Google Reaches Agreement With DOJ Over Compliance With Subpoenas, Search Warrants

The logo for Google LLC is seen at the Google Store Chelsea in New York City, Nov. 17, 2021. Andrew Kelly/Reuters

Tech giant Google has reached a stipulated agreement with the Department of Justice (DOJ) promising to reform and upgrade its legal process compliance program after it allegedly lost federal data that was being sought by investigators in 2016.

In a press release, the DOJ said that under the “first-of-its-kind resolution,” Alphabet Inc.’s Google will improve its legal process compliance program, which responds to legal demands such as subpoenas and search warrants while also safeguarding users’ privacy and limiting government access to user data, according to Google (pdf).

The program will be updated and reformed to ensure “timely and complete responses to legal process such as subpoenas and search warrants, as required under the Stored Communications Act (SCA) and other applicable legal authorities,” the DOJ said.

Google will also ensure it maintains sufficient compliance staff numbers to ensure the newly improved program runs smoothly and will “allocate engineering resources to support legal process compliance.”

A third-party Independent Compliance Professional will also monitor the tech giant to ensure it fulfills its legal obligations, the DOJ said.

The agreement comes following a 2016 search warrant that was obtained by the United States in California for data held at Google. The data, according to the DOJ, related to an investigation into cryptocurrency exchange BTC-e, which was indicted in 2017 for alleged money laundering.

The warrant was issued under the Stored Communications Act (SCA), under which tech companies such as Google are compelled to disclose stored customer communications when served with a warrant signed by a judge and supported by probable cause.

However, the U.S. Court of Appeals for the Second Circuit later ruled that the search warrants issued under the SCA did not cover data stored outside of the United States, and thus Google “halted execution of the search warrant and made rolling productions containing only information it could confirm was stored in the United States,” because its data preservation tools at the time stored data in the United States, according to the DOJ.

‘Ensure Public Safety and Bring Offenders to Justice’

In 2018, Congress clarified the SCA did cover data that U.S. providers store overseas, but in the meantime, data responsive to the 2016 warrant was lost.

Under Tuesday’s agreement, Google has also committed to implementing procedures that will ensure it responds to legal processes in a timely manner and to “generate a compliance timeliness record for missed deadlines, which will be made available to the government upon request.”

The California-headquartered company will also “develop and maintain needed tools to retrieve data in response to legal process” and “develop plans for legal process responses corresponding to new product launches,” the DOJ said.

It will also create periodic reports and updates regarding its enhanced Legal Process Compliance Program which it will hand over to the government, the Google Compliance Steering Committee, and the Audit and Compliance Committee of the Alphabet Board of Directors.

“The Department is committed to ensuring that electronic communications providers comply with court orders to protect and facilitate criminal investigations,” said Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division. “This agreement demonstrates the Department’s resolve in ensuring that technology companies, such as Google, provide prompt and complete responses to legal process to ensure public safety and bring offenders to justice.”

Google on Tuesday estimated that it has already spent over $90 million on “additional resources, systems, and staffing to implement legal process compliance program improvements” and said it will maintain its “lawful protections of user data.”

The tech giant noted that the agreement does not provide the United States access to Google user data.

“Google has a long track record of protecting our users’ privacy, including pushing back against overbroad government demands for user data, and this agreement in no way changes our ability or our commitment to continue doing so,” an unnamed Google representative told The Wall Street Journal.