Criminal Justice & the Rule of Law Surveillance & Privacy

Skirting Judicial Scrutiny by Mooting and Scooting

Richard Salgado
Wednesday, February 26, 2025, 2:00 PM

We rely on providers to resist improper surveillance. The Justice Department uses a “moot and scoot” tactic to hobble this protection.

Cybersecurity. (Tim Reckmann, https://ccnull.de/foto/cybersecurity/1105048, CC-BY 2.0)

Published by The Lawfare Institute
in Cooperation With
Brookings

Increasingly, people rely on service providers as gatekeepers of the data they entrust to them, including scrutinizing and resisting improper government surveillance demands. The Department of Justice, however, has deployed a “moot and scoot” tactic to frustrate this gatekeeping function and keep challenges under wraps.

As Orin Kerr explained more than a decade ago, we can’t rely on defense counsel motions to check on government overreach as the law stands now. There are three oft-cited reasons for this. First, there is no suppression remedy for evidence collected from a provider in violation of core surveillance statutes. Neither the Stored Communications Act nor the Pen Register and Trap and Trace Devices statute provides for a suppression remedy for a violation. And the Wiretap Act has no suppression remedy for improper acquisition of electronic communications. Unless the violation is one that contravenes the constitutional rights of the defendant, there’s no hope for suppression and no real point in defense counsel raising it, even if the constitutional rights of others are violated. Second, where defense counsel can point to a violation of the defendant’s constitutional rights, courts can avoid ruling on the merits of the suppression motion by first applying the good-faith doctrine. The reasoning goes that even if the objection was valid, the evidence would still be admissible due to law enforcement’s good-faith reliance on the legal process. Third, and perhaps most important, not all surveillance by the government leads to a criminal trial, or even a suspect for that matter. While many have been subject to surveillance, many have also not been a criminal defendant and therefore had no defense counsel to raise an objection. 

Hope is not lost. Significantly, the providers themselves can play a critical, if limited, role. As a matter of course and necessity, providers scrutinize surveillance demands issued under these statutes and many object to those that they assess as invalid or materially flawed in whole or part. Often, when a provider is served with legal process demanding that it take action for the government that is problematic, its first step is to inform the investigating agent or the prosecutor of the issues. The goal is to address the problems through a conversation. If the back and forth doesn’t lead to a resolution, the court can be brought in to resolve the matter.

Regrettably, the Department of Justice, specifically its Criminal Division, has behaved in a manner that frustrates this approach and, worse, is seemingly designed to keep provider objections from receiving judicial review at all. To accomplish this, the Justice Department simply refuses to confront the objections unless the provider expends the resources to file a motion with the court, and if the provider does so, the government quickly moots the challenge by withdrawing the demands before a court can rule on the objections. The government’s abandoned undertakings, and the flaws identified by the providers, are then obscured from view through a cocktail of sealed filings and nondisclosure orders issued at the government’s behest. Mooting the issues before a court rules, and burying the matter, leaves the government free to scoot away with the technique unevaluated and untarnished by a loss in court.

At first glance, this practice of pursuing a surveillance technique until it is on the precipice of an adverse court ruling may seem to be a tactic one should accept with a shrug, and perhaps even applause. It could be that, in spite of detailed exchanges with the provider, the government didn’t understand until enlightened by a provider’s formal motion to quash why its demand is unconstitutional, violative of statute, based on an incorrect understanding of the underlying technology, impractical, or otherwise offensive to civil norms. And dropping the demand is simply the right thing to do. The provider should perhaps feel vindicated having the government ultimately withdraw the demand, even if the government waited until the provider filed a motion. After all, counsel for a typical litigant in an adversarial system is expected to pursue their client’s position with vigor and allow the process to unfold, unless counsel deems the position untenable, in which case they should withdraw that position.

The Justice Department’s Criminal Division is no normal litigant however. It represents the government and the public interest, and wields extraordinary powers and co-commitment obligations that go beyond advocating for a client. The Justice Department properly acknowledges its responsibilities to uphold the rule of law, to follow the facts and the law wherever they may lead, and to maintain the integrity of the legal system as a whole. In this perhaps idealized version of the Justice Department, the government is expected to act consistent with the public good, not just in the pursuit of a conviction.

In these cases, the government is well aware of the objections through often detailed discussions with the provider, before any formal filing is made. Yet the government often treats the exchanges as unworthy of consideration and takes the time to reflect on its actions only if the provider expends the funds to prepare and file a motion (which will easily exceed $20,000 in attorneys fees alone) and the court is brought in. At that point, the government quickly withdraws the demand and moots the objections and avoids a potential adverse ruling. The ignoble surveillance technique remains at the ready to deploy again, and the provider has been taught it will pay a price for the fight with no ruling at the end. Perhaps next time the government will meet a provider that is less alert, or is less likely or has fewer resources to contest, and will be before a court and with facts more sympathetic to the government. And if not, the government can just withdraw and moot the whole thing again. If deftly applied as a strategy, the law will develop as the government wishes, ever ratcheting in its favor. The gamers out there will note that the technique enjoys infinite respawns and save points.

