“This agreement demonstrates the Department’s resolve in ensuring that technology companies, such as Google, provide prompt and complete responses to legal process to ensure public safety and bring offenders to justice,” said Assistant Attorney General Kenneth Polite of the Criminal Division.
The stipulation and agreement, filed Oct. 25 in U.S. District Court for the Northern District of California, resolves a dispute with Google over the loss of data responsive to a 2016 search warrant. To ensure Google fulfills its legal obligations related to these compliance enhancements, an independent compliance monitor will be retained, the Justice Department said.
“The warrant underlying this agreement was sought in connection with a significant criminal investigation,” said U.S. Attorney Stephanie Hinds for the Northern District of California. “This agreement will help to ensure that, moving forward, Google will maintain the technical capability and resources necessary to comply with lawful warrants and orders, such as the one at issue in this case, that are critical to federal criminal investigations.”
According to the Statement of Facts accompanying the agreement, the United States obtained a search warrant in the Northern District of California in 2016 for data held at Google related to the investigation of the criminal cryptocurrency exchange BTC-e. The government issued the warrant under the Stored Communications Act (SCA), the federal statute that requires providers to disclose customer communications when served with a warrant signed by a judge and supported by probable cause.
After a judge in the Northern District of California reviewed, signed, and served Google the warrant, the Second Circuit Court of Appeals held that SCA search warrants did not apply to data stored outside the United States. “Google halted execution of the search warrant and made rolling productions containing only information it could confirm was stored in the United States,” according to the Justice Department.
“Because Google’s data preservation tools at the time stored data in the United States – and thus brought the data under undisputed U.S. jurisdiction – Google also endeavored to create new tools that would prevent the data from being repatriated,” the Justice Department said. “Google and the government litigated regarding the search warrant through 2017 and into 2018, when Congress clarified that the SCA does indeed reach data that U.S. providers choose to store overseas. In the intervening time, data responsive to the warrant was lost.”
Agreement Terms
In resolving the matter with the Department, Google has agreed to numerous improvements to its compliance program, tailored to ensure Google complies with its legal obligations to respond to lawful court orders. “Google will maintain sufficient compliance staffing levels to support the enhancements to the program and will allocate engineering resources to support legal process compliance,” the Justice Department said.
Google further committed to “generate a compliance timeliness record for missed deadlines, which will be made available to the government upon request,” the Justice Department added. “Google will also develop and maintain needed tools to retrieve data in response to legal process, and to develop plans for legal process responses corresponding to new product launches.”
The agreement also provides that an independent compliance monitor “will verify the accuracy of assertions in all reports contemplated by the agreement and evaluate Google’s assessment of its compliance with the enhancements to Google’s legal process compliance program set forth in the agreement,” the Justice Department said.
Google will further create periodic reports and updates regarding implementation of these compliance enhancements and provide these reports to the government, Google’s compliance steering Committee, as well as to the audit and compliance committee of the Alphabet board of directors, Google’s parent company.
In the filed stipulation, Google represented to the court that it spent over $90 million on additional resources, systems, and staffing to implement legal process compliance program improvements. “Google will maintain its lawful protections of user data,” the Justice Department said, “and the agreement does not provide the United States access to Google user data.” 
Jaclyn Jaeger is a contributing editor at Compliance Chief 360° and a freelance business writer based in Manchester, New Hampshire.