In an almost unprecedented move, a small town judge in Edina, Minnesota (population
< 50,000) has authorized a warrant requiring Google to disclose any and all user or subscriber information for anybody who searched for the search term 'Douglas {last name}'. While Judge Gary Larson is not the Gary Larson of The Far Side fame, it does seem that this could be a situation straight out of that comic's universe.
The facts of this case are that someone – the someone that the Edina police department is trying to identify – knew the name and other personal information of Douglas (last name unknown as it has been redacted in the only public version of the warrant), of Edina, MN, and managed to convince Douglas’ bank, the Spire Credit Union, to initiate a wire transfer into the fraudster’s bank account.
They accomplished this by searching for Douglas’ full name on line, and grabbing an image that came up as a result of that search. While, as it turns out, the image was not actually of Douglas, it was apparently a close enough match. They took the image, used it create a fake passport in Douglas’ name, and then faxed the fake passport to the credit union to show the credit union that it was really Douglas requesting the transfer.
It’s worth noting that they had enough personally identifiable information (PII) for Douglas, including his home telephone number, that they were able to credibly pretend to be him. They even spoofed his home telephone number when they faxed the fake passport to the credit union, so that it really looked like it was coming from him. The odds are very good that they acquired this information from a data breach similar to the Yahoo data breach, if not from that breach itself.
The credit union then transferred $28,500 to the perpetrator’s bank account with Bank of America.
In investigating this case, the Edina PD noted that when searching either Yahoo or Bing for the victim’s name, no images turned up, but while searching Google the exact image used on the fake passport turned up as part of the search results. Thus they concluded that the perpetrator likely used Google to search for the image that they used. This led the Edina PD to serve an administrative warrant (this is a warrant issued directly by the police department or a lawyer, not through the court) on Google, which Google rejected, at which point the Edina PD requested a court-ordered search warrant, which the court granted.
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
Now, our readers are almost certain to pick up on the fact, disclosed in the below affidavit upon which the warrant was granted, that, knowing that the money was transferred to a bank account at Bank of America, the Edina police could, and should, have asked Bank of America to turn over the details as to who owns the account that received the ill-gotten gains. We can only assume that they have done this in addition to making the demands on Google.
But we digress. The point of our writing this up is that a judge has ordered Google to reveal everyone who searched on for that name during the 5-week period starting December 1st, 2016.
We can only assume that Google is going to fight this and, in fact, Google has suggested as much in an email to arsTECHNICA, in which they say “We aren’t able to comment on specific cases, but we will always push back when we receive excessively broad requests for data about our users.”
We’ll keep an eye on this. In the meantime, here is the full text of the affidavit which convinced Judge Larson to issue the search warrant for the Google data.
Full Text of Affidavit Used to Get Judge Gary Larson to Order Google to Hand Over Data of Everybody who Searched for Douglas (Last Name) of Edina, Minnesota
I, David Lindman, a licensed peace officer of the State of Minnesota, make an application to this
Court for a warrant to search the premises described below for the property and thing(s) described below.
I know the content of this application and affirm the statements contain in this
application are true based on my own knowledge, or are believed to be true.
I believe that the following described property and thing(s), namely:
Any/all user or subscriber information related to the Google searches of:
– Douglas (middle initial) (last name)
– Douglas (middle initial) (last name)
– Douglas (middle name) (last name)
– Douglas (last name)
For the timeframe of December 1st, 2016 through January 7th, 2017
The specific date/time the searches took place
The user/subscriber information to include, but not limited to: name(s), address(es),
telephone number(s), dates of birth, social security numbers, email addresses, payment
information, account information, IP addresses, and MAC addresses of the person(s) who
request/completed the search
is or are at the premises described as:
Custodian of Records Google Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043
Fax: 650-249-3429
located in city or township of Edina, County of Hennepin, State of Minnesota
I apply for a search warrant on the following grounds:
– The property or things above-described constitute evidence which tends to show a crime
has been committed or tends to show that a particular person has committed a crime.
The facts establishing the grounds for issuance of a search warrant are as follows:
The facts tending to establish the foregoing grounds for issuance of a search warrant are as follows:
Your Affiant, Edina Police Detective David Lindman, is a licensed State of Minnesota Peace
Officer with 16 years of experience, to include 5 years on the Minnesota Financial Crimes
Task Force as a full time Detective. Your affiant has received significant training in crimes
related to check fraud, financial transaction card fraud, identity theft, and theft by swindle.