For providers who mount formal challenges to what they see as legally questionable demands for the disclosure of user data, the response by federal prosecutors to moot the matter by withdrawing the demand is all too familiar. The determined provider may expend yet more time and expense in an attempt to unseal at least part of the record. Success often involves tedious line-by-line negotiations with the government, and plenty kept underwraps. Seldom is the case brought to light for all to see. But there are now recently unveiled examples.

District of New Mexico

The first example of this strategy is on display in New Mexico in an investigation by the FBI and local law enforcement into several murders spanning over 2021 and 2022. The relevant docket and the filings have now been unsealed, much to the credit of the U.S. Attorney’s Office for the District of New Mexico, which joined the provider in a motion to unseal. It gives the world a rare glimpse into how the government can avoid serious challenges to its conduct.

Investigative journalist Ryan Laughlin writing for KOB News reported on a geofence warrant issued to Google. Generally speaking, the term “geofence warrant,” when used with regard to Google, describes a search warrant issued under the Stored Communications Act to compel Google to search the content of the Location History accounts of all Location History subscribers looking for entries that fall within the geographic areas and added within a time frame identified in the warrant. The warrant then commands Google to produce some class or classes of information about the subscribers who have such entries in their Location History accounts. In this case, the warrant covered multiple locations. One was the Islamic Center of New Mexico. As shown in the application for the warrant, the goal of the FBI was to identify those who attended the funeral of two victims.

It’s possible that when issuing the warrant, the magistrate judge didn’t fully understand that the warrant included the Islamic Center and surroundings, or that there was any sort of particular event of interest, much less a funeral. In its written search application, which was sworn telephonically, the government explicitly mentioned the place of worship but, when describing the search parameters, used only the latitude and longitude coordinates to describe the areas of interest (in this case, “Target Location: a radius of 300 meters around 35.0683260, -106.6216778”). The application failed to provide maps to the court with human-friendly descriptions. The magistrate judge issued the warrant.

The government also asked the court to seal the warrant and issue a one-year gag on Google. The court granted both requests. The day after the warrant was secured and presented to Google, the government arrested four people. It pressed on with the geofence warrant nonetheless and took no action to unseal the warrant or ungag Google. Although there were press reports of the arrests, there’s no suggestion in the docket that the prosecution alerted the court to the arrests, much less to the possibility that the facts presented to the court to obtain the warrant, to seal it, or to gag Google had changed.

According to the filings, Google promptly expressed its concerns about the warrant to the government, while also moving forward with the substantial effort needed to comply. All of its attempts to work with the government to narrow the warrant were rebuffed. Google then moved to quash on multiple grounds. I’ll resist the urge to get into the substantial legal problems with the warrant here, most of which are obvious. Google laid them out well in its motion, and the U.S. Court of Appeals for the Fifth Circuit has since found such warrants fatally flawed under the Fourth Amendment, setting up a potential conflict with the U.S. Court of Appeals for the Fourth Circuit. (The Fourth Circuit is rehearing the case, automatically vacating the panel decision.) Suffice it to say that the challenge brought by Google was a compelling one. The U.S. attorney was quoted by reporter Laughlin as saying that the reporter’s concerns about extending the search to the funeral were “real” and valid” while also defending the warrant.

In spite of this, the government’s response in court was not to defend the warrant or its legal basis, other than to pronounce that the warrant was “perfectly consistent with the mandates of the Fourth Amendment.” Rather, the government withdrew the warrant, claiming to do so “in part because the investigation has progressed” and that it anticipated submitting an amended warrant in its stead. The response doesn’t say what else motivated this decision, and the docket does not reflect that the government sought a new warrant. The government then asked the court to deny the motion to quash the warrant as moot. 

The magistrate judge was clearly concerned by the government’s behavior, perhaps in part because this was the second time in a three-month period that the U.S. Attorney’s Office in New Mexico withdrew a geofence warrant rather than litigating a motion brought by Google. But the court concluded that its hands were tied; the withdrawal by the government rendered the dispute moot, leaving the court without jurisdiction. Interestingly, the magistrate judge actually granted the motion to quash based on the mootness of the warrant. Technically this is not what the government had asked for, and it’s not clear how this is consistent with the court’s professed loss of jurisdiction, but it allowed the government to avoid having to defend the warrant and for the magistrate judge to say that Google received the remedy it sought.

The magistrate judge went further though. While expressly not questioning the government’s “investigative techniques or motives,” the magistrate judge said:

The Court is left to imagine whether the criminal investigation had “progressed” sufficiently with that arrest, or sometime shortly thereafter, so that the Government could have withdrawn its warrant long before … Google sought quashal. The Court is perplexed by this timing and encourages the Government to act more expeditiously, so as to avoid unnecessary expenditure of resources whenever possible. 

