In the Matter of the Search of Content Stored at Premises Controlled by Google Inc. and as Further Described in Attachment A

Filing 113

STIPULATION AND ORDER RE 112 JOINT REQUEST TO CLOSE MATTER ADMINISTRATIVELY. Signed by Chief Judge Richard Seeborg on 10/25/2022. (cl, COURT STAFF) (Filed on 10/25/2022)

1 STEPHANIE M. HINDS (CABN 154284)
United States Attorney
2
THOMAS A. COLTHURST (CABN 99493)
3 Chief, Criminal Division
4 LLOYD FARNHAM (CABN 202231)
Assistant United States Attorney
5
450 Golden Gate Avenue, Box 36055
San Francisco, California 94102-3495
6
Telephone: [phone]
[e-mail]
7
8 C. ALDEN PELKER (MD BAR)
Senior Counsel
9
Department of Justice
Computer Crime & Intellectual Property Section
10
1301 New York Avenue NW, Suite 600
Washington, D.C. 20005
11
Telephone: [phone]
[e-mail]
12
13 Attorneys for United States of America
14
UNITED STATES DISTRICT COURT
15
NORTHERN DISTRICT OF CALIFORNIA
16
SAN FRANCISCO DIVISION
17
18
19
20

CASE NO. 16-MC-80263-RS

IN THE MATTER OF THE SEARCH OF
CONTENT STORED AT PREMISES
CONTROLLED BY GOOGLE INC. AND
AS FURTHER DESCRIBED IN
ATTACHMENT A

STIPULATION AND JOINT REQUEST TO
CLOSE MATTER ADMINISTRATIVELY;
ORDER

21
22
23

This stipulation is entered into between the United States of America, acting through the United

24 States Attorney’s Office and the United States Department of Justice, Computer Crime & Intellectual
25 Property Section (the “Government”), and Google LLC (“Google”), through their authorized
26 representatives.
27

WHEREAS, the parties have agreed to a resolution of all issues in and related to this case and

28 the proceedings related to Google’s compliance with the search warrant issued by the Honorable Laurel
STIPULATION AND ORDER 16MC-80263-RS

1

1 Beeler, United States Magistrate Judge for the Northern District of California, on June 30, 2016,
2 captioned “In the Matter of the Search of CONTENT RELATED TO BTC-E THAT IS STORED AT
3 PREMISES CONTROLLED BY GOOGLE INC. AND FURTHER DESCRIBED IN ATTACHMENT
4 A,” Case No. 3-16-70816;
5

WHEREAS, the resolution includes an Agreed Facts and Procedural History, attached hereto as

6 Attachment A, and an Agreement between the parties, attached hereto as Attachment B. The Agreement
7 involves continued and ongoing enhancements to Google’s legal process compliance program, which is
8 intended to achieve timely and complete responses to certain legal process in compliance with
9 applicable laws, while permitting Google to safeguard users’ privacy and limit Government access to
10 user data except for responses to valid legal process and only to the extent authorized by law; and
11

WHEREAS, Google estimates that it has spent more than $90 million on additional resources,

12 systems, and staffing to implement improvements to its legal process compliance program, including in
13 response to these proceedings. In light of these significant expenditures, the parties agree that no further
14 remedial compensation is warranted.
15

THEREFORE, IT IS HEREBY STIPULATED AND AGREED, by and between the

16 undersigned parties, through their respective counsel, that this matter is fully resolved, and the parties
17 jointly request that the Court close this case administratively.
18 DATED: October 24, 2022

Respectfully submitted,

19

STEPHANIE M. HINDS
United States Attorney

20
21
LLOYD FARNHAM
Assistant United States Attorney

22
23

JOHN LYNCH
Chief, Computer Crime & Intellectual
Property Section
U.S. Department of Justice

24
25
26

C. ALDEN PELKER
Senior Counsel

27
28
STIPULATION AND ORDER 16MC-80263-RS

2

1 DATED: October 21, 2022

WILMER CUTLER PICKERING
HALE AND DORR LLP

2
3
MARK D. FLANAGAN
Attorneys for Google LLC

4
5
6
7

ORDER CLOSING MATTER ADMINISTRATIVELY
Based on the above stipulation of the parties and considering the Agreed Facts and Procedural

8

9 History, attached hereto as Attachment A, and the Agreement of the parties, attached hereto as
10 Attachment B, the Court HEREBY ORDERS this matter closed, all issues having been resolved by the
11 parties.
12

This Court retains jurisdiction to resolve disputes regarding the resolution of this matter as set

13 forth in the Agreement of the parties.
14

IT IS SO ORDERED.

