Judge issues search warrant for anyone who Googled a victim's name
US court order casts really, really, really wide net
Updated A judge in Minnesota, America, has granted cops a search warrant to direct Google to provide personal details about anyone searching for a specific name.
Tony Webster, who describes himself as a web engineer, public records researcher, and policy nerd, published a portion of the warrant out of concern that administrative subpoenas and search warrants are being used for what amounts to fishing expeditions.
Under the Fourth Amendment, searches and seizures must be reasonable and as such are generally limited in their scope, to balance privacy expectations. At issue is whether a warrant for the Google account data of anyone searching for a given term is unconstitutionally broad.
For Hennepin County Judge Gary Larson at least, the warrant was adequate.
According to the warrant, seen in full by The Register, the case involves bank fraud in which an unknown party used the victim's name to wire $28,500 from Spire Credit Union to Bank of America. The credit union relied on a faxed copy of the victim's passport to verify the transaction, but the document was faked.
The search warrant, filed by Edina Police Detective David Lindman, says that when investigators searched Google Images for the victim's name, they found the photo used to make the fake passport – an image of someone who resembled the victim but was not the same person. This led police to believe that the person responsible searched Google for the victim's name.
Searches of Bing and Yahoo did not produce results, the warrant says.
Reached by phone, Edina police lieutenant Timothy Olson told The Register an earlier report that investigators had sought the Google searches of everyone in Edina was "blatantly inaccurate." Olson declined to discuss what he characterized as an active case, but said the warrant was related to a felony that had been reported and that it outlined probable cause.
The warrant asks for Google user information related to Google searches of the victim's name. The request was filed in "the city or township of Edina, County of Hennepin, State of Minnesota," but its extent is unlimited: anyone who searched for this particular victim using Google falls under the granted warrant.
A copy of the order obtained by The Register. We've redacted the full name of the victim
The warrant seeks, "any/all user or subscriber information related to the Google searches of" four variants of the victim's name over a five-week period, from December 1, 2016 through January 7, 2017.
It describes the information sought as including, but not limited to: "name(s), address(es), telephone number(s), dates of birth, social security numbers, email addresses, payment information, account information, IP addresses, and MAC addresses of the person(s) who requested/completed the search."
According to the warrant, Google rejected an administrative subpoena from the court. "Though Google Inc.'s rejection of the administrative subpoena is arguable," the warrant states, "[the Edina Police Department] is applying for this search warrant so that the investigation of this case does not stall."
Google may not cooperate, however. The internet king has an interest in fending off overreaching governments and police to avoid becoming an on-demand data dispensary.
"We aren't able to comment on specific cases, but we will always push back when we receive excessively broad requests for data about our users," a Google spokesperson said in an email to The Register.
Stephanie Lacambra, EFF criminal defense staff attorney, in an email to The Register, expressed skepticism that the warrant as described will be able to survive Constitutional scrutiny.
"As a former public defender for over a decade, I can say that this kind of warrant appears both unusual, in that it was approved in the first place without first establishing as a threshold matter that the suspect perpetrator used Google to obtain the photo used in the fraudulent passport in the first place, and overbroad, in that it calls for a dragnet production of the private information of all querents who searched a particular name within a five week time frame without any further limiting factors," she said. ®
Editor's note: Having obtained a full copy of the warrant, and having spoken to legal experts, we have updated this story to clarify that the warrant goes beyond Edina, Minnesota – it touches everyone who used Google to search for a particular person.
- Black Hat
- Common Vulnerability Scoring System
- Cybersecurity and Infrastructure Security Agency
- Cybersecurity Information Sharing Act
- Data Breach
- Data Protection
- Data Theft
- Digital certificate
- Identity Theft
- Kenna Security
- Palo Alto Networks
- Privacy Sandbox
- Privacy Shield
- Trusted Platform Module
- Zero trust