How cops can get your private online data

https://www.eff.org/deeplinks/2025/06/how-cops-can-get-your-private-online-data

by jamesgill • 8 months ago

298 66 8 months ago

eff.org

tailspin2019• 8 months ago

Needs the “How” adding back to the beginning of the title

jamesgill2• 8 months ago

HN truncated it, unfortunately.

layer82• 8 months ago

You can edit the title after submission, for some limited period of time. The HN auto-rewrite rules are only applied upon submission, not when editing the title subsequently. It's recommended to always check the title immediately after submission, and correct it if the auto-rewrite did the wrong thing.

dang• 8 months ago

Sorry about that! Recapitated.

suprnurd• 8 months ago

I've never even heard of a "super warrant"... until this article.

psunavy03• 8 months ago

Sounds like just a layman's way of describing the enhanced Fourth Amendment restrictions case law has placed on live wiretaps.

YeahThisIsMe• 8 months ago

I hope they like porn, because I do.

asacrowflies3• 8 months ago

The amount of LEO that are scarred everyday by weird fury porn is my comfort in this life .

cess113• 8 months ago

Why do you think they're scarred by it?

Here's a recent news article about swedish politicians planning to make our cops synthesise CSAM, because they supposedly need it:

https://www.aftonbladet.se/nyheter/a/jQV959/polisens-nya-ver...

hammock• 8 months ago

Where does search history fall in the table?

noman-land2• 8 months ago

Search history is fair game with no warrant or notification requirements.

https://en.wikipedia.org/wiki/Third-party_doctrine

rc_mob2• 8 months ago

I just rotate my searches among 5 search engines now. They can never get the full picture lol

shevy-java• 8 months ago

I am not sure I have understood this fully.

Should not a query towards some provider about the online-data about some citizen be protected by the first amendment? In other words, if a search warrant would be required to enter a house, unless invited, why would this not apply to online data stored somewhere? There are only very few situations where a warrantless search may be conducted, e. g. such as when driving a car and a cop has an objective and reasonable suspicion. When the court systems is no longer involved, it then means that people objectively have lost certain basic rights, freedoms and safeguards against any governmental overreach.

tempfile• 8 months ago

The first amendment is not related. I think you are talking about the fourth amendment (protection from unreasonable searches and seizures). In this case the online data is stored by the provider, and there is no private location for which to obtain a warrant. The provider's database is not your private domicile. Legally, it is no different from a cop asking a store for footage from their cameras.

Of course, the claim is that it should not be considered this way, because it is bad for privacy. But the reasoning that led here is pretty comprehensible.

serbuvlad• 8 months ago

Given the analogy, I assume the provider can refuse to disclose information except under a warrant.

And that the client and provider can sign a contract forbidding the provider to disclose the information except under a warrant.

bee_rider2• 8 months ago

Legally, it is probably the case that the laws are just not written to satisfy those of us who want privacy, right? The “ubiquitous privatized surveillance” industry came about after our government lost the institutional capability to pass new laws that help people (around the turn of the century).

noman-land2• 8 months ago

The courts view service providers as "third parties" and when you knowingly give them your data, the courts believe that it is no longer yours and is thereby not protected by the Fourth Amendment.

https://en.wikipedia.org/wiki/Third-party_doctrine

gowld2• 8 months ago

The "Third Party doctrine" is a blatantly unconstitutional power grab.

It was originally controversially applied to a person's transactions with a bank, and then absurdly extended to include anything anyone holds for someone else, even someone who holding it for the purpose of providing secure storage.

LatteLazy• 8 months ago

Broadly speaking if the data is on someone else’s computer, it’s in their “house” for the purpose of the search.

Cracking open your phone might require a warrant. But basically every byte of data on it has come from your ISP and is backed up to Apple\Google etc. and those companies will let me search their computers for your data no questions asked (or for a nominal fee).

That’s how you sidestep the 4th amendment when it comes to tech in the modern age.

gowld2• 8 months ago

"Sidestep" : "violate" :: "po-tay-to" : "po-tah-to"

OkayPhysicist• 8 months ago

The crux of the issue is that, just like how you're free (if extremely ill-advised) to invite a cop to search your car or home without requiring a warrant from them, the companies are letting the cops search "their" information (about you) freely.

The companies are entirely within their rights to say "fuck off and get a warrant, you ghouls", but from their perspective, it's a lot easier to just hand it over.

travisgriggs• 8 months ago

Not just easier. But more profitable/lucrative, indirectly, and sometimes disturbingly, pretty directly.

zerocrates• 8 months ago

They aren't always entirely within their rights to refuse to give up your data: the third party doctrine doesn't transfer your expectation of privacy to the third party holding your data, it says that neither you nor the third party has an expectation of privacy for that information. Subpoenas and court orders and other process short of a warrant can compel disclosure of this "third party" data.