15
16 DATED: October 25, 2022
17
HONORABLE RICHARD SEEBORG
Chief Judge, United States District Court

18
19
20
21
22
23
24
25
26
27
28
STIPULATION AND ORDER 16MC-80263-RS

3

1

ATTACHMENT A
AGREED FACTS AND PROCEDURAL HISTORY

2
3

1.

On June 30, 2016, the Honorable Laurel Beeler, U.S. Magistrate Judge for the Northern

4 District of California, issued a search warrant pursuant to the Stored Communications Act (“SCA”),
5 captioned “In the Matter of the Search of Content Related to BTC-e that is Stored at Premises
6 Controlled by Google Inc. and further described in attachment A,” Case No. 16-70816-MISC-LB, (“the
7 Warrant”) requiring Google to produce materials relevant to the investigation of an illegal
8 cryptocurrency exchange called BTC-e and its administrators. On July 6, 2016, Homeland Security
9 Investigations Special Agent Michael Delaney served the Warrant on Google.
10

2.

On July 14, 2016, the Second Circuit Court of Appeals issued its opinion in In the Matter

11 of Warrant to Search a Certain E-Mail Account Controlled and Maintained by Microsoft Corp., 829 F.
12 3d 197 (2nd Cir. 2016) (the “Microsoft Decision”). That decision held that SCA search warrants did not
13 reach data stored outside the United States.
14

3.

Following the Microsoft Decision, Google temporarily halted processing of the Warrant.

15 The Microsoft Decision was issued by the Second Circuit, in which Google operates but is not
16 headquartered; however, in the absence of contrary Court of Appeals authority directly on point, Google
17 conducted a legal analysis and decided to follow the Microsoft Decision in all Circuits, including the
18 Ninth Circuit and the Northern District of California.
19

4.

At the time of the Microsoft Decision, in order to optimize performance, reliability, and

20 other efficiencies, Google stored certain data in an intelligent network, which moved component parts of
21 data seamlessly and automatically between locations. As a result, Google could not always determine
22 the country in which certain data was stored at a given time. Following the Microsoft Decision, Google
23 determined that in response to United States search warrants, Google was required to produce only data
24 that it could confirm was located in the United States. However, at the time, Google’s legal export tools
25 would collect information from across Google’s servers without regard to location and save the data
26 within the United States. Google believed that using its legal export tools to retrieve the data in
27 connection with the Warrant would exceed the scope of the SCA’s reach as interpreted by the Microsoft
28 Decision and thus started developing location-aware tooling.
ATTACHMENT A AGREED FACTS
16-MC-80263-RS

1

1

5.

From Fall 2016 through Spring 2017, Google worked to develop location-aware tools

2 that would allow the company to retrieve data in response to search warrants without bringing data that
3 was potentially stored outside of the United States into the United States so that it could be preserved
4 pending possible litigation.
5

6.

On September 27, 2016, SA Delaney contacted Google asking for the status of Google’s

6 response to the Warrant, acknowledging the “large volume of information” it requested from Google
7 and requesting a “partial or rolling production” if not all responsive records were available. On
8 September 28, 2016, Google produced some data and documents that it was able to ascertain were stored
9 in the United States in response to the Warrant. In its first production, Google acknowledged its
10 production was only a partial response to the Warrant and that the produced responsive records were
11 retrieved from “Google’s U.S. servers,” citing the Microsoft Decision. On October 3, 2016, HSI SA
12 Delaney contacted Google to ask whether responsive data were omitted from Google’s production
13 because they were stored outside of the United States, what types of responsive data were stored in
14 foreign countries, and in which countries such data were stored. On October 12, 2016, HSI SA Delaney
15 and a Google representative discussed the Warrant. At that time, Google indicated that certain data
16 responsive to the Warrant were stored outside of the United States, and that Google would only produce
17 data stored in the United States in response to the Warrant consistent with its interpretation of the
18 Microsoft Decision.
19

7.

On November 18, 2016, Google supplemented its production to the Government based on

20 new location-aware tooling it had developed since its first production. On November 21, 2016, Google
21 wrote a letter to the Government providing updates on the production. In particular, Google stated that
22 while it produced “all information it confirmed to be stored in the United States,” it did not produce
23 other responsive data whose location Google could not determine and could not confirm to be in the
24 United States, consistent with Google’s interpretation of the Microsoft Decision.
25

8.

