What's Unconstitutional About Google Keyword Search Warrants? Nothing, Says Colorado Supreme Court

The Colorado Supreme Court has ruled that police can use Google search histories to identify suspects in criminal investigations, leading digital rights orgs to warn the ruling has broad privacy implications for anyone using search engines.

The case, People v. Seymour, involved a 2020 act of arson that killed five people in a Denver home. When the Denver Police Department couldn't identify suspects, investigators sent Google a search warrant requesting information about any and all users who searched for nine variations of the home's address over a two-week period prior to the fire.

Police can start prosecuting us based on our thoughts and our idle curiosities

Google refused to hand over the data on the grounds that the warrant didn't comply with its privacy policy [PDF], court documents show.

Google and the police argued that point for some time. The Department eventually asked Google to turn over user data and the search giant refused, but eventually produced details of 61 searches made by eight accounts, including the IP addresses used. Five of these were based in Colorado, and in a subsequent warrant, Google gave the Denver PD basic subscriber information for the five accounts.

Using this data, police identified two suspects, aged 15 and 16 at the time of the incident. One of the suspects, Gavin Seymour, asked the court to throw out the evidence against him because it came from a reverse-keyword warrant. This, according to his attorneys, was unconstitutional because it violated the Fourth Amendment ban on unreasonable searches and seizures.

On Monday, the Colorado court Supreme Court upheld the warrant and ruled that law enforcement acted in good faith [PDF].

The court also recognized that users have a reasonable expectation of privacy in their search results, and that such expectation applies even to results that do not include identifying information about the user.

In the four-justice majority opinion, the court stated the decision should not be interpreted as a "broad proclamation about the propriety of reverse-keyword warrants."

"Our finding of good faith today neither condones nor condemns all such warrants in the future," the justices said. "If dystopian problems emerge, as some fear, the courts stand ready to hear argument regarding how we should rein in law enforcement's use of rapidly advancing technology. Today, we proceed incrementally based on the facts before us."

• Should Google location data be a tool for cops?
• One year after Roe v Wade overturned and 'uterus surveillance' looks grim
• Mozilla calls cars from 25 automakers 'data privacy nightmares on wheels'
• California's Governor Newsom signs laws on right to repair and data deletion

Digital dragnet tool

The Electronic Frontier Foundation (EFF), which filed two amicus briefs in support of Seymour's appeal, warned that the Colorado Supreme Court's decision is worrisome for several reasons.

EFF has long argued that keyword warrants are unconstitutional because they represent a digital dragnet for law enforcement to scoop up massive amounts of data — in this case queries by one billion Google users — with no real evidence against them.

Further, the court "also did not provide any direction for lower courts that are going to have to address these warrants going forward," EFF General Counsel Jennifer Lynch told The Register, adding that this will likely result in a "piecemeal approach" to keyword warrants.

Our finding neither condones nor condemns all such warrants in the future

Lynch added her fears that innocent people may be caught in the dragnet.

"All of us perform thousands of searches using search engines every day," Lynch said. "And if the police can ask Google for information on everybody who's searched for any term, they can start prosecuting us based on our thoughts and our idle curiosities."

The stakes are especially high in US States that have outlawed abortions or restrict gender-affirming care for trans-kids, according to Lynch.

"People who are searching for an abortion, searching for [hormone-blocking drug] mifepristone, or gender-affirming care for the children — they're going to do that using a search engine," she said. "And if the police can just get access to this information, I think we'll start to see a lot more very questionable prosecutions."

Google's role?

Google bears some responsibility to its users, too, Lynch said. "Google could not store this data in a way that it is accessible for the police," she said.

"The only keyword search warrants that we have heard of that have been successful for the police have been to Google. People do use other search engines. But the police are not asking for information from those search engines, because they're not storing the data in a way that can be identified and released to the police. So, I think Google shares a lot of responsibility in this case, because they make it easy for the police to get access to our private search information."

Google has long maintained that it has no problem denying overly broad or unlawful law enforcement demands for data, especially those concerning sensitive health information.

When asked about the Colorado court's opinion, a Google spokesperson told The Register: "It's important that the Colorado Supreme Court recognized the significant privacy and First Amendment interests implicated by keyword searches. With all law enforcement demands, including reverse warrants, we have a rigorous process designed to protect the privacy of our users while supporting the important work of law enforcement." ®