Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 1 of 18
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`STEPHANIE M. HINDS (CABN 154284)
`United States Attorney
`
`THOMAS A. COLTHURST (CABN 99493)
`Chief, Criminal Division
`
`LLOYD FARNHAM (CABN 202231)
`Assistant United States Attorney
`
`450 Golden Gate Avenue, Box 36055
`San Francisco, California 94102-3495
`Telephone: (415) 436-7200
`lloyd.farnham@usdoj.gov
`
`C. ALDEN PELKER (MD BAR)
`Senior Counsel
`
`Department of Justice
`Computer Crime & Intellectual Property Section
`1301 New York Avenue NW, Suite 600
`Washington, D.C. 20005
`Telephone: (202) 514-1026
`catherine.pelker@usdoj.gov
`
`13
`
`Attorneys for United States of America
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`UNITED STATES DISTRICT COURT
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`SAN FRANCISCO DIVISION
`
`IN THE MATTER OF THE SEARCH OF
`CONTENT STORED AT PREMISES
`CONTROLLED BY GOOGLE INC. AND
`AS FURTHER DESCRIBED IN
`ATTACHMENT A
`
`CASE NO. 16-MC-80263-RS
`
`STIPULATION AND JOINT REQUEST TO
`CLOSE MATTER ADMINISTRATIVELY;
`ORDER
`
`This stipulation is entered into between the United States of America, acting through the United
`
`24
`
`States Attorney’s Office and the United States Department of Justice, Computer Crime & Intellectual
`
`25
`
`Property Section (the “Government”), and Google LLC (“Google”), through their authorized
`
`26
`
`representatives.
`
`27
`
`WHEREAS, the parties have agreed to a resolution of all issues in and related to this case and
`
`28
`
`the proceedings related to Google’s compliance with the search warrant issued by the Honorable Laurel
`
`STIPULATION AND ORDER 16-
`MC-80263-RS
`
`1
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 2 of 18
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`Beeler, United States Magistrate Judge for the Northern District of California, on June 30, 2016,
`
`captioned “In the Matter of the Search of CONTENT RELATED TO BTC-E THAT IS STORED AT
`
`PREMISES CONTROLLED BY GOOGLE INC. AND FURTHER DESCRIBED IN ATTACHMENT
`
`A,” Case No. 3-16-70816;
`
`WHEREAS, the resolution includes an Agreed Facts and Procedural History, attached hereto as
`
`Attachment A, and an Agreement between the parties, attached hereto as Attachment B. The Agreement
`
`involves continued and ongoing enhancements to Google’s legal process compliance program, which is
`
`intended to achieve timely and complete responses to certain legal process in compliance with
`
`applicable laws, while permitting Google to safeguard users’ privacy and limit Government access to
`
`user data except for responses to valid legal process and only to the extent authorized by law; and
`
`WHEREAS, Google estimates that it has spent more than $90 million on additional resources,
`
`systems, and staffing to implement improvements to its legal process compliance program, including in
`
`response to these proceedings. In light of these significant expenditures, the parties agree that no further
`
`14
`
`remedial compensation is warranted.
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`THEREFORE, IT IS HEREBY STIPULATED AND AGREED, by and between the
`
`undersigned parties, through their respective counsel, that this matter is fully resolved, and the parties
`
`jointly request that the Court close this case administratively.
`
`DATED: October 24, 2022
`
`STIPULATION AND ORDER 16-
`MC-80263-RS
`
`2
`
`Respectfully submitted,
`
`STEPHANIE M. HINDS
`United States Attorney
`
`LLOYD FARNHAM
`Assistant United States Attorney
`
`JOHN LYNCH
`Chief, Computer Crime & Intellectual
`Property Section
`U.S. Department of Justice
`
`C. ALDEN PELKER
`Senior Counsel
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 3 of 18
`
`DATED:
`
`WILMER CUTLER PICKERING
`HALE AND DORR LLP
`
`MARK D. FLANAGAN
`Attorneys for Google LLC
`
`ORDER CLOSING MATTER ADMINISTRATIVELY
`
`Based on the above stipulation of the parties and considering the Agreed Facts and Procedural
`
`History, attached hereto as Attachment A, and the Agreement of the parties, attached hereto as
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`Attachment B, the Court HEREBY ORDERS this matter closed, all issues having been resolved by the
`
`11
`
`parties.