This is why there's a patchwork of statutes requiring Fourth Amendment ish processes for things like wiretaps and emails.

shortrounddev2• 8 months ago

In other words, if a search warrant would be required to enter a house, unless invited, why would this not apply to online data stored somewhere?

The government has long considered the 4th amendment to be a major hindrance. The only reason that they even seek a warrant to search your home or belongings is because the 4th amendment explicitly says

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated

I don't know the legal justification for excluding things like email metadata, but I imagine it goes like this:

Your emails are not in your house, on your person, or are papers or effects. They are numbers stored in someone else's computer, and we only need the consent of someone else to get that information, which they will provide because they don't want to get on our bad side.

But the realistic reasoning is: the 4th amendment is a pain in the ass to law enforcement and they'd much rather it was never written at all, so they will cast whatever legal incantations are required to put a wall between your rights and your data

jeffbee• 8 months ago

I don't know why the article says the recipient of a search warrant for stored communications can't challenge it prior to disclosure. They can, and often do, especially on the grounds of lack of particularity or undue burden. As an example, Google claims that of all search warrants received by them for user data in 2024, they disclosed data for 90% of them, not 100%.

I also feel like the article generally misrepresents the entire American legal system, since the system itself does not really prevent the cops from doing the bad things, but instead tries to say that the result of the bad thing cannot be used as evidence. So it really isn't structured to ensure that the cops can't get your voice mails. It is structured such that if the cops improperly accessed your voice mails that can't be used against you in court.

w10-1• 8 months ago

It is structured such that if the cops improperly accessed your voice mails that can't be used against you in court

Yes, it's true that illegally obtained evidence can be excluded.

But warrants -- prior authorization -- are required for searches. The law is structured to prevent both use and gathering if improper. (Whether warrant practice is effective at prevention is another question.)

0manrho• 8 months ago

But warrants -- prior authorization -- are required for searches.

Required in what sense? In that they're unable to perform those searches by some mechanism preventing them from doing it outright? Or just that there are consequences if they do?

If the latter, we immediately jump into "It's only illegal if I get caught" territory.

cess113• 8 months ago

News like these cause "I Really Like the Cops" to start playing in the back of my head.

https://www.youtube.com/watch?v=sX_EHeCbMqc

treebeard9012• 8 months ago

About a decade ago, there was outrage over just having access to metadata. Since then, the backdoor access has expanded. Now they have moved past metadata and on to content of your messages.

The public is largely unaware of just how much control third party governments give law enforcement. They can manipulate your search results to hide information from you or promote certain things they want to be presented to someone they are looking into.

If the historical basis of this access is being able to read the list of library books you check out, now it has expanded to controlling which books are recommended to you and they have the ability to control the content of the media you receive.

A common dismissal of this issue is that nothing can be accessed without court orders or a subpoena. It's important to remember that this is only really true if they intend to directly use the information obtained from you in a court proceeding. Often times it is about information gathering on a target that is not meant to be used in court. Even then, they have endless ways of using a form of parallel construction to hide the source of the information. This also extends to data brokers, which have to work with the Government to continue operating. The same is true for app developers who want their apps to be listed on app stores. Or device manufactures that want the ability to sell their products and pass FCC certifications...

In more serious cases, it extends to the concept of your identity itself. Law enforcement often will not hold itself accountable for violating the laws or your rights. Identity theft tied to online actions against you is not out of the question for them either. When it is taken this far, good luck reporting it and having it resolved.

The stuff they can do with the backdoors in YouTube, the advertising system, cloud document storage (LE can view your live work in cloud storage like Google Docs, etc... Imagine working on a lawsuit against someone watching you formulate your legal arguments)... It just goes on and on...

End rant

NickC25• 8 months ago

Law enforcement often will not hold itself accountable for violating the laws or your rights

How naive and idealistic to write "often" in that sentence. Law enforcement will NEVER hold itself accountable. Law enforcement has been given carte blanche to violate every constitutional right Americans have. Policing at all levels has been corrupted by overzealous politicians and lobbyists of all shades of blue and red.

treebeard9012• 8 months ago

I was trying to be generous. I stand corrected.

actionfromafar• 8 months ago

Never isn't exactly right, IMHO. Somewhere between "seldom" and "never".

notepad0x90• 8 months ago

The title should begin with "At minimum", I hope cops having access isn't a surprise, what might surprise is how other parties can too. In some cases, cops can't legally access the data but 3rd parties can, so cops get it through third party brokers.

Small example: Accurately correlating a phone number or IP address to the current real-time physical address.

ekjhgkejhgk4• 8 months ago

On topic, collaborative docs with end to end encryption https://cryptpad.fr/ I use the Kanban app, it's so snappy. In comparison Trello is a bloated PoS.

