Disconnect VPN to Login

jnmeade

Cleared for Takeoff
Joined
Sep 25, 2005
Messages
1,280
Location
Eastern Iowa
Display Name
Jim Meade
Home Airfield
Iowa City, IA
I find some sites will not allow a login if one is using VPN. Some (not all) banks, some (not all) government sites, for example. The response or indication varies; sometimes a 403 error, sometimes some general statement. I do not see a statement such as, "Hey! disconnect your VPN " or anything like that. One is left to figure it out by oneself.
I prefer to use VPN routinely. Is there any workaround, do you know, so I can stay on VPN?
Do any of you experience this refusal to let you sign in through a VPN occuring?
 
First of all, "using VPN" can mean multiple things. It's like "on WiFi" could mean you're web surfing at a coffee shop or moving files across your home LAN or ad-hoc peer-to-peer with another endpoint device. Or like "in an airplane" could mean PIC sole manipulator of a Cub or an aisle seat of an airliner. For example, I frequently use a VPN to access my NAS or my Linux box at home while I'm away from home. If I go web surfing with that connection turned on, to the world it looks like I'm sitting on my couch/bed/porch for anyone doing a traceroute on the IP address that goes out. However I sometimes use VPN to connect to an anonymizing service, which judging from the context I think might be what you're asking about. This service is a perk of my ISP so when I go web surfing, the IP address makes it look like I'm accessing (say perhaps my checking account) from a server in their network operations center. The NOC is in a nearby city and same county as the home address that I registered with my bank, so that won't create any problem. If your home address is in the USA and your anonymizing VPN service has a co-lo in say perhaps Afghanistan or Nigeria, that might raise a few eyebrows when you go to transfer some money.

So in order to better answer your question, why do you want to use an anonymizing service? Would you feel comfortable not using it if you were hardwired into your Ethernet router at home?
 
It’s likely more simple than that. Many internet sites have IP range lists of vpn providers and just block them. I find just changing the vpn portal city will sometimes let me through.
 
I live in the midwest and the VPN happened to be in Chicago. Some businesses have no problem, others, for an unknown reason, do. I wonder why a small bank in a nearby hometown cares about my location when another bank that I use nearby doesn't. It seems arbitrary. Same with government offices.
I've been turning my VPN off for long enough to transact the business. I'll try changing it next time.
 
This won't be a popular answer.

If you completely trust your VPN provider with your personal data, AND you trust the laws and governing bodies in the countries where they do business, you can probably safely access those protected sites by just disabling your VPN temporarily. This method assumes that your VPN client hasn't been corrupted or isn't specifically designed to harvest personal data. However, if you really want to protect your data, you'll want to remove the client. Some places, if a VPN client has been installed on a computer the fix is to re-image the computer. That's the safest option.

Sites with financial or other sensitive data will often subscribe to services that will block known malicious sites, suspected malicious sites, VPN services, foreign countries at the request of the site host, etc. It's not foolproof protection, but it's part of a layered defense. By blocking VPN hosts, they're reducing the chances that their customers will be subject to a man in the middle attack that's exploiting the VPN client, protecting their customer's data, and combined with geofencing of the IP addresses they're also reducing the chances of foreign attackers hitting their sites.

Adding a VPN client to your PC, in and of itself, won't improve the security of your connection to your bank. With any modern browser, if the https connection to your bank isn't right it won't let you connect. Now on the down side, if that VPN client is compromised, or if the VPN vendor itself is malicious, then there's the potential that the VPN client sees all of your data, and sends it somewhere else. Or in other words, for a secure connection, VPN can only make it worse. The exception to this is if the VPN provider is also providing ad blocking or malware blocking services in addition to VPN. In which case you gain something from the ad blocks.

If you're using VPN software so you can travel overseas and watch local movies or whatever, I get it. It's annoying that different countries have different rules. But I wouldn't use a computer with that setup for my banking. It would be the "entertainment PC" that I didn't much care if it became infected.