The Government informed Google that its incomplete production was not satisfactory,

26 and that if Google did not fully comply, the Government would petition the Court to hold Google in
27 contempt. On December 6, 2016, Google filed a Motion to Quash the Warrant.
28

9.

On January 13, 2017, the Government filed an Opposition to the Motion to Quash and

ATTACHMENT A AGREED FACTS
16-MC-80263-RS

2

1 moved the Court for a hearing requiring Google to show cause why it was not in contempt of the Court’s
2 warrant. At a hearing on February 21, 2017, the Honorable Laurel Beeler, United States Magistrate
3 Judge for the Northern District of California, heard arguments by the parties. At the hearing, Magistrate
4 Judge Beeler addressed the issue of preservation of data called for by the Warrant during the period in
5 which Google challenged the Warrant, but stated that the issue was not before her and did not issue a
6 specific order regarding preservation. On April 19, 2017, Magistrate Judge Beeler denied the Motion to
7 Quash by Google, but also declined to hold a show cause hearing.
8

10.

Following Magistrate Judge Beeler’s April 2017 order, Google produced additional

9 responsive data it confirmed to be stored in the United States on May 2, 2017, and noted in its
10 production letter that it had not produced all data sought by the Warrant. In May 2017, Google
11 continued to work on preserving the remaining data.
12

11.

On May 3, 2017, Google appealed the order of Magistrate Judge Beeler. The appeal was

13 assigned to the Honorable Richard Seeborg, United States District Judge for the Northern District of
14 California. Judge Seeborg held a hearing on the matter on August 10, 2017. In briefing and during the
15 hearing, the Government asked that the Court hold Google in contempt and hold a show cause hearing.
16 On August 14, 2017, Judge Seeborg upheld the ruling by Magistrate Judge Beeler that Google must
17 comply fully with the Warrant regardless of whether data was overseas or in the United States and noted
18 that “[i]n light of the Second Circuit decision in Microsoft and the absence of relevant Ninth Circuit
19 precedent, Google’s diligent, good faith efforts to comply with current law do not warrant contempt at
20 this stage of the proceedings.” Google indicated a desire to appeal Judge Seeborg’s August 14, 2017
21 ruling to the Ninth Circuit to ensure that it did not produce data unless compelled by law, consistent with
22 Google’s policies of protecting users’ privacy. To take that appeal would require a contempt order by
23 Judge Seeborg. Accordingly, Google moved for an order finding it in civil contempt.
24

12.

On October 19, 2017, pursuant to Google’s request, Judge Seeborg entered an order of

25 civil contempt against Google so that Google could bring its appeal of Judge Seeborg’s August 17, 2017
26 order that Google must comply fully with the Warrant regardless of whether data was overseas or in the
27 United States. Judge Seeborg ordered Google to preserve data responsive to the Warrant in his October
28 19, 2017 order. Google informed Judge Seeborg that it would preserve responsive data, including such
ATTACHMENT A AGREED FACTS
16-MC-80263-RS

3

1 data stored abroad, during the pendency of the litigation and the appeal to the Ninth Circuit. On
2 November 28, 2017, Google filed an appeal to the United States Court of Appeals for the Ninth Circuit.
3

13.

On March 23, 2018, the United States Congress passed the CLOUD Act, which made

4 clear that a warrant requires disclosure of information held by a provider even if the provider chooses to
5 store data overseas.
6

14.

On July 13, 2018, during the pendency of the appeal, the United States Attorney’s Office

7 indicated to Google that the Government intended to investigate whether data responsive to the Warrant
8 had been lost and whether that constituted criminal contempt. Google informed the Government that
9 Google would cooperate in that investigation. On or about August 3, 2018, Google reported to the
10 Government that, due to issues with designing and implementing Google’s tools intended to preserve
11 data without repatriating the data, some data had been deleted by a user, and therefore was no longer
12 available to Google. Google likewise informed the Ninth Circuit in connection with the pending appeal.
13

15.

