February 3, 2006 4:00 AM PST
FAQ: When Google is not your friend
- Related Stories
Anti-China hypocrisy in Congress?February 1, 2006
No booze or jokes for Googlers in ChinaJanuary 26, 2006
FAQ: What does the Google subpoena mean?January 20, 2006
Feds take porn fight to GoogleJanuary 19, 2006
Google balances privacy, reachJuly 14, 2005
Search engines take the standMay 13, 2004
Web privacy policies confuse Net surfersJune 24, 2003
Video: Google's new toolbar
A look at the latest version of Google's Toolbar
It's only a matter of time before other attorneys realize that a person's entire search history is available for the asking, and the subpoenas begin to fly. This could happen in civil lawsuits or criminal prosecutions.
That type of fishing expedition is not legally permitted for Web mail providers. But because search engines are not fully shielded by the 1986 Electronic Communications Privacy Act--concocted back in the era of CompuServe and bulletin board systems--their users don't enjoy the same level of privacy.
"Back then, providers were very different animals than they are now," says Paul Ohm, a former Justice Department attorney who teaches computer crime law at the University of Colorado at Boulder.
Two solutions are simple to describe, but not likely to happen. First, search engines could voluntarily--or be required by law to--delete search histories after a few months unless the customer objects. Second, federal law could be amended to make it clear that search engines, which serve as a window to the Internet, are fully protected.
CNET News.com has surveyed Google, Microsoft, Yahoo and AOL to find out their privacy practices, and assembled these answers to frequently asked questions.
Q: Does Google collect and record people's search terms whether
they're logged in or not?
Yes. Google confirmed this week that it keeps and collates these results, which means the company can be forced to divulge them under court order. Whether Google does anything else with them is another issue.
Given the Department of Justice's recent subpoena to Google, it's likely the police or even lawyers in civil cases--divorce attorneys, employers in severance disputes--eventually will demand that Google, Microsoft, Yahoo, AOL, and other search engines cough up users' search histories.
Q: Has this happened before?
Almost. A North Carolina man was found guilty of murder in November in part because he Googled the words "neck," "snap," "break" and "hold" before his wife was killed. But those search terms were found on Robert Petrick's computer, not obtained from Google directly.
Also, attorneys have already begun introducing searches conducted on Google, Yahoo and AltaVista as evidence.
Q: When I use search engines, I type in a lot of search terms I consider private. What does this mean?
We go into all the details below. But the short answer is that when private companies collect reams of data all the time on nearly every American, and the government and curious attorneys can get to that with few obstacles, this becomes a problem. Search engines provide a look into people's personal lives, and privacy awareness has not kept pace.
Q: Aren't there any privacy laws that protect us?
Not really. There is a federal law called the Electronic Communications Privacy Act. But it was enacted in 1986, long before politicians knew about the Internet, and the wording doesn't prevent police and attorneys from targeting search engines.
Politicians wrote that law in a way that is technology-specific--one key part revolves around the meaning of the pre-Internet term "processing services"--instead of adopting a more flexible approach that would grow with technology. Some states may have laws that are more applicable.
The fate of search engine privacy, at least in the near future, could hinge on an antique and nearly indecipherable legal term: "processing services."
In general, attorneys can use a subpoena to obtain records from a company if the data would be relevant to a lawsuit. But a 1986 law called the Electronic Communications Privacy Act offers additional protections to users of remote computers that provide "processing services."
Google's language-translation service may do that. But what about the search engine? It's not exactly clear, and the courts have been little help in applying that language to the Internet.
Orin Kerr, a former prosecutor who is now a law professor at George Washington University, said Congress meant for the language to apply to outsourcing.
"Does eBay provide 'processing services' for its customers?" he asks in a 2004 law review article. "I think the better answer is 'no.' The legislative history indicates that 'processing services' refer to outsourcing functions. In the era before spreadsheets, a company might send raw data to a remote computing service and ask the service to crunch numbers to calculate its payroll."
But let's assume for the sake of argument that Google does offer "processing services." Here's what could happen when:
Prosecutors seek Internet addresses.
An unusual twist in federal law (18 U.S.C. 2703) makes it easier for prosecutors to obtain Internet addresses from search terms than the other way around.
The law is remarkably permissive. It allows a "governmental entity" to demand "information pertaining to" search engine users by firing off a mere administrative subpoena--simply a piece of paper not even reviewed in advance by a judge. Information that can be requested includes name, address, Internet address, when connections were made, and credit card numbers if available.
Prosecutors are allowed to demand such information as long as it is "relevant and material to an ongoing criminal investigation." If the search company objects, however, a judge has the leeway to narrow the request if it is "unusually voluminous in nature or compliance with such order otherwise would cause an undue burden."
Prosecutors seek search terms.
If the Justice Department already happens to have someone's Internet address and is seeking their search history, a slightly different procedure exists.
In that case, prosecutors must ask a judge in advance for an actual court order and claim that the results are "relevant and material to an ongoing criminal investigation."
In practice, of course, that's not terribly difficult to do.
An aside: This distinction assumes that search terms are "content," which federal law defines as information about the "substance, purport, or meaning of that communication." If they're not, only a subpoena--and no court order--is required.
Attorneys seek records in civil suits.
A different set of rules applies to attorneys in a civil suit who aren't working for the government.
However, the rules almost certainly do not apply to search engines. They were aimed at preventing e-mail and similar providers (remember, this law was written in the era of CompuServe, BIX, and The Source) from sharing their customers' personal data with third parties.
Translation: A curious divorce attorney simply needs to send a subpoena to Google.
"These laws were written some time ago," says Lee Tien, a staff attorney at digital rights group Electronic Frontier Foundation in San Francisco. "They were careful in some places and not in others."
Q: Why does Google store that information about me, anyway?
No law requires Google to delete it, and there are some business justifications for keeping it.
For instance, keeping detailed records can help in identifying click fraud (faking clicks on Web ads to drive up a rival's cost), and in optimizing search results for different geographic areas. Compiling a user profile can aid in tailoring search results in products like Google Personalized Search. Also, disk storage is cheap, and engineers tend to prefer to keep data rather than delete it.
44 commentsJoin the conversation! Add your comment