Google’s headquarters in Mountain View, Calif. Alphabet Inc., the parent company of Google, reports financial results Thursday, Oct. 27, 2016. (AP Photo/Marcio Jose Sanchez, File)
A judge in Minnesota has signed off on a warrant allowing police to demand Google data on anyone who searched for the name of a fraud victim across a whole city, according to web engineer and public records researcher Tony Webster.
Webster posted the warrant on his site, explaining that Edina Police Department sought the records after a bank, Spire Credit Union, was contacted by a man they thought was a customer asking for a $28,500 wire transfer. Turned out it was a fraud attempt and whoever was behind it had created a fake passport to use as ID.
Police did a Google image search for the real bank account owner and discovered the fake passport photo used by the fraudster, which was not of the real victim but of someone with the same name. Searches on Bing and Yahoo didn’t return the same photo.
Believing the perpetrator lived in Edina, the cops asked a court if they could request Google provide records of everyone in the city who’d searched four different variations of the victim’s name between December 1 2016 and January 7 2017. Specifically, they wanted names, email addresses, social security numbers, payment information account information and IP addresses, which could be enough to identify where those searches were made.
Needless to say a lot of innocent people could be caught up in such a data grab. “It’s possible that such a wide net could catch completely routine and non-criminal searches of the victim’s name by neighbors, prospective employers or business associates, journalists, or friends,” said Webster.
Unsurprisingly, there was a fair amount of disbelief from privacy and legal experts, including this from Elizabeth Joh, professor at UC Davis School of Law:
Is this for real?
Warrant for everyone in Edina, Minnesota who entered a particular Google search: https://t.co/wop8K6aK9V
— Elizabeth Joh (@elizabeth_joh) March 17, 2017
One staff attorney at the Electronic Frontier Foundation suggested a case name change was in order:
— Andrew Crocker (@agcrocker) March 16, 2017
Google initially rejected a subpoena from Hennepin County, but investigators are still arguing for the information. It’s unknown if Google is fighting the new order. It hadn’t responded to a request for comment at the time of publication.
Got a tip? Email at TFox-Brewster@forbes.com or firstname.lastname@example.org for PGP mail. Get me on Signal on +447837496820 or email@example.com on Jabber for encrypted chat.