A Pennsylvania court says police can sift through Google searches to find suspects

[Daniel Sims]

Why it matters: The Pennsylvania Supreme Court has upheld a search warrant for a week of Google keyword search history that police used to identify a suspect in a 2016 rape case. While the ACLU criticized the tactic, an opinion from the court compared Google to banks and phone companies while setting aside a distinction for VPN usage.

In the case of Commonwealth v. Kurtz, Pennsylvania state police obtained a warrant to review Google's search data for the week before a woman was abducted from her home and raped. The warrant raises questions regarding the Fourth Amendment because it did not focus on a specific suspect.

According to a 32-page opinion from Justice David N. Wecht, the police found that John Kurtz had searched for the victim's address twice, hours before the attack. They later obtained DNA from a cigarette Kurtz discarded, matching a rape kit. Kurtz later confessed to the assault and four others, showing authorities where the victims lived.

However, the defendant later argued that the reverse keyword search violated his Fourth Amendment rights against unreasonable searches and seizures because police had not obtained probable cause specifically targeting him. The incident resembles a 2023 case in which a Colorado court found a reverse keyword search warrant to be flawed, but determined that the police acted in good faith. The Electronic Frontier Foundation, which wants a full ban on the tactic, slammed the decision.

Wecht's opinion applied the third-party doctrine, in which a person surrenders any expectation of privacy upon turning information over to a third party, such as a bank or phone company. The Justice wrote that, when Kurtz entered his search query into Google and pressed Enter, he submitted that information to Google, which he considers to be a third party.

Furthermore, the search giant's privacy statement says that it retains user information, which it can use to satisfy legal requirements. However, Wecht also accepts that taking any steps to protect user information, such as activating a VPN, demonstrates a reasonable expectation of privacy.

Meanwhile, in a dissenting opinion, Justice Christine Donohue asserted that the reverse keyword warrant endangered the privacy of everyone who searched the victim's name or address that week. After running out of other leads, police connected the search terms to several IP addresses. They focused on one associated with Kurtz because he was a coworker of the victim's husband.

Kurtz was sentenced to 59 years to life in prison.

Permalink to story:

A Pennsylvania court says police can sift through Google searches to find suspects

 

[amghwk]

In today's world of cross border and internal terrorism, the police need to do as much investigations as possible.

If you didn't do anything wrong, you don't need to worry about what you're doing online.

 

[JMGuy]

We absolutely need better privacy protections in the U.S.

But the ACLU’s argument seeks expanded privacy protections by recharacterizing internet search engines as the functional equivalent of libraries, which they’re not.

Libraries receive heightened confidentiality protections because they are public or quasi-public institutions with statutory duties, professional norms, and missions centered on intellectual freedom. Search engines are private companies whose business involves collecting and retaining user data as part of providing their services. Treating them as libraries does not reflect how they operate or why their records are maintained.

If greater privacy in search queries is warranted, it should be enacted through legislation, not through constitutional analogy that obscures material differences between institutions.

If stronger privacy protections for search queries are to be recognized, that determination should be made explicitly by legislatures, which are better positioned to weigh competing interests and establish clear, prospective rules. Courts should not achieve that result by recharacterizing private companies as libraries under existing constitutional doctrine.

As much as I want to see greater enactment of privacy here, it needs to be done so appropriately. IMHO the ACLU is barking up the wrong tree with this particular argument.

 

[SRB]

Seems to me that if a crime has been committed, looking into who was searching for specific information about the victim through a legal warrant is just a next step in an investigatin, I don't see the problem. Yes, it may return some leads that are not connected, but those can be quickly vetted. I think the bank record analogy is spot on. Without a warrant, or going on fishing expeditions without specific crime or reason is another story. But then again, you just can go looking through bank records or phone records without a vaild reason and warrent either, unless you're a fedral prosicutor, but that's a different story.

 

[Theinsanegamer]

In today's world of cross border and internal terrorism, the police need to do as much investigations as possible.

If you didn't do anything wrong, you don't need to worry about what you're doing online.

Those who would trade privacy for security deserve neither.

Me doing nothing wrong is NOT justification for my life to be sifted through by authorities. Using fear as a justification is a terrible idea and ALWAYS backfires.

Seems to me that if a crime has been committed, looking into who was searching for specific information about the victim through a legal warrant is just a next step in an investigatin, I don't see the problem. Yes, it may return some leads that are not connected, but those can be quickly vetted. I think the bank record analogy is spot on.

Well you answered your own question. Do you REALLLY trust the authorities to properly vette whatever BS google serves them?

