Right to Privacy in Internet Search Queries and IP Address; Probable Cause to Support Search Warrant of Google Search Records
Commonwealth v. Kurtz, 294 A.3d 509 (Pa. Super. 2023), allocatur granted Oct. 30, 2023, appeal dockets 98 – 101 MAP 2023
In this case, the Pennsylvania Supreme Court will consider two issues of first impression: (1) whether an individual has a reasonable expectation of privacy in their Google searches and IP address, and (2) whether there was sufficient probable cause to support a search warrant to Google, where the suspect was unknown and no evidence was presented establishing that Google was used in the planning or commission of a crime.
John Edward Kurtz was convicted of numerous rape and kidnapping offenses involving five victims. Superior Court summarized the factual history leading up to Kurtz’s arrest as follows:
On the evening of July 19, 2016, K.M. went to sleep in her home in Northumberland County after her husband left for his overnight shift at a correctional facility. When K.M. was awakened by her barking dogs and left her bedroom to investigate, a man jumped out of one of her empty bedrooms, tied her hands behind her back with zip ties, blindfolded her, placed a gag in her mouth, and struck her several times. The man then dragged K.M. outside and into his vehicle and transported her to a camper, where he vaginally and anally raped her. After being released in a corn field close to her home, K.M. found her way to a residence and the Pennsylvania State Police (“PSP”) were called. K.M. was taken to a hospital where sperm was collected from her anus; DNA was ultimately extracted from the sperm.
On September 14, 2016, PSP obtained a search warrant directed to Google, Inc. for records of searches made with Google’s search engine for K.M.’s name or home address during the week preceding the July 2016 incident. On November 29, 2017, Google returned a report that identified an internet protocol (“IP”) address as having conducted two searches of K.M.’s address several hours before the attack. PSP later determined through requests submitted to the American Registry of Internet Numbers and Appellant’s telecommunications service provider that the IP address corresponded to Appellant.
PSP began to conduct 24-hour surveillance of Appellant, who troopers soon discovered was employed as a corrections officer at the same facility as K.M.’s husband. During the course of the surveillance, troopers retrieved a cigarette butt that Appellant discarded in a store parking lot. DNA was extracted from the cigarette butt, which was determined to match the DNA collected from K.M.
PSP arrested Appellant on December 18, 2017. During the course of a police interview, Appellant admitted to having committed the kidnapping and rape of K.M. In addition, Appellant incriminated himself in four other incidents involving victims D.S., H.Z., A.H., and T.S.
Slip op. at 2-3. Kurtz was charged with rape and kidnapping offenses of the five victims. Prior to trial, Kurtz filed a motion in limine seeking to suppress evidence showing two Google searches of K.M.’s residence from Kurtz’s IP address hours prior to K.M.’s kidnapping and rape, and alleged that the Commonwealth’s mishandling of the electronic file provided by Google, prevented Kurtz from being able to verify that the file had not been manipulated. The trial court denied the motion in limine, finding that (1) the search warrant directed to Google was supported by probable cause because there was a fair probability based upon the information in the possession of law enforcement that the individual who attacked K.M. stalked her online by searching for her address; and (2) Kurtz lacked a reasonable expectation of privacy in his IP address and Google searches. Following trial, Kurtz was found guilty on all counts and sentenced to 59 to 280 years of imprisonment. Kurtz appealed, arguing, among other issues, that the trial court erred in permitting admission of the Google searches. As summarized by Superior Court, Kurtz argued that:
…the affidavit of probable cause in support of the warrant was merely speculative and did not set forth grounds that an individual of reasonable caution would believe that the perpetrator of the assault of K.M. used the Google search engine when planning the crimes. Appellant asserts that he had a reasonable expectation of privacy over his Google search queries, as it is nearly impossible to participate in contemporary society without conducting internet searches. In addition, Appellant argues that he did not lose his privacy interest in his searches as a result of his assent to Google’s privacy policy, which only authorized search results to be turned over in response to legally enforceable requests.
Slip op. at 8.
Superior Court affirmed the trial court’s denial of the motion in limine, agreeing with the trial court that Kurtz lacked a reasonable expectation of privacy in his IP address and/or internet searches, and that the search warrant was supported by probable cause. As to the internet searches, Superior Court found the third-party doctrine, which provides an individual may forfeit his or her legitimate privacy interest in property that is voluntarily provided to others as he has taken the risk that that information would be conveyed by the third party to the government, applied to Kurtz’s Google searches. In so holding Superior Court noted that Pennsylvania courts have “extended” the third-party doctrine “to computer files, electronic messages and other digital records.” Slip op. at 11, citing Commonwealth v. Dunkins, 263 A.3d 247 (Pa. 2021) (“Dunkins II”) (holding that a student’s assent to his college’s computing resources policy resulted in a voluntary relinquishment of any expectation of privacy concerning the records of his connection to the campus wireless internet network). As to Kurtz’s IP address, Superior Court noted that federal courts have held that there is no individual privacy interest in an IP address:
Regarding IP addresses, the Third Circuit Court of Appeals has stated that “[f]ederal courts have uniformly held that” individuals do not have a cognizable privacy interest in their IP addresses. United States v. Christie, 624 F.3d 558, 573 (3d Cir. 2010); see also, e.g., United States v. Trader, 981 F.3d 961, 967-68 (11th Cir. 2020); United States v. Morel, 922 F.3d 1, 9 (1st Cir. 2019); United States v. Contreras, 905 F.3d 853, 857 (5th Cir. 2018). As that court explained, “no reasonable expectation of privacy exists in an IP address, because that information is … not merely passively conveyed through third party equipment, but rather [ ] voluntarily turned over [to internet service providers] in order to direct the third party’s servers.” Christie, 624 F.3d at 574 (citation omitted).
