Google User Data Has Become a Favorite Police Shortcut

[bnew]

Google User Data Has Become a Favorite Police Shortcut

Investigators increasingly use warrants to obtain location and search data from Google, even for nonviolent cases—and even for people who had nothing to do with the crime.

www.bloomberg.com

Illustration: Jordan Speer for Bloomberg Businessweek
Businessweek

The Big Take

Google User Data Has Become a Favorite Police Shortcut​

Investigators increasingly use warrants to obtain location and search data from Google, even for nonviolent cases—and even for people who had nothing to do with the crime.


By Julia Love and Davey Alba

September 28, 2023 at 12:01 AM EDT

One morning in January 2020, Robert Potts was loading up his SUV for a trip to the police academy in Raleigh, North Carolina. He started warming up the car, his mind on exams, and went back into his apartment to grab his lunch. When he returned the SUV was gone, along with a rubber training pistol, a set of handcuffs and a portable radio.

Raleigh cops found the SUV by lunchtime. Potts was distraught. Losing your gear is very bad form for a cop, especially a rookie, and the thief had walked off with some of Potts’, including the most sensitive item—the radio. Someone could use that to disrupt the police department’s communications with false reports. Potts’ supervisors reassured him they’d take care of it.


Potts returned his focus to exams, completely unaware of the events his early-morning blunder had set in motion. He says the Raleigh PD was able to remotely disable his radio, ensuring that their communications remained uncompromised. But the cops weren’t ready to drop the matter. In their determination to recover the radio, they capitalized on two cutting-edge investigative tools available to local law enforcement—both made possible by Google.

Parking lot where the SUV was stolen.Photographer: Cornell Watson for Bloomberg Businessweek

PottsCourtesy of subject

Within days of the theft, the Raleigh PD sent Google a search warrant demanding a list of people who were in the neighborhood when the gear was stolen. They also secured a judge’s order for the company to identify anyone who Googled “Motorola APX 6000,” the model of the radio, and similar phrases in the days after the device went missing. Google handed over user location data in response.

Google maintains one of the world’s most comprehensive repositories of location information. Drawing from phones’ GPS coordinates, plus connections to Wi-Fi networks and cellular towers, it can often estimate a person’s whereabouts to within several feet. It gathers this information in part to sell advertising, but police routinely dip into the data to further their investigations. The use of search data is less common, but that, too, has made its way into police stations throughout the country.


Police say these warrants can unearth valuable leads when detectives are at a loss. But to get those leads, officers frequently have to rummage through Google data on people who have nothing to do with a crime. And that’s precisely what worries privacy advocates.

Traditionally, American law enforcement obtains a warrant to search the home or belongings of a specific person, in keeping with a constitutional ban on unreasonable searches and seizures. Warrants for Google’s location and search data are, in some ways, the inverse of that process, says Michael Price, the litigation director for the National Association of Criminal Defense Lawyers’ Fourth Amendment Center. Rather than naming a suspect, law enforcement identifies basic parameters—a set of geographic coordinates or search terms—and asks Google to provide hits, essentially generating a list of leads.

PricePhotographer: Nicky Woo for Bloomberg Businessweek

Police have been using versions of this method for decades. Security camera footage and cell tower data from phone companies all have the potential for invasions of privacy that go beyond searching a suspect’s trunk. But the sheer volume of information available from Google about where tens of millions of people have been and what they’ve searched for is unprecedented.

By their very nature, these Google warrants often return information on people who haven’t been suspected of a crime. In 2018 a man in Arizona was wrongly arrested for murder based on Google location data. Despite this possibility, police have continued to embrace the practice in the years since. “In many ways, law enforcement thinks it’s like hitting the easy button,” says Price, who’s mounting some of the country’s first legal challenges to warrants for Google’s location and search data. “It would be very difficult for Google to refuse to comply in one set of cases if it’s complying in another. The door gets cracked open, and once it’s open, it just becomes a floodgate.”