On September 4, 2018, Google formally presented to the Government on what had

14 happened to the data. Google advised that despite having taken steps to preserve data responsive to the
15 Warrant, its preservation had inadvertently not extended to certain files, including 6 photographs deleted
16 by the user subsequent to Judge Seeborg’s October 19, 2017 preservation order. Google took actions in
17 May 2017 to preserve potentially responsive data. It was not recognized until after the deletions had
18 occurred that the steps taken in May 2017 did not extend to photographs because tooling that allowed
19 preservation without repatriation had not been developed for photographs as of that time. Google also
20 reported that there were some categories of data for which it could not determine whether data had
21 become unavailable between the service of the Warrant on July 6, 2016 and May 2017, when Google
22 undertook additional efforts to preserve data responsive to the Warrant.
23

16.

Google agrees that its interpretation of the Microsoft Decision, litigation in this matter,

24 and insufficient tooling delayed its final production of data responsive to the Warrant and, combined
25 with inadvertent human error, allowed the user’s deletion of information after service of the Warrant,
26 resulting in Google being unable to produce data that had been in its possession and was responsive to
27 the Warrant at the time the Warrant was executed on Google.
28

17.

In a separate 2014 matter, In Re Search of the Content of Gmail Account and In Re

ATTACHMENT A AGREED FACTS
16-MC-80263-RS

4

1 Search of the Content of Account (XXX) XXX-9145 Serviced by Google Voice, Case No. 13-905562 MISC-LB (N.D. Cal. 2014), Google acknowledged it had not responded completely to legal process
3 related to investigations by the United States Attorney’s Office for the Northern District of California
4 and that certain data was lost that would have been responsive to the legal process. In connection with
5 the settlement and agreed resolution of that matter, Google undertook improvements to its program for
6 complying with legal process, including increasing the size of its law enforcement compliance unit,
7 decreasing the average response times for legal process, creating a dedicated email address for law
8 enforcement to request expedited responses, and improving its engineering efforts to respond to legal
9 process.
10

18.

On November 20, 2020, Google met with representatives of the Department of Justice

11 and described the compliance structure around Google’s program for complying with legal process
12 propounded by United States law enforcement to ensure timeliness and completeness while respecting
13 the rights of its users and enhancements to that program that Google had voluntarily undertaken and to
14 which Google was committed to continuing to voluntarily undertake. On April 8, 2021, Google
15 provided an update on the program and enhancements.
16
17
18
19
20
21
22
23
24
25
26
27
28
ATTACHMENT A AGREED FACTS
16-MC-80263-RS

5

1

ATTACHMENT B
AGREEMENT

2
3 I.

Introduction

4

Google LLC (“Google” or the “Company”) and the United States of America, acting through the

5 United States Department of Justice and the United States Attorney’s Office for the Northern District of
6 California (the “Government”), have agreed to resolve all issues in and related to the following matter,
7 In the Matter of the Search of Content Stored at Premises Controlled by Google Inc. and as Further
8 Described in Attachment A, Case No. 16-MC-80263-RS, a proceeding initiated on December 6, 2016, in
9 the United States District Court for the Northern District of California, related to a search warrant issued
10 on June 30, 2016, captioned In the Matter of the Search of Content Related to BTC-E that is Stored at
11 Premises Controlled by Google Inc. and Further Described in Attachment A, Case No. 16-70816-MISC12 LB.
The parties are filing a Stipulation and Joint Request to Close Matter Administratively regarding

13

14 this matter concurrently with this Agreement. As stated in that Stipulation, the resolution of the matter
15 also includes (1) an agreed upon statement of facts and (2) the Agreement of the parties as contained
16 herein.
Nothing herein limits Google’s ability to challenge any future legal process, including on the

17

18 basis of legal process being overbroad, unconstitutional, or otherwise unlawful, and to advocate on
19 behalf of users of its products and services. Further, nothing herein limits Google’s enforcement of its
20 policies safeguarding users’ privacy and limiting Government access to user data by producing data only
21 in response to valid legal process and only to the extent authorized by law.
22 II.

Definitions

23

The following terms, when used with initial capitalization herein, have the indicated meanings:

24

A.

Data – data that is (i) directly generated by Google users or reflects Google user conduct

25

and (ii) is reasonably likely to be material and relevant to typical law enforcement

26

investigations.

27
28

B.

Effective Date – the date on which the following conditions are met: (1) the Agreement
is executed by all signatories hereto and (2) the Independent Compliance Professional

ATTACHMENT B AGREEMENT
16-MC-80263-RS

1

accepts the engagement described in this Agreement.

1
2

C.

described below in section IV.

3
4

Enhancements – enhancements to Google’s Legal Process Compliance Program, as

D.

