This Google user data scandal shows why more people are using GrapheneOS

US authorities routinely send requests for user data to tech companies. Google is no exception, but the company’s own policy states that it will generally notify people when authorities have requested their user data. However, a new legal complaint might motivate you to deGoogle your digital life.

A legal complaint by the Electronic Frontier Foundation (EFF) alleges that Google may have broken its own rules and given a user’s data to Immigration and Customs Enforcement (ICE) without notifying the user first. The user, Amandla Thomas-Johnson, is a foreign PhD student who apparently attended a pro-Palestine protest at Cornell University.

Thomas-Johnson claims that he was forced into hiding amid a government crackdown on student protests, with federal agents looking for him at his home. He also claimed that a friend was interrogated at a Tampa airport in connection with his whereabouts.

Thomas-Johnson was visiting Switzerland weeks later when he received an email notifying him that Google had handed over his user data to the Department of Homeland Security. He didn’t receive an email from Google to notify him of the request.

“That notice is meant to provide a chance to challenge the request. In my case, that safeguard was bypassed,” he explained.

Google’s policy webpage does indeed note that it will generally notify users of the request before handing over any data to the government.

However, the company also explains that there are a few exceptions:

We won’t give notice when legally prohibited under the terms of the request. We’ll provide notice after a legal prohibition is lifted, such as when a statutory or court-ordered gag period has expired.

We might not give notice if the account has been disabled or hijacked. And we might not give notice in the case of emergencies, such as threats to a child’s safety or threats to someone’s life, in which case we’ll provide notice if we learn that the emergency has passed.

In other words, the company may have been barred from notifying the subject of a data request due to a legal requirement. It might also hand over data without notification if there’s a threat to someone.

For what it’s worth, Google apparently handed over Thomas-Johnson’s IP addresses, physical address, session times/durations, and other “identifiers.” This might not sound like much, but it can be used to determine someone’s location, home, and when you’re communicating with others. The search giant also claims that it often seeks to narrow the scope of disclosed data if it feels the request is too broad.

Nevertheless, it’s no wonder that we’ve seen more and more people switch to Android forks like GrapheneOS. The platform doesn’t phone home to Google and even offers a duress PIN. The latter is a separate PIN code that can wipe your entire device, making it handy if you’re forced to hand over your phone to authorities or criminals.

We’ve also seen people switching from Google apps and services to alternatives like Brave, ProtonMail, and BitWarden. I’m a big proponent of not having all of my digital eggs in one basket, so you might want to do the same if you’re worried about repressive governments. In any event, we’ve asked Google about this legal complaint and will update our article if the company gets back to us.