Report Shows ICE Is Demanding Subscriber Info It Has No Legal Right To With Self-Issued Subpoenas

from the snatch-it-baby-coz-I-can dept

Just because your service provider is willing to notify you of the government's (perhaps unexpected) interest in all your digital belongings doesn't mean there's someone standing between you and the government's flimsy piece of administrative paper.

A recent report by the Los Angeles Times -- based on notifications from service providers about government demands for data -- shows there's not much that can stop the government from obtaining a bunch of info with almost zero judicial oversight. Email notifications from Google shared with journalists show just how powerless end users are when confronted with government demands for data. Sure, notification is nice, but it's not all that helpful.

The government has almost unlimited power to make requests for data. The people they serve, however, are subject to demands that cannot possibly be met.

In one email The Times reviewed, Google notified the recipient that the company received a request from the Department of Homeland Security to turn over information related to their Google account. (The recipient shared the email on the condition of anonymity due to concern about immigration enforcement). That account may be attached to Gmail, YouTube, Google Photos, Google Pay, Google Calendar and other services and apps.

The email, sent from Google’s Legal Investigations Support team, notified the recipient that Google may hand over personal information to DHS unless it receives within seven days a copy of a court-stamped motion to quash the request.

The government -- in this case, ICE -- prints out an administrative subpoena, something that doesn't require judicial approval to send out to third parties storing user data. You, however, need to run to court to block it. And you need to do it in less than a week. The government says "give." And citizens are expected to find representation or just make the most of their Google searches for "quash" in less than seven days or their service providers will feel "compelled" to hand over all kinds of information to government employees engaging in self-approved fishing expeditions.

And, as if this barrier to due process entry wasn't enough, notification from service providers generally doesn't include handing over the underlying document. People are expected to approach federal courts with almost zero information in hopes of denying the government its request for information. And it's a lot of information -- at least in the case viewed by the LA Times.

The email from Google did not include a copy of the legal request. Upon requesting it, the recipient learned it was an administrative subpoena from the U.S. Immigrations and Customs Enforcement agency. ICE was looking for the names, email addresses, phone numbers, IP addresses, street addresses, length of service such as start date, and means of sources of payment linked in any way to the Google account.

Where's my bulwark against encroaching government interests, you might ask? The answer will not surprise you. It's mainly you with the occasional assist from service providers. To be fair, some service providers are better than others at rebuffing data demands that arrive without judicial approval. But, for the most part, users are still on their own. According to its own transparency reports, Google hands over data 83% of the time. Facebook does it 88% of the time. Twitter is a relative rebel, handing over data at only a 59% clip.

If most of these requests were warrants and court orders, great. If not, there's still a lot of work that needs to be done. On the relatively brighter side, some users are at least being notified the government is coming for their bits and bytes.

That's where administrative subpoenas act as their own form of restraint on government overreach. To obtain a gag order that prevents notification of targeted users, government agencies generally must get a court order. Using their own in-house paperwork means they can't prevent service providers from notifying users of the government's interest. That doesn't mean agencies won't add bullshit boilerplate to subpoenas that implies it would be illegal to notify end users. They still will. It just means they can't do anything about it when tech companies let end users in on the government's attempted secrets.

And they can't do what ICE did here. ICE demanded a wealth of information with its administrative subpoena. These subpoenas can only be used to request basic subscriber information. The one seen by the LA Times goes far beyond those limits, requesting Google hand over emails addresses, names, phone numbers, and financial info.

Hopefully Google only turned over what ICE could legally obtain with its flimsy paperwork, if it decided it was obligated to turn over anything at all. But this shows what the government will try to do in the perceived absence of pushback. It knows no end users are capable of securing a court order quashing these subpoenas in seven days. And it knows it can't request the information it's requesting. But it will do it anyway because the odds are still in its favor and bypassing the judicial branch means no one's going to benchslap it for breaking the rules or deny its requests as overbroad.

Filed Under: 4th amendment, administrative subpoenas, ice, privacy, subpoenas
Companies: google

Unconstitutional Fishing Expeditions: The Massive Abuse Of Administrative Subpoenas By The Government

from the depressing dept

For years, we've talked about how the Justice Department has massively abused the "National Security Letters" (NSLs) process that lets it seek information from third parties without judicial oversight. At least with FBI NSLs, the FBI is required to release some (though not all) info on how they're used, which is why we have some indication of how widely they're abused. However, as Dave Kravets recently detailed in a fantastic article at Wired.com, the use of "administrative subpoenas" (NSLs are a form of administrative subpoena) allowing government officials to issue mandatory subpoenas to third parties with no oversight at all has become quite widespread. Even worse: most government agencies don't seem to have any interest in revealing any data about them. In other words, if you thought the FBI was abusing NSLs, you should probably be even more concerned about some of these others administrative subpoenas.

Meet the administrative subpoena (.pdf): With a federal official’s signature, banks, hospitals, bookstores, telecommunications companies and even utilities and internet service providers — virtually all businesses — are required to hand over sensitive data on individuals or corporations, as long as a government agent declares the information is relevant to an investigation. Via a wide range of laws, Congress has authorized the government to bypass the Fourth Amendment — the constitutional guard against unreasonable searches and seizures that requires a probable-cause warrant signed by a judge.

In fact, there are roughly 335 federal statutes on the books (.pdf) passed by Congress giving dozens upon dozens of federal agencies the power of the administrative subpoena, according to interviews and government reports. (.pdf)

It's worth reading Kravets' full article, even if it is depressing. What amazes me is that we let this kind of stuff continue unabated. We've seen increasing surveillance and abuse over the years, but it seems that any time people push back on these processes, they're brushed off because "OMG!Terrorists!" or something along those lines. It's sad that we, as a country, seem so accepting of the government taking away basic Constitutional rights if it just screams something about terrorists and crime.

Filed Under: abuse, administrative subpoenas, justice department, national security letters, nsls, oversight