What happens when ICE asks Google for your user information | Hacker News Reader

What happens when ICE asks Google for your user information

latimes.com

There should be a wider list of who to notify.

For example, if the court request is "Hand over names of all users in this geographic region at this time", then every Google user should be notified. Many of the notifications will say "A court ordered us to check your location history. You were not in the relevant area at the relevant time, so we handed no further of your data to the court".

Such notifications would inform regular Joe how often and why the government is looking at his data.

What's the point of notifying about government looking at data, if nothing will realistically change? By analogy, the sales tax is printed on every single receipt for a product, yet nobody clamours to reduce the sales tax. It's "just the way it is" because people have gotten used to it.

Presumably they are mostly okay with the sales tax and may not be okay being spied on.

People understand that the government needs money to operate and have come to terms with that, people might not have come to terms with the government looking through their private lives on the Internet.

Yet, people have come to terms with [big company] collecting their data and [selling] that data to [literally anyone with money].

That demonstrably false - ask a random joe how much tax he just paid, and he will know. Ask him how many companies bought his data, and he wont have a clue. He doesnt even know who has it, who sold it, or anything for that matter.

If, every time his data was sold, he got a notification, then maybe we would see a change.

Ask Joe where the government spends his taxes, he’ll equally be unable to tell you where it goes.

Roads, healthcare, education, infrastructure, military are things most people would probably be able to respond. Also the money they're giving to the government isn't tied to their identity in any way other than how well they're doing financially.

What? Joe in UK gets a summary of national budget in the post every year, and can attend parlamentary sessions where budgets are discussed. They are public documents

In general perhaps, just like generally we have an idea of what Google or Apple or Facebook have. But likewise although we know in aggregate what the government does with money, we don’t know specifically what they do with our contribution, nor do we have control over it whether we agree or disagree with the usage of it.

What is this absurdity, why are you on a mission to create an appearence that private and confidential dealings of Facebook and just as transparent as public documents subject to multiple levels of scruitiny by elected officials?

there is no 'spesifically your contribution', you know exactly how much was spent on each road if you bother to look, and you do not have an idea of what facebook has and to whom it was sold because this information is not public.

Random joe somehow both knows how much tax he just paid, but also worries that if he gets into the "next tax bracket" he'll suddenly take home much less money.

Random joe knows what his taxes pay for, but also thinks 25% of his taxes fund NASA and the NEA.

I think this is disingenuous.

“Think of how stupid the average person is, and realize half of them are stupider than that.”

I think that 50% of people have no idea what the value of metadata is, nor how much or what they are leaking.

> By analogy, the sales tax is printed on every single receipt for a product, yet nobody clamours to reduce the sales tax.

Many people do clamour to reduce the sales tax. But not "enough" because it's arguable that the sales tax has a purpose and that the people agree with the purpose and (mostly) agree with the price set of the purpose.

You've got to plug both holes in a sinking ship.

The imagination deficit by the public can be fixed separately but both that and knowledge of what is going on is necessary to stop this.

There no "1984" (art that acts as a sort of standardized warning - to the point that it's almost a cliche) for a world with Google. Not yet, anyway.

While the themes of 1984 are relevant, the tech isn't. We don't have TVs that record us at home but we have something potentially worse.

> We don't have TVs that record us at home

You might want to learn more about "smart" TVs.

TVs with a microphone and "always on" internet connection are already a thing being sold.

I've seen demos of cameras placed directly behind display screens. Ostensibly they're marketed for better quality selfies on phones (as if that isn't a terrifying idea). But it could just as easily be in a TV.

So I actually received one of these notices from Google.

A few years ago detective in Massachusetts had subpoenaed all information having to do with my GMail address.

Not having done anything wrong it was very stressful time for me trying to figure out what the police were after.

Turns out some scammer had put down my email address (a common first name/ last name combo) on a form at a UPS store.

UPS being the terrible company it is didn't bother to verify said address. (And BTW refused to remove my address even after I repeatedly called their help line).

In the end I had to hire a lawyer a thousand miles away in order to contact the detective to try and clear up the situation.

Five things stick out in my memories of this incident:

1. If I was so inclined it would have been really easy to destroy all of my computers given the advance warning.

2. They attack surface was bigger than I could imagine. Given that I payed for Google Drive and used Google DNS Google knows everything about my online life including all the illegal things (copyright related) that the fuzz might find despite looking for something completely unrelated.

3. It is super easy to find oneself in a kafkaesque type situation where one if forced to try and prove a negative. "Yes that is my email address but I swear I never scammed someone out of their iPhone. Yes I know that's what actual scammers would say."

4. It would have been super easy to dismiss the warning email as spam.

5. They don't tell you why you where subpoenaed. I get Google doesn't know but it does leave (innocent) people to spin out into a paranoid frenzy.

Yup. I know a guy who got all scared because he got a letter from the government indicating call(s) of his had been recorded in a wiretap.

Fortunately for his peace of mind I immediately suspected what was going on--he had called a business that had been wiretapped. (I didn't know about the wiretap, I knew about the investigation from the newspaper.) A complete nothing, but it scared an educated guy.

I would like to see all gag orders be time-limited. And I'd like to see the vast majority of them not being for more than a year - very few investigations take over a year, so why should the gag order be longer?

> In Google’s case, the company typically lets users know which agency is seeking their information.

So, they dont have to let you know. :)

> Because of this, it’s important for providers such as Google to act as a check on law enforcement, Crocker said.

