US Gov't Demands For Google Data Up 37% Over the Last Year

Sparrowvsrevolution writes "Governments are sticking their noses into Google's servers more than ever before. In the second half of 2011, Google received 6,321 requests that it hand over its users' private data to U.S. government agencies including law enforcement, and complied at least partially with those requests in 93% of cases, according to the latest update to the company's bi-annual Transparency Report. That's up from 5,950 requests in the first half of 2011, and marks a 37% increase in the number of requests over the same period the year before. Compared with the second half of 2009, the first time Google released the government request numbers, the latest figures represent a 76% spike. Data demands from foreign governments have increased even more quickly than those from the U.S., up to 11,936 in the second half of 2011 compared with 9,600 in the same period the year before, though Google was much less likely to comply with those non-U.S. government requests."

Comments

It's not a "demand" -- it's a request

[daveschroeder]

That's why it's called a "request". Words mean things.

So what's driving the requests?

There's far more information to request. Whether or not you agree with the notion of government requests for information, would you really expect requests to remain flat, or go down, when the pool from which information is being requested is getting dramatically larger? Yes, it's newsworthy -- that's why you're reading this story -- but it's not inappoprtiate.

It's a request -- it is not illegal for the the US government to make a request of a business. It has never been illegal, and this is not some kind of "post-9/11" construct as some will assert. Government has been able to ask business for assistance since the founding of our country, and it does not run counter to the letter or spirit of the Constitution. Government is part of our society, and it is lawful for it to communicate with other components of our society.

Government cannot compel a particular response without a warrant or court order: Google is not obligated to respond to the a request that is not accompanied by a warrant or court order in any particular way. Google may CHOOSE to comply with a request because there is nothing inappropriate about a business deciding to comply with a lawful request from a government agency. Fortunately, if you don't like Google's policy, you can choose not to use it.

In other words, if you have an issue with Google complying with a US government request, your problem isn't with the US government -- it's with Google.

Google policy analyst Dorothy Chou told me in an interview prior to the data’s release that one example of the requests might be for the IP addresses of users who log into their Google accounts, which law enforcement agents use to locate individuals involved in criminal cases such as kidnapping.

She says Google requires that the requests are submitted in a written form, come from the appropriate agency, cite a criminal case and are sufficiently narrow in their demands in terms of which users are affected and what time frame of data is requested. "The data can often be very critical to a case," says Chou. "We want to show that we're advocating on your behalf. But we also want to do right by the spirit and letter of the law."

[...]

"We noticed that government agencies from different countries would sometimes ask us to remove political content that our users had posted on our services. We hoped this was an aberration. But now we know it’s not," reads the post from Google’s Chou. "Just like every other time before, we've been asked to take down political speech. It’s alarming not only because free expression is at risk, but because some of these requests come from countries you might not suspect—Western democracies not typically associated with censorship."

For example, in the second half of last year, Spanish regulators asked us to remove 270 search results that linked to blogs and articles in newspapers referencing individuals and public figures, including mayors and public prosecutors. In Poland, we received a request from a public institution to remove links to a site that criticized it. We didn’t comply with either of these requests.

See also Google's official blog post.

Re:It's not a "demand" -- it's a request

[Bigby]

"Spying" would be requesting information more than once on the same individual. Although I am sure that there are several cases here that could be classified as "spying", these numbers do not directly support your assertion. It is probably closer to 100 individuals than 10,000 individuals.

Most of these responses probably helped eliminate a suspect from an investigation. Some responses helped incriminate the individual.

Google is quite transparent and forthright about these requests and responses. Do they inform the person for which information was requested?

Re:It's not a "demand" -- it's a request

[Gonoff]

Some of the best officers I remember, or have heard of very often asked for rather than directly ordered things. It was more a case of "Please take your unit up there and do X." Afterwards there was "thank you".
If things got "stressful" the please and thank yous ceased but they returned as soon as normal communication volumes and speeds returned."

They may have included all the request words but they were orders none the less. They were in a position of power and politeness is a good way of ensuring co-operation. There are plenty lesser powers who feel they have to order everything. As they climb up society (or the ranks) they seem to become nicer.

Just because they are called "requests" does not mean that you have much leeway whether it is a captain telling people to head into danger or a suited spook asking for information that the owners might object to. You just have to do it.

Re:It's not a "demand" -- it's a request

[betterunixthanunix]

That's why it's called a "request". Words mean things.

"You want to lay that fiber, right? Just hand over the information we want..."