`
`12
`
`This Court retains jurisdiction to resolve disputes regarding the resolution of this matter as set
`
`13
`
`forth in the Agreement of the parties.
`
`IT IS SO ORDERED.
`
`14
`
`15
`
`16
`
`DATED:
`
`October 25, 2022
`
`HONORABLE RICHARD SEEBORG
`Chief Judge, United States District Court
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`STIPULATION AND ORDER 16-
`MC-80263-RS
`
`3
`
`October 21, 2022
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 4 of 18
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`ATTACHMENT A
`AGREED FACTS AND PROCEDURAL HISTORY
`
`1.
`
`On June 30, 2016, the Honorable Laurel Beeler, U.S. Magistrate Judge for the Northern
`
`District of California, issued a search warrant pursuant to the Stored Communications Act (“SCA”),
`
`captioned “In the Matter of the Search of Content Related to BTC-e that is Stored at Premises
`
`Controlled by Google Inc. and further described in attachment A,” Case No. 16-70816-MISC-LB, (“the
`
`Warrant”) requiring Google to produce materials relevant to the investigation of an illegal
`
`cryptocurrency exchange called BTC-e and its administrators. On July 6, 2016, Homeland Security
`
`Investigations Special Agent Michael Delaney served the Warrant on Google.
`
`2.
`
`On July 14, 2016, the Second Circuit Court of Appeals issued its opinion in In the Matter
`
`of Warrant to Search a Certain E-Mail Account Controlled and Maintained by Microsoft Corp., 829 F.
`
`3d 197 (2nd Cir. 2016) (the “Microsoft Decision”). That decision held that SCA search warrants did not
`
`13
`
`reach data stored outside the United States.
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`3.
`
`Following the Microsoft Decision, Google temporarily halted processing of the Warrant.
`
`The Microsoft Decision was issued by the Second Circuit, in which Google operates but is not
`
`headquartered; however, in the absence of contrary Court of Appeals authority directly on point, Google
`
`conducted a legal analysis and decided to follow the Microsoft Decision in all Circuits, including the
`
`Ninth Circuit and the Northern District of California.
`
`4.
`
`At the time of the Microsoft Decision, in order to optimize performance, reliability, and
`
`other efficiencies, Google stored certain data in an intelligent network, which moved component parts of
`
`data seamlessly and automatically between locations. As a result, Google could not always determine
`
`the country in which certain data was stored at a given time. Following the Microsoft Decision, Google
`
`determined that in response to United States search warrants, Google was required to produce only data
`
`that it could confirm was located in the United States. However, at the time, Google’s legal export tools
`
`would collect information from across Google’s servers without regard to location and save the data
`
`within the United States. Google believed that using its legal export tools to retrieve the data in
`
`connection with the Warrant would exceed the scope of the SCA’s reach as interpreted by the Microsoft
`
`Decision and thus started developing location-aware tooling.
`
`ATTACHMENT A AGREED FACTS
`16-MC-80263-RS
`
`1
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 5 of 18
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`5.
`
`From Fall 2016 through Spring 2017, Google worked to develop location-aware tools
`
`that would allow the company to retrieve data in response to search warrants without bringing data that
`
`was potentially stored outside of the United States into the United States so that it could be preserved
`
`pending possible litigation.
`
`6.
`
`On September 27, 2016, SA Delaney contacted Google asking for the status of Google’s
`
`response to the Warrant, acknowledging the “large volume of information” it requested from Google
`
`and requesting a “partial or rolling production” if not all responsive records were available. On
`
`September 28, 2016, Google produced some data and documents that it was able to ascertain were stored
`
`in the United States in response to the Warrant. In its first production, Google acknowledged its
`
`production was only a partial response to the Warrant and that the produced responsive records were
`
`retrieved from “Google’s U.S. servers,” citing the Microsoft Decision. On October 3, 2016, HSI SA
`
`Delaney contacted Google to ask whether responsive data were omitted from Google’s production
`
`because they were stored outside of the United States, what types of responsive data were stored in
`
`foreign countries, and in which countries such data were stored. On October 12, 2016, HSI SA Delaney
`
`and a Google representative discussed the Warrant. At that time, Google indicated that certain data
`
`responsive to the Warrant were stored outside of the United States, and that Google would only produce
`
`data stored in the United States in response to the Warrant consistent with its interpretation of the
`
`18
`
`Microsoft Decision.