If you're using VPN software to try to evade nation-state level espionage for whatever reason, please frequently express to your friends and loved ones how much you care about them. They're remember that.
 
What a broadening answer. I'm obviously a real clodhopper on topics like this.
Your case number one fits me and that is what I do.
I may change my VPN site to something as local as possible, to see if the bank cares about that. Although, I'd think Adam Smith signing in from Chicago to his Iowa bank would be OK; but maybe not.
I do my ad blocking through my browser, so the VPN is not for that.
I really should learn to set my VPN to Germany so I can watch more local broadcasts like Bundesliga soccer from there - I just haven't gotten around to it yet.
If I were using VPN to evade nation-state level monitoring, I might not ask about it on a popular aviation web site (although, who knows?).
No, I'm just a person who figures what I do is no one else's business and find it curious that the very act of doing so brings on some of the reactions you've noted. Well, I still lower the blinds when I dress and will continue to do so, and those curious agencies that think that is suspicious will have to add me to their watch list.
Thanks for the comments - they are educational and appreciated.
 
:) I do get it and hope I didn't sound harsh. There are people who try to use things like Tor and vpn's to try to send messages around because they live in Iran or China or whatever, and they may be in real danger if their views are exposed. But in my view, the tech those people use is not good enough to protect them from those adversaries. I kinda figured that wasn't the case, but wanted to bring it up.

In the case of foreign country access to US sites, it is pretty easy for the bad guys attacking banks and such to get US IP addresses, but it's even easier not to, so many companies just block the back blocks. And when the people are behind a VPN, it can be more difficult to spot the compromised computers and attackers just by IP address.

There is far too much sharing of personal information between corporations just for marketing purposes. An unfortunate part, though, is that most of that is happening on the client PC side. Not just cookies, but tools and authentications that you use, and information that is carried when you finally get to the sites you want to go to. More of it is happening at that back end. There are only a handful of companies that are carrying most of the US Internet traffic, maybe most of the world's traffic. With those perspectives, the amount of information they have is staggering. Largely I think all that data is "just" used for marketing and to aid in separating the good from the bad, but in my limited perspective on all of this - and it really is - I have a bit of trouble believing it's all collected without harm.

Anyway, I work roughly in the area of keeping bad out of good. Not so much the day to day and certainly nothing with lasers or spies, more long term planning, but I have a little bit of view into the industry side of the controls and monitors that are in place.
 
It’s simply data harvesting and being creepy.

YouTube says to keep their community safe they need my IP address which could link back to where my family sleeps.
I don’t think it’s about keeping their community safe, whatever that means, it’s about data harvesting and targeted ads.
 
A little searching online reveals a significant amount of discussion on how and why VPN is blocked and ways to get around it. A casual glance shows it's important to choose a good VPN or it could be used to harvest data rather than protect your privacy. There are at least three common ways to block VPN typically used by different actors for different reasons. Eye-opening to this ole' country boy.
 
The entire Internet is about data harvesting. Youtube is owned by Google and they already know where your family sleeps, and what they watch, where they eat, work, shop and bank, and maybe even what they think. I'm not arguing that it's good, just that using VPN software to try to avoid that doesn't work. Well, it does add you to the list of people who might buy add-on security software, so there's that.

I grew up in a small town. We had one traffic light. Everybody knew what everybody else was doing, and anybody that thought otherwise was kidding themselves. The vet who was secretly dating the mayor's kid, the side business run out of the butcher shop, etc. The Internet makes the whole world like a small town. On the plus side, nobody cares, and very few people have access to all of the details because there's way too much money to be made in selling all that marketing data.