Google says it received a record 60,472 search warrants in the US last year, more than double the number from 2019. The company provides at least some information in about 80% of cases. Although many large technology companies receive requests for information from law enforcement at least occasionally, police consider Google to be particularly well suited to jump-start an investigation with few other leads. Law enforcement experts say it’s the only company that provides a detailed inventory of whose personal devices were present at a given time and place. Apple Inc., the other major mobile operating system provider, has said it’s technically unable to supply the sort of location data police want. That’s OK, because many iPhone users depend on Google Maps and other Google apps. Google’s search engine owns 92% of the market worldwide and is currently the focus of an antitrust lawsuit from the US Department of Justice.

Featured in Bloomberg Businessweek, Oct. 2, 2023. Subscribe now.Photo illustration: 731; Photos: Getty Images; Google Earth

A Google spokesperson says the company scrutinizes all demands for user data and challenges those that it finds to be overly broad. Recent court cases have better equipped the company to push back, it says. “There are legitimate requests that we get every day. At the same time, there are sometimes requests that can be so broad that they infringe privacy rights and are really inappropriate,” says Kent Walker, the president for global affairs at Google and its parent company, Alphabet Inc. “In a significant percentage of cases, we go back and forth with the government to try and narrow warrants.”

Bloomberg Businessweek collected and analyzed 115 warrants for the company’s location and search data in five states, one of the largest known reviews of such documents. The analysis, based on search warrants filed from 2020 to 2023 with courthouses in Austin, Denver, Phoenix, Raleigh and San Francisco, showed that departments used them not only to solve violent crimes but also for more routine offenses. About 1 in 5 location warrants were for offenses such as theft and vandalism. A detective in Scottsdale, Arizona, got one in search of somebody accused of stealing a Louis Vuitton handbag. In that investigation and many others, the Google data offered nothing useful.


In the case of the missing radio, Lieutenant Jason Borneo of the Raleigh Police Department says Google data can be “critical to obtaining stolen property,” but Google says it didn’t deliver the search data the investigators were after. They never got the radio back and have yet to make an arrest. When asked how the department learned it could get this sort of information from Google, Borneo says, “One detective became aware of the keyword search warrant from another detective.”

That’s often how it spreads: a phone call from one department to another, a suggestion from a federal investigator, a training session from an outside consultant. The reliance on Google in some cases is so extensive that police are taking what one retired judge calls a “belt and suspenders” approach, applying for location warrants even when they have other leads at their disposal. In law enforcement, as in life, sometimes it’s easier to ask Google for the answer.

Satellite image of the parking lot at 15444 N. Frank Lloyd Wright Blvd., Scottsdale, Arizona.Source: Google Earth

The purse was stolen in this parking lot.Photographer: Adriana Zehbrauskas for Bloomberg Businessweek

Cooperation between American businesses and police traces as far back as the days of the telegraph. In the years after the Sept. 11 terrorist attacks, surveillance demands from federal agents increased dramatically. But most local police didn’t catch on to the potential of using Google location and search data to generate leads until fairly recently.

 

[bnew]

Tech companies rarely help without a legal order. But with a warrant in hand, police can get an unparalleled glimpse into a person’s life. They can obtain emails, text messages and photos in a camera roll. Those requests hinge on police having a suspect. It’s when there’s no suspect at all that Google’s help is most coveted.

Google can paint the most detailed portrait of a person whose account uses a feature called Location History. For these users, Google compiles a list of places they’ve been with their phone, registering their locations on average every two minutes. The company invites users to enable the feature when they use apps such as Google Maps, whether on an iPhone or Google’s Android. (The notifications are more insistent on Android.) Google pitches the feature as a way to remember trips you’ve taken, rediscover old haunts and get insights on where you’ve spent time and how far you’ve traveled. The company says that the feature has always been opt-in and that users are regularly reminded of the data collection. An estimated one-third of all active Google users have Location History turned on.

Search warrant for a purse robbery.Source: Maricopa County Superior Court

This data is important to Google’s advertising business, which generates about 80% of the parent company’s revenue. It can help marketers determine how many people visited a store after seeing an ad, according to a court testimony in 2021 from Marlo McGriff, then a Location History product manager at Google. The company stores location information in a database known as Sensorvault. If users turn off Location History, the company stops collecting, but prior data remains on its servers and within law enforcement’s reach.

