Search Engines and Reporting Illegal Activity
By Anonymous | July 5, 2019
Search engines are one of the most ubiquitous internet services and generate some of the largest databases in the world as a result. In 2012, Google handled over 1 trillion search queries [1]. However, a certain subset of such search queries point to less benign actions, and may be important clues to help identify terrorists, child abusers, human traffickers, and illegal drug traders. Should search engines be obligated to report on the potential for such illegal activity so it can be followed up on?
First we should examine how easy this would be from a technical standpoint. To do this, I went through the search logs of a major search engine to try and find a query I had input earlier.
Figure 1: Finding a user in search data: surprisingly easy.
Within a few minutes I had my nonsensical query (Column 4), the URLs I clicked (Column 6), my rough location information (Column 11), and my IP address (Column 21) which is considering personally identifying under GDPR rules [2]. If a search company were to target for other queries like “how to make a bomb†they could quickly collect the IP addresses of potential lawbreakers and cross reference with ISP companies to figure out names and home addresses. The ease of success of this experiment indicates the technical costs of implementing a filtering and reporting system to be not be a blocking issue.
There is already some basis for the idea that search engines should be obligated to report on suspected illegal activity especially regarding child abuse. In the US, all states have mandatory reporter laws that require professionals which may be seen as trusted sources for children (such as teachers, health-care workers, and child care providers) to make a report if they suspect that a child has been abused or neglected [3]. A similar law exists for companies to report child sexual abuse, which Google used in 2014 after finding explicit photos in a scan of a user’s Gmail account [4]. The law, importantly, does not require companies to be proactive and monitor or affirmatively search for illegal content which would be easy for companies to implement [5].
Figure 2: Google already searches through some user data and is mandated to report child pornography it finds.
The main drawbacks to search engines entering the space of reporting illegal activity are the concerns over a users rights and expectations to privacy. In Gonzales v. Google Inc, the U.S government subpoenaed Google and other search engine companies for queries and URLs for a study [6]. The court ruled that forcing Google to divulge query and url data would diminish user trust in the company due to the fact that users have some expectation of privacy when using the platform. It is this expectation of privacy that keeps many users from migrating away from major search engines to smaller privacy concious alternatives.
There are also issues with false positives, where users may search terms jokingly or out of curiosity and trigger automated alerts leading to unfounded accusations. This actually happened in 2013 when a counter-terrorism unit mistakenly searched a family’s home after the husband searched “pressure cooker bomb†and “backpacks†out of curiosity at work [7]. If search engines stepped into this space, law enforcement agencies may be faced with an overwhelming number of false positive cases which would waste resources and cause bad press.
Figure 3: Searching for pressure cookers and backpacks could trigger a false positive and get your house searched.
Finally, there is the argument that searches are protected under free speech. In United States v. Gilberto Valle, the US Second Circuit Court of Appeals reversed the ruling that Valle’s Google searches, which were related to fantasizing about violent crimes, themselves constituted a crime. The court reasoned that no action was taken thus no actual crime was committed, and that Valle was free to express his fanatasies [8]. This ruling was supported by a number of First Amendment and Internet law scholars and points to search queries being protected as free speech, making it more of a potential PR disaster for search engine companies to be handing it off to law enforcement or the government.
Privacy expectations and laws surrounding search engines are still a hotly debated and contested area today. The technologies to allow search engines to find and report suspected cases of illegality are easy to implement, and there is some movement in the legal sphere to cover cases like child abuse where it is clear that search engines are ethically obligated to act. On the other side, there are genuine privacy and trust concerns, false positive issues, and legal battles over the coverage of free speech that will probably keep search engine companies sidelined. Most likely, these companies will wait for the legal contests to be settled before deciding to move into any reporting of potential criminal activities unless explicitly forced to by law, so it up to all of us to decide whether the tradeoff is worth it or not.
References
[1] https://archive.google.com/zeitgeist/2012/#the-world
[2] https://eugdprcompliant.com/personal-data/
[3] https://www.childwelfare.gov/pubPDFs/manda.pdf
[4] https://mashable.com/2014/08/04/google-gmail-child-porn-case/
[5] https://www.law.cornell.edu/uscode/text/18/2258A
[6] https://scholarship.law.berkeley.edu/cgi/viewcontent.cgi?article=1689&context=btlj
[7] https://www.theguardian.com/commentisfree/2013/aug/01/government-tracking-google-searches
[8] https://www.eff.org/cases/united-states-v-gilberto-valle