Feds may need warrant for web browser surveillance, court rules

When Edward Snowden revealed the NSA secretly monitored Americans’ internet use, officials allayed concerns by explaining “only metadata” was collected. Now a federal court says some URLs fall outside the metadata category, qualifying as content.

When data is “non-content,” such as who is sending or receiving communications, courts generally have ruled in favor of national security interests above privacy interests. However, a Tuesday ruling by the federal third circuit court of appeals adds nuance to that, protecting some URLs the same way as content found in email, text messages or phone conversations would be.

That protection requires authorities to have “probable cause” and may require them to seek a warrant if they want access, the court ruled.

The decision comes from a class action lawsuit against Google as well as two other companies, Vibrant Media and Media Innovation Group. All three are being prosecuted for allegedly bypassing customer protections, circumventing user-implemented blocks against “cookies,” or tracking web browser histories.

While the court didn’t find any company violated the Wiretap Act, it did say that such a violation could occur if the government or private third party surreptitiously kept an eye on URLs without a warrant. The court found the companies in this case were not third parties.

How could a URL be considered content and not metadata? If a web address is detailed enough, it could show the purpose behind the user’s web surfing. For instance, look at the URL of this article. If it reveals the reader’s interest in court cases or privacy, then it is no longer simply metadata.

“For the reasons stated by the Surveillance Court, we are persuaded that, under the surveillance laws, ‘dialing, routing, addressing, and signaling information’ may also be ‘content,’” the third circuit court wrote, referencing a previously classified ruling by the FISA court.

While it is true the FISA court and Department of Justice have recognized a difference between metadata and content qualities of certain URLs, this open federal court decision could have more substantive repercussions.

“This is a pretty big deal for law enforcement,” Jonathan Mayer, a Stanford fellow in computer science and law, told Wired. Mayer’s analysis led to the class action lawsuit against Google and the two other media groups.

“The punchline is that if the FBI or any law enforcement agency wants to look at your web history, they’ll have to get a warrant for a wiretap order,” Mayer said.