It’s not possible to get into the heads of the government officials involved in this matter. It’s only fair to note that this was a serious case that rocked the city, and one could expect a thorough, perhaps forward leaning, investigative approach generally. What is clear is that the geofence warrant was at best problematic. The government was able to avoid scrutiny in an adversarial proceeding by simply walking away after a formal motion to quash was filed.

Middle District of Florida

A second, and older, illustration of this just came to light out of the Middle District of Florida. The light here is very dim due to the heavy redactions in the unsealed material and the fact that the redacted documents are held in court chambers (not the clerk’s office) even now, more than four years after the warrant was issued. From what one can glean from the sparse words that appear between the redaction bars in Google’s motion, on Sept. 8, 2020, the government sought and obtained a “keyword search warrant” directed at Google for information about all users who submitted to Google any search query that matches those specified in two long lists of terms in the warrant. Presumably each list applied to a different Google service. The government also sought and received a year-long gag order on Google, preventing Google from notifying its users or anyone else.

What exact information the government sought is unclear from the redacted materials, though the scant unredacted portions of the motion suggest it was far more than the identity of each user who performed matching searches. The redactions make it difficult to understand much more than that. What we do know is that on June 15, 2021, Google moved to quash based on lack of particularity and specificity. Nine days later, the government filed a return on the warrant, which the court concluded rendered the motion moot. (In the New Mexico case, the FBI warrant return simply stated “withdrawing warrant.” Perhaps that was the case here, but that return remains sealed.) Once again, a reverse warrant of questionable legality was protected from judicial review. 

Northern District of California

A peek into a third case, out of the Northern District of California, just became available as reported by Forbes. Like the New Mexico cases, this too involved a geofence warrant. The search warrant and supporting materials, and the exhibits to Google’s motion to quash remain sealed. Still, the motion to quash the warrant, as heavily redacted as it is, gives a glimpse into the breadth of the government’s attempted and abandoned demand.

In this instance, according to the motion to quash, the government sought to compel Google to search the contents of all account holders who subscribed to Location History, using search parameters that covered 13 areas and various time periods: 

The search spans a combined area of more than 1,600 acres—or approximately 2.5 square miles—for a total period of nearly two-and-a-half days. The search areas comprise, among other things, thousands of homes, numerous places of worship, multiple schools, many businesses, and highways and other busy roadways.

At least five of the areas covered were in San Francisco, the most densely populated major city in the United States after New York City. Not surprisingly, the number of accounts that fit the government’s search criteria according to Google’s motion was enormous, amounting to over 2,600.

That such a warrant was problematic should have been apparent to the government before it even began the application process, but it proceeded anyway, and it took a motion to quash for the government to react. The government quickly followed the playbook and withdrew the warrant. The court then denied the motion to quash as moot. Approximately 30 days elapsed between the issuance of the warrant and the court’s order. Exactly a year after Google filed its motion to quash, the court partially unsealed the file and lifted the gag on Google to the same degree. The surveillance technique is left unscathed by judicial scrutiny, and many details remain in the dark.

What to Do?

Practitioners in this field will recognize this behavior as a common tactic by federal prosecutors, one not limited to geofence or keyword search warrants. There may be ways to check this practice, while not infringing on the government’s prerogative to conduct the investigation as it deems appropriate.

Certainly the Justice Department could correct this directly through a policy change. There could also be room for a court to act when the government drops a demand upon the filing of a motion. A court could conclude, for example, that the matter is not moot as to the particular technique at issue because the government’s ability to make another materially equivalent demand is capable of repetition yet evasive of review. One could also imagine a legal mechanism, built into the individual court-issued legal process or by statute, that permits an objecting provider to secure a judicial check on the government’s decision to withdraw a demand to ensure it is not done for the purpose of evading judicial review. Arguably, at least, the prosecution should have to explain to the judge why it did not do what is “commanded” by the judge in most warrants.

Understanding that this utterly wasteful charade exists, calling it out for what it is, and recognizing its negative consequences is a starting point to improving the state of affairs.


Richard Salgado teaches at Stanford and Harvard Law Schools. He also serves as an Advisory Board Member of American University Washington College of Law’s Tech Law and Security Program, a Visiting Fellow on Security and Surveillance with the Cross-Border Data Forum, and a Senior Associate (Non-resident) with the Center for Strategic and International Studies. Richard founded a consultancy to provide guidance to organizations navigating cybersecurity and surveillance challenges. Richard has over 35 years of experience across the private sector, government and academia, including as Google’s Director of Law Enforcement & Information Security for 13 years, and as a prosecutor with the Computer Crime and Intellectual Property Section of the Justice Department.
}

Subscribe to Lawfare