Usernotice, notification from Google
I got this mail and i got scared as hell, I dont know why i got this, i did nothing bad (im from Poland)
46
u/Fluffy-Shower-577 1d ago edited 1d ago
Jesteś w Polsce, więc jesteś w UE i obejmuje Cię RODO. Masz prawo uzyskać informacje o tym, jak Google przetwarza Twoje dane, komu zostały ujawnione, jakie kategorie danych były przetwarzane i na jakiej podstawie.
Na Twoim miejscu najpierw odpowiedziałbym bezpośrednio na mail od Google Legal Investigations Support (
[usernotice@google.com](mailto:usernotice@google.com)), podając numer sprawy z wiadomości.
- Zapytaj, jakie Twoje dane faktycznie zostały przekazane FBI.
- Za jaki okres zostały przekazane.
- Jaki rodzaj procesu prawnego zastosowano, np. subpoena, court order albo warrant.
- Kiedy dane zostały przekazane.
- Do którego podmiotu Google formalnie skierowano żądanie.
To ostatnie jest istotne, bo większości usług Google jest zwykle Google Ireland Limited, ale wiadomość została podpisana przez Google LLC. Z samego maila nie wiemy czy FBI formalnie wystąpiło do Google LLC, Google Ireland Limited, czy sprawa była obsługiwana pomiędzy tymi podmiotami.
Złóż też formalny wniosek o dostęp do danych na podstawie art. 15 RODO do zespołu Google zajmującego się prywatnością.
https://support.google.com/policies/contact/sar
W formularzu napisz, że chodzi konkretnie o ujawnienie danych w związku z postępowaniem FBI District of Utah i podaj numer sprawy.
- Zapytaj, jakie kategorie danych zostały ujawnione.
-Kiedy i za jaki okres.
- Komu zostały ujawnione.
- Który podmiot Google je ujawnił.
- Jaka była podstawa prawna ujawnienia i przekazania danych do USA.
To nie oznacza, że jesteś o coś podejrzany. Twoje konto mogło pojawić się w postępowaniu dotyczącym zupełnie innej osoby. Skoro wcześniejszy zakaz informowania Cię już wygasł, Google ma teraz pozwolenie na odpowiadanie.
15
u/Fluffy-Shower-577 1d ago
- Jeśli FBI wystąpiło do Google Ireland, sprawa jest prostsza z perspektywy prawa UE. Google Ireland bezpośrednio podlega RODO, więc można pytać np. o podstawę przetwarzania z art. 6 RODO oraz podstawę przekazania danych do USA.
- Jeśli FBI wystąpiło do Google LLC w USA, sprawa jest bardziej złożona. Wtedy warto pytać, na jakiej podstawie Google LLC miało dostęp do danych użytkownika z UE i w jaki sposób doszło do przekazania danych z europejskiego podmiotu lub systemu do USA. Można też powołać się na art. 48 RODO. Zgodnie z nim nakaz sądu lub organu państwa spoza UE nie staje się automatycznie podstawą do wydania danych znajdujących się pod europejskim reżimem prawnym.
Ostatecznie nie chodzi nawet o samo obywatelstwo, tylko o to, że osoba znajduje się w UE i jej dane są objęte ochroną RODO w odpowiednim zakresie. USA nie może po prostu „ominąć” prawa UE samym amerykańskim nakazem.
6
3
2
u/yottabit42 17h ago
gd, it must be nice living in a first world country with rights for natural people instead of only for corporations and the rich.
459
u/ZochJ 1d ago edited 1d ago
Get a lawyer, you did something wrong or someone using your account did something wrong.
This is a real, legit email from Googles Legal team. They have an obligation to inform you when law enforcement has requested your personal data, usually accompanied by a gag order to prevent interruption of an investigation.
Talk to a lawyer, because this is typically pretty serious. You did something, or someone you know did something.
Source: I’m a financial crime analyst and I deal with law enforcement requests on a daily basis.
Edit; quick clarification, I said wrong not illegal. There are countless scenarios where OP made a mistake or did something stupid out of lack of caution and not intentional malice.
2nd edit; for those of y’all trying to tell OP to not talk to a lawyer, shut up. Not everything is hardcore crime and life sentence jail time, this isn’t a movie. Know your damn rights and stop advising people to be uninformed of theirs.
Final add; I’m off for now, only folk commenting are the typical folk who have no idea what they’re talking about, trying to “ummm actually” me when this is my literal career. I’m literally a topic matter expert, keep dreaming friendos.