A hint, if you want activity not linked between the different worlds, use a different device, not a vpn or a private browser or some layer on a PC. If you want activity that isn't tracked at all, don't do it on a computer. If you simply want to watch TV shows or sports from around the world, probably THE best reason and maybe only reason to use VPN, then I'd use a separate device for that. Reason being, the name brand VPNs are going to be, generally speaking, the easiest things for the media people to block. While the little VPNs are harder for the media people to block, but are also much more likely to either have been intentionally or unintentionally infected with something that's going to steal your data when you use that computer for something else sensitive.

Oh, and the probable reason that youtube or other generally legitimate media providers block vpn addresses isn't because they want to track you, they can do that anyway, it's because they're most likely bound by various laws and contracts to block certain content to certain areas. Whether reasonable or not, if XYZ country passes a law making it illegal to talk about jelly beans, the providers may try to block it just to reduce the hassle of lawsuits or court-orders. They're in business just for the money of it, just like the rest of the Internet. Or...it might just be a quick way for them to do regionally targeted ads.

Just my peripheral view into this world...all info above is probably not worth what you paid for it. We're all in glass houses now.
 
The entire Internet is about data harvesting. Youtube is owned by Google and they already know where your family sleeps, and what they watch, where they eat, work, shop and bank, and maybe even what they think. I'm not arguing that it's good, just that using VPN software to try to avoid that doesn't work. Well, it does add you to the list of people who might buy add-on security software, so there's that.

I grew up in a small town. We had one traffic light. Everybody knew what everybody else was doing, and anybody that thought otherwise was kidding themselves. The vet who was secretly dating the mayor's kid, the side business run out of the butcher shop, etc. The Internet makes the whole world like a small town. On the plus side, nobody cares, and very few people have access to all of the details because there's way too much money to be made in selling all that marketing data.

A hint, if you want activity not linked between the different worlds, use a different device, not a vpn or a private browser or some layer on a PC. If you want activity that isn't tracked at all, don't do it on a computer. If you simply want to watch TV shows or sports from around the world, probably THE best reason and maybe only reason to use VPN, then I'd use a separate device for that. Reason being, the name brand VPNs are going to be, generally speaking, the easiest things for the media people to block. While the little VPNs are harder for the media people to block, but are also much more likely to either have been intentionally or unintentionally infected with something that's going to steal your data when you use that computer for something else sensitive.

Oh, and the probable reason that youtube or other generally legitimate media providers block vpn addresses isn't because they want to track you, they can do that anyway, it's because they're most likely bound by various laws and contracts to block certain content to certain areas. Whether reasonable or not, if XYZ country passes a law making it illegal to talk about jelly beans, the providers may try to block it just to reduce the hassle of lawsuits or court-orders. They're in business just for the money of it, just like the rest of the Internet. Or...it might just be a quick way for them to do regionally targeted ads.

Just my peripheral view into this world...all info above is probably not worth what you paid for it. We're all in glass houses now.

If Google/youtube knew everything they wouldn’t care about my VPN.

Resistance is futile was a good line in Star Trek, but not a good moto to live by :)
 
If Google/youtube knew everything they wouldn’t care about my VPN.

Resistance is futile was a good line in Star Trek, but not a good moto to live by :)
Just for fun, go to a site where you buy things, or watch things, or read things. Go to inspect mode in your browser, take a look at the network tag, and refresh the page. Now look at how much content is being sent. Not just the posts, most of it is in the URL of the get statements. Lots of encoded information about what you're looking for, and also identifying you. Now, if you have good ad-blockers, script blockers on your browser, that'll help a bit. But most pages, most places, you're going to be sending identifying information to a handful of companies that are tracking you. And a VPN won't change that at all. User preference tracking is done largely at the client/app level because it's easy and it's accurate. It can track thousands of people individually working at a business or staying at a hotel, even though they're all sharing a couple of outbound IP addresses on NAT. It can track you as you travel around the world, either in reality or through a VPN. My apologies if you already know all of this.

The companies that track things are always tracking new things because they're always looking for more data. It's just what they do.

