Here's US Homeland Security collaring a suspected arsonist after asking Google for the IP addresses of folks who made a specific search
- Reference: 1602245047
- News link: https://www.theregister.co.uk/2020/10/09/google_search_arrest/
- Source link:
It raises a mild concern that if Uncle Sam's request is too broad, and Google can't or won't resist the order, you could be swept up into an investigation simply by searching for the wrong thing at the wrong time. We note, though, that in this particular tale, the query was rather narrow, and Google insists it challenges overly broad warrants.
In June, a rented SUV was torched outside the home of a witness involved in the ongoing US prosecution of R. Kelly, who has been charged with 18 counts ranging from possession of child sex abuse material to kidnapping and forced labor. The next month, Homeland Security agents [1]collared a guy called Michael Williams, accused him of setting fire to the witness's vehicle, and charged him with attempting to use intimidation and threats.
Fast forward to this week, and Robert Snell of Detroit News [2]uncovered the aforementioned [3]search warrant [PDF] showing how Homeland Security investigators enlisted Google and Verizon Wireless to connect Williams, who lives in the state of Georgia, to the scene of the crime in Florida.
Homeland Security special agent Sylvette Reynoso testified that her team began by asking Google to produce a list of public IP addresses used to google the home of the victim in the run-up to the arson. The Chocolate Factory complied with the warrant, and gave the investigators the list. As Reynoso put it:
On June 15, 2020, the Honorable Ramon E. Reyes, Jr., United States Magistrate Judge for the Eastern District of New York, authorized a search warrant to Google for users who had searched the address of the Residence close in time to the arson.
The records indicated two IPv6 addresses had been used to search for the address three times: one the day before the SUV was set on fire, and the other two about an hour before the attack. The IPv6 addresses were traced to Verizon Wireless, which told the investigators that the addresses were in use by an account belonging to Williams. The agents noted Williams is a relative of a former publicist of R. Kelly.
To catch a thief, go to Google with a geofence warrant – and it will give you all the details [4]READ MORE
After that, the team got another search warrant and went to the mobile carriers who operated the cell towers surrounding the street address where the arson happened. Sure enough, Williams's smartphone connected to those towers at around the time the SUV was set ablaze, after also having connected to towers near his home several hours prior, the Feds say.
On top of all that, surveillance cameras showed a truck, matching one registered to Williams, speeding away from the scene immediately after the vehicle was consumed by flames. Following Williams's arrest, it [5]was revealed [PDF] Google had also directly connected the searches to Williams' Gmail account.
Williams's individual case, which looks to be part of a larger investigation, has since been sealed.
While word of these sort of requests for the identities of people making specific searches will raise the eyebrows of privacy-conscious users, Google told The Register the warrants are a very rare occurrence, and its team fights overly broad or vague requests.
"We vigorously protect the privacy of our users while supporting the important work of law enforcement," Google's director of law enforcement and information security Richard Salgado told us. "We require a warrant and push to narrow the scope of these particular demands when overly broad, including by objecting in court when appropriate.
"These data demands represent less than 1 per cent of total warrants and a small fraction of the overall legal demands for user data that we currently receive" ®
Get our [6]Tech Resources
[1] https://www.justice.gov/usao-edny/pr/three-individuals-arrested-separate-schemes-harass-threaten-intimidate-and-bribe
[2] https://twitter.com/robertsnellnews/status/1313560399556509698
[3] https://regmedia.co.uk/2020/10/09/williams.pdf
[4] https://www.theregister.com/2020/01/18/google_geofence_warrant/
[5] https://www.justice.gov/usao-edny/press-release/file/1303846/download
[6] https://whitepapers.theregister.com/
one thing this guy really should have thought of first
Perhaps, not setting out as a career criminal and whatever else. I cannot say I have any sympathy for crooks such as him, but I wonder what other skeletons he will now have uncovered from his various closets.
Re: one thing this guy really should have thought of first
"On top of all that, surveillance cameras showed a truck, matching one registered to Williams, speeding away from the scene immediately after the vehicle was consumed by flames."
Not really sure the IT derived evidence adds so much to that.
Presumably once the recent decision of the EUCJ has been implemented, such crime-fighting techniques will not be available in the EU.
We don't do it anyway, this sort of effort is not spent on arson attacks against normal people.
But if it was, then you'd be able to do it if you had a warrant in the EU.
It's witness intimidation in a major case.
The guy must have forgotten they weren't dealing with the local plod.
Not happening all that often?
Just who does the 'Do Evil' company think will believe that?
{silence}
A narrow search is good
Starting with who's looking for the address of a witness, then subsequent requests for any of these going near the location at specific times. I'm ok with this as a starting point for investigations.
