone in law enforcement[1] to get data on users, even without a warrant. 1. https://lers.google.com https://lers.google.com

heavyset_go 6y ago
Providers are notorious for just handing user data over when they are asked nicely by law enforcement to do so. No warrant needed in those cases.
- nchelluri 6y ago
  wow. TIL
AI_WAIFU 6y ago
Quick question, what's stopping me from just using this? How rigorous is their verification process?

thisiscorrect 6y ago

It seems like CNET has an angle here. Since when is complying with a warrant "giving away information" as they put it.

adrianmonk 6y ago

I don't think it's helpful for this article to equate searching for a street address and searching for a keyword. One is a lot narrower than the other in the sense that the data which Google delivers to law enforcement is a much shorter list. If the government makes them hand over data about everyone who searched for a keyword, that's more prone to being dragnet surveillance. If the government asks who search for a specific street address, they may have learned about that address through an investigation of a specific crime. Of course, you're free to oppose both, but to me the reasoning to oppose one wouldn't necessarily apply to the other. They are different types of queries.

whimsicalism 6y ago
Is there a legal or internal Google policy basis for the distinction that you're setting up? Otherwise, all this indicates is that, in this specific case, Google gave information about an address, but you have no idea that these "keyword warrants" are limited to the "narrow" conception that you put forth. In fact, they explicitly reference a case where this keyword warrant was not used to look for an address, but rather a different search query.
- perpetualpatzer 6y ago
  >Is there a legal or internal Google policy basis for the distinction that you're setting up? I understand OP to be distinguishing between "overbroad" and "not overbroad" warrants. The legal basis for that distinction is the particularity requirement in the 4th Amendment[0]. Overbreadth is a common point of contention that gets warrants denied/challenged when they probably cover a lot more targets than just the suspected party, for example, in this high-profile geofence search case[1]. An example, if you can prove "the perp lives in this apartment," it's okay to search it. If you can only prove "the perp lives in this apartment building", you can't get a warrant to search the whole building, because you'll definitely wind up searching a bunch of innocent people. The different search query you're referencing was for a specific name during a 38-day period[2]. A man of that name had been defrauded by a person using a fake passport with an image that appeared in Google's image search results for that name (but not Bing or Yahoo's, meaning it was likely obtained from Google). That, like the address, should yield a smallish number of total searcher (depending on the name/address). OP seems to believe that warranted, specific searches aren't as unchecked as "giving data to police based on search keywords" seems to suggest. I'd tend to agree. Given the evidence presented, you could write a similar article saying "Bank of America is giving banking information to police based on Walmart purchases, court docs show". [0] https://law.justia.com/constitution/us/amendment-04/09-particularity.html https://law.justia.com/constitution/us/amendment-04/09-parti... [1] https://www.eff.org/deeplinks/2020/08/new-federal-court-rulings-find-geofence-warrants-unconstitutional-0 https://www.eff.org/deeplinks/2020/08/new-federal-court-ruli... [2] https://www.documentcloud.org/documents/3519211-Edina-Police-Google-Search-Warrant-Redacted.html https://www.documentcloud.org/documents/3519211-Edina-Police...

Johnny555 6y ago

I've made a lot of seemingly suspicious google chats/emails though completely facetiously, like when I dropped off some DVD's at a friend's house near Golden Gate Park, I sent him a Hangout's message like: "I made the drop at the agreed upon location near Golden Gate Park, Please send me the money, small unmarked bills only" I've often joked about "I hope the police aren't reading this", and it turns out that they might be... thanks to Google.

Andrew_nenakhov 6y ago
I see what you are doing. Now that you know that Google keeps proofs of your past criminal activities, you're attempting to create a plausible story that would explain communication with your accomplices as a 'joke'. Nice try.

tantalor 6y ago

In these cases, do they actually have evidence a search engine query was made? How do they decide which search engines to subpoena? Do they just subpoena multiple search engines? To search your house for evidence, they must have reliable information showing probable cause of evidence specifically in your house, and not somewhere else. If they don't know where the evidence is, or what it is, they aren't allowed to do the search. But in the arson case, do they have evidence the suspect used Google in the course of the crime? If not, how do they have probable cause for the warrant?

cblconfederate 6y ago

Liberal democracies have forgotten they are liberal . They are democracies with a market and an army. There were monarchies in the past with better individual protections.

bigbubba 6y ago
The way the word 'liberal' is commonly [mis]used in America makes me think many people don't even know what it means. I've even had people look at me weird when using it in a non-political context ("I'd like a liberal serving of mashed potatoes please.")

nullc 6y ago

They were doing this decades ago too. Back when I worked for a county government I talked a fair bit with the sheriffs office IT folks. There had been a theft of a $1000 bill from a safe at a residence. They asked from google for a list of all recent searches for "$1000 bill" for the area and received it. Unfortunately the report was enormous and not useful: apparently some TV show (one of those antique roadshow or storage unit shows) had recently featured one. If you're as intellectually curious as me, ... perhaps it's better to not think too much about what your search strings look like without context. It seems to me that keeping a local copy of Wikipedia is becoming increasingly critical for being able to have private thoughts in a world deluged with information.

makuto 6y ago
While you're at it, to help with this specific case, you could also get a local copy of OpenStreetMap. That way you can look up and navigate to addresses without touching the internet.

RightTail 6y ago

wonder how long before search terms + facecrime ala (https://www.faception.com/ https://www.faception.com/) + harvested voice data = either arrested on suspicion of future crime or preemptive TOS violation Per Thiel's ("something you know to be true but few people agree with you on") Is it even possible for such a precrime dystopia NOT to exist? Is crypto the way out of this future?

deleted 6y ago
[deleted]

tsjq 6y ago

That's coming closer to thought crime

WoefullyInept 6y ago

As a European, this is a no shit sherlock moment for me. Who thought Google searches wouldn't be used?

joshstrange 6y ago

I'm really surprised no one has mentioned the short story by Cory Doctorow "Scroogled" [0] (Not to be confused with the MS ad campaign). It's about US officials using what ads you were served to vet you, not too far off from using your search results. [0] https://craphound.com/scroogled.html https://craphound.com/scroogled.html

kyuudou 6y ago
I was about to mention it. Although it's a bit dated I strongly recommend any one in software to read that. It's a quick read and enjoyable. I think the title is a nod to tireless privacy advocate Daniel Brandt, too.

holidayacct 6y ago

Google's value is in its data. Short of encrypting every thing and handing their users the key there isn't much they can do. They aren't going to encrypt everything and they have to comply with the law so why is this surprising?

electrondood 6y ago

Curiosity about a topic is not the same as an intention to engage in that topic in real life. This is why privacy matters. Because you cannot trust the people who collect information about you to interpret that information correctly. You also cannot trust those people to exploit that information for their own purposes.

1cvmask 6y ago

Work at big Internet company and frame people for fun. Or blackmail them. Or make money from bribery. Reminds me of this judge who made a pretty penny and ruined the lives of thousands: https://www.npr.org/sections/thetwo-way/2011/08/11/139536686/pa-judge-sentenced-to-28-years-in-massive-juvenile-justice-bribery-scandal https://www.npr.org/sections/thetwo-way/2011/08/11/139536686...

dest 6y ago

"Ruin my search history" https://www.vice.com/en_us/article/bmvv9w/ruin-your-google-search-history-with-one-click-using-this-website https://www.vice.com/en_us/article/bmvv9w/ruin-your-google-s...

pessimizer 6y ago

Maybe we need librarians to run our search engines, rather than advertising companies with no moral center.