To obtain a warrant, police create what’s known as a geofence, using software to draw a virtual perimeter around a crime scene with location coordinates instead of caution tape. Then they must convince a judge that there’s a good chance they’ll find evidence of a crime within the area. If the judge approves, the officers send the warrant to Google.
“It’s far more complicated than it might appear. But it’s so tempting that the government is going to use it”

The company received its first geofence warrant from federal agents in 2016. Word has spread among law enforcement over the past several years, driven partly by a cottage industry of companies that sell software to police departments. Some of the same consultants who’ve helped law enforcement process cell tower data are now pitching them tools and seminars about tapping Google.

Training sessions have reached from the suburbs of Watchung, New Jersey, to the hills of Creston, Iowa, according to SmartProcure Inc., which maintains a database of government contracts. From 2017 to 2022, the dollar amount that local law enforcement paid for geofence training and other cellphone investigation techniques more than tripled, according to Businessweek’s analysis of SmartProcure data.

The sessions can be revelatory. In 2018, Travis Staab, a detective in Mesa, Arizona, attended a training program offered by ZetX, a software company now owned by LexisNexis. Afterward he filed a warrant for a cold case that had been languishing on his desk: the burglary of a local gun store. The results Google sent showed that one device had been active in the shopping center the night of the incident, long after closing time. Staab found his suspect.

In the years since, Staab has marveled at the success his colleagues have had with Google data, which he likens to “an electronic fingerprint that you can find at the scene.” His partner identified two suspects in a murder at a local park and solved a string of catalytic converter thefts based on the proximity of the thief’s phone to a power box at the exact moment the electricity in the parking lot had been shut off. “That little hit right there in front of the power box, and it’s tied to a person’s name, their email address, their telephone number, their street address,” Staab says, “it’s like, that’s who it is.”

Staab hasn’t had much luck with the warrants in his own cases since his first hit, but he continues to obtain them anyway and to coach other detectives in his department on the process. “When it works, it’s phenomenal,” he says. “And so when it doesn’t, it stings a little bit more.”

Illustration: Jordan Speer for Bloomberg Businessweek

It’s tempting to see Google data as a crime-solving shortcut, but geofence warrants can be time-consuming and often ineffective. Businessweek’s review of court documents and other reporting uncovered numerous instances in which the warrants failed to deliver anything useful.

In March 2021, police in Austin secured a geofence warrant to track down someone who robbed a teen riding his bike to a neighbor’s house to deliver tamales. The assailant had punched the kid in the face and bloodied his nose. Google provided results, a representative for the police department says, but in the end police didn’t find grounds to charge anyone.

Money was transferred from the victim’s Cash App account here.Source: Google Earth

In the Phoenix suburb of Surprise, Detective Taylor Knight obtained five geofence warrants in a span of less than three months to investigate a spate of burglaries and vandalism at construction sites last year. Among the equipment police sought to recover were a microwave and a cooktop. One of the warrants, obtained for the theft of a wood chipper, demanded information on anyone who was near the construction site for almost an entire week. The Surprise Police Department says no prosecutions have materialized.

And police in Holly Springs, North Carolina, sought Google’s location data last year after a safe containing more than $30,000 worth of gold and silver coins and bars vanished from a StorageMax facility. The safe belonged to William “B.J.” Lawson, then the chief technology officer of Donald Trump’s Truth Social, and his wife. The couple had “strategically positioned” the chest behind some cardboard boxes in the storage unit, they told police. (They later said they regretted hiding it there.) A judge approved the warrant, though cops ultimately didn’t get anything from Google.



Police have become overreliant on Google location data, says Aaron Edens, an intelligence analyst who trains law enforcement on geofence warrants. “At some point it became, just check the box to get it done.”

