One of the things we learned from the Snowden documents is that the NSA conducts “about” searches. That is, searches based on activities and not identifiers. A normal search would be on a name, or IP address, or phone number. An about search would something like “show me anyone that has used this particular name in a communications,” or “show me anyone who was at this particular location within this time frame.” These searches are legal when conducted for the purpose of foreign surveillance, but the worry about using them domestically is that they are unconstitutionally broad. After all, the only way to know who said a particular name is to know what everyone said, and the only way to know who was at a particular location is to know where everyone was. The very nature of these searches requires mass surveillance.
The FBI does not conduct mass surveillance. But many US corporations do, as a normal part of their business model. And the FBI uses that surveillance infrastructure to conduct its own about searches. Here’s an arson case where the FBI asked Google who searched for a particular street address:
Homeland Security special agent Sylvette Reynoso testified that her team began by asking Google to produce a list of public IP addresses used to google the home of the victim in the run-up to the arson. The Chocolate Factory [Google] complied with the warrant, and gave the investigators the list. As Reynoso put it:
On June 15, 2020, the Honorable Ramon E. Reyes, Jr., United States Magistrate Judge for the Eastern District of New York, authorized a search warrant to Google for users who had searched the address of the Residence close in time to the arson.
The records indicated two IPv6 addresses had been used to search for the address three times: one the day before the SUV was set on fire, and the other two about an hour before the attack. The IPv6 addresses were traced to Verizon Wireless, which told the investigators that the addresses were in use by an account belonging to Williams.
Google’s response is that this is rare:
While word of these sort of requests for the identities of people making specific searches will raise the eyebrows of privacy-conscious users, Google told The Register the warrants are a very rare occurrence, and its team fights overly broad or vague requests.
“We vigorously protect the privacy of our users while supporting the important work of law enforcement,” Google’s director of law enforcement and information security Richard Salgado told us. “We require a warrant and push to narrow the scope of these particular demands when overly broad, including by objecting in court when appropriate.
“These data demands represent less than one per cent of total warrants and a small fraction of the overall legal demands for user data that we currently receive.”
Here’s another example of what seems to be about data leading to a false arrest.
According to the lawsuit, police investigating the murder knew months before they arrested Molina that the location data obtained from Google often showed him in two places at once, and that he was not the only person who drove the Honda registered under his name.
Avondale police knew almost two months before they arrested Molina that another man his stepfather sometimes drove Molina’s white Honda. On October 25, 2018, police obtained records showing that Molina’s Honda had been impounded earlier that year after Molina’s stepfather was caught driving the car without a license.
Data obtained by Avondale police from Google did show that a device logged into Molina’s Google account was in the area at the time of Knight’s murder. Yet on a different date, the location data from Google also showed that Molina was at a retirement community in Scottsdale (where his mother worked) while debit card records showed that Molina had made a purchase at a Walmart across town at the exact same time.
Molina’s attorneys argue that this and other instances like it should have made it clear to Avondale police that Google’s account-location data is not always reliable in determining the actual location of a person.
“About” searches might be rare, but that doesn’t make them a good idea. We have knowingly and willingly built the architecture of a police state, just so companies can show us ads. (And it is increasingly apparent that the advertising-supported Internet is heading for a crash.)
The US government is entitled to every cent Edward Snowden earns from publishing his memoir, Permanent Record, a federal judge ruled on Tuesday. During his employment at the CIA and NSA, Snowden signed contracts promising to seek pre-clearance from those agencies before publishing any book or other publication containing classified materials. If he failed to do so, the contracts said, Snowden would forfeit any proceeds to the federal government.
Snowden is still in exile in Russia, where he has been stranded since 2013. The classified documents Snowden leaked to multiple journalists that year sparked an intense debate over US surveillance practices and inspired some modest reforms. Snowden faces near-certain prosecution for espionage if he returns to the US.
The US Department of Justice filed a lawsuit on September 17, the day Snowden’s book first went on sale, seeking to seize Snowden’s book profits. On Tuesday, just three months later, Judge Liam O’Grady granted the government’s motion for summary judgment.
Snowden’s lawyers had asked O’Grady to allow the case to move forward to the discovery phase, where each side could conduct fact-finding related to the case. They argued that more information was needed to establish whether the US government had singled Snowden out for special treatment in administering the pre-clearance process.
But O’Grady rejected that request, arguing that the contracts were clear and the key facts of the case were not in serious dispute. The contracts required Snowden to get pre-clearance, and those requirements were still in effect, the judge held. Snowden had not sought pre-clearance, yet he published a book full of classified information anyway.
The judge also ruled that Snowden had breached his contractual responsibilities by giving speeches at the TED conference and other venues. Each of these speeches included slides with materials that were marked as classified. Snowden argued that he shouldn’t be held responsible for re-publishing information that was already in the public domain, but the judge rejected that argument, saying that there was no such limitation in the agreement.
“Both the CIA and NSA secrecy agreements prohibit unauthorized publication of certain information, and Permanent Record discusses those types of information,” O’Grady wrote. As a result, “the government is entitled to summary judgment.”