Google Disrupts Geofence Warrants, Says (Most) Location Data Will Be Stored Locally

Privacy

from the lolololooooooooooooool dept

For years, Google has collected all the data it can about its users. And for years, it has utilized this data to… well, it depends on who you ask.

For Google, it meant a whole lot of targeted advertising — something so valuable Google tended to collect the data even when it told users it wouldn’t.

Once law enforcement realized Google loved data, it started approaching Google to get data it couldn’t get elsewhere. Google was home to the most popular search engine and most popular map app in the world. For those to work, users needed to allow Google to collect data. And if Google was collecting the data, law enforcement knew exactly where to go with so-called “warrants” that assumed nothing else than the probability (as in “probable cause”) Google’s servers might contain this data.

Everything just took off from there. Another boost to law enforcement hoovering of data was given (inadvertently) by the Supreme Court’s Carpenter decision. That decision said law enforcement needed to obtain warrants before obtaining cell site location data, especially if it covered weeks, months, or years of collected data.

No problem, said the cops. We’ll just use questionable warrants to obtain data we could credibly argue is still subject to the Third Party Doctrine. That’s how geofence warrants came to be: warrants that seek data on everyone in a certain area at a certain time, even if this theoretically limited time/place might give law enforcement plenty of data on innocent people who happened to be in the wrong place at the wrong time.

Also enter keyword warrants, in which law enforcement submits search keywords to Google, seeking anyone who might have used those terms at a particular time and place. Sounds great… right up until you realize Google has to search all of its retained user data to find information responsive to these requests.

While not exactly novel, geofence and keyword warrants reside in the gray area of unsettled law. That means the government can rack up “wins” with little fear of being found deliberately on the wrong side of the Constitution.

Legislation is in the works to curb the government’s acquisition of location data from third parties (the data brokers buying data from app developers). On this front, however, there are only the courts (mixed results) and the location data collectors (collective shrugs to this point) standing between the government and mass collection of location data.

The government isn’t going to restrain itself. But, in a surprise announcement, a company that feasts on data says it will consume a little less if it means protecting users from government overreach.

This week, the company said it will begin changing where it stores that Timeline data. Currently, it lives on your devices and Google’s servers, but when the shift takes place, your location history will remain solely on the hardware you own. And less of that data will be stored over time, Google says — only three months’ worth by default, down from the 18 months that are currently saved.

The company says the changes will “gradually roll out through the next year.”

Well… holy shit… at least to some degree. It’s an in-progress rollout, which means not everyone is protected right out of the gate. And it means that users will have to decide whether limited data collection works better for them than the wholesale collection they’re used to. If the latter appeals more than the former, users will need to find their own way to create a long-running, rolling history of their movements.

For most people, the default option will work. For most cops, it obviously won’t. And even if users decide they want to store everything Google collects about their movements, there’s no easy way for law enforcement to access this information. That data will be encrypted by default — accessible to users, but not to the government.

This is a win for Google users, which comprise roughly 99.9% of the nation. It will be portrayed by government officials as a loss for law enforcement, which will now have to perform investigations the way it has for decades: by finding suspects first and looking for evidence after.

That shouldn’t be a problem for cops who have done things the old way for years. But, of course, there are always those willing to argue that protecting citizens from their government is a net loss for society. That’s where law prof Orin Kerr comes in with his post on this subject for the Volokh Conspiracy.

My very tentative sense, from a public policy standpoint, is that this seems like a bit of a bummer.  Geofencing was being used to solve some really serious crimes—like murders, rape, and armed robberies—when there were no known suspects or leads and the case had gone cold.  Having governments be able, with sufficient cause, to go to a court, get a court order, and then obtain potentially responsive location records that could provide a lead to investigate was, on the whole, a good thing.

I often disagree with Orin Kerr — a Fourth Amendment scholar for whom I still retain a great deal of respect. But today is no different. The respect and the disagreement are both present here.

Even given the links to crimes supposedly solved by access to Google location data, there’s no way allowing law enforcement to force Google to search all users’ data, compile a list of data involving almost entirely innocent people, and handing that over to the government, is “on the whole, a good thing.”

Without a doubt, law enforcement could solve a lot of major crimes by searching houses door-to-door with nothing more than a “because you’re home” warrant. Would that be a “good thing” for society? Or would it be what we’ve been witnessing for years: a willingness to operate in areas ungoverned by constitutional bright line decisions just because cops can?

There are plenty of net goods for humanity that could be realized with governmental abuses of power. But, at least in the United States, the balancing of the government’s needs against the rights of the people tends to favor the people most of the time. Why? Because they have the least power. And that imbalance of power doesn’t change just because it’s a third party collecting all the data. Google may be the 800 lb. gorilla of the internet but its power pales in comparison to what the government is capable of doing when it decides to flex its muscles.

This move won’t make Google any more popular with US law enforcement agencies. As as much as it may irritate US cops (and irk Orin Kerr), the fact remains that private companies serve their users, not the US government. If the government wants the access it used to have, it needs to have a long talk with itself. If it thinks now is the time to abridge rights, it can talk to sympathetic legislators and hope any resulting laws pass the constitutional sniff test. Otherwise, it can go back to performing investigations the way it used to before everyone carried a power computer in their pockets at all times.

What’s happening here is just a long-needed course correction from one of the thirstiest data collectors in internet history. What it definitely isn’t is a net loss for society.

Filed Under: 3rd party doctrine, 4th amendment, geofence warrant, law enforcement, location data, privacy, surveillance, warrants
Companies: google