FAQ: What does the Google subpoena mean?

By Declan McCullagh
http://news.com.com/FAQ+What+does+the+Google+subpoena+mean/2100-1029_3-6029042.html

Story last modified Fri Jan 20 04:00:00 PST 2006

Preparing to defend a controversial Internet pornography law in court, the Justice Department has demanded search logs from Google, Microsoft, Yahoo and America Online.

The department asked the search giants to hand over millions of records involving what search terms people have used on the sites and what Web sites are accessible via the search engines.

On one level, the situation involves a straightforward question of whether the department's demands are too onerous and therefore not permitted under federal law. On another, the dispute raises novel questions about search engines' privacy protections and the relationship that four tech giants have with the federal government.

What does it all mean, and what happens next? Read on.

Q: What is the Justice Department demanding from search engines?
A: Federal prosecutors have asked Google, Microsoft, Yahoo and America Online to turn over two types of data: logs showing search terms used by people, and a list of Web sites indexed by the companies' search engines.

Q: Which companies have complied?
The Justice Department isn't talking, at least not yet. Google has opposed the request. Yahoo and AOL have acknowledged complying, saying that they went along with the government's request but did not turn over personally identifiable information. At the time this was written, Microsoft was refusing to say anything, but the ACLU has confirmed that the company did comply.

Q: What information was turned over?
We don't know. The Justice Department initially demanded that the four companies divulge "all URLs that are available to be located through a query on your company's search engine as of July 31, 2005." The subpoena also asked for "all queries that have been entered on your company's search engine between June 1, 2005 and July 31, 2005, inclusive."

But at least when trying to negotiate with Google, the Justice Department eventually narrowed that request to a "random sample of 1 million URLs" and "copies of the text of each search string entered onto Google's search engine over a 1-week period."

Q: So we don't know whether Microsoft, Yahoo and AOL went along with the initial request, or whether they negotiated a better deal?
Exactly. We just don't know, at least not yet, and they're not providing details.

AOL came the closest, saying it turned over a list of "aggregate and anonymous search terms, and not results, from a roughly 1-day period." But it refused to elaborate.

Q: Is there any law preventing a company from talking to the press?
Nope. If they chose, they could disclose all the negotiations that took place, release the correspondence they exchanged with prosecutors and so on. It's a little odd that they're being so tight-lipped.

Or they could have done what Google did and fought the Justice Department in court.

Q: I used those search engines in June and July. Should I be worried about my privacy?
It depends. If you typed in search terms that you consider to be private or confidential, you should be concerned. Such terms might include personal information about you, such as your name or street address.

But what's important to note is that the Justice Department has not been asking for any information that would link those search terms to your identity. It hasn't requested Internet Protocol addresses.

So if you typed in search terms indicating that you, say, have a healthy interest in marijuana cultivation, the data turned over won't implicate you.

Q: The subpoena came from the Justice Department's civil division. Will the attorneys there share the data with their colleagues at the department's criminal division or the FBI?
No law would appear to prohibit them from doing so. A protective order does say that only Justice Department attorneys "who have a need" for the information may receive it.

If the disclosed search logs show evidence of criminal activity, that language may be vague enough to let prosecutors return with a second subpoena to demand the identification of one or more Internet addresses linked with those search terms. Terror-related searches are another likely area of information-sharing--President Bush likes to talk about how "law enforcement officers should not be denied vital information their own colleagues already have."

There has, however, been no evidence that the Justice Department has or has not done this to date.

Q: So the Justice Department could end up using it in a prosecution?
Tim Wu, a law professor at Columbia University, says it may be fair game.

"That's one of the biggest questions in evidence law," Wu says. "It's like if you subpoena a book for another reason, and you find a murder note in it. Can you use it as evidence?"

If the records are in the hands of a third party such as a search engine, Wu says, "generally speaking they can use it to find out about other crimes."

Q: What does the Justice Department plan to do with this data, anyway?
A declaration (click here for PDF) by Philip Stark, a professor of statistics at the University of California at Berkeley, sheds some light on this.

Stark says he has been "involved in conversations" with attorneys and engineers at the companies targeted by the Justice Department to find "practical approaches to sampling their databases of URLs and user queries."

The point of the exercise, Stark said, is to evaluate "how often Web users" encounter pornographic material online, and "to measure the effectiveness of filters in screening those materials."