Re:It's not a "demand" -- it's a request

[sohmc]

Government cannot compel a particular response without a warrant or court order: Google is not obligated to respond to the a request that is not accompanied by a warrant or court order in any particular way. Google may CHOOSE to comply with a request because there is nothing inappropriate about a business deciding to comply with a lawful request from a government agency.

If I had the mod points, I'd mod you up. This is an important distinction.

My guess is that Google wants to keep the feds on their good side. Google is getting rather large and wants to make sure that the Feds remember that Google helps them "catch terrorists". Unlike the populous, the federal government has long memories and can hold grudges for long periods of time.

Fortunately, if you don't like Google's policy, you can choose not to use it.

This is easier said than done. Google, like Facebook, has become tightly integrated with our society, so much so that it's weird when I see product placements for other search engines on shows and movies. I can't remember the show but I remember seeing a product placement for Yahoo search. I remember saying out loud, "Who still uses Yahoo?"

I would say it's easier to simply not register an account on Google. However, they may still know who you are based on your browser fingerprint.

Re:It's not a "demand" -- it's a request

[daveschroeder]

This is a clever trick in this debate — to claim that Google is essentially "forced" to comply with "requests" or it may not receive favorable government treatment.

It's clever, because it means you don't have to confront the truth, which is that there is nothing wrong with a government in a free society asking a business for help, and nothing wrong with a business deciding to provide that help. It's not illegal, and doesn't run afoul of the Constitution.

Now, if you had any sort of proof that Google felt pressured by the US government to respond to such requests, something it isn't asserting in any way, then you might have a point. The beauty of your argument is you don't need "proof"; you can just say, "Hey, intuitively, I believe that Google 'has' to help or else the government would screw them; therefore this is 'wrong'," without having anything whatsoever to back up that argument.

Re:It's not a "demand" -- it's a request

[daveschroeder]

No, not "just like" that at all.

It's the law to pay taxes in the United States — it's not a request.

There is no "law" that says that Google has to comply with a US government request (that is not accompanied by a court order or a warrant) in any particular way.

Are you saying that the government should NEVER be able to have any communications with any other business or entity in the US, or make any kind of request, unless it is accompanied by the force of law and criminal penalties for noncompliance?

Re:It's not a "demand" -- it's a request

[alen]

well we have a few thousand murders in the USA every year and last month there was one in florida where the perps googled how to kill someone right before they did it. add in all the drug dealers and organized crime and 20,000 per year is not a big deal

Re:It's not a "demand" -- it's a request

[betterunixthanunix]

It's clever, because it means you don't have to confront the truth, which is that there is nothing wrong with a government in a free society asking a business for help, and nothing wrong with a business deciding to provide that help. It's not illegal, and doesn't run afoul of the Constitution.

You are ignoring the very real expectation that people have that their email will enjoy the same privacy as their postal mail and their phone conversations. Google does not make its policy of complying with US government requests clear to its users (it is an ambiguous statement buried in the privacy policy), and the US government has not been forthcoming about its cozy relationship with Internet companies. People have every reason to think that a court order would be required before the government can receive their information from Google, because that is how things work with their telephone conversations.

This is a legal loophole that should be closed, not defended. The Stored Communications Privacy Act was written before the Internet became a widely used medium of communication. At the time, most computer users understood how emailed worked and understood that their email was being sent in the clear through another person's computer system, and they did not have a reasonable expectation of privacy. That is not true today; the majority of computer users today have no idea how email works, they think of it as a fancy version of postal mail, and they have no understanding of the privacy implications of sending plaintext email (or that there is even an alternative). The logic behind the SCPA is twenty years out of date.

Yes, there is a problem with the government asking businesses for "help," when the purpose in doing so is to avoid legal and constitutional requirements. If Google did not comply with these sorts of requests, the government would have to either violate the law or turn to the court system to get wiretap orders and so forth. That is how the system is supposed to work: your communications are supposed to be private except when a warrant is issued, and warrants are not supposed to be issued unless probable cause can be shown. This friendly, "Hey Google, you think you could give us all the information you have about Joe Schmoe," system is not the sort of system we are supposed to have in this country.

Really, the idea that Google was pressured by the government is not that far-fetched, given the government's behavior in the past, and it is optimistic for Google -- the company that claims it will "do no evil." Sure, evidence is lacking, which is a result of the secrecy that surrounds police operations. We really do not know how these requests are being made. Is Google being pressured? Did Google propose the idea of this sort of relationship to the government? Does Google use its cooperation as a bargaining chip when it wants to build a new data center or lay some new fiber?