Also on topic, the XMPP protocl is federated and supports E2E encryption via OMEMO aka "the signal protocol". Go create an account and get your friends into it. I use Dino on Debian and Conversations on Android. These two clients support all the "modern" features that whatsapp does, including audo and video calls, in addition to niceties like public channels where you can meet new people outside your circle of friends. For providers, find one on https://providers.xmpp.net/. All of this is free software, (although in the case of XMPP being federated you can't guarantee that your messages won't be routed through proprietary servers.)

Not affiliated with either, I just LOVE those two.

ekjhgkejhgk4• 8 months ago

There is no “cloud,” just someone else's computer

The EFF are quoting Stallman now? I wonder if they're slowly coming to realize that yes, once again, Stallman was right.

stonogo• 8 months ago

I don't think that meme originated with Stallman.

integralid• 8 months ago

Is there any reason to suspect EFF believes stallman was not right? I remember they opposed his reelection to FSF in 2021, but that was about his alleged misconduct, not his views on software (in fact they said they believe in FAF mission importance)

ekjhgkejhgk4• 8 months ago

Nah, just gossip. I remember an interview with Linus Torvals where he expressed that he thought that some elements at FSF were sleezy (he didn't say or insinuate Stallman) or maybe dishonest, I don't remember exactly, due to GPLv3. He said "I understand what they're trying to do, but it should be a different license, not a new version of the same license". And then he finished with the comment "If you want to support I'd send my money to the EFF instead if I were you", which gave me the impression that there was some tension between the EFF and the FSF. That's it.

But Stallman WAS right about basically everything though.

wiredpancake• 8 months ago

Stallman was right about a number of free and open source software things, although he is a disgusting person for his comments around the Jeffery Epstien situation and his views on minors...

ekjhgkejhgk4• 8 months ago

I suggest that you search and read the actual things he said in the "stallman report". Not the summaries from the author.

asacrowflies3• 8 months ago

I love stalman and these blatant bullying tactics with obvious lies and bullshit meant to have an emotional reaction short circuit any actual rational read. The stalman controversy is the text book example of bullying an autistic person with semantics. Seen the same shit since grade school.

lunias• 8 months ago

And I'm here for it. "The cloud" is one of the most obvious, misleading rebrands of all time.

ComputerGuru• 8 months ago

There is only a single sentence about how this works with US-resident data and foreign intelligence or LE apparatus.

I'm under no illusion about the willingness of most corporations to hand over everything from subscriber info to content on a dime, but does anyone have any experience with specifics?

Especially pertinent to my question: what is to stop a member of a (non-sanctioned) foreign country (let's say not five eyes) from requesting data on a user of an American service "pursuant to a foreign investigation" (whatever that means)? Does it make a difference in practice if the user is an American resident, a resident of said foreign country, or a resident of a 3rd country altogether?

Example: a dissident launches a website and employs a registrar-provided domain privacy shield (these have notoriously vague guarantees of actual privacy). A "law enforcement officer" from country Xyz "subpoenas" the .com or .tld registry (hosted in the USA) and requests information about the owner of the domain. What happens next (in practice, not in theory)? Do some normally go through US intermediaries? Can American companies just refuse (consider both if the registrar/company has or doesn't have a physical presence in the foreign country in question)?

(Not exactly the same situation, but I was surprised that the FBI request to subpoena the identity of the hero behind the archive.tld service made the news [0]. I a) thought these were very much normal order-of-business things that would happen quietly behind the scenes, b) expected companies would roll over on this info without even a subpoena given the loose guarantees most registrars make about privacy, c) made me wonder if the specific registrars were selected for related reasons, and d) wondered about when and where it makes sense to avoid registering a domain with you real identity even if you use a privacy shield service. Also, I think most companies/registrars wouldn't even bother to notify their customers/users, regardless of whether a gag order was in place or not.)

[0] https://arstechnica.com/tech-policy/2025/11/fbi-subpoena-tri...

sans_souse• 8 months ago

Posted this last month, definitely an informative set of data

https://transparencyreport.google.com/user-data/overview?use...

husamia• 8 months ago

Data brokers are a legal surveillance loophole: Police can simply buy your private data from commercial data brokers—no warrant, no court order, no oversight. This massive, unregulated market lets agencies sidestep every traditional privacy protection. “Super warrants” exist for real-time content: If cops want to intercept your messages as they’re sent, they must meet the highest legal bar—probable cause, exhaustion of alternatives, and strict minimization rules. This requirement is stricter than for stored data, yet most users have never heard of it. Gag orders silence providers—and you: Law enforcement can force tech companies to keep data requests secret, blocking them from notifying you. These open-ended non-disclosure orders erode First Amendment rights and hide the true scale of surveillance from public view.

phendrenad2• 8 months ago

Of course, lower bar means lower information. Nobody is getting your private text messages via data broker. Period.

How cops can get your private online data

Related Stories