Guidelines for what constitutes 'Narrow' probably don't exist beyond what individual judges deem either acceptable or a fishing trip.
Hmmm
This is one of those 'good intentions' stories isn't it. Clearly phrased requests with a very narrow focus produced a very small pool of results leading to a clear and appropriate suspect.
This is then the supporting evidence for the next request which may not be quite so precise but it still looks OK..etc etc
Re: Hmmm
Ah yes; the entirely lacking in evidence argument that "they did it legitimately this time means they won't the next time".
Sure, maybe they will try that, but having not done so is not proof nor evidence they will.
I am old enough to remember when "innocent until proven guilty" used to be a thing.
Re: "innocent until proven guilty"
... or even, perhaps: s/until/unless/
Re: Hmmm
Yep. But in the case of governments and law enforcement, sensible caution suggests 'guilty until proven innocent'.
Remember the UK rules to catch terrorists - you know, people who use guns and bombs to kill people? Subsequently used to catch people who put bins out on the wrong day?
Re: Hmmm
OK so they caught someone who was stupid and didn't think about getting tracked.
But what about the professionals who know that anything you do on the internet is be tracked? There's a whole range of organizations that employ people who know that they should never get on the internet to do this and who would leave their phone at home (maybe letting a junior carry it from room to room) while they go out to do this "work" and then have "evidence" that they did not do anything and never left the house... "Officer, my phone's GPS shows I was at home, and my Fitbit says I was sitting on the sofa watching TV"
Percentage...
And, of course, it's only a "small percentage" of cases; my cynical mind immediately asks "how many cases are there?" If it's a large number that sort of cancels this out, doesn't it?
Re: Percentage...
That's a very good point
Stupid Gets Caught
Looking up a location on Google Maps to get a better idea of the area is something I often do after reading some news stories. Always figured someone somewhere would be able to use the search results to make me a suspect.
After watching CSI programs im sure I have Googled "How to dispose of a body completely" or similar just out of interest, Pretty sure my search terms would set off alarm bells despite being too lazy to commit any crime.
So thank god for VPN's, random User agent switching addons, noscript, pi-holes and all the little things you can run to not appear on a watchlist and waste the time of authorities.
From knowing years ago that they were flagging people who took certain books out of a library and to now knowing about mass surveillance post Snowden, everyone, including criminals should know what they are doing is logged and traceable.
At least everyone should know by now you don't take your mobile phone out with you to commit a crime. That situation should only happen if its spur of the moment of you are stupid.
P.S.After hearing how IPV6 wouldnt affect privacy but knowing all along it would, here is a clear case of IPV6 pointing to someone to validate the other data (being logged in to google while doing searches doesnt help either ;P). On IP4 it would have been a shared by thousands carrier grade NAT IP address that would have ended at that router.
Re: Stupid Gets Caught
Pretty sure that "carrier grade" nat would allow them to go beyond that router to the actual device, hence the "carrier grade" bit.
One can imagine Google using this itself to apply pressure on Legislators and Judicary
"We know what you Googled Last Summer".
Who needs a State Stasi when you have your own Private one?
Exactly this
Exactly this is why I use Tor browser to search the web looking for something that might be misinterpreted by some stupid LEA official.
The problem with these stupid computers is that these kind of searches are possible. And if it's feasibly LEA wants to use it because child porn and terrorism.
The Goog Don't Track Me Not Never...Uhhhhh....
I search for a paper shredder. Every website I later look at has paper shredder ads. The Goog don't track me. I search for some trabs, trainers like. For weeks and months, every website I see has a trab ad. The Goog don't track me. Every search for any item, there they are over and over, all the items I searched everywhere I go.
But the Goog don't track me. The 5G don't track me. The 4G don't track me. The Alexa don't. The Siri don't. Except, I sneeze near Alexa or Siri, and I get ads for masks, pills, inhalers and Theraflu for weeks.
But - nobody tracks me.
Ah, bullshit. Who even needs a warrant? The Goog, the Amazon, the Appple, the O2, 3, T and more. They all track me and I am nobody. So, why?
This arson ejat - he stupid as mud.
What an idiot
He should have used DuckDuckGo
Re: What an idiot
And Duck should have been installed on a burner that talked to the network through a pi-hole that in turn was attached to a public network in a city centre cafe.
He would be wearing a face mask of course. Except when he took a sip of coffee.
I'm supposed to feel good about this?
"These data demands represent less than 1 per cent of total warrants and a small fraction of the overall legal demands for user data that we currently receive"
so if this bothers me, I should take comfort they are doing over 100x what I think they are up to?
And this is for law enforcement - much like the old phone company, Google, et. al. have no trouble listening in for their own purposes.
If there was one thing this guy really should have thought of first it was a burner phone...