This is a matter of preserving the principles upon which the US was founded. The government is not supposed to be all-powerful, and the panopticon is not supposed to exist here. Our privacy is supposed to be violated only after a careful legal procedure, only after a judge is convinced of a legitimate investigative need.

Re:It's not a "demand" -- it's a request

[betterunixthanunix]

Hm...so we have probable cause...and that's why we do not bother getting a court order. Interesting approach to the constitution...

Re:It's not a "demand" -- it's a request

[daveschroeder]

Great reply — one of the increasingly few thoughtful responses I get on slashdot these days.

To address your points, there are many exceptions to the warrant requirement. For example, the metadata or "envelope" of communications has generally been considered by the courts to be exempt from warrant requirements.

In the literal sense of an envelope, a warrant is not required for government to look at the outside of an envelope (e.g., addresses written on the envelope, or its size and shape or other external characteristics).

In the case of phone conversations, Smith v. Maryland (1979) said that things like the list of phone calls received, or numbers called, or for how long, were part of phone company billing records and a warrant was not required.

In the context of the internet, a warrant is not required for communications metadata — IP addresses, DNS names, To: and From: addresses on an email message, and similar.

It is the CONTENT of communications that requires a warrant. The words written in a letter; the words spoken on a phone call; the words contained in an email message or VoIP call.

So, if these kind of non-content requests don't require a warrant, and have longstanding analogues in the non-digital realm upheld by the Supreme Court, what is wrong with making these requests in the digital realm?

Some might say that a much more complete picture of a person can be constructed from increasing activities in the digital realm, even without the benefit of the content of communications. Certainly I would agree. Does that automatically make it illegal, immoral, or wrong? It's definitely not illegal or unconstitutional (it isn't illegal until a law says it is, and it isn't unconstitutional unless a court of competent jurisdiction says so; and these examples above are explicitly held as constitutional), so is it immoral or wrong? If the government has legitimate interests here, and legitimate charges to execute the law, the real question is just how far that authority goes.

It would be ridiculous to assert that any contact with business by government in a free society be accompanied by force of law. It would be similarly ridiculous to allow for the provision of any and all information the government asked for without a warrant. So the balance is clearly somewhere between these two extremes. Currently the balance is a result of the fact that there are numerous and longstanding (i.e., not "post 9/11) exemptions to the requirement for a warrant for written (mail), voice (telephone), and digital (internet) communications.

Security and liberty are not at two ends of a zero-sum sliding scale. We can and should have a good measure of both.

Re:It's not a "demand" -- it's a request

[Hatta]

If I wasn't clear, I was talking about what should be, not what is. Our government already has way too much power. We need more restrictions written into the constitution, and making warrants mandatory for all non-public information would be an effective and fair check on government power.

Re:It's not a "demand" -- it's a request

[betterunixthanunix]

So, if these kind of non-content requests don't require a warrant, and have longstanding analogues in the non-digital realm upheld by the Supreme Court, what is wrong with making these requests in the digital realm?

The fact that the analogues are not quite identical. Sure, without a warrant the government can look at an envelope while a letter is in transit; the problem here is that the emails are not being inspected while they are in transit, but rather when they are stored on a server. Postal mail is not copied and saved by each courier that delivers it; email is. You can be reasonably certain that once a postal letter is delivered, nobody will get the chance to inspect or make a copy of the envelope; yet even after receiving an email, the message may be stored on one or more servers for indefinite periods of time, during which the server operator may have a chance to comply with such requests.

These systems are also automated and integrated to a degree that far exceeds previous systems. I could visit a website that appears to have nothing to do with Google, but without my knowledge Google could have recorded that visit. It would be as if each store you shopped at had dozens of security cameras, which were operated by dozens of different entities -- and the police could potentially ask any one of those entities to play back the footage. One website's operators may not be willing to comply with a police request and might demand a court order; the police could simply go to some other entity and receive the same records. It is reasonable to expect Slashdot's readership to be cognizant of this sort of thing; it is unreasonable to expect the majority of Americans, who have little understanding of computers, to be equally informed.

It would be ridiculous to assert that any contact with business by government in a free society be accompanied by force of law

Sure, but we are not talking about any old contact, we are talking about contact that is specifically related to law enforcement activities. We need to be careful when it comes to law enforcement power; too little power would be detrimental to public safety, but too much invites various abuses and tyranny. I have noticed a pattern, and I do not think I am the only one, where increases in police power are followed up with increases in the number of laws and the number of ways people can become criminals. Put another way, the trend is for the police to be pushed to their maximum capacity to enforce the law, regardless of what that capacity is.

