Yesterday, the Supreme Court of Colorado handed down the first state supreme court case on the law of reverse keyword searches for Google terms: People v. Seymour. Here's the issue: If the government has reason to think that someone entered in a particular Google search related to a crime, can it get a warrant to compel Google to hand over IP addresses or account that entered that search? If so, how broad can the search be? And is a warrant needed at all?
Seymour involves an arson at a particular address. Having no leads about who set the arson, investigators figured that whoever did the crime probably googled the address of the arson in the weeks beforehand. (The idea being, I assume, that between getting directions and getting Google images pictures of what it and the surrounding area looks like, it's a natural way to do recon of the place as part of the plan to commit the arson.). Investigators obtained a warrant covering the 15 days leading up to the arson, and Google responded that 8 IP addresses had googled that address. Five of the eight addresses were local, and investigators ruled out two of them. They then obtained another warrant to get records of the other three. One of the three was the defendant, Seymour.
Among the questions raised: Did Seymour have Fourth Amendment rights in Google's records of his search terms? Someone at his computer, presumably him, had googled the address; Google had the search term that was sent to it. Did informing the government that the term had been searched from his IP address violate his Fourth Amendment rights?
The Colorado Supreme Court answered that question in a very novel way. First, it held that although it was likely not a Fourth Amendment "search" to collect that information — the user is sending the data to Google, after all, so Google receiving and storing it is covered by the third-party doctrine — it is a search under the broader Colorado Constitution. I don't have any particular view of the Colorado Constitution, so that part of the opinion is isn't all that important.
But then the court did something I have not seen before: It ruled that copying the data held by Google "seized" it under the Fourth Amendment even though accessing it was not a search. The court did this in two steps. First, it ruled that a Google user has a possessory interest in search terms held by Google sufficient to receive Fourth Amendment seizure protection:
Under both the Fourth Amendment and the Colorado Constitution, a seizure occurs when the government meaningfully interferes with an individual's possessory interests in property. Hoffman v. People, 780 P.2d 471, 473 (Colo. 1989); accord Jacobsen, 466 U.S. at 113. And several courts have recognized, albeit in different contexts, that individuals can have possessory interests in intangible or digital property. E.g., Ruckelshaus v. Monsanto Co., 467 U.S. 986, 1003 (1984) (holding that, at least for the purposes of the Takings Clause, individuals have property rights in intangible property, such as trade secrets); Integrated Direct Mktg., LLC v. May, 495 S.W.3d 73, 76 (Ark. 2016) (holding that electronic data can be converted if a person impedes on the property rights of the owner). Indeed, Google's licensing agreement makes clear that it does not own its users' content. Instead, users own their Google content, which, according to testimony from a Google policy specialist, includes their search histories.
It next ruled that copying the data was a "seizure" of it:
"One of the main rights attaching to property is the right to exclude others, and one who owns or lawfully possesses or controls property will in all likelihood have a legitimate expectation of privacy by virtue of this right to exclude." Rakas, 439 U.S. at 143 n.12 (citation omitted). So, while law enforcement can copy digital data without affecting the owner's access to that data, it is the act of copying that meaningfully interferes with the owner's possessory interest because it infringes on one's rights to exclude and to control the dissemination and use of that digital data. See Randolph S. Sergent, A Fourth Amendment Model for Computer Networks and Data Privacy, 81 Va. L. Rev. 1181, 1186 (1995); Orin S. Kerr, Fourth Amendment Seizures of Computer Data, 119 Yale L.J. 700, 710–14 (2010) (discussing that a seizure of digital property occurs when the government copies the data because it is the copying of the digital property rather than control of the physical hardware that preserves it for future evidentiary use and therefore meaningfully interferes with the possessory interest of exclusive control)
I don't have a problem with the second part of that, as you might guess: I have long argued, including in the cited article, that copying Fourth Amendment protected data is a seizure of it.
But the first part of that holding strikes me as incredibly novel and far-reaching, as it gets to a super-important question about when copying is a seizure. I have always treated the seizure power as coextensive with the search power. Under that approach, copying data is a seizure only if accessing it is a search. As I put it in Fourth Amendment Seizures of Computer Data, it's copying of "Fourth Amendment protected data" that is the seizure—not just any copying.
Unless you take that view, it seems to me, you end up silently overturning—or least practically nullifying— Fourth Amendment caselaw on what is a search in the first place. The problem is that the process of revealing information almost always requires first copying it. If you say that it's a seizure to copy information, even when revealing it is not a search, then you end up requiring a warrant for act of obtaining the data even though the obtaining doesn't require a warrant. Just the incidental need to copy the unprotected data to obtain the information ends up requiring a warrant. And I don't think that makes sense.
Indeed, if you take that view, you end up having to devise a brand-new set of principles as to when copying data is a seizure. If you're no longer tied to what data is protected under the search rules, what else is there to trigger enough of a Fourth Amendment interest?
The Colorado Supreme Court doesn't offer much in the way of an answer. First, it notes that some courts have said you can possess data:
And several courts have recognized, albeit in different contexts, that individuals can have possessory interests in intangible or digital property.
Sure, in the abstract, that's right. You can have a possessory right in data. But why would that mean Google search terms are possessed, when you have given up possession by sending the query to Google? The cases the court cites don't shed any light on that:
E.g., Ruckelshaus v. Monsanto Co., 467 U.S. 986, 1003 (1984) (holding that, at least for the purposes of the Takings Clause, individuals have property rights in intangible property, such as trade secrets); Integrated Direct Mktg., LLC v. May, 495 S.W.3d 73, 76 (Ark. 2016) (holding that electronic data can be converted if a person impedes on the property rights of the owner).
What does that have to do with why you would have a possessory right in records you have handed over to Google? The last part of the analysis adds:
Indeed, Google's licensing agreement makes clear that it does not own its users' content. Instead, users own their Google content, which, according to testimony from a Google policy specialist, includes their search histories.
I suppose this is an improvement, in that at least it's about Google records specifically, rather than as data in an abstract sense. But why does the licensing agreement, or terms of service, matter? As I argue here, terms of service don't effect Fourth Amendment rights. Why would a licensing agreement magically create a property right in data, such that copying the data is a Fourth Amendment seizure that requires a warrant?
If the Colorado Supreme Court's approach is right, then I would think there is a super-easy way for an Internet company to impose a universal warrant requirement on any effort to get any data from the company. Just slip this line into the terms of service:
By using this service, you gain a property right in all data held by the company.
By adding this line, would any effort from the government to get any record— even just subscriber identity, or a list of someone else's IP addresses—be a seizure of the data you own because the data would need to be copied in the course of turning it over? If not, I'm not sure why not. But that can't be right, it seems to me.
There's a lot more in the Seymour opinion that's of interest, but that seizure holding strikes me as really far-reaching. I realize that many of our readers are Fourth Amendment maximalists, and will cheer on any ruling that adds new kinds of protection. But it seems to me that the court's seizure analysis leaves a lot to be desired.
The post Can Copying Data Be a Fourth Amendment Seizure If Accessing It Is Not a Search? appeared first on Reason.com.