Now there are ways to reduce your digital footprint past that of using ad-blockers and script blockers. I'm sure there are browsers and browser extensions that, kinda like a stealth fighter, can greatly reduce and perhaps nearly eliminate client side tracking. But then the next question is, what's the visibility of doing that, and who's looking for it? Because in the telecom world, and I kinda suspect the general IT world, there are systems that look out specifically for things that are keeping an unusually low profile, and tracking them. It's the electronic equivalent of walking around a shopping mall in urban camo and a mesh mask, it can draw more attention. (One of the rare examples of this coming out in public was by the Italian secret services, re phones, it's an interesting story, and with 20 year old tech.)

I like analogies, but in this case there's not one Borg. There are lots of them. They trade data between each other, sometimes. The big ones, though, their worst bite is generally some annoying guy that says "hey, would you like to buy a timeshare?" or insurance policy or $20 think that pretends to lower your electric bill or whatever.

Anyway, there is a really easy way to avoid a lot of tracking, and it doesn't stand out all that much, especially if you're old. Don't carry a phone, don't shop online, never ever use social media, watch TV from an antenna, pay cash for everything, don't ever sign up for a rewards program, and drive an old car. You'll still have a profile, but the borgs will just think you're cheap and hate technology. And I may resemble some of those activities. Some of that may be a big cost just to avoid having to watch a wonder bread ad, though.

If I come off a bit anti VPN, I am. Not because I don't support people that are trying to improve their privacy. But because it's not as virtual or private as it's being advertised as. Maybe if they called it "web proxy", which is really what it is in the best case, I wouldn't be as grumpy about it. Maybe.
 
Just for fun, go to a site where you buy things, or watch things, or read things. Go to inspect mode in your browser, take a look at the network tag, and refresh the page. Now look at how much content is being sent. Not just the posts, most of it is in the URL of the get statements. Lots of encoded information about what you're looking for, and also identifying you. Now, if you have good ad-blockers, script blockers on your browser, that'll help a bit. But most pages, most places, you're going to be sending identifying information to a handful of companies that are tracking you. And a VPN won't change that at all. User preference tracking is done largely at the client/app level because it's easy and it's accurate. It can track thousands of people individually working at a business or staying at a hotel, even though they're all sharing a couple of outbound IP addresses on NAT. It can track you as you travel around the world, either in reality or through a VPN. My apologies if you already know all of this.

The companies that track things are always tracking new things because they're always looking for more data. It's just what they do.

Now there are ways to reduce your digital footprint past that of using ad-blockers and script blockers. I'm sure there are browsers and browser extensions that, kinda like a stealth fighter, can greatly reduce and perhaps nearly eliminate client side tracking. But then the next question is, what's the visibility of doing that, and who's looking for it? Because in the telecom world, and I kinda suspect the general IT world, there are systems that look out specifically for things that are keeping an unusually low profile, and tracking them. It's the electronic equivalent of walking around a shopping mall in urban camo and a mesh mask, it can draw more attention. (One of the rare examples of this coming out in public was by the Italian secret services, re phones, it's an interesting story, and with 20 year old tech.)

I like analogies, but in this case there's not one Borg. There are lots of them. They trade data between each other, sometimes. The big ones, though, their worst bite is generally some annoying guy that says "hey, would you like to buy a timeshare?" or insurance policy or $20 think that pretends to lower your electric bill or whatever.

Anyway, there is a really easy way to avoid a lot of tracking, and it doesn't stand out all that much, especially if you're old. Don't carry a phone, don't shop online, never ever use social media, watch TV from an antenna, pay cash for everything, don't ever sign up for a rewards program, and drive an old car. You'll still have a profile, but the borgs will just think you're cheap and hate technology. And I may resemble some of those activities. Some of that may be a big cost just to avoid having to watch a wonder bread ad, though.

If I come off a bit anti VPN, I am. Not because I don't support people that are trying to improve their privacy. But because it's not as virtual or private as it's being advertised as. Maybe if they called it "web proxy", which is really what it is in the best case, I wouldn't be as grumpy about it. Maybe.