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`7.
`
`On November 18, 2016, Google supplemented its production to the Government based on
`
`new location-aware tooling it had developed since its first production. On November 21, 2016, Google
`
`wrote a letter to the Government providing updates on the production. In particular, Google stated that
`
`while it produced “all information it confirmed to be stored in the United States,” it did not produce
`
`other responsive data whose location Google could not determine and could not confirm to be in the
`
`United States, consistent with Google’s interpretation of the Microsoft Decision.
`
`8.
`
`The Government informed Google that its incomplete production was not satisfactory,
`
`and that if Google did not fully comply, the Government would petition the Court to hold Google in
`
`contempt. On December 6, 2016, Google filed a Motion to Quash the Warrant.
`
`9.
`
`On January 13, 2017, the Government filed an Opposition to the Motion to Quash and
`
`ATTACHMENT A AGREED FACTS
`16-MC-80263-RS
`
`2
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 6 of 18
`
`
`
`
`
`
`moved the Court for a hearing requiring Google to show cause why it was not in contempt of the Court’s
`
`warrant. At a hearing on February 21, 2017, the Honorable Laurel Beeler, United States Magistrate
`
`Judge for the Northern District of California, heard arguments by the parties. At the hearing, Magistrate
`
`Judge Beeler addressed the issue of preservation of data called for by the Warrant during the period in
`
`which Google challenged the Warrant, but stated that the issue was not before her and did not issue a
`
`specific order regarding preservation. On April 19, 2017, Magistrate Judge Beeler denied the Motion to
`
`Quash by Google, but also declined to hold a show cause hearing.
`
`10.
`
`Following Magistrate Judge Beeler’s April 2017 order, Google produced additional
`
`responsive data it confirmed to be stored in the United States on May 2, 2017, and noted in its
`
`production letter that it had not produced all data sought by the Warrant. In May 2017, Google
`
`continued to work on preserving the remaining data.
`
`11.
`
`On May 3, 2017, Google appealed the order of Magistrate Judge Beeler. The appeal was
`
`assigned to the Honorable Richard Seeborg, United States District Judge for the Northern District of
`
`California. Judge Seeborg held a hearing on the matter on August 10, 2017. In briefing and during the
`
`hearing, the Government asked that the Court hold Google in contempt and hold a show cause hearing.
`
`On August 14, 2017, Judge Seeborg upheld the ruling by Magistrate Judge Beeler that Google must
`
`comply fully with the Warrant regardless of whether data was overseas or in the United States and noted
`
`that “[i]n light of the Second Circuit decision in Microsoft and the absence of relevant Ninth Circuit
`
`precedent, Google’s diligent, good faith efforts to comply with current law do not warrant contempt at
`
`this stage of the proceedings.” Google indicated a desire to appeal Judge Seeborg’s August 14, 2017
`
`ruling to the Ninth Circuit to ensure that it did not produce data unless compelled by law, consistent with
`
`Google’s policies of protecting users’ privacy. To take that appeal would require a contempt order by
`
`Judge Seeborg. Accordingly, Google moved for an order finding it in civil contempt.
`
`12.
`
`On October 19, 2017, pursuant to Google’s request, Judge Seeborg entered an order of
`
`civil contempt against Google so that Google could bring its appeal of Judge Seeborg’s August 17, 2017
`
`order that Google must comply fully with the Warrant regardless of whether data was overseas or in the
`
`United States. Judge Seeborg ordered Google to preserve data responsive to the Warrant in his October
`
`19, 2017 order. Google informed Judge Seeborg that it would preserve responsive data, including such
`
`ATTACHMENT A AGREED FACTS
`16-MC-80263-RS
`
`3
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 7 of 18
`
`
`
`
`
`
`data stored abroad, during the pendency of the litigation and the appeal to the Ninth Circuit. On
`
`November 28, 2017, Google filed an appeal to the United States Court of Appeals for the Ninth Circuit.