Without a warrant, or going on fishing expeditions without specific crime or reason is another story. But then again, you just can go looking through bank records or phone records without a vaild reason and warrent either, unless you're a fedral prosicutor, but that's a different story.

Opening up Google searches to be used as evidence is a major step towards that power being abused by those who do not have valid reasons or warrants but get away with it. Keeping them inadmissible denies the entire stack the ability to abuse.

 

[p51d007]

Let's see...google can use your search history any way it wants, but no one else can? LOL

 

[Win7User]

Unless, you're smart enough to NOT use your real name on ANY account, social media or otherwise, ever! Or any information for that matter. I'm, not a criminal, but my personal business is my business, no one else's, especially law enforcement!

 

[Win7User]

In today's world of cross border and internal terrorism, the police need to do as much investigations as possible.

If you didn't do anything wrong, you don't need to worry about what you're doing online.

I, may just not want them (law enforcement) or anyone for that matter seeing any of my personal information. It, has nothing to do with doing something wrong or not. It's called privacy. Of, course I have NEVER, in my 28 yrs online, ever given my real name, address or phone number, for a free email address, or anything else. It's getting harder and harder to keep that up, though. For, instance, you can't get a Gmail account without using a phone number nowadays. I already have two Gmail addresses, (almost 20yrs old) that's enough I guess.

 

[MasterAce]

So the man was convicted on DNA. They tailed him and snatched a sample, and connected that to four other cases. The reverse search was used to find someone who’s sample to compare. And he was not matched to a google account, instead a ip address was used to recognise him.

Seems to me that privacy violation would be for the police to go and look at google records to see all the searches a person does. Here a single address was used as a keyword, so the exposure of private life was minimal. They only saw anyone searching for a specific address.

At the same time, 20y ago, the man would have used a phonebook, and noone would have known. Our phones track our every move, ours cars know where we are going and our robot vacuum has a floorplan of our house. This is the age we live in, has the definition of privacy shifted?

 

[unoficialoficial]

Almost sixty years in prison—effectively a lifetime sentence—for sexual conduct under any circumstances, without any other harm to the victim, is far too severe. The penalty is not proportionate to the harm caused. It constitutes a clearly disproportionate and cruel punishment, violating the Eighth Amendment to the United States Constitution. Even a sentence of five to seven years would already be excessive. There is no any lasting biological or economic harm inflicted.

 

[Galloper22]

The question is - can Google link the search query to a person even if they're not logged in?

 

[ScottSoapbox]

Let's see...google can use your search history any way it wants, but no one else can? LOL

When the “someone else” can jail or even kill you, wise people want extra precautions put in place.

 

[ScottSoapbox]

If you didn't do anything wrong, you don't need to worry about what you're doing online.

A bumper sticker argument that Joseph Stalin would love.

Here's how it could play out in this case:

The police show up at your work, saying they need to speak with you because you are a suspect in an abduction and rape case. They have evidence from found in your google search history implicating you. All true facts for your co-workers to absorb.

This evidence gives them probable cause to search (notably a legal protection you don't want us to have) your bank records, your phone records, your GPS location history, and more...

The evidence? You happened to search for Susan Landry (the same name as the victim) two weeks before. Sure, it turns out that was a different Susan for an unrelated reason, but you now get to deal with a police investigation that (with no other leads) goes on for weeks and then try to convince everyone that it was a mistake and you do not search for rape things online.

But you have nothing to worry about since you did nothing wrong, right? The default cannot be needing to constantly prove that you actually did nothing wrong. Innocent until proven guilty. Or do you find that unnecessary as well?

 

[sdms96825]

Almost sixty years in prison—effectively a lifetime sentence—for sexual conduct under any circumstances, without any other harm to the victim, is far too severe. The penalty is not proportionate to the harm caused. It constitutes a clearly disproportionate and cruel punishment, violating the Eighth Amendment to the United States Constitution. Even a sentence of five to seven years would already be excessive. There is no any lasting biological or economic harm inflicted.

WTF?

 

[jeffbert]

1. Do not do anything even remotely suspicious
2. Always use a VPN.
3. Say your prayers every night

 

[Win7User]

In today's world of cross border and internal terrorism, the police need to do as much investigations as possible.

If you didn't do anything wrong, you don't need to worry about what you're doing online.

Good, argument for dismantling the United States Constitution!

 

[jeffbert]

In today's world of cross border and internal terrorism, the police need to do as much investigations as possible.

If you didn't do anything wrong, you don't need to worry about what you're doing online.

Who needs the 4th Amendment? Just be good.

Except, sometimes even the innocent are convicted. It has happened before & will happen again, despite all the Constitutional protections.