Your affiant has written and executed many warrants related to financial crime. In that
capacity, your affiant has reviewed the relevant documents and believe the following to be
true and corret:
On January 7th, 2017 the victims Douglas (last name) and J(first name) (last name) reported that a
person(s) had stolen $28,500.00 from a line of credit associated with their Spire Credit Union
account ending in (last 4 digits). The theft took place on or about January 6th, 2017.
The Edina Police Department began to investigate the fraud, where investigators have
learned, or have reason to believe, that the following took place:
– The theft involved the suspect(s) transferring money from the victims’ line of credit into
the victim’s savings account. The money was then wired out of victims’ savings account
to an account at Bank of America.
– The suspect(s) provided, via phone or electronic means, Spire Credit Union the identity
information for Douglas (last name), to include name, date of birth, and social security
number so that the transaction could be completed. Furthermore, the suspect(s) faxed a
forged/fake United States Passport in the name of Douglas (last name) to Spire Credit Union.
The fax purported to be from the victims’ home telephone number, however, this
appeared to have been “spoofed”.
– The picture on the forged/fake passport is not Douglas (last name), however, it does appear
to be a picture of someone near the same age.
– A Google image search of “Douglas (middle initial) (last name)” displayed several image results to include
the photograph used on the forged/fake passport. An image search using Yahoo and
Bing search engines displayed multiple image results as well, however, it did not display
this photograph as one of the results. Based on this, your affiant believes that the search
term of “Douglas (middle initial) (last name)” is unique, and even more unique when used in the Google
search engine.
– A Hennepin County Administrative Subpoena was sent to Google Inc. requesting
subscriber information for anyone who had performed a Google search for “Douglas (middle initial)
(last name)” to include other various combinations of this name. Google Inc. rejected the
administrative subpoena request as they concluded that this request had to do with
content. Thought Google Inc.’s rejection of the administrative subpoena is arguable, your
affiant is applying for this search warrant so that the investigation of this case does not
stall.
Based on your affiant (sic) training and experience, your affiant knows that Internet Service
Providers and/or internet based businesses collect, save and/or store data that could include:
– Subscriber information, to include names, dates of birth, email addresses, addresses,
social security number, telephone numbers, account numbers, and more of people
utilizing their service
– IP Addresses and/or MAC Addresses of persons/computers/connections utilizing their
services
– Dates and times that users view/user their services
– Information related to the content the user is viewing/using
Your affiant requests that the court grant this search warrant for Google Inc. so that the
following information can be obtained:
Any/all user or subscriber information related to the Google searches of:
– Douglas (middle initial) (last name)
– Douglas (middle initial) (last name)
– Douglas (middle name) (last name)
– Douglas (last name)
– For the timeframe of December 1st, 2016 thru (sic) January 7th, 2017
– The specific date/time the searches took place
– The user/subscriber information to include, but not limited to: name(s), address(es),
telephone number(s), dates of birth, social security numbers, email addresses, payment
information, account information, IP addresses, and MAC addresses of the person(s)
who requested/completed the search
Based on the aforementioned information, your affiant has reason to believe that the
suspect(s) used the Google search engine to obtain a photograph that they believed to
be was (sic) the victim. By obtaining information related to who searched for the victim’s name
and this photograph, your affiant, and other investigators, can use the information to assist
with identifying/confirming the suspect(s).
Google Inc. accepts and recognizes search warrants from Hennepin County District Court.
Additionally, Google Inc. has set up a law enforcement portal website so that legal process,
to include search warrants, can be served on them electronically.
(End of Page)
I, David Lindman, a licensed peace officer of the State of Minnesota, make an application to this
Court for a warrant to search the premises described below for the property and thing(s) described below.
I know the content of this application and affirm the statements contain in this
application are true based on my own knowledge, or are believed to be true.
I believe that the following described property and thing(s), namely:
Any/all user or subscriber information related to the Google searches of:
– Douglas (middle initial) (last name)
– Douglas (middle initial) (last name)
– Douglas (middle name) (last name)
– Douglas (last name)
For the timeframe of December 1st, 2016 through January 7th, 2017
The specific date/time the searches took place
The user/subscriber information to include, but not limited to: name(s), address(es),
telephone number(s), dates of birth, social security numbers, email addresses, payment
information, account information, IP addresses, and MAC addresses of the person(s) who
request/completed the search
is or are at the premises described as:
Custodian of Records Google Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043
Fax: 650-249-3429
located in city or township of Edina, County of Hennepin, State of Minnesota
I apply for a search warrant on the following grounds:
– The property or things above-described constitute evidence which tends to show a crime
has been committed or tends to show that a particular person has committed a crime.