Legal Process – process issued by a federal court, federal grand jury, or federal agency

5

that is valid and properly served for obtaining, or causing the preservation of, Data in

6

Google’s possession for federal law enforcement purposes, not limited to federal process

7

from, or in support of, a United States Attorney’s Office for a particular District or

8

particular component of the United States Department of Justice, and excluding such

9

process authorized by the Foreign Intelligence Surveillance Act, National Security

10

Letters, and 18 U.S.C. § 2709, including: preservation requests issued under 18 U.S.C. §

11

2703(f), search warrants, court orders issued under 18 U.S.C. § 2703(d), pen-

12

register/trap-and-trace orders, wiretap orders, and subpoenas.

13

E.

Legal Process Compliance Program – a program run by Google reasonably designed to

14

achieve timely and complete responses to Legal Process and compliance with applicable

15

laws and policies safeguarding users’ privacy and limiting Government access to user

16

data.

17

F.

Independent Compliance Professional – an independent third-party professional with

18

expertise in audit and compliance whose functions and responsibilities are elaborated

19

herein. As used herein, the term “independent” means able to perform the

20

responsibilities outlined in this Agreement with integrity, objectivity, and freedom from

21

conflicts of interest, and does not preclude the engagement of a third party solely for

22

having had engagements with Google in other contexts.

23
24

G.

Reports refers collectively to the following three types of reports:
i.

Initial Report – a report, including an addendum reflecting Google’s consultation

25

with the Independent Compliance Professional, prepared by Google that Google

26

will issue to the Google Compliance Steering Committee, the Audit and

27

Compliance Committee of the Alphabet Board of Directors, and the Government

28

within 120 calendar days of retaining the Independent Compliance Professional.
ATTACHMENT B AGREEMENT
16-MC-80263-RS

2

ii.

1

Annual Report – a report, including an addendum reflecting Google’s

2

consultation with the Independent Compliance Professional, prepared by Google

3

that Google will issue to the Google Compliance Steering Committee, the Audit

4

and Compliance Committee of the Alphabet Board of Directors, and the

5

Government each year during the term of this Agreement, beginning one year

6

after issuance of the Initial Report.
iii.

7

Final Report – a report, including an addendum reflecting Google’s consultation

8

with the Independent Compliance Professional, prepared by Google that Google

9

will issue at the conclusion of the term of this Agreement to the Google

10

Compliance Steering Committee, the Audit and Compliance Committee of the

11

Alphabet Board of Directors, and the Government.
H.

12

Six-Month Interim Update – a brief status update that Google will provide to the
Government six months before each Annual Report is issued.

13
14 III.

Legal Process Compliance Program Generally

15

Google will continue to maintain a Legal Process Compliance Program with the characteristics

16 set forth below. The Legal Process Compliance Program will be reasonably designed to achieve timely
17 and complete compliance with Legal Process. The Legal Process Compliance Program will have the
18 following components and characteristics: data-driven risk assessments; policies and procedures;
19 training and communication tools; systems for reporting compliance concerns; risk-based due diligence
20 of third-party relationships; due diligence on mergers and acquisitions; an autonomous, well-structured
21 and adequately resourced program; support from all levels of Google; processes to promote compliance
22 and ethical behaviors; systems to monitor and regularly review performance; and a properly scoped
23 investigation team.
To the extent that Google has already begun or completed the steps set forth below as of the time

24

25 of this Agreement, the efforts will be deemed to satisfy the corresponding obligations under the
26 Agreement.
27 IV.

Legal Process Compliance Program Enhancements

28

In furtherance of that Legal Process Compliance Program, Google has undertaken, or will
ATTACHMENT B AGREEMENT
16-MC-80263-RS

3

1 undertake, the following:
2

A.

3

The Legal Process Compliance Program will include processes reasonably designed to achieve a

Continuous Improvements and Testing

4 comprehensive understanding of the Data for those of Google’s products and services likely to generate
5 Data, including periodic reviews and updates as products and services change over time.
6

The Legal Process Compliance Program will include monitoring, processes, and quality

7 assurance mechanisms reasonably designed to achieve the proper identification, preservation, and
8 production of Data, including Data associated with a searchable identifier, in order to achieve timely and
9 complete compliance with Legal Process, regardless of Google service used.
10

B.