`
`13.
`
`On March 23, 2018, the United States Congress passed the CLOUD Act, which made
`
`clear that a warrant requires disclosure of information held by a provider even if the provider chooses to
`
`store data overseas.
`
`14.
`
`On July 13, 2018, during the pendency of the appeal, the United States Attorney’s Office
`
`indicated to Google that the Government intended to investigate whether data responsive to the Warrant
`
`had been lost and whether that constituted criminal contempt. Google informed the Government that
`
`Google would cooperate in that investigation. On or about August 3, 2018, Google reported to the
`
`Government that, due to issues with designing and implementing Google’s tools intended to preserve
`
`data without repatriating the data, some data had been deleted by a user, and therefore was no longer
`
`available to Google. Google likewise informed the Ninth Circuit in connection with the pending appeal.
`
`15.
`
`On September 4, 2018, Google formally presented to the Government on what had
`
`happened to the data. Google advised that despite having taken steps to preserve data responsive to the
`
`Warrant, its preservation had inadvertently not extended to certain files, including 6 photographs deleted
`
`by the user subsequent to Judge Seeborg’s October 19, 2017 preservation order. Google took actions in
`
`May 2017 to preserve potentially responsive data. It was not recognized until after the deletions had
`
`occurred that the steps taken in May 2017 did not extend to photographs because tooling that allowed
`
`preservation without repatriation had not been developed for photographs as of that time. Google also
`
`reported that there were some categories of data for which it could not determine whether data had
`
`become unavailable between the service of the Warrant on July 6, 2016 and May 2017, when Google
`
`undertook additional efforts to preserve data responsive to the Warrant.
`
`16.
`
`Google agrees that its interpretation of the Microsoft Decision, litigation in this matter,
`
`and insufficient tooling delayed its final production of data responsive to the Warrant and, combined
`
`with inadvertent human error, allowed the user’s deletion of information after service of the Warrant,
`
`resulting in Google being unable to produce data that had been in its possession and was responsive to
`
`the Warrant at the time the Warrant was executed on Google.
`
`17.
`
`In a separate 2014 matter, In Re Search of the Content of Gmail Account and In Re
`
`ATTACHMENT A AGREED FACTS
`16-MC-80263-RS
`
`4
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 8 of 18
`
`
`
`
`Search of the Content of Account (XXX) XXX-9145 Serviced by Google Voice, Case No. 13-90556-
`
`MISC-LB (N.D. Cal. 2014), Google acknowledged it had not responded completely to legal process
`
`related to investigations by the United States Attorney’s Office for the Northern District of California
`
`and that certain data was lost that would have been responsive to the legal process. In connection with
`
`the settlement and agreed resolution of that matter, Google undertook improvements to its program for
`
`complying with legal process, including increasing the size of its law enforcement compliance unit,
`
`decreasing the average response times for legal process, creating a dedicated email address for law
`
`enforcement to request expedited responses, and improving its engineering efforts to respond to legal
`
`process.
`
`18.
`
`On November 20, 2020, Google met with representatives of the Department of Justice
`
`and described the compliance structure around Google’s program for complying with legal process
`
`propounded by United States law enforcement to ensure timeliness and completeness while respecting
`
`the rights of its users and enhancements to that program that Google had voluntarily undertaken and to
`
`which Google was committed to continuing to voluntarily undertake. On April 8, 2021, Google
`
`provided an update on the program and enhancements.
`
`
`
`
`
`
`
`
`
`
`
`
`ATTACHMENT A AGREED FACTS
`16-MC-80263-RS
`
`5
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 9 of 18
`
`
`
`
`
`
`1
`
`2
`
`3
`
`I.
