How Cops Can Get Your Private Online Data

Needs the “How” adding back to the beginning of the title

I've never even heard of a "super warrant"... until this article.

I hope they like porn, because I do.

Where does search history fall in the table?

I am not sure I have understood this fully.

Should not a query towards some provider about the online-data about some citizen be protected by the first amendment? In other words, if a search warrant would be required to enter a house, unless invited, why would this not apply to online data stored somewhere? There are only very few situations where a warrantless search may be conducted, e. g. such as when driving a car and a cop has an objective and reasonable suspicion. When the court systems is no longer involved, it then means that people objectively have lost certain basic rights, freedoms and safeguards against any governmental overreach.

I don't know why the article says the recipient of a search warrant for stored communications can't challenge it prior to disclosure. They can, and often do, especially on the grounds of lack of particularity or undue burden. As an example, Google claims that of all search warrants received by them for user data in 2024, they disclosed data for 90% of them, not 100%.

I also feel like the article generally misrepresents the entire American legal system, since the system itself does not really prevent the cops from doing the bad things, but instead tries to say that the result of the bad thing cannot be used as evidence. So it really isn't structured to ensure that the cops can't get your voice mails. It is structured such that if the cops improperly accessed your voice mails that can't be used against you in court.

About a decade ago, there was outrage over just having access to metadata. Since then, the backdoor access has expanded. Now they have moved past metadata and on to content of your messages.

The public is largely unaware of just how much control third party governments give law enforcement. They can manipulate your search results to hide information from you or promote certain things they want to be presented to someone they are looking into.

If the historical basis of this access is being able to read the list of library books you check out, now it has expanded to controlling which books are recommended to you and they have the ability to control the content of the media you receive.

A common dismissal of this issue is that nothing can be accessed without court orders or a subpoena. It's important to remember that this is only really true if they intend to directly use the information obtained from you in a court proceeding. Often times it is about information gathering on a target that is not meant to be used in court. Even then, they have endless ways of using a form of parallel construction to hide the source of the information. This also extends to data brokers, which have to work with the Government to continue operating. The same is true for app developers who want their apps to be listed on app stores. Or device manufactures that want the ability to sell their products and pass FCC certifications...

In more serious cases, it extends to the concept of your identity itself. Law enforcement often will not hold itself accountable for violating the laws or your rights. Identity theft tied to online actions against you is not out of the question for them either. When it is taken this far, good luck reporting it and having it resolved.

The stuff they can do with the backdoors in YouTube, the advertising system, cloud document storage (LE can view your live work in cloud storage like Google Docs, etc... Imagine working on a lawsuit against someone watching you formulate your legal arguments)... It just goes on and on...

End rant

> There is no “cloud,” just someone else's computer

The EFF are quoting Stallman now? I wonder if they're slowly coming to realize that yes, once again, Stallman was right.

Data brokers are a legal surveillance loophole: Police can simply buy your private data from commercial data brokers—no warrant, no court order, no oversight. This massive, unregulated market lets agencies sidestep every traditional privacy protection. “Super warrants” exist for real-time content: If cops want to intercept your messages as they’re sent, they must meet the highest legal bar—probable cause, exhaustion of alternatives, and strict minimization rules. This requirement is stricter than for stored data, yet most users have never heard of it. Gag orders silence providers—and you: Law enforcement can force tech companies to keep data requests secret, blocking them from notifying you. These open-ended non-disclosure orders erode First Amendment rights and hide the true scale of surveillance from public view.

There is only a single sentence about how this works with US-resident data and foreign intelligence or LE apparatus.

I'm under no illusion about the willingness of most corporations to hand over everything from subscriber info to content on a dime, but does anyone have any experience with specifics?

Especially pertinent to my question: what is to stop a member of a (non-sanctioned) foreign country (let's say not five eyes) from requesting data on a user of an American service "pursuant to a foreign investigation" (whatever that means)? Does it make a difference in practice if the user is an American resident, a resident of said foreign country, or a resident of a 3rd country altogether?

Example: a dissident launches a website and employs a registrar-provided domain privacy shield (these have notoriously vague guarantees of actual privacy). A "law enforcement officer" from country Xyz "subpoenas" the .com or .tld registry (hosted in the USA) and requests information about the owner of the domain. What happens next (in practice, not in theory)? Do some normally go through US intermediaries? Can American companies just refuse (consider both if the registrar/company has or doesn't have a physical presence in the foreign country in question)?

(Not exactly the same situation, but I was surprised that the FBI request to subpoena the identity of the hero behind the archive.tld service made the news [0]. I a) thought these were very much normal order-of-business things that would happen quietly behind the scenes, b) expected companies would roll over on this info without even a subpoena given the loose guarantees most registrars make about privacy, c) made me wonder if the specific registrars were selected for related reasons, and d) wondered about when and where it makes sense to avoid registering a domain with you real identity even if you use a privacy shield service. Also, I think most companies/registrars wouldn't even bother to notify their customers/users, regardless of whether a gag order was in place or not.)

[0]: https://arstechnica.com/tech-policy/2025/11/fbi-subpoena-tri...

Posted this last month, definitely an informative set of data

https://transparencyreport.google.com/user-data/overview?use...

The title should begin with "At minimum", I hope cops having access isn't a surprise, what might surprise is how other parties can too. In some cases, cops can't legally access the data but 3rd parties can, so cops get it through third party brokers.

Small example: Accurately correlating a phone number or IP address to the current real-time physical address.

On topic, collaborative docs with end to end encryption https://cryptpad.fr/ I use the Kanban app, it's so snappy. In comparison Trello is a bloated PoS.

Also on topic, the XMPP protocl is federated and supports E2E encryption via OMEMO aka "the signal protocol". Go create an account and get your friends into it. I use Dino on Debian and Conversations on Android. These two clients support all the "modern" features that whatsapp does, including audo and video calls, in addition to niceties like public channels where you can meet new people outside your circle of friends. For providers, find one on https://providers.xmpp.net/. All of this is free software, (although in the case of XMPP being federated you can't guarantee that your messages won't be routed through proprietary servers.)

Not affiliated with either, I just LOVE those two.

News like these cause "I Really Like the Cops" to start playing in the back of my head.

https://www.youtube.com/watch?v=sX_EHeCbMqc