11

The Legal Process Compliance Program will include processes and procedures reasonably

Timeliness and Completeness

12 designed to respond to all Legal Process within the time provided or to communicate to the Court and/or
13 to the proponent of the Legal Process that there will be delay or to otherwise seek legal action to quash,
14 narrow, seek additional time, exclude, or modify the Legal Process. For any instance where a court15 ordered or grand jury production deadline is missed, Google will generate a compliance timeliness
16 record capturing the reason for the missed production deadline and when production was made, except
17 for productions made within 14 days of service of the Legal Process, where the court-ordered or grand
18 jury production deadline was less than 14 days from the date of service. These records may be made
19 available to the Independent Compliance Professional and/or to the AUSA or agent responsible for the
20 Legal Process service upon request.
21

The Legal Process Compliance Program will also include systems for reporting compliance

22 concerns, including, but not limited to, an escalation process to address actual or potential non23 compliance with the timeliness or completeness of productions in response to Legal Process. That
24 escalation process will include escalation to the Chief Compliance Officer and the Head of Regulatory
25 Response, Investigations, and Strategy in instances of potential culpability of a Google employee or
26 agent where remediation or disciplinary action may be warranted.
27

C.

28

The Legal Process Compliance Program will be reasonably designed to be autonomous, well-

Autonomy and Resources

ATTACHMENT B AGREEMENT
16-MC-80263-RS

4

1 structured, and adequately resourced and to accomplish the Enhancements set forth in this Agreement,
2 including the following:
3
4

i.

Tooling

Google will identify the products whose Data are most widely requested by the Government and

5 assess whether relevant Google personnel have adequate and efficient access to that Data for the purpose
6 of responding to Legal Process, thereby developing a list of “priority products” for integration with
7 tooling. The list of priority products may change over time.
8

Google will integrate the priority products with its Legal Process response tools and will develop

9 and maintain related tooling. Google will have processes reasonably designed to test the tooling for
10 accuracy and completeness and maintain integrations up to date with Data changes.
11
12

ii.

Product Launches

Google will develop processes reasonably designed to flag new launches for those products and

13 services that will generate Data, which will include how Google will respond to Legal Process for Data
14 associated with those new products and services, and may include integration with tooling.
15
16

iii.

Compliance Staffing

Google will maintain a Legal Process Compliance Program reasonably designed to achieve

17 adequate staffing levels to support the Legal Process Compliance Program, including ramp-up protocols
18 to allow Google to surge compliance resources as necessary. Google will hire and retain compliance
19 leads embedded in the Legal Process Compliance Program, who will provide a systemic view of
20 operational and regulatory compliance. Google’s Chief Compliance Officer and Head of Regulatory
21 Response, Investigations, and Strategy will oversee Google’s compliance efforts, including
22 Enhancements to the Legal Process Compliance Program. Google executives will support and promote
23 the Legal Process Compliance Program.
24

Google’s Legal Process Compliance Program will operate with independence and autonomy and

25 will be designed such that the Chief Compliance Officer, Head of Regulatory Response, Investigations,
26 and Strategy, and compliance staff have adequate resources to perform their duties with respect to the
27 Legal Process Compliance Program.
28
ATTACHMENT B AGREEMENT
16-MC-80263-RS

5

iv.

1

Dedicated Engineering Resources

Google will establish a process reasonably designed to effectuate the allocation of adequate

2

3 engineering resources to support tooling improvement initiatives and to ensure processes and tooling for
4 responding to Legal Process are feasible, accurate, and complete.
5

D.

6

The Legal Process Compliance Program will include processes and procedures reasonably

Updated Legal Response Policies and Training

7 designed to articulate and communicate Google’s commitment to compliance. This will include (1)
8 maintaining policies and procedures for responding to Legal Process that are designed to achieve clarity,
9 usability, and improved transparency; (2) reviewing and amending the policies and procedures as
10 necessary to ensure they are readily and robustly understood by Google personnel who are tasked with
11 responding to Legal Process; and (3) developing and maintaining a robust training program for
12 personnel involved in responding to Legal Process. Google will ensure adequate communication and
13 education of all relevant employees to educate them on the Legal Process Compliance Program.
14 V.

Independent Compliance Professional

15

A.

16

Google shall retain an Independent Compliance Professional (as described in section II.F above).