Again, if VPNs didn’t work companies where your data is the product wouldn’t go the lengths to block them.

It’s like a fire extinguisher, will it stop all fires, no, do I still carry one in my vehicles and home, you betcha
 
Again, if VPNs didn’t work companies where your data is the product wouldn’t go the lengths to block them.

It’s like a fire extinguisher, will it stop all fires, no, do I still carry one in my vehicles and home, you betcha
:) OP's example, I believe, was his local bank was blocking his VPN service. They're not doing that because they're trying to harvest information about their own customers - they already know who their own customers are. They're blocking it as part of a package that blocks VPN services as potentially malicious and frequently used by attackers - because they are!

It's OK if you believe that VPN companies are providing a service at a cost that is worth something to you. I'd substitute a different analogy. It's like hiring a company to put security cameras inside your home, with the idea that this will prevent other people from having security cameras in your home, because the first company pinky swears that THEY won't spy on you. And with sites you trust, banking, health care, shopping, it's actually worse than that. If you're using your trusted site with a current browser, it's secure. If you're using a VPN client that plugs into that browser, you have no idea at all if it's secure. Pinky swear vs actual tech.

The irony of all of this is that the VPN providers use "the borg" to find customers who are worried about "the borg" tracking them. It's baffling to me, but it's not my monthly subscription money.

And again, for that folks that are using this stuff to watch Netflix while you're in the Caribbean, I get it.
 
Again, if VPNs didn’t work companies where your data is the product wouldn’t go the lengths to block them.
Albany Tom has said it better than me, but just to add on: Lots of bad actors try to hide behind VPNs. If you run a site that is a target of bad actors, you end up seeing lots of attacks coming from the same IP addresses, and sometimes those IPs belong to VPNs. If you're a bank, for instance, you may decide that there's little reason why a legitimate user would need to be using a VPN to access your site, and it's a lot easier to just block the VPN's IP address to stop attacks coming from that route, so it's a pretty easy choice to just block connections coming from the VPN.

This has nothing to do with "if VPNs didn’t work companies where your data is the product wouldn’t go the lengths to block them". It's not about your data, or whether "VPNs work". It's about taking a simple action to block a path commonly used by bad actors.
 
:) OP's example, I believe, was his local bank was blocking his VPN service. They're not doing that because they're trying to harvest information about their own customers - they already know who their own customers are. They're blocking it as part of a package that blocks VPN services as potentially malicious and frequently used by attackers - because they are!

It's OK if you believe that VPN companies are providing a service at a cost that is worth something to you. I'd substitute a different analogy. It's like hiring a company to put security cameras inside your home, with the idea that this will prevent other people from having security cameras in your home, because the first company pinky swears that THEY won't spy on you. And with sites you trust, banking, health care, shopping, it's actually worse than that. If you're using your trusted site with a current browser, it's secure. If you're using a VPN client that plugs into that browser, you have no idea at all if it's secure. Pinky swear vs actual tech.

The irony of all of this is that the VPN providers use "the borg" to find customers who are worried about "the borg" tracking them. It's baffling to me, but it's not my monthly subscription money.

And again, for that folks that are using this stuff to watch Netflix while you're in the Caribbean, I get it.

When they pass independent audits I tend to trust them more than say my ISP


It’s also nice to not have it obvious to anyone where my internet traffic is going, plus if you live in china or texas you need a VPN to get around the censorship
 
Just for my own education: when people are talking "VPN" in this thread, they mean a VPN service for the purpose of anonymizing (that's a word?) interweb traffic, right?

They are not using VPN for, say, access to network services/servers from outside (from the big bad interweb), right?
 
Just for my own education: when people are talking "VPN" in this thread, they mean a VPN service for the purpose of anonymizing (that's a word?) interweb traffic, right?