`
`Introduction
`
`ATTACHMENT B
`AGREEMENT
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`Google LLC (“Google” or the “Company”) and the United States of America, acting through the
`
`United States Department of Justice and the United States Attorney’s Office for the Northern District of
`
`California (the “Government”), have agreed to resolve all issues in and related to the following matter,
`
`In the Matter of the Search of Content Stored at Premises Controlled by Google Inc. and as Further
`
`Described in Attachment A, Case No. 16-MC-80263-RS, a proceeding initiated on December 6, 2016, in
`
`the United States District Court for the Northern District of California, related to a search warrant issued
`
`on June 30, 2016, captioned In the Matter of the Search of Content Related to BTC-E that is Stored at
`
`Premises Controlled by Google Inc. and Further Described in Attachment A, Case No. 16-70816-MISC-
`
`12
`
`LB.
`
`13
`
`14
`
`15
`
`The parties are filing a Stipulation and Joint Request to Close Matter Administratively regarding
`
`this matter concurrently with this Agreement. As stated in that Stipulation, the resolution of the matter
`
`also includes (1) an agreed upon statement of facts and (2) the Agreement of the parties as contained
`
`16
`
`herein.
`
`17
`
`18
`
`19
`
`20
`
`21
`
`Nothing herein limits Google’s ability to challenge any future legal process, including on the
`
`basis of legal process being overbroad, unconstitutional, or otherwise unlawful, and to advocate on
`
`behalf of users of its products and services. Further, nothing herein limits Google’s enforcement of its
`
`policies safeguarding users’ privacy and limiting Government access to user data by producing data only
`
`in response to valid legal process and only to the extent authorized by law.
`
`22
`
`II.
`
`Definitions
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`The following terms, when used with initial capitalization herein, have the indicated meanings:
`
`A.
`
`Data – data that is (i) directly generated by Google users or reflects Google user conduct
`
`and (ii) is reasonably likely to be material and relevant to typical law enforcement
`
`investigations.
`
`B.
`
`Effective Date – the date on which the following conditions are met: (1) the Agreement
`
`is executed by all signatories hereto and (2) the Independent Compliance Professional
`
`ATTACHMENT B AGREEMENT
`16-MC-80263-RS
`
`1
`
`
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 10 of 18
`
`
`
`
`
`
`accepts the engagement described in this Agreement.
`
`C.
`
`Enhancements – enhancements to Google’s Legal Process Compliance Program, as
`
`described below in section IV.
`
`D.
`
`Legal Process – process issued by a federal court, federal grand jury, or federal agency
`
`that is valid and properly served for obtaining, or causing the preservation of, Data in
`
`Google’s possession for federal law enforcement purposes, not limited to federal process
`
`from, or in support of, a United States Attorney’s Office for a particular District or
`
`particular component of the United States Department of Justice, and excluding such
`
`process authorized by the Foreign Intelligence Surveillance Act, National Security
`
`Letters, and 18 U.S.C. § 2709, including: preservation requests issued under 18 U.S.C. §
`
`2703(f), search warrants, court orders issued under 18 U.S.C. § 2703(d), pen-
`
`register/trap-and-trace orders, wiretap orders, and subpoenas.
`
`E.
`
`Legal Process Compliance Program – a program run by Google reasonably designed to
`
`achieve timely and complete responses to Legal Process and compliance with applicable
`
`laws and policies safeguarding users’ privacy and limiting Government access to user
`
`data.
`
`F.
`
`Independent Compliance Professional – an independent third-party professional with
`
`expertise in audit and compliance whose functions and responsibilities are elaborated
`
`herein. As used herein, the term “independent” means able to perform the
`
`responsibilities outlined in this Agreement with integrity, objectivity, and freedom from
`
`conflicts of interest, and does not preclude the engagement of a third party solely for
`
`having had engagements with Google in other contexts.
`
`G.
`
`Reports refers collectively to the following three types of reports:
`
`i.
`
`Initial Report – a report, including an addendum reflecting Google’s consultation
`
`with the Independent Compliance Professional, prepared by Google that Google
`
`will issue to the Google Compliance Steering Committee, the Audit and
`
`Compliance Committee of the Alphabet Board of Directors, and the Government
`
`within 120 calendar days of retaining the Independent Compliance Professional.
`
`ATTACHMENT B AGREEMENT
`16-MC-80263-RS
`
`2
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 11 of 18
`
`
`
`
`ii.
