Google refuses data — will other companies bow?

It was a case that gave a new meaning to the phrase “Google search.”

Earlier this year, a federal judge signed a search warrant for a windfall of private information to help find the robber responsible for a string of crimes in southern Maine.

Authorities were seeking a large amount of sensitive user data — including names, addresses and location, as first reported by Forbes — of anyone who had been in the vicinity of at least two of the nine robbery locations, within 30 minutes of the crime.

The Associated Press reports Google apps can collect data even when users have turned off location services on their phones, so the potential number of people covered by the warrant was vast. Still, without knowing whom the warrant was looking for or whether the suspect even used a Google device, a federal judge signed the warrant on March 30.

The warrant ordered Google to turn over all data sought, whether a user was carrying an Android phone or running a Google app at the time, a move that has alarmed some privacy and Fourth Amendment experts worried that warrants with very broad scopes will become a new norm for police investigations.

“Where big data policing and data trails are available it becomes tempting, and maybe too tempting, to take shortcuts with process that should be used as a last resort,” Andrew Ferguson, a criminal law attorney and author of The Rise of Big Data Policing: Surveillance, Race, and the Future of Law Enforcement, told the Washington Post. He pointed to all the people bound to be swept up in such dragnet searches.

The government’s warrant was written by the U.S. attorney’s office in the District of Maine to assist in catching the perpetrator, according to the document: “[I]nformation stored in connection with an email account may provide crucial evidence of the ‘who, what, why, when, where, and how’ of the criminal conduct under investigation, thus enabling the United States to establish and prove each element or alternatively, to exclude the innocent from further suspicion.”

According to Ferguson, the facts of each robbery, laid out by officials in the warrant application, did not make clear what they were looking for. The suspect had committed seven successful armed robberies and botched two attempts, targeting local gas stations, convenience stores and Chinese restaurants. The perpetrator was usually, though not consistently, described as white, wearing a dark hoodie and covering the lower half of his face. All of the mentioned crimes spanned late March.

“It’s like they were trying to lump them all together and draw threads using digital trails,” Ferguson said.

Google’s first court-ordered deadline arrived on April 23, but the U.S. attorney’s office had not received anything. It asked for an extension to afford the company more time, Assistant United States Attorney Michael Conley said to the Post. Five months and three extensions later, his office gave up.

“We were pursuing every possible angle,” Conley said.

By that point, though, Conley didn’t need Google’s assistance. The suspect, Travis Card, had been arrested months earlier in an armed robbery of a country gas station in Westbrook, Maine.

It is unclear whether Google, which could not be reached for immediate comment, failed to respond to the warrant in an attempt to thwart law enforcement and protect user privacy or because it couldn’t locate the information. But the incident appears to be an example of corporations struggling with how to position themselves in relation to law enforcement.

In an age where virtually everyone carries a phone at nearly every moment of the day, devices have a trove of data for law enforcement to look to — map applications, Wi-Fi hotspots, cell tower triangulations, images with embedded locations.

People should not have to rely on tech companies to make discretionary decisions about whether to protect such personal data, said Nathan Freed Wessler, a staff attorney at the ACLU Speech, Privacy, and Technology Project.

Instead, he said, sensitive information should be protected by strong laws and judges’ strong enforcement of the Constitution.

“The only real way we’re going to avoid unnecessary dragnet searches is to have protections in place. It may be appropriate in exceptional circumstances or where other avenues are exhausted, but there are lots of other ways to build leads and find suspects,” said Wessler, drawing a comparison to wiretaps, which are also not the first option in criminal investigations. Courts require a showing that they are, in fact, a necessary tactic. The same, he said, should be true of data searches that can sweep up other people.

Some technology companies have tried to argue these requests are fishing expeditions, though as service providers they often have little ground to stand on in court. Facebook fought New York prosecutors, losing the battle to block bulk search warrants in 2017.

Last year, Amazon.com was ordered to turn over any data collected during an alleged murder. Though the company satisfied part of the warrant, it filed a motion to void the rest, calling the warrant excessive. Like Card’s case, Amazon’s compliance eventually became moot.