They are not using VPN for, say, access to network services/servers from outside (from the big bad interweb), right?
Yes. NordVPN, ExpressVPN, SurfShark, etc.
 
Just for my own education: when people are talking "VPN" in this thread, they mean a VPN service for the purpose of anonymizing (that's a word?) interweb traffic, right?

They are not using VPN for, say, access to network services/servers from outside (from the big bad interweb), right?
Yep! I wouldn't call it anonymizing, though. They hide your source IP address from the carrier and the destination sites by way of web proxy. That's effectively it.
 
Are you sure that "independent audit" is really valid? How far down the rabbit hole do you want to go?


I trust them miles over any ISP

And how often are you running DNS leak tests?;)

Every few months or so, my VPN also has DNS servers, I run the VPN on my mobile devices as well as my home router
 
The ISP's around here are Spectrum and Verizon. I trust them to barely maybe meet the bandwidth agreement in the contract, and to provide service about 99% of the time. Neither is going to spend any effort on anything that doesn't make money for them, and honestly I don't think Spectrum has enough ambition to do so even if someone in their organization thought of it. As most of the web is encrypted these days, the only information they have is which sites you go to, and yeah, they also have your residential mailing address. But all of that is pretty minor compared to client browsing data, and data from the search engines and websites.

Now if you lived in 1995, or maybe some small town where a guy named Bob runs the Internet, I can see how Bob the ISP might tell Marge at the coffee shop that you liked to go to xhamster or whatever every night. Spooky. So if you use a VPN/proxy instead, they can say that you use a VPN to hide where you browse from them. That's actually going to sound more spooky to Marge at the coffee shop. Nobody hides that they're going to some only fans site, so what is this guy up to? Maybe he's a spy!

Not really joking about the 1995 thing...I knew a couple of the guys running ISP's back then in this area ("capital district"), and I wouldn't put it past some of their staff, then, to be looking at who was going where for the fun of it. These days? Nobody cares, it's people trying to feed their family. If anybody is playing 'snoop on the neighbor', they're driving around playing with wifi, or surfing around looking for the personal VPNs or IOT devices you have. And that's probably the number one thing that people these days do that enables lack of privacy. Want privacy? Disconnect your TVs from a direct connection to the Internet. They haven't been a one-way device for quite some time now.
 
Detecting a VPN connection from a phone / device is quite easy.. all the major players' IP blocks are well known.

If you are trying to 'hide' then you will have to forego some sites as they won't accept connections from well known IP blocks.

VPN services are selling a bit of snake oil, other than providing a remote 'exit' server you are still connecting to a site/app under good old HTTP/HTTPS.

I have never found ad tracking to be anywhere near close to what I am searching for... but then again searching for MS21042-3s isn't gonna come up on many SEO results.

If you want to stay off teh ad-radar then a good ab-block (ublock origin and ghostry) setup is about as good as you can get...

Unless you want to boot up a new virtual server, randomize the MAC/UUIDs and tweak all the well known fingerprints every time you want to login to post those two are are an 80% solution.
 
Now on the down side, if that VPN client is compromised, or if the VPN vendor itself is malicious, then there's the potential that the VPN client sees all of your data, and sends it somewhere else.
This is the fallacy of VPNs.. they have the private key, they can decrypt anything they want. Your key is generally for authentication, the data itself is encrypted with a key exchange.

Its never been a matter of 'if they can'. They can, and the tools they would use are seemless.
 
Detecting a VPN connection from a phone / device is quite easy.. all the major players' IP blocks are well known.

If you are trying to 'hide' then you will have to forego some sites as they won't accept connections from well known IP blocks.

VPN services are selling a bit of snake oil, other than providing a remote 'exit' server you are still connecting to a site/app under good old HTTP/HTTPS.

I have never found ad tracking to be anywhere near close to what I am searching for... but then again searching for MS21042-3s isn't gonna come up on many SEO results.

If you want to stay off teh ad-radar then a good ab-block (ublock origin and ghostry) setup is about as good as you can get...