Currently the balance is a result of the fact that there are numerous and longstanding (i.e., not "post 9/11) exemptions to the requirement for a warrant for written (mail), voice (telephone), and digital (internet) communications.

I would say that as early as the 1970s, the police were given too much power at the expense of our civil rights and liberties. People generally point to 9/11 as a turning point; they ignore other turning points, like CALEA (which mandates that wiretapping capabilities be built into our phone system, among other things), the Comprehensive Crime Control Act (which allows the police to recycle seized assets into their own budgets), and the Controlled Substances Act (which gives the Attorney General's office the power to declare drugs illegal without any democratic process). Each of these laws has been detrimental to our civil rights, and in each case the power of the police was increased, then followed up with an increase in the number of reasons the police can have to arrest people (the most obvious case of the this is the CSA, which has resulted in the list of illegal drugs growing and never shrinking -- and drug cases are one of the cited reasons for the requests being made to Google).

Security and liberty are not at two ends of a zero-sum sliding scale

I do not think it is zero-sum. As an extreme example, the citizens of

Re:It's not a "demand" -- it's a request

[betterunixthanunix]

To protect our rights from police abuses. We require police to get a warrant from the courts to ensure that there is no single branch of government that can unilaterally violate your privacy or freedom. We do not want the police running around making their own decisions; the judge that signs a warrant is supposed to be a check against an out-of-control police force.

Re:It's not a "demand" -- it's a request

[betterunixthanunix]

The problem is that Google has access to a vast amount of information about US citizens. Let's put it this way: if you and I are communicating using gmail, and the police come to you and demand copies of the emails I sent you and you refused, they would just go to Google. They would not have to seek a court order of any sort to get the information they want. Suppose instead that you and I send paper mail to each other, and the police demand the letters I sent you. Short of a court order compelling you to produce that evidence, the police would have no recourse.

That is the point here. When people send postal mail, they know that once the message is received, nobody else can read it. People expect the same sort of privacy with their email, but the reality is that email is copied and potentially stored by all of the systems in the delivery chain. Either we need to better educate people, or we need to legally protect people from police abuses (an out of control police force could have unlimited access to email from a cooperative third party -- the Stored Communications Privacy Act provides some protection, but not nearly enough).

Yes: there is leeway, and no obligation to respond

[daveschroeder]

As I said in another comment:

I know some will say that not complying with such requests might have "consequences", the implication being that it really is a demand with which Google "must" comply; of course, this is an assertion with no proof, designed to deflect attention from the fact that it is in no way illegal or unconstitutional for the US government to make such requests. If you have a problem with a business responding to such a request, then your problem is with that business, not the government. The irony is that Google is telling you that it's doing this, while other businesses don't -- and they're under no obligation to do so, either.

If you were talking about a business in Russia, China, or Iran, you might have a point.

"76% spike"

[John Hasler]

No, a 76% increase. "Spike" implies that it went up quickly and then immediately came back down, forming a spike on a graph. Thus only in the unlikely event that it comes back down next year can you legitimately call it a spike. Yes, I'm being picky.

DuckDuckGO - it's not Google, it's a Govn't issue

[Bananatree3]

DuckDuckGo.com is now my default search engine for exactly this reason. They simply don't keep historical search records that are identifyable to me. Of course, they too would have to legally comply with any government request, but their historical data is of little use.

While I trust Google to be as secure as can be reasonable, I do *not* trust the likes of the FBI (readup on National Security Letters), or other TLAs that decide they have a bee in their crotch and want to through their legal weight around for little reason.

With NSA's warrantless wiretapping laws fully protected now, I don't trust the government to honestly care about my privacy. I trust Google to Do The Right Thing (TM), but they're hands are tied when the government wants something.

Re:DuckDuckGO - it's not Google, it's a Govn't iss

[Lawrence_Bird]

With all due respect, you are a naive fool. Do you work for DuckDuckGo? Have you administered their servers? You (and any other user) have absolutely no way of validating claims of 'we don't keep any records' by this company or any other. Anyone who takes such claims at face value might as well use Google as they are not really serious about protecting their privacy.

That's the reverse of the question

[daveschroeder]

This is Qwest claiming it was punished for not participating in an early iteration of the long-defunct TSP. If that's true, then would it not stand to reason that AT&T should have received the most government contracts in response? Except two other telecom operators were ahead of them.

Google is not claiming it was or will be punished; in fact, it is taking great pains to explain that its cooperation is voluntary. The Qwest CEO's claims do not mean that Google feels it is being pressured, and doesn't address the fact that such requests are neither unlawful nor unconstitutional.