Once that box is checked, it falls to Google’s rank and file to evaluate the avalanche of requests and push back when appropriate. A Google team known as Legal Investigations Support, or LIS, reviews search warrants and subpoenas. Working with Google’s legal counsel, an employee might process 80 to 90 requests a week. Many LIS specialists are only a few years out of college; some view the role as a way to test the waters before applying to law school. These operations within tech companies can have a significant impact, says Albert Gidari, an affiliate of the Stanford Law School Center for Internet and Society, who’s represented Google. “There’s a whole field of common law surveillance being written every day by twentysomething-year-olds.”

Former LIS employees say they took pride in pulling every lever at their disposal to challenge requests for data, including seizing on typos as grounds to reject a warrant. One common slip-up in written requests from police: targeting email accounts ending in “@gamil.com,” rather than “@gmail.com.” “We were encouraged to push back on that,” says one former employee who wasn’t authorized to speak about the work and asked not to be identified. “If they want this data, then they have to be buttoned up.”

But Google can only do so much. It says it isn’t always told the nature of an investigation or the severity of the crime. When the company receives a warrant, Google’s role boils down to ensuring that the request is technically feasible and “particularized,” a legal term indicating the information is tailored to the case at hand. “You’re dealing with government demands, so these aren’t just optional,” says Richard Salgado, who led Google’s division of law enforcement and information security for more than 13 years.

 

[bnew]

2711 W. Union Hills Dr., Phoenix.Source: Google Earth

A credit card in the purse was used at this gas station.Photographer: Adriana Zehbrauskas for Bloomberg Businessweek

Google says it’s increased staffing on the LIS team to meet growing demands from police. To safeguard users’ privacy, the company says, it furnishes workers with the minimum amount of personal data necessary to process a request.

To manage the thousands of search warrants it receives each year, Google created formulas for dealing with common requests. For geofence warrants it follows a three-step process: The company first shares a list of all devices found to be present at the time of the crime, stripping away information it believes could be used to identify users. Second, law enforcement can request more detailed information for a subset of the first group. Finally, in Step 3, Google provides the names and email addresses that officials have determined are relevant to the investigation. The company generally follows a similar process for keyword search warrants, according to employee declarations in court.

Although the process was designed with privacy in mind, it also encourages police to exercise restraint. Officers typically have to return to a judge to secure a new warrant for each step of the process and plug the files from Google into different spreadsheet and mapping programs to make sense of the data, law enforcement officials say. Detective Alex Dyer in Scottsdale set out to investigate the robbery of a woman’s purse in a Target parking lot last year. When Step 1 failed to surface anything promising from Google, Dyer dropped it there. “I did not request a Step 2,” he says.
“It’s not a magic technique,” says Salgado, who left Google last year and now teaches courses on surveillance law and other policy issues at Stanford and Harvard universities. “It’s far more complicated than it might appear. But it’s so tempting that the government is going to use it.”

Google’s safeguards to anonymize the data aren’t foolproof. The information provided in Step 2 can be reverse-engineered, according to expert testimony, which is especially worrisome if sensitive locations such as health clinics and places of worship fall within the search area.
“This is all very new and very untested and made up as they go along,” says Andrew Crocker, the surveillance litigation director for the nonprofit Electronic Frontier Foundation. “And that’s, from a civil liberties point of view, very dangerous.”

Even when Google delivers results, police officers must remember the data are based on a device, not a person. The Arizona man who was wrongly accused of murder had lent his car and an old phone to an acquaintance, who was later arrested for the crime. Another limitation is that the warrants turn up only devices that have Location History enabled. Some officials say that the technique is becoming less effective as more criminals learn about it and that many of them simply turn off the setting on their devices or leave their phones at home before committing a crime.


Little by little, calls for reform are intensifying. Lawmakers in California and New York proposed legislation that would ban police in those states from seeking geofence and keyword search warrants, but the bills have stalled over concerns that they’d impede essential police work.

Some lawmakers have been motivated by the Supreme Court decision to overturn Roe v. Wade and how Google data could be used to pursue women who get abortions. A California law passed last year bars companies in the state from providing data to build cases against abortion seekers. Google asks law enforcement to attest that they’re not requesting information for that purpose, though advocates still worry the data could be weaponized.