Unless you want to boot up a new virtual server, randomize the MAC/UUIDs and tweak all the well known fingerprints every time you want to login to post those two are are an 80% solution.

I run VPNs 24/7, I very seldom have to do anything other than rarely just shift to another VPN which takes about 2 seconds.

The point is not only the random exit point but the encryption from me to the VPN, go to places like China or Texas and they’ll block certain sites the state doesn’t like.

Other creeps will give you issues if you have certain traffic, like a torrent.

China has also been know to monitor and try to sniff data going to foreflight
 
Last edited:
I run VPNs 24/7, I very seldom have to do anything other than rarely just shift to another VPN which takes about 2 seconds.
For surfing and movies that's a solution, but many things people want to do (banking) will reject vpn ip blocks. They claim its for fraud prevention.

No one cares what you are doing online. Its hilarious that people who swear by VPNs also have Alexa in the house, or a smart tv, you are already being tracked. lol
 
For surfing and movies that's a solution, but many things people want to do (banking) will reject vpn ip blocks. They claim its for fraud prevention.

No one cares what you are doing online. Its hilarious that people who swear by VPNs also have Alexa in the house, or a smart tv, you are already being tracked. lol

I won’t do business with a bank that does that, my normal banks don’t, we had a credit card for a brief time that wouldn’t login with a VPN we just got rid of it, oh well

If no one cared what we do on the net, all the big players wouldn’t be so determined to have the IP address which leads to where my family sleeps.

*Sucks if you are all signed into your googles and on a whim decide to search that old high school buddy only for them to coincidentally get killed shortly after

“Police are finding suspects based on their online searches as courts weigh privacy concerns

By MARK SCOLFORO Updated 5:03 AM PST, February 23, 2026

HARRISBURG, Pa. (AP) — Criminal investigators hoping to develop suspects in difficult cases have been asking Google to reveal who searched for specific information online, seeking “reverse keyword” warrants that critics warn threaten the privacy of innocent people.

Unlike traditional search warrants that target a known suspect or location, keyword warrants work backward by identifying internet addresses where searches were made in a certain window of time for particular terms, such as a street address where a crime occurred or a phrase like “pipe bomb.”

Police have used the method to investigate a series of bombings in Texas, the assassination of a Brazilian politician and a fatal arson in Colorado.

It’s not a wild guess by investigators to conclude that people are using Google searches in all manner of crimes, as the company’s search engine has become the main gateway to the internet and users’ daily lives increasingly leave online traces. The potential value to investigators of the data Google collects is obvious in cases with no suspect, such as the search for Nancy Guthrie’s kidnapper.

The legal tension between the need to solve crimes quickly and the U.S. Constitution’s Fourth Amendment protections against overly broad searches was at the heart of a recent Pennsylvania Supreme Court decision that upheld the use of a reverse keyword warrant in a rape investigation.

Privacy advocates see it as giving police “unfettered access to the thoughts, feelings, concerns and secrets of countless people,” according to an amicus brief filed in the Pennsylvania appeal by the American Civil Liberties Union, the Internet Archive and several library organizations.

In response to written questions about the warrants, Google provided an emailed statement: “Our processes for handling law enforcement requests are designed to protect users’ privacy while meeting our legal obligations. We review all legal demands for legal validity, and we push back against those that are overbroad or improper, including objecting to some entirely.”

A break in the case

Pennsylvania State Police were stymied in their investigation into the violent rape of a woman in 2016 on a remote cul-de-sac outside Milton, a small community in the center of the state. With no clear leads, police obtained a warrant directing Google to disclose accounts that searched for the victim’s name or address over the week when she was attacked.

More than a year later, Google reported two searches for the woman’s address were made a few hours before the assault from a specific IP address, a numeric designation that lists where a phone or computer lives on the internet.

That led them to the home of a state prison guard named John Edward Kurtz.