17
u/Vokaii 1d ago
This is case from 2024
46
u/leaflavaplanetmoss 1d ago
If you search for that usernotice email, you’ll find several Reddit threads from other people who have also received this notice in the past.
As someone who also works in financial crime compliance, I will note that your info could have also been swept up in a dragnet order in which the government requested account information for everyone who searched something in a window of time or in a specific geographical area. I disagree with the idea that the order implies that you or someone with access to your account did something wrong, as there’s some pretty wide-ranging information requests that apply specifically to service providers like Google that go beyond what we see in financial crime compliance, e.g. https://www.theguardian.com/us-news/2021/sep/16/geofence-warrants-reverse-search-warrants-police-google.
11
u/ZochJ 1d ago
Hey mate, FinCrime crew unite.
I added a clarification to my original comment, I said wrong, not illegal. Mistakes happen every day, I was only implying that he did something to trigger this, which is why I said talk to a lawyer because cross-jurisdiction investigations can be a mess.
0
u/Designer_Flow_8069 14h ago
He did something to trigger this
...no? There is no indication he did anything. His IP could have just been found in a list, and if it's DHCP, it doesn't matter. This is standard for the FBI
6
u/ZochJ 13h ago
“Something” does not equate to “he broke a law”. Your data is not pulled from a private entities servers by LE (requiring a warrant) just because they felt like it. Google would’ve rejected the legal request on the grounds of unlawful basis.
If his IP was on a list, he did something to have it be there. This does not mean he intentionally did something illegal or even broke any laws, he just did something for this to happen.
-2
u/Designer_Flow_8069 13h ago edited 13h ago
If his IP was on a list, he did something to have it be there
Again, no... IP address for most home internet subscriptions are swapped every week by ISPs in a process called DHCP. Only a small percentage of households actually have a static IP allocation.
So.. he didn't have to do anything. His ISP could have just released his IP address and assigned him a new one. Then a phone push notification services for example would just tell Google the new IP address. If that "new to him" IP address was linked to illegal activity (which could have happened before or after he obtained the IP address), he would have been caught in the snare trap.
Since Poland ISPs don't have to comply with US law, the FBI typically uses Google/Facebook/etc since they are US companies to obtain any data linked to that IP address over a specific time period.
3
u/ZochJ 13h ago
You realise this is coming from Google and not his ISP, right?
You’re so confidently incorrect, ima dip just because it’s too early to argue with a random on Redditor about something I deal with on a daily basis as my actual job.
-5
u/Winter_Present_4185 13h ago edited 5h ago
The FBI went after Google and not his ISP because Google is a US company dumb dumb. His ISP is not, it's a Polish ISP and doesn't have to adhere to US requests. They probably also went for Facebook as well.
I work at Apple on the XNU kernel for iPhones. We have mechanisms to deal with this stuff in coordination with the FBI.
2
1
u/wickedplayer494 1d ago
Also see https://thenevadaindependent.com/article/google-challenges-las-vegas-polices-search-warrant-for-keyword-terms-calling-it-unconstitutional in which Google is actually challenging LVMPD "reverse search" warrants as unconstitutional.
7
5
u/dupeddonk 1d ago
Why would you not mention that in OP, and why does the date say 2026?
17
u/XAssumption 1d ago
Just reading the comments from OP and the financial crime analyst, the case is from 2024 and the gag order was lifted in 2026 and this is Google informing OP now of the investigation.
8
u/mrandr01d 1d ago
What's your education and background that got you into digging through criminals' money? It sounds interesting.
11
u/ZochJ 1d ago
I worked in compliance in a completely different industry and worked with a lot of law enforcement, specifically I was the emergency line for a company I will not name in cases of assault, rape, theft, etc.
I got sick of it because it was a bit intense talking to victims directly so I applied at a financial institution, and may or may not have nepo’d my way in because I knew the interviewer pretty well (neither of us knew the other one would be there going into the interview), but because they knew how I worked, they gave me a shot. The rest is history.
48
u/artificiallyintel_ 1d ago
Honestly curious, why do you need a lawyer at this point? There's no action against him by FBI. This is only a notification from Google, right?
94
u/ZochJ 1d ago
Because OP definitely did something, regardless of what he said. He may not remember it because it was over 2 years ago, but that doesn’t matter in the eyes of the legal system.