Federal law limits the use of wiretapping to the investigation of serious offenses such as murder, kidnapping and drug trafficking, and law enforcement must demonstrate that they can’t gather evidence to investigate their cases through less intrusive means. No such restrictions exist for geofence warrants. “It’s a clear sign that we need a strong nationwide standard on it,” says Jake Laperruque, deputy director of the security and surveillance project at the Center for Democracy & Technology, a think tank.

But opinions are divided about whether the risks to civil liberties outweigh the potential benefits to law enforcement. Roy Schahrer, a salesman in the Phoenix suburb of Chandler, was questioned by police after Google data put him near the scene of a shooting in 2021. Cops ruled him out as a suspect after determining he’s “a routine cat feeder” in the neighborhood, says Sergeant Emma Huenneke. Schahrer says he wasn’t bothered by the questioning or that police looked through his Google account. “I’d rather they investigate, and I’d rather they follow whatever leads that they need to,” he says. “If I was the one that was guilty of doing it, I might feel a different way.”

The location of the 2021 shooting in Chandler, Arizona.Photographer: Adriana Zehbrauskas for Bloomberg

Some state judges do indeed feel a different way. Courts in California and Virginia have rejected geofence warrants that relied on overly broad sweeps of Google data. The Virginia ruling last year stemmed from a case in which cops obtained a geofence warrant covering more than 17 acres to try to solve a bank robbery. It made some departments wary of using Google data, fearing the evidence may not hold up in court, says Lyla Zeidan, a law enforcement instructor and former prosecutor in Ashburn, Virginia. “This should be a warning to law enforcement.”

Google says that the Virginia decision has better equipped it to push back against sweeping requests and that it supports legislative reform. The company says it’s successfully objected to almost 2,000 geofence warrants over the past year, including ones covering thousands of devices or those encompassing sensitive locations such as houses of worship. Google declined to say how many total geofence warrants it received during that time.

One of the most consequential court battles is taking place now in Colorado. The case revolves around the killing of a family of five in a fire at their home in 2020. Footage captured by a security camera showed three people in masks sprinting across the yard right before the house went up in flames; it was among the only clues detectives had to work with. Police in Denver obtained almost two dozen warrants that failed to generate any leads, including a pair of geofence orders. So a detective on the case tried something he’d never done before: He secured a court order for information about anyone who’d Googled the address of the home over a two-week period leading up to the blaze.

The current site of the Denver home that was set ablaze in 2020.Photographer: Joanna Kulesza for Bloomberg Businessweek

After some back and forth and calls to Google’s outside counsel, the company provided the data. Detectives zeroed in on five accounts in Colorado and, in particular, three that had searched for the address multiple times. Police traced the accounts back to three teens, who were arrested for murder. One of the kids told the cops he set the house on fire because he thought the residents had stolen his iPhone, says a spokesman for the Denver district attorney. The teen didn’t realize until he saw the headlines the next day that he’d targeted the wrong house.


Investigators found one of the teens, Gavin Seymour, because he’d Googled the home’s address 14 times in the days before the fire. As part of the investigation, police also sifted through the account of someone else. That person, identified in court papers as “EM,” had Googled the address, too, but detectives ruled her out as a suspect after reviewing all her Google data, including her search history and a registry of places she’d been. They determined she had no connection to the other suspects.

More than three years after the fire, one of the teens has pleaded guilty, but the other two are still fighting. Seymour argues that the keyword warrant, which broke open the case, constituted an illegal search and that all evidence stemming from it should be suppressed. His motion, which is pending before the Colorado Supreme Court, is the first challenge to the constitutionality of the technique.

Colorado’s top court is expected to rule before the end of the year. In the meantime, law enforcement is finding new ways to mine the digital trail we leave behind. Police in San Francisco and the Phoenix area have begun sending warrants for video footage recorded by self-driving cars as they roam city streets. One of the main recipients of those warrants is Waymo, a sister company of Google. —With Jack Gillum, Kurt Wagner and Leah Nylen

 

[Payday23]

Spooky but not surprised