Qualifications and Selection

17 The Government may object to Google’s proposed Independent Compliance Professional on the grounds
18 of a lack of independence, as defined in section II.F, or a lack of the requisite expertise needed to serve
19 effectively in the role. If the parties are unable to agree on an acceptable retained Independent
20 Compliance Professional, they may submit the matter to the Court for resolution.
The Independent Compliance Professional’s functions will be in place for a three-year period

21

22 from the Effective Date of this Agreement, subject to one two-year extension as set forth in section VII
23 below.
24

If the Independent Compliance Professional resigns or is otherwise unable to fulfill its

25 obligations as set forth herein, Google will retain a replacement Independent Compliance Professional to
26 serve the remainder of the three-year term of the Independent Compliance Professional function.
27

B.

28

The Independent Compliance Professional will verify the accuracy of assertions in all Reports

Roles and Responsibilities

ATTACHMENT B AGREEMENT
16-MC-80263-RS

6

1 and evaluate Google’s assessment of its compliance with the Enhancements to the Legal Process
2 Compliance Program as set forth above in section IV.
3

C.

4

The Independent Compliance Professional, and any agents or employees thereof, will have no

No Access to Information or Data of Google Users

5 ability to access or review any user data on any Google services or platforms, and will not direct or
6 recommend the disclosure of any such data to the Government or anyone else for any purpose.
7

Google will cooperate with the Independent Compliance Professional to allow the Independent

8 Compliance Professional to fulfill its functions by providing the information necessary to assess the
9 accuracy of assertions in all Reports, to the extent not privileged or subject to non-disclosure
10 obligations.
11

The Independent Compliance Professional will maintain in strictest confidence and inviolate the

12 confidence, at every peril to itself, all non-public information, documents, and records it receives from
13 Google. The Independent Compliance Professional will take steps to ensure that any of its agents or
14 employees will similarly maintain inviolate such confidentiality at all peril to themselves. Within thirty
15 days after the end of the Independent Compliance Professional’s term, the Independent Compliance
16 Professional will return anything obtained from Google or certify that such information has been
17 destroyed.
18

To the extent that the Independent Compliance Professional seeks access to information that is

19 privileged or attorney work product, Google will use its best efforts to provide the Independent
20 Compliance Professional with comparable information without compromising the asserted privilege or
21 protection.
22

Nothing herein shall be read to require the Independent Compliance Professional to perform its

23 duties in a manner that would conflict with the AICPA Code of Professional Conduct.
24

D.

25

The Independent Compliance Professional may include personnel with appropriate professional

Scheduling, Staffing, and Compensation

26 qualifications who are reasonably necessary to assist in the proper discharge of the Independent
27 Compliance Professional’s functions, as specified herein. Google may offer suggestions on qualified
28 professional personnel to assist the Independent Compliance Professional, and the Independent
ATTACHMENT B AGREEMENT
16-MC-80263-RS

7

1 Compliance Professional will interview any such suggested personnel to assess their qualifications and
2 any potential conflicts of interest. Google may perform routine conflict checks on individuals or entities
3 the Independent Compliance Professional proposes to engage, and within two weeks of a proposed
4 engagement, Google will advise the Independent Compliance Professional if any conflicts exist.
Google will pay reasonable compensation and expenses of the Independent Compliance

5

6 Professional, and of persons hired by the Independent Compliance Professional pursuant to its authority
7 hereunder. The Independent Compliance Professional, and any persons hired by the Independent
8 Compliance Professional, will be compensated in accordance with their hourly rates or a reasonable fee
9 based on applicable market rates.
Google agrees that it will not employ or retain the Independent Compliance Professional, or

10

11 professionals retained by the Independent Compliance Professional during the term of this Agreement,
12 except in an independent third-party professional role, for a period of at least two years from the date of
13 termination of the term of this Agreement.
The Independent Compliance Professional, Google, and the Government shall meet annually to

14

15 discuss Google’s Legal Process Compliance Program.
16

E.

17

The Independent Compliance Professional has no authority not expressly provided herein and

Only Express Authority

18 has no authority to supplant any law of the United States or any State, or the specifics of any order by
19 any court.
20 VI.

