Wednesday, April 04, 2012

Google's pro-privacy legal position re: DOJ could assist class action lawyers in search referrer privacy lawsuit

In the summer of 2010, I filed a FTC complaint (pdf) against Google for deceiving its users about the extent to which it knowingly leaks user search queries to third parties via the referring header sent by web browsers. Shortly after my complaint was made public, a class action firm hit Google with a lawsuit over the practice.

Like many privacy class actions, the lawyers included every possible legal argument they could think of. One of their claims was that Google had violated the Stored Communications Act, which prohibits companies from sharing the contents of users' communications contents with other parties (even law enforcement agencies, unless they have a warrant).

The federal judge assigned to the case recently threw out all but one of the class action firm's claims, but but has permitted the case to continue solely focusing on Google's alleged violations of the Stored Communications Act. As such, one of the next big, important issues that the court is going to have to address is determining whether or not search queries are considered communications content under the Stored Communications Act.

As law professor Eric Goldman recently observed, "the SCA's poor drafting means that no one (including the judges) knows exactly what's covered by the statute." This is certainly true, and made worse by the fact that the statute hasn't really been updated since it was passed in 1986, long before the first web search engine or referrer header. It is for this very reason that DOJ has argued that the government should be able to get search engine query data without a warrant. Thankfully, Google disagrees.

Google: Search queries are content

At a recent event at San Francisco Law School, Richard Salgado, Google's Director of Law Enforcement and Information Security spoke publicly (for the first time) about Google's aggressively pro-privacy legal position on search queries and government access:

As far as search warrants and content go, Google and I think a lot of providers are taking this position, sees the 4th amendment particularly as it has been applied in the Warshak cases, as establishing that there is a reasonable expectation of privacy such that disclosure of the contents held with the third party is protected by the 4th Amendment. And not limited to email, but other material that is uploaded to the service provider to be handled by the service provider.

You hear a lot about ECPA about electronic communications service, ECS and remote computing sevice, RCS, and the crazy rules that apply [for example], the 180 day rule. I think most providers now, although I really should only speak to Google, view the way the case law is going and certaininly viewing the 4th Amendment as applying to any content that is provided by the user to the service, so that, for Google, would include things like Calendar and Docs, and all those others, even where there is not a communication function going on, that there's not another party involved in the Doc that you're uploading, the notes that you're keeping for yourself. It's still material that you've put with the service provider as part of the service that the company, in this case Google, is holding on your behalf. Its our view that that is protected by the 4th amendment, and unless one of the exceptions to the warrant requirement apply, its not to be disclosed to a government entity as a matter of compulsion.

Question: Where does search fall in that?

Answer: Search is one where we take a pretty hard stance, the same with other material, so we view search that its provided to us the way that other information is provided to us. That is very consistent with the ligitiation with the Department of Justice back in 2006.

Now, it seems pretty clear that Salgado is primarily talking about Google's view that the 4th Amendment protects user search queries, and is not arguing that they are communications content under the Stored Communications Act. Prior to this public event, I had heard reliable rumors that Google had adopted a warrant position for search queries based on the Stored Communications Act. Perhaps my sources were wrong, or perhaps Google realizes that it is going to be difficult to simultaneously argue two different positions on search engine queries and the SCA.

Even so, I suspect Google's legal team is still going to have a difficult time convincing the judge in this case that search engine queries are private enough for the company to repeatedly argue that they deserve warrant protections under the 4th Amendment, yet not private enough to deserve protections under the Stored Communications Act's prohibition against sharing communications content.

After all, as Al Gidari, Google's top privacy outside lawyer himself said at Brookings last year:

"[C]ontent is content, I don’t care how many times you try to repackage it into something else, content is still content, and the standards that we try to apply that give lesser protection to that content inevitably falls short, as well, when people stop and think about it."


Andrew said...

Maybe I am not up to date on my understanding of content providers vs. communications service providers, but is Google arguing that it is a communications service provider? I know that the boundaries of have been muddled regarding where communications services and content services really end, but I hope that Google is not continuing that argument. The distinction is a very real and very important one. For example, I suppose that Blogger is facilitating this communication right now, but so is Verizon backbone through which I am able to access it. Content facilitates communication, but a bright legal distinction has to exist so that we can separate issues of privacy and sensitivity of the information transacted through communications services, and content services.

Additionally, while I stand behind the principal of your lawsuit, I don't share your enthusiasm about Google having a hard time reconciling their arguments. A Constitutional argument requires a much higher degree of discretion and deliberation than does an analysis of a Congressional statute. I hope that Google is taken to task for violating what trust that its search users had expected, but were not expressly warned of.

Tom Cooke said...

Very interesting coverage of the events here. I really appreciate the time and interest you putting into Google's interactions with the DOJ, Chris. I am curious as to how this development relates to the release of information to companies and the US government on foreigners abroad. From what I understand, this case primarily concerns American citizens, and perhaps, foreigners on US soil. However, foreigners abroad are not governed by the US 4th amendment, and as far as I can tell, there is no overarching governing authority that will protect foreigners from the release of search query content. I am asking these questions and providing these observations as I am currently researching the nature of the relationship between foreign policy and social media. I recently emailed you, but decided to attempt to pick your brain a bit more here after having subscribed to your RSS feed. Your work will be very beneficial to my research, Chris. I hope to hear from you in the near future.