`
`Annual Report – a report, including an addendum reflecting Google’s
`
`consultation with the Independent Compliance Professional, prepared by Google
`
`that Google will issue to the Google Compliance Steering Committee, the Audit
`
`and Compliance Committee of the Alphabet Board of Directors, and the
`
`Government each year during the term of this Agreement, beginning one year
`
`after issuance of the Initial Report.
`
`iii.
`
`Final Report – a report, including an addendum reflecting Google’s consultation
`
`with the Independent Compliance Professional, prepared by Google that Google
`
`will issue at the conclusion of the term of this Agreement to the Google
`
`Compliance Steering Committee, the Audit and Compliance Committee of the
`
`Alphabet Board of Directors, and the Government.
`
`H.
`
`Six-Month Interim Update – a brief status update that Google will provide to the
`
`Government six months before each Annual Report is issued.
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`III.
`
`Legal Process Compliance Program Generally
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`Google will continue to maintain a Legal Process Compliance Program with the characteristics
`
`set forth below. The Legal Process Compliance Program will be reasonably designed to achieve timely
`
`and complete compliance with Legal Process. The Legal Process Compliance Program will have the
`
`following components and characteristics: data-driven risk assessments; policies and procedures;
`
`training and communication tools; systems for reporting compliance concerns; risk-based due diligence
`
`of third-party relationships; due diligence on mergers and acquisitions; an autonomous, well-structured
`
`and adequately resourced program; support from all levels of Google; processes to promote compliance
`
`and ethical behaviors; systems to monitor and regularly review performance; and a properly scoped
`
`23
`
`investigation team.
`
`24
`
`25
`
`To the extent that Google has already begun or completed the steps set forth below as of the time
`
`of this Agreement, the efforts will be deemed to satisfy the corresponding obligations under the
`
`26
`
`Agreement.
`
`27
`
`IV.
`
`Legal Process Compliance Program Enhancements
`
`28
`
`
`
`In furtherance of that Legal Process Compliance Program, Google has undertaken, or will
`
`ATTACHMENT B AGREEMENT
`16-MC-80263-RS
`
`3
`
`
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 12 of 18
`
`
`
`
`
`
`undertake, the following:
`
`A.
`
`Continuous Improvements and Testing
`
`The Legal Process Compliance Program will include processes reasonably designed to achieve a
`
`comprehensive understanding of the Data for those of Google’s products and services likely to generate
`
`Data, including periodic reviews and updates as products and services change over time.
`
`The Legal Process Compliance Program will include monitoring, processes, and quality
`
`assurance mechanisms reasonably designed to achieve the proper identification, preservation, and
`
`production of Data, including Data associated with a searchable identifier, in order to achieve timely and
`
`complete compliance with Legal Process, regardless of Google service used.
`
`B.
`
`Timeliness and Completeness
`
`The Legal Process Compliance Program will include processes and procedures reasonably
`
`designed to respond to all Legal Process within the time provided or to communicate to the Court and/or
`
`to the proponent of the Legal Process that there will be delay or to otherwise seek legal action to quash,
`
`narrow, seek additional time, exclude, or modify the Legal Process. For any instance where a court-
`
`ordered or grand jury production deadline is missed, Google will generate a compliance timeliness
`
`record capturing the reason for the missed production deadline and when production was made, except
`
`for productions made within 14 days of service of the Legal Process, where the court-ordered or grand
`
`jury production deadline was less than 14 days from the date of service. These records may be made
`
`available to the Independent Compliance Professional and/or to the AUSA or agent responsible for the
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`Legal Process service upon request.
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`The Legal Process Compliance Program will also include systems for reporting compliance
`
`concerns, including, but not limited to, an escalation process to address actual or potential non-
`
`compliance with the timeliness or completeness of productions in response to Legal Process. That
`
`escalation process will include escalation to the Chief Compliance Officer and the Head of Regulatory
`
`Response, Investigations, and Strategy in instances of potential culpability of a Google employee or
`
`agent where remediation or disciplinary action may be warranted.
`
`C.