I feel safe now /s

    We have a well-established process for managing requests from law enforcement for data about our users: when we receive a request, we notify users that their information has been requested, push back on overly broad requests to protect users’ privacy, and provide transparency around such requests in our transparency report

As a non-native speaker of l'inglese, there's two ways my brain parses this - simultaneously:

(A) when we receive a request, we notify users (... well knowing they can't do anything ...), push back on overly broad requests to protect users' privacy (i.e., we do push back on requests that request we respect users' privacy, who do you think we are?!) and provide transparency ... ("only") in our "transparency" report

I.e., we very well sell the hide of anybody and everybody as quickly as possible, not only abiding by requests but filling in the blanks as well. Then we increment a counter "requests_served++" and include that in our transparancy "report" lol

(B) when we receive a request, we notify users (..to warn and enable them..), push back on overly broad requests IN ORDER TO protect users' privacy and provide transparency (as best as possible)

I.e., we are the good guys and actually try to serve our users as best as possible.

The sentence "we push back on overly broad requests to protect users' privacy" is at the center of this dichotomy for me. To clarify: we push back on (overly broad requests to protect users' privacy) vs. we push back on (overly broad requests) [in order] to protect users' privacy. To you native speakers: is there doubt which of the two are meant for you?

It's obvious that they intend "IN ORDER TO", because it's obvious that they aren't getting requests from law enforcement to protect users' privacy. But I do think the correct interpretation is somewhere in the middle, since they notify users while knowing that they can't do anything.

Yeah, Law Enforcement won't request to protect users' privacy, but users may very well reply to the heads-up requesting a "broad" protection of their own privacy...

>"it's obvious that they aren't getting requests from law enforcement to protect users' privacy"

Obviously privacy law is not something enforced by law enforcement!

They'd probably hand over the account information of some poor sap who shares my very common name since I don't have a Google account.

Short article. They have a soft paywall. Article text:

You’re scrolling through your Gmail inbox and see an email with a strange subject line: A string of numbers followed by “Notification from Google.”

It may seem like a phishing scam or an update to Gmail’s terms of service. But it could be the only chance you’ll have to stop Google from sharing your personal information with authorities.

Tech companies, which have treasure troves of personal information, have become natural targets for law enforcement and government requests. The industry’s biggest names, such as Google, Facebook, Twitter and LinkedIn, receive data requests — from subpoenas to National Security Letters — to assist in, among other efforts, criminal and non-criminal investigations as well as lawsuits.

An email like this one is a rare chance for users to discover when government agencies are seeking their data.

In Google’s case, the company typically lets users know which agency is seeking their information.

In one email The Times reviewed, Google notified the recipient that the company received a request from the Department of Homeland Security to turn over information related to their Google account. (The recipient shared the email on the condition of anonymity due to concern about immigration enforcement). That account may be attached to Gmail, YouTube, Google Photos, Google Pay, Google Calendar and other services and apps.

The email, sent from Google’s Legal Investigations Support team, notified the recipient that Google may hand over personal information to DHS unless it receives within seven days a copy of a court-stamped motion to quash the request.

That’s a high bar to clear in a short amount of time, said Paromita Shah, co-founder and executive director of immigration rights law firm Just Futures.

“What Google expects you to do is to quash the subpoena and that would require you to go to federal court,” Shah said. “I’d like to know how many people are gonna have the resources and the understanding that they have only seven days to hire an attorney to quash an ICE subpoena in federal court.”

>Google hands over data of criminals to law enforcement

What is the story here?

Technically if you’re being investigated and the companies hand over your info, you may not be a criminal at that point. You remember the concept we had for hundreds of years that people are presumed innocent until found guilty by a jury of their peers.

Also, for hundreds of years, police could not just nicely ask a third party to turn over all of your data, at least at the scale of something like the data google keeps on everyone.

I’m amazed by the number of people apparently just fine with this being the norm.

People are fine with police overstepping as long as they aren't in the crosshairs.

Usually, even non paranoid people become staunch privacy advocates once they had to fight the system after their data was abused.

I am greatly opposed to mass surveillance, especially when justified by some immaterial bogeyman such as "stopping terrorism".

However in this case, illegal immigration is a legitimate problem in the US with actual statistics to prove so, and it seems that they are only targetting individuals that they actually suspect of being criminals.

If law enforcement has genuine belief that I am a criminal then why would I be opposed to giving them data to absolve myself?

And yes of course this has the potential to be abused, but is there any proof of this in the article? It seems like one specific individual was targetted, and they had the courtesy to notify them that this was happening.

For hundreds of years police could just nicely ask a third party to turn over all your data - by simply going in and asking what they wanted to know - and proprietors often just did tell all they knew or had recorded. If the third party would refuse and police would demand that they comply, then they'd need a warrant, but nicely asking has always been an option during an investigation.

They are looking for 1 criminal so they took data of a 1,000 people?

Is it cool for police to seize property of thousands of people just because someone somewhere might have commited a crime?

Because then your property can be seized at any time without reason, there is always some crime somewhere nearby.

You are just making this up. Nowhere in the article is there any mention of them requesting data of 1,000 users to find one criminal.

What the article actually says:

>From January 2020 to June 2020, Google received nearly 40,000 requests for user information from law enforcement

There were 185,884 deportations by ICE last year, which is around 92,942 in the same time period. They are making 0.5 requests for information for every person they deport.

You are assuming that each request is for information on 1 person, when in fact it is quite common to ask for all persons having some identifiable characteristic, such as a geofenced location or using certain search terms.

What happens in my case is GDPR says no.

How does Google know who is a GDPR-bound user? Geo-location of initial signup IP address?

And Google already breaches the GDPR with their non-compliant consent prompt.

But regarding law enforcement requests, GDPR explicitly allows any data sharing that's required to comply with the law.

Reply on news.ycombinator.com