Q: Who cares about filtering software's effectiveness, anyway?
The Bush administration, for one. It's trying to defend a 1998 law called the Child Online Protection Act before a Philadelphia judge in a trial expected to begin in October.

When the U.S. Supreme Court ruled in the COPA case in June 2004, the majority voted to send it back down to the lower court for a full trial. That would, the majority said, "allow the parties to update and supplement the factual record to reflect current technological realities."

That's what the Justice Department aims to do--by arguing in court that filtering software is not a realistic alternative to a federal criminal law because the concept of filtering is flawed and unworkable in practice.

Q: Are my search terms private?
If they're unlinked from your identity, and just part of a list of anonymous searches scrolling across a screen, the privacy concerns are minimized.

Google even displays a list of live search terms on a screen that visitors can view in its Silicon Valley headquarters. That's probably one reason why the company's lawyers have been careful not to raise privacy arguments.

Instead, in a letter dated Oct. 10, 2005, Google lawyer Ashok Ramani objected to the Justice Department's request on the grounds that it could disclose trade secrets and was "overbroad, unduly burdensome, vague and intended to harass."

Q: Then why are privacy groups complaining? Your article includes I-am-outraged statements from the Electronic Privacy Information Center and the Electronic Frontier Foundation.
There are probably a few reasons. First, they'd say, private companies should not serve as convenient information repositories for trial attorneys hoping to win court cases. Second, it's not clear where this information will end up, and how far the protective order stretches.

Third, they simply believe that search engine companies are collecting too much information about their users. Google, Yahoo, AOL and Microsoft set cookies, collect personal information, and retain permanent logs that could be used to create a kind of dossier about a person's search habits.

Deleting cookies is one option. So is preventing your browser from accepting them in the first place. The Firefox browser, for instance, lets you block certain sites so they'll never set cookies.

Q: What will happen next?
The ball's in Google's court. The company will have to respond to the Justice Department's request, and then a federal judge in San Jose, Calif., will rule on the matter. Appeals are also a possibility.

Q: Will there be any political fallout?
Well, the U.S. Congress is controlled by Republicans, and the Bush administration made the request, so the political math is pretty simple. It would probably take more evidence of privacy invasion or wrongdoing for congressional Republicans to do anything substantial.

But the Democrats may. Sen. Daniel Inouye, a Democrat from Hawaii, on Thursday asked the Justice Department about this topic during a Senate hearing.

"On the Google case, what is your reaction to Google's position that (the Justice Department's request) is an invasion of their privacy?" Inouye asked. The Justice Department representative, Deputy Assistant Attorney General Laura Parsky, declined to comment.

Q: This law that the Justice Department is defending talks about "child protection." Is that related to child pornography?
No. Child pornography is already illegal, and the ACLU is not challenging that law in this case. Some of the initial news reports were wrong.

The Child Online Protection Act makes it a crime for a commercial Web site to post material that some jurors might find "harmful" if a minor stumbled across it.

That vague requirement has alarmed mainstream Web publishers and civil liberties groups, which have supported the ACLU's lawsuit. Plaintiffs in the COPA case include the American Booksellers Foundation for Free Expression, Salon.com, ObGyn.net, Philadelphia Gay News and the Internet Content Coalition. Founding members of the now-defunct Internet Content Coalition included CNET Networks (publisher of News.com), Adobe, Reuters New Media, Sony Online and the New York Times.

Q: What material might be viewed as "harmful to minors?"
The 3rd U.S. Circuit Court of Appeals looked into this when ruling the law was unconstitutional based on preliminary evidence (a full trial is scheduled for this fall).

The judges said that even portions of a "collection of Renaissance artwork" could be viewed as harmful to minors if a prosecutor was sufficiently zealous.

"Thus, in our opinion, the act, which proscribes publication of material harmful to minors, is not narrowly tailored to serve the government's stated purpose in protecting minors from such material," the judges said. (Click here for PDF).

Q: How long does Google have to respond to the government's motion in federal court?
In general, the defendant would have two weeks to reply and then the government would have one week for its response. This is an unusual case, however, because no hearing has been set. So the deadlines may be extended.

Q: Are my search results normally disclosed?
Yes, though generally in the context of "most popular search terms" totals. SearchEngineWatch.com has a long list of examples. Dogpile actually lets you review live search terms of the type that the Justice Department also wants to see.

---
Cast your vote [I says NO]
http://polls.cnet.com/polls/show_results.php?action=results&poll_ident=1792&template_set=news_fd