Unlike traditional search warrants that target a known suspect or location, keyword warrants work backward by identifying internet addresses where searches were made in a certain window of time for particular terms, such as a street address where a crime occurred or a phrase like “pipe bomb.”

Police have used the method to investigate a series of bombings in Texas, the assassination of a Brazilian politician and a fatal arson in Colorado.

It’s not a wild guess by investigators to conclude that people are using Google searches in all manner of crimes, as the company’s search engine has become the main gateway to the internet and users’ daily lives increasingly leave online traces. The potential value to investigators of the data Google collects is obvious in cases with no suspect, such as the search for Nancy Guthrie’s kidnapper.

The legal tension between the need to solve crimes quickly and the U.S. Constitution’s Fourth Amendment protections against overly broad searches was at the heart of a recent Pennsylvania Supreme Court decision that upheld the use of a reverse keyword warrant in a rape investigation.

Privacy advocates see it as giving police “unfettered access to the thoughts, feelings, concerns and secrets of countless people,” according to an amicus brief filed in the Pennsylvania appeal by the American Civil Liberties Union, the Internet Archive and several library organizations.

In response to written questions about the warrants, Google provided an emailed statement: “Our processes for handling law enforcement requests are designed to protect users’ privacy while meeting our legal obligations. We review all legal demands for legal validity, and we push back against those that are overbroad or improper, including objecting to some entirely.”

A break in the case

Pennsylvania State Police were stymied in their investigation into the violent rape of a woman in 2016 on a remote cul-de-sac outside Milton, a small community in the center of the state. With no clear leads, police obtained a warrant directing Google to disclose accounts that searched for the victim’s name or address over the week when she was attacked.

More than a year later, Google reported two searches for the woman’s address were made a few hours before the assault from a specific IP address, a numeric designation that lists where a phone or computer lives on the internet.

That led them to the home of a state prison guard named John Edward Kurtz.

Police then conducted surveillance and collected a cigarette butt he discarded that matched DNA recovered from the victim, according to court records. He confessed to the rape and attacks involving four other women over a five-year period, and was convicted in 2020. Now 51, he’s been sentenced to 59 to 280 years.

Kurtz’s attorneys argued police lacked probable cause to obtain the information and impinged on his privacy rights.

The state Supreme Court rejected those claims late last year but split on the reasons why. Three justices said Kurtz should not have expected his Google searches to be private, while three more said police had probable cause to look for anyone who searched the victim’s address before the attack. But a dissenting justice said probable cause requires more than just a “bald hunch” and guessing that a perpetrator would have used Google.

Kurtz lawyer Douglas Taglieri made the same point in a court filing, but conceded, “It was a good guess.”

Julia Skinner, a prosecutor in the case, said reverse keyword searches are much more effective when there are specific and even unusual terms that can narrow results, such as a distinctive name or an address. They are also particularly effective when crimes appear to have been planned out beforehand, she said.

“I don’t think they’re used super frequently, because what you need to target has to be so specific,” she said. There were 57 searches returned in the Kurtz case, but many of them were first responders trying to locate the home in the immediate aftermath of the crime, Skinner said.

Acting in good faith

In the similar case in Colorado, police sought the IP addresses of anyone who searched over a 15-day period for the address of a home where a deadly arson occurred. Authorities got IP addresses for 61 searches made by eight accounts, ultimately helping identify three teenage suspects.

The Colorado Supreme Court ruled in 2023 that although the keyword warrant was constitutionally defective for not specifying an “individualized probable cause,” the evidence could be used because police had acted in good faith about what was known about the law at the time.

“If dystopian problems emerge, as some fear, the courts stand ready to hear argument regarding how we should rein in law enforcement’s use of rapidly advancing technology,” the majority of Colorado justices ruled.

Courts have long permitted investigators to seek things like bank records or phone logs. However, civil liberties groups say extending those powers to online keywords turns every search user into a suspect.

It’s unclear how many keyword warrants are issued every year — Google does not break down the total number of warrants it receives by type, according to the Electronic Frontier Foundation and the Pennsylvania Association of Criminal Defense Lawyers in a January 2024 brief.

The two groups said police working on the bombings in Austin, Texas, sought anyone who searched for terms such as “low explosives” and “pipe bomb.” And in Brazil, investigators trying to solve the 2018 assassination in Rio de Janeiro of the politician Marielle Franco asked for those who searched for Franco’s name and the street where she lived. A Brazilian high court is expected to decide soon on the legality of those search disclosures.

Reverse keyword warrants are distinct from “geofence” warrants, where criminal investigators seek information about who was in a given area at a particular time. The U.S. Supreme Court said last month it will rule on that method’s constitutionality.

An index of deeply personal matters

For many people, their Google search history contains some of their most personal thoughts, from health issues and political beliefs to financial decisions and spending patterns. Google is introducing more artificial intelligence into its search engine, seemingly a way to learn even more about users.

“What could be more embarrassing,” asked University of Pennsylvania law professor and civil rights lawyer David Rudovsky, if every Google search “was now out there, gone viral?”

Google warns users personal information can be shared outside the company when it has a “good-faith belief that disclosure of the information is reasonably necessary” to respond to applicable laws, regulations, legal processes or an “enforceable government request.”

In the Kurtz case, Pennsylvania Justice David Wecht drew a distinction between Kurtz deciding to search for the victim’s name on Google and a 2018 U.S. Supreme Court decision that limited the use of broad collections of cellphone location data.

“A user who wants to keep such material private has options,” Wecht wrote. “That user does not have to click on Google.”

___

AP Technology Writer Michael Liedtke in San Francisco and writer Mauricio Savarese in Sao Paulo, Brazil, contributed.