Google Fights Dragnet Warrant For Users' Search Histories Overseas While Continuing To Give Data To Police In The U.S.

The Electronic Frontier Foundation (EFF)
by Naomi Gilens, Jennifer Lynch, and Veridiana Alimonti
Reprinted under Creative Commons Attribution License 3.0
Originally published April 5, 2022

Google is fighting back against a Brazilian court order to turn over data on all users who searched for specific terms, including the name of a well-known elected official and a busy downtown thoroughfare. (Brief in Portuguese and English*) While we applaud Google for challenging this digital dragnet search in Brazil, it must also stand up for the rights of its users against similar searches in the U.S. and elsewhere.

Background: Keyword Search Warrants

Keyword search warrants like the one in Brazil are far broader than traditional search warrants described in the Fourth Amendment to the U.S. Constitution. The Fourth Amendment requires police to establish probable cause to search a particular place or seize a particular person or thing before the court authorizes the warrant. But keyword search warrants don't start with a suspect person or device. Instead, they require Google to comb through the search histories of all of its users, including users who are not logged into a Google account when they search.

Keyword warrants allow the police to learn anyone and everyone who may have searched for particular terms on the off-chance one of those people could have been involved with the crime. Like better-known geofence warrants, keyword warrants allow police to conduct a fishing expedition and sweep up data on innocent people, turning them into criminal suspects. Police are using both types of expansive, suspicionless searches with increasing frequency.

Google Takes a Stand Against Keyword Search Warrants--in Brazil

The Brazilian case arises out of the assassination of Rio de Janeiro City Councilor Marielle Franco. Franco was murdered, along with her driver, Anderson Gomes, near Rio de Janeiro in 2018. It was a terrible crime that stirred up public outcry.

As part of the investigation into the assassination, police ordered Google to trawl through its users' search histories, scanning for searches of certain terms--including the name of a heavily trafficked street in Rio de Janeiro ("Rua dos Inválidos"), Franco's name, and the name of a nonprofit cultural space intended to support Black women (Casa das Pretas), where Franco had participated in an event earlier on the day she was killed. The order required Google to turn over identifying data about all users who searched for these and other related terms over the course of four days.

Google has challenged this order, eventually appealing it all the way to Brazil's Supreme Federal Court, arguing that this kind of indiscriminate search violates the Brazilian constitution. (Google's brief in Portuguese and English*) As Google rightly explains, the warrant is wildly overbroad. The search terms would all have been popular and common queries, and many people are likely to have used them--including citizens and journalists interested in the activities of a city councilor, or people interested in collaborating with or receiving support from the nonprofit cultural center Casa das Pretas.

This particular keyword search warrant is particularly egregious, given the sheer number of people likely caught in its dragnet, but even a more narrow warrant should trigger human rights concerns. These types of warrants inevitably sweep in users whom police have no reason to believe were involved in the crime, and they give police unbridled discretion to determine which of these people to target for further investigation. In the Fourth Amendment framework, the unbridled discretion inherent in keyword search warrants, like geofence warrants, makes them an unconstitutional "general warrant."

As Google emphasized in its brief, this case in Brazil has far-reaching implications. This method of investigating transforms a platform intended to provide access to information into a tool for the government to collect highly revealing private data from innocent people. And Google receives thousands of law enforcement orders to provide user data in Brazil each year, affecting tens of thousands of users. If Brazil's Supreme Court signs off on dragnet keyword searches, the number of impacted users could skyrocket.

Google Fails to Challenge Keyword Search Warrants in the U.S.

Keyword search orders are becoming increasingly common in the U.S.--but Google seemingly hasn't fought nearly as hard to protect the privacy of its U.S. users. We aren't aware of any cases in which Google has pushed back against keyword search warrants in the U.S. In fact, we have no idea how many keyword warrants Google receives or how it responds to them at all, because Google has kept that information entirely secret. That secrecy surrounding keyword warrants contrasts with Google's recent reporting on geofence warrants; Google has now shared the number of geofence warrants it receives and the three-step process it uses to respond to them.

It's remarkable that Google has taken a strong stand in favor of user privacy in Brazil. But this problem isn't limited to one country, and Google could do much more to protect its users. Google can and should take proactive steps to address the highly revealing capacity of its databases and adopt robust data minimization measures on how user data is processed and for long it is stored. And it should take a stand in the courts to protect users in the U.S. and other countries from dragnet keyword searches, just like it's doing in Brazil.