Police then conducted surveillance and collected a cigarette butt he discarded that matched DNA recovered from the victim, according to court records. He confessed to the rape and attacks involving four other women over a five-year period, and was convicted in 2020. Now 51, he’s been sentenced to 59 to 280 years.

Kurtz’s attorneys argued police lacked probable cause to obtain the information and impinged on his privacy rights.

The state Supreme Court rejected those claims late last year but split on the reasons why. Three justices said Kurtz should not have expected his Google searches to be private, while three more said police had probable cause to look for anyone who searched the victim’s address before the attack. But a dissenting justice said probable cause requires more than just a “bald hunch” and guessing that a perpetrator would have used Google.

Kurtz lawyer Douglas Taglieri made the same point in a court filing, but conceded, “It was a good guess.”

Julia Skinner, a prosecutor in the case, said reverse keyword searches are much more effective when there are specific and even unusual terms that can narrow results, such as a distinctive name or an address. They are also particularly effective when crimes appear to have been planned out beforehand, she said.

“I don’t think they’re used super frequently, because what you need to target has to be so specific,” she said. There were 57 searches returned in the Kurtz case, but many of them were first responders trying to locate the home in the immediate aftermath of the crime, Skinner said.

Acting in good faith

In the similar case in Colorado, police sought the IP addresses of anyone who searched over a 15-day period for the address of a home where a deadly arson occurred. Authorities got IP addresses for 61 searches made by eight accounts, ultimately helping identify three teenage suspects.

The Colorado Supreme Court ruled in 2023 that although the keyword warrant was constitutionally defective for not specifying an “individualized probable cause,” the evidence could be used because police had acted in good faith about what was known about the law at the time.

“If dystopian problems emerge, as some fear, the courts stand ready to hear argument regarding how we should rein in law enforcement’s use of rapidly advancing technology,” the majority of Colorado justices ruled.

Courts have long permitted investigators to seek things like bank records or phone logs. However, civil liberties groups say extending those powers to online keywords turns every search user into a suspect.

It’s unclear how many keyword warrants are issued every year — Google does not break down the total number of warrants it receives by type, according to the Electronic Frontier Foundation and the Pennsylvania Association of Criminal Defense Lawyers in a January 2024 brief.

The two groups said police working on the bombings in Austin, Texas, sought anyone who searched for terms such as “low explosives” and “pipe bomb.” And in Brazil, investigators trying to solve the 2018 assassination in Rio de Janeiro of the politician Marielle Franco asked for those who searched for Franco’s name and the street where she lived. A Brazilian high court is expected to decide soon on the legality of those search disclosures.

Reverse keyword warrants are distinct from “geofence” warrants, where criminal investigators seek information about who was in a given area at a particular time. The U.S. Supreme Court said last month it will rule on that method’s constitutionality.

An index of deeply personal matters

For many people, their Google search history contains some of their most personal thoughts, from health issues and political beliefs to financial decisions and spending patterns. Google is introducing more artificial intelligence into its search engine, seemingly a way to learn even more about users.

“What could be more embarrassing,” asked University of Pennsylvania law professor and civil rights lawyer David Rudovsky, if every Google search “was now out there, gone viral?”

Google warns users personal information can be shared outside the company when it has a “good-faith belief that disclosure of the information is reasonably necessary” to respond to applicable laws, regulations, legal processes or an “enforceable government request.”

In the Kurtz case, Pennsylvania Justice David Wecht drew a distinction between Kurtz deciding to search for the victim’s name on Google and a 2018 U.S. Supreme Court decision that limited the use of broad collections of cellphone location data.

“A user who wants to keep such material private has options,” Wecht wrote. “That user does not have to click on Google.”

AP Technology Writer Michael Liedtke in San Francisco and writer Mauricio Savarese in Sao Paulo, Brazil, contributed.

https://www.oann.com/tech/police-ar...ne-searches-as-courts-weigh-privacy-concerns/ “
 
Back
Top