Slip op. at 12. Superior Court additionally noted that Google’s terms of service, which Kurtz agreed to by accessing Google’s search engine, provided that:
We collect information about the services that you use and how you use them …
We collect device-specific information (such as your hardware model, operating system version, unique device identifiers, and mobile network information including phone number) …
When you use our services or view content provided by Google, we automatically collect and store certain information in server logs. This includes … details of how you used our service, such as your search queries[,] … [and IP] address …
We will share personal information with companies, organizations or individuals outside of Google if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to … meet any applicable law, regulation, legal process or enforceable governmental request.
Slip op. at 13. Thus, Superior Court held that Kurtz lacked a reasonable expectation of privacy concerning his Google searches of K.M.’s home address and his IP address, concluding that:
By typing in his search query into the search engine and pressing enter, Appellant affirmatively turned over the contents of his search to Google, a third party, and voluntarily relinquished his privacy interest in the search. Sodomsky, 939 A.2d at 369; Proetto, 771 A.2d at 830-31. The fact that Appellant lost his reasonable expectation of privacy over his search query is reinforced by Google’s privacy policy, which specifically allowed for the company to turn over search results when requested by law enforcement and which he assented to by using the company’s search service. Dunkins II, 263 A.3d at 255-56. Furthermore, Appellant lacked a reasonable privacy interest in his IP address because the IP address served as the manner in which Google’s servers communicated with his computer. Christie, 624 F.3d at 573-74; Duncan, 817 A.2d at 462-63.
Slip op. at 13-14. Superior Court further concluded that the search warrant to Google was supported by probable cause, reasoning that:
We agree with the trial court that the search warrant set forth grounds to show a “fair probability” that the Google search information would uncover evidence related to K.M.’s sexual assault, specifically the identity of her attacker. Harlan, 208 A.3d at 505 (citation omitted). The circumstances set forth in the search warrant—namely the secluded location of the residence, the drop-off location close to K.M.’s home but also in an isolated area, the fact that the attack happened at a time when K.M. was asleep at home and her husband was working, and the potential fantasy driven motivation for the perpetrators of this type of sexual assault—showed reasonable grounds to conclude that the sexual assault was not random or spur of the moment. Rather, a “practical, common sense assessment” of these factors reasonably led the investigating officers, as well as the issuing magistrate, to conclude that the assault of K.M. was conducted after significant planning, and that planning was particularly focused on the situs where the events occurred. Id. (citation omitted). Furthermore, it was reasonable to conclude, due to the ubiquity of internet search engines and Google’s services in particular, that the planning of the crime would take advantage of Google’s search engine.
Moreover, we are unpersuaded by Appellant’s claims that the affidavit was improperly based upon “general assumptions rather than specific and articulable facts” and that it lacked “concrete evidence” that the perpetrator of K.M.’s assault used Google. Appellant’s Brief at 19. The search warrant did not simply assert that a crime occurred at a certain place and ask for all Google searches related to that location. Instead, Trooper Follmer articulated various circumstances he discovered during his investigation indicating that the crime was well-planned, including the secluded locations of K.M.’s house and the field where K.M. was dropped off, the timing of the crime when K.M.’s husband was at work, and the typical profile of perpetrators of this type of sexual assaults. Furthermore, Appellant’s contention that the warrant needed to lay out “concrete evidence” that Appellant had used Google’s services, id., is in conflict with the probable cause standard, which requires only that there is a “fair probability” that the search will be fruitful. Harlan, 208 A.3d at 505 (citation omitted). Granting the appropriate deference to the issuing authority’s probable cause determination, we see no error in the trial court’s conclusion that the facts alleged in the warrant were sufficient to warrant an individual of reasonable caution to believe that a search should be conducted. Pacheco, 263 A.3d at 645.
Slip op. at 18-19.
The Pennsylvania Supreme Court granted allocatur to consider the following issues:
- In an issue of first impression, whether the Superior Court erred in concluding that an individual does not have a reasonable expectation of privacy in his or her electronic content, particularly in his or her private internet search queries and IP address?
- In an issue of first impression, whether the Superior Court erred in finding that probable cause may be established to support a search warrant to Google, Inc. requesting the content of an individual’s private internet search queries where the suspect is unknown and no evidence is presented establishing that Google, Inc. was used in the planning or commission of the crime?
For more information, contact Kevin McKeon or Dennis Whitaker.