`
`Autonomy and Resources
`
`The Legal Process Compliance Program will be reasonably designed to be autonomous, well-
`
`ATTACHMENT B AGREEMENT
`16-MC-80263-RS
`
`4
`
`
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 13 of 18
`
`
`
`
`
`
`structured, and adequately resourced and to accomplish the Enhancements set forth in this Agreement,
`
`including the following:
`
`i.
`
`Tooling
`
`Google will identify the products whose Data are most widely requested by the Government and
`
`assess whether relevant Google personnel have adequate and efficient access to that Data for the purpose
`
`of responding to Legal Process, thereby developing a list of “priority products” for integration with
`
`tooling. The list of priority products may change over time.
`
`Google will integrate the priority products with its Legal Process response tools and will develop
`
`and maintain related tooling. Google will have processes reasonably designed to test the tooling for
`
`accuracy and completeness and maintain integrations up to date with Data changes.
`
`ii.
`
`Product Launches
`
`Google will develop processes reasonably designed to flag new launches for those products and
`
`services that will generate Data, which will include how Google will respond to Legal Process for Data
`
`associated with those new products and services, and may include integration with tooling.
`
`iii.
`
`Compliance Staffing
`
`Google will maintain a Legal Process Compliance Program reasonably designed to achieve
`
`adequate staffing levels to support the Legal Process Compliance Program, including ramp-up protocols
`
`to allow Google to surge compliance resources as necessary. Google will hire and retain compliance
`
`leads embedded in the Legal Process Compliance Program, who will provide a systemic view of
`
`operational and regulatory compliance. Google’s Chief Compliance Officer and Head of Regulatory
`
`Response, Investigations, and Strategy will oversee Google’s compliance efforts, including
`
`Enhancements to the Legal Process Compliance Program. Google executives will support and promote
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`the Legal Process Compliance Program.
`
`24
`
`25
`
`26
`
`Google’s Legal Process Compliance Program will operate with independence and autonomy and
`
`will be designed such that the Chief Compliance Officer, Head of Regulatory Response, Investigations,
`
`and Strategy, and compliance staff have adequate resources to perform their duties with respect to the
`
`27
`
`Legal Process Compliance Program.
`
`28
`
`
`
`ATTACHMENT B AGREEMENT
`16-MC-80263-RS
`
`5
`
`
`
`

`

`Case 3:16-mc-80263-RS Document 113 Filed 10/25/22 Page 14 of 18
`
`
`
`
`
`
`iv.
`
`Dedicated Engineering Resources
`
`Google will establish a process reasonably designed to effectuate the allocation of adequate
`
`engineering resources to support tooling improvement initiatives and to ensure processes and tooling for
`
`responding to Legal Process are feasible, accurate, and complete.
`
`D.
`
`Updated Legal Response Policies and Training
`
`The Legal Process Compliance Program will include processes and procedures reasonably
`
`designed to articulate and communicate Google’s commitment to compliance. This will include (1)
`
`maintaining policies and procedures for responding to Legal Process that are designed to achieve clarity,
`
`usability, and improved transparency; (2) reviewing and amending the policies and procedures as
`
`necessary to ensure they are readily and robustly understood by Google personnel who are tasked with
`
`responding to Legal Process; and (3) developing and maintaining a robust training program for
`
`personnel involved in responding to Legal Process. Google will ensure adequate communication and
`
`education of all relevant employees to educate them on the Legal Process Compliance Program.
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`V.
`
`Independent Compliance Professional
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`A.
`
`Qualifications and Selection
`
`Google shall retain an Independent Compliance Professional (as described in section II.F above).
`
`The Government may object to Google’s proposed Independent Compliance Professional on the grounds
`
`of a lack of independence, as defined in section II.F, or a lack of the requisite expertise needed to serve
`
`effectively in the role. If the parties are unable to agree on an acceptable retained Independent
`
`Compliance Professional, they may submit the matter to the Court for resolution.
`
`The Independent Compliance Professional’s functions will be in place for a three-year period
`
`from the Effective Date of this Agreement, subject to one two-year extension as set forth in section VII
`
`23
`
`below.
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`If the Independent Compliance Professional resigns or is otherwise unable to fulfill its
`
`obligations as set forth herein, Google will retain a replacement Independent Compli