The facts establishing the grounds for issuance of a search warrant are as follows:
The facts tending to establish the foregoing grounds for issuance of a search warrant are as follows:
Your Affiant, Edina Police Detective David Lindman, is a licensed State of Minnesota Peace
Officer with 16 years of experience, to include 5 years on the Minnesota Financial Crimes
Task Force as a full time Detective. Your affiant has received significant training in crimes
related to check fraud, financial transaction card fraud, identity theft, and theft by swindle.
Your affiant has written and executed many warrants related to financial crime. In that
capacity, your affiant has reviewed the relevant documents and believe the following to be
true and corret:
On January 7th, 2017 the victims Douglas (last name) and J(first name) (last name) reported that a
person(s) had stolen $28,500.00 from a line of credit associated with their Spire Credit Union
account ending in (last 4 digits). The theft took place on or about January 6th, 2017.
The Edina Police Department began to investigate the fraud, where investigators have
learned, or have reason to believe, that the following took place:
– The theft involved the suspect(s) transferring money from the victims’ line of credit into
the victim’s savings account. The money was then wired out of victims’ savings account
to an account at Bank of America.
– The suspect(s) provided, via phone or electronic means, Spire Credit Union the identity
information for Douglas (last name), to include name, date of birth, and social security
number so that the transaction could be completed. Furthermore, the suspect(s) faxed a
forged/fake United States Passport in the name of Douglas (last name) to Spire Credit Union.
The fax purported to be from the victims’ home telephone number, however, this
appeared to have been “spoofed”.
– The picture on the forged/fake passport is not Douglas (last name), however, it does appear
to be a picture of someone near the same age.
– A Google image search of “Douglas (middle initial) (last name)” displayed several image results to include
the photograph used on the forged/fake passport. An image search using Yahoo and
Bing search engines displayed multiple image results as well, however, it did not display
this photograph as one of the results. Based on this, your affiant believes that the search
term of “Douglas (middle initial) (last name)” is unique, and even more unique when used in the Google
search engine.
– A Hennepin County Administrative Subpoena was sent to Google Inc. requesting
subscriber information for anyone who had performed a Google search for “Douglas (middle initial)
(last name)” to include other various combinations of this name. Google Inc. rejected the
administrative subpoena request as they concluded that this request had to do with
content. Thought Google Inc.’s rejection of the administrative subpoena is arguable, your
affiant is applying for this search warrant so that the investigation of this case does not
stall.
Based on your affiant (sic) training and experience, your affiant knows that Internet Service
Providers and/or internet based businesses collect, save and/or store data that could include:
– Subscriber information, to include names, dates of birth, email addresses, addresses,
social security number, telephone numbers, account numbers, and more of people
utilizing their service
– IP Addresses and/or MAC Addresses of persons/computers/connections utilizing their
services
– Dates and times that users view/user their services
– Information related to the content the user is viewing/using
Your affiant requests that the court grant this search warrant for Google Inc. so that the
following information can be obtained:
Any/all user or subscriber information related to the Google searches of:
– Douglas (middle initial) (last name)
– Douglas (middle initial) (last name)
– Douglas (middle name) (last name)
– Douglas (last name)
– For the timeframe of December 1st, 2016 thru (sic) January 7th, 2017
– The specific date/time the searches took place
– The user/subscriber information to include, but not limited to: name(s), address(es),
telephone number(s), dates of birth, social security numbers, email addresses, payment
information, account information, IP addresses, and MAC addresses of the person(s)
who requested/completed the search
Based on the aforementioned information, your affiant has reason to believe that the
suspect(s) used the Google search engine to obtain a photograph that they believed to
be was (sic) the victim. By obtaining information related to who searched for the victim’s name
and this photograph, your affiant, and other investigators, can use the information to assist
with identifying/confirming the suspect(s).
Google Inc. accepts and recognizes search warrants from Hennepin County District Court.
Additionally, Google Inc. has set up a law enforcement portal website so that legal process,
to include search warrants, can be served on them electronically.
(End of Page)
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
Google SHOULD comply with the search warrant. It is a legitimate request for a legitimate reason.
This opinion should apply to ALL legitimate search warranted requests.