Can Everything You Search Be Used Against You?

by Greg Beck

CNET’s Declan McCullagh highlights a recent 7th Circuit decision that hasn’t received much attention until now.  The court in United States v. Schuster upheld a hacker’s fifteen-month prison sentence for breaking into a wireless network service and interfering with other users, relying in part on the defendant's Google searches for “how to broadcast interference over wifi 2.4 GHZ,” “interference over wifi 2.4 Ghz,” “wireless networks 2.4 interference,” and “make device interfere wireless network.”  As the article points out, this is not the first time Google search terms have been used to support a criminal conviction.  A North Carolina murder defendant was convicted last year in part based on his searches for the words “neck,” “snap,” “break,” and “hold” after police recovered the search data from his computer.

Although there is no indication in the court's opinion about how prosecutors in this case obtained the search data, Google has acknowledged that it can trace searches back to a particular computer or, in some cases, to a particular user.  What exactly does Google know about you?  Its privacy policy states that it automatically records information that your browser sends whenever you visit a website. This can include your search terms, IP address, date and time of your search request, and, if you have cookies enabled, possibly your personal identity.  Google also acknowledges that it can track which links you click from its search results.  In short, Google may have several years’ worth of your search activity stored in its databases, and it may be able to connect much or all of this activity back to you.

AOL demonsrated how much of a privacy risk Internet searches can pose earlier this year when it publicly released of 650,000 randomly selected user logs containing 20 million search queries.  The logs were full of private, embarrassing, and sometimes disturbing searches.  Although the search data was intended to be anonymous, personal information included in searches gave clues to who was behind many of them, and allowed the New York Times to identify one searcher by name.

Despite the sensitive nature of search data, search engines like Google are not covered by the Electronic Communications Privacy Act, which protects the privacy of some electronic data.  To its credit, Google did fight off the Justice Department’s attempt to subpoena search data in support of the government's defense of the Child Online Protection Act, but Google will not say how often it receives other subpoenas or how it responds to those requests.  The company’s decision to store massive amounts of highly sensitive information on its servers, however, cannot help but make the company an increasingly tempting target for prosecutors, civil plaintiffs, and hackers.