Reports and Updates

21

Google will prepare an Initial Report, Annual Reports, and a Final Report that describe its Legal

22 Process Compliance Program and Enhancements. The Reports will include the specific subject matters
23 noted in this Agreement, including those described in section IV above.
24

Google will consult with the Independent Compliance Professional regarding Google’s

25 assessment of the Enhancements to Google’s Legal Process Compliance Program. Each Report will
26 include an update on Google’s Legal Process Compliance Program and Enhancements and Google’s
27 assessment of its compliance with the Enhancements to the Legal Process Compliance Program. Each
28 Report will include an addendum reflecting consultation with the Independent Compliance Professional,
ATTACHMENT B AGREEMENT
16-MC-80263-RS

8

1 the Independent Compliance Professional’s evaluation regarding Google’s assessment of its compliance
2 with the Enhancements to the Legal Process Compliance Program, and a certification by the
3 Independent Compliance Professional regarding the accuracy of the assertions in the Report.
The Government agrees that all Reports are non-public and contain and/or reflect Google trade

4

5 secrets and commercial information, and agrees to maintain them private and confidential. Nothing
6 herein precludes providing a Report to the Court; provided, however, that the parties agree that any
7 Reports provided to the Court will be designated “Highly Confidential,” and if filed with the Court, will
8 be placed conditionally under seal in accordance with Local Rule 79-5.
Google will prepare Six-Month Interim Updates, which will be submitted to the Government six

9

10 months prior to each Annual Report. The Six-Month Interim Updates will include a brief update on the
11 status of Enhancements described in previous Reports. The Government agrees that all Six-Month
12 Interim Updates are non-public and contain and/or reflect Google trade secrets and commercial
13 information, and agrees to maintain them private and confidential.
The Initial Report will be drafted and issued within 120 days of the retention of the Independent

14

15 Compliance Professional. The Annual Report will be drafted and issued in 12-month intervals
16 following the issuance of the Initial Report. The Final Report will be submitted on or about November
17 1, 2025.
18 VII.

Evaluation of Agreement

19

Within 45 days of the submission of the Final Report, if the Government determines that Google

20 has not substantially complied with the terms of the Agreement, it may seek a single extension of the
21 terms of the Agreement for one two-year term, which will extend the term of the Independent
22 Compliance Professional and Google’s obligation to prepare Annual Reports and Six-Month Interim
23 Updates. The parties agree that this single two-year extension is the Government’s exclusive remedy for
24 alleged non-compliance with this Agreement by Google. Nothing herein limits the rights of any U.S.
25 Attorney’s Office, component of the U.S. Department of Justice, or other federal government agency to
26 enforce compliance, in any appropriate jurisdiction, with legal process served on Google during the
27 Agreement term. If Google disagrees that it has not substantially complied with the Agreement and that
28 an extension is therefore unwarranted, it may seek resolution of that dispute by the Court.
ATTACHMENT B AGREEMENT
16-MC-80263-RS

9

DocuSign Envelope ID: 832DDB55-D46A-4825-A550-CEDE54106353

1 VIII. Limitations
This Agreement is not an admission of liability or wrongdoing by Google, nor a concession by

2

3 the Government regarding the merits of its ability to seek remedies in this matter.
The requirements of this Agreement are in addition to all other applicable requirements of law.

4

5 Nothing herein operates as a permit under federal, state, or local regulations, and Google remains
6 responsible for complying with all applicable federal, state, and local laws, orders, and permits. Google
7 may not claim that compliance with this Agreement is a defense to any action commenced under
8 applicable federal, state, or local law other than the action resolved through this Agreement. The
9 Government does not warrant that Google's compliance with this Agreement constitutes compliance
10 with other applicable legal requirements.
11 IX.

Release

12

The Government agrees that it will not further investigate, prosecute, or seek any relief other

13 than as described herein for conduct by Google, including its directors, officers, employees, agents,
14 attorneys, and affiliates, in processing, litigating, responding to, or failing to respond to, legal process in
15, the referenced matter of In the Matter of the Search of Content Stored at Premises Controlled by Google
16 Inc. and as Further Described in Attachment A, Case No. 16-MC-80263-RS or in the similarly situated
17 investigations disclosed by Google to the Government as of the Effective Date in which data was or may
18 have been lost.
19

( —Dom/Signed by:

October 21, 2022

20

EEMAMFMULHOLLAND
DATE
21 Vice President, Alphabet Regulatory Response, Investigations & Strategy
Google LLC
22
23
24 KENNETH A. POLITE, JR.
Assistant Attorney General
25 U.S. Department of Justice, Criminal Division

DATE

26
27

3-',07taote:67

74'atdd,

October 24, 2022

STEPHANIE M. HINDS
28 United States Attorney, Northern District of California
ATTACHMENT B AGREEMENT
16-MC-80263-RS

10

DATE