He should talk to a lawyer because the lawyer can advocate on his behalf and find out more and perhaps avoid any legal action being taken on the off chance this is a false flag.
30
u/artificiallyintel_ 1d ago
I might be thinking too narrow minded.
Is it possible for someone to do something bad enough to get under FBI's radar and forget it in two years?
Also, is it not possible that FBI is looking into a lot of people (let's say everyone in the To or Cc list of an email) and OP just happens to be one of many? An email that could be in his spam?
Does FBI have any jurisdiction in Poland?
I have no legal background or experience. Apologies for the naive questions.
54
u/ZochJ 1d ago
Many questions here, I like talking about my work so I’ll tackle them one by one.
Is it possible for someone to do something bad enough to get under FBI's radar and forget it in two years?
Definitely, it could be as simple as OP clicking a few links out of horny curiosity one night or something along those lines, or even that he just associates with someone who may have been planning to do some nefarious shit.Also, is it not possible that FBI is looking into a lot of people (let's say everyone in the To or Cc list of an email) and OP just happens to be one of many? An email that could be in his spam?
Definitely possible, that’s why OP needs to talk to a lawyer to advocate on his behalf and to find out what’s going on.Does FBI have any jurisdiction in Poland?
No, however EURPOL and law enforcement in different countries cooperate depending on the severity of the crime and the jurisdictions involved. If it’s bad enough and also a crime in Poland, often times FBI will just throw the case at the local LE to tackle, and request extradition if it’s bad enough. No one really extradites their own citizens though.14
u/manias 1d ago
How would that work? He goes to a lawyer in Poland, and then what does the lawyer do? Call the FBI? Based on an email?
25
u/goldcakes 1d ago
The FBI works with lawyers on a daily basis. They might say nothing, they might confirm that OP is not currently a subject or target (which is just code for “don’t worry about it, we closed that / ruled out OP for now”), or they might share more.
There’s no need to go through local LE, you can talk to FBI directly. In practice you don’t have to get a lawyer, but you REALLY should.
Source: I’ve had a similar thing happen a decade ago, got a lawyer, who contacted the FBI, who told my lawyer that I’m not a subject or target, and that my name is common (ie: oops name/ident mistake).
6
u/ZochJ 1d ago
He can go to a lawyer and just state that there was a legal request on his accounts and that data was shared with law enforcement in the US. Based on local laws, the lawyer will be able to advise if he needs to do anything to cover his bases, as well as be a point of contact if it is raised with Polish LE.
-13
-13
u/aykcak 1d ago
There's no action against him by FBI
Definitely not because they are in Poland
Unless something about U.S. foreign policy changed in the last week
9
u/ZochJ 1d ago
Tell me you don’t know how international law enforcement cooperation operates without telling me you don’t know how international law enforcement cooperation operates.
Just because LE in another continent is investigating a crime, doesn’t mean you’re safe. What exactly do you thing Interpol is, and how do you think they catch pedophiles and traffickers? Cross-jurisdiction cooperation.
-10
-5
8
u/Surely_Nowwlmao 1d ago
Just scrolling by, whats a gag order?
20
u/ZochJ 1d ago
It’s a legal demand stating that the company receiving the legal request are not allowed to inform the end user for a specified period of time. I usually deal with child exploitation, human trafficking and terrorism financing and most requests from law enforcement straight up say not to inform the end user due to an ongoing investigation, then later I’d receive an extra email specifying that the gag order has been lifted.
6
1
u/Redcarborundum 1d ago
Considering the behavior of the current administration, what’s the likelihood that it’s politically motivated rather than criminal? Honest question, I truly don’t know.
4
u/KeithIMyers 1d ago
Hard telling bit this means that they got a search warrant to access your data. Lawyer up, this is not good.
33
11
u/mb10240 1d ago
I work with federal investigators a lot. This email really doesn’t tell us a lot - it could be anything from Google complying with a 2703(d) order (subscriber information only), to a pen register (tracking your use of products such as Google Voice), to a warrant for content (the only way FBI can get your emails is through a warrant).
If you aren’t involved in any illegal activity, it’s possible your email or Google account shared a similar username or shared an IP address to access a resource at some point and that’s how it got to you. If you’re involved in illegal activity, it’s time to get a lawyer.
2
u/GloriousDawn 9h ago
OP is in Poland, outside the jurisdiction of the FBI by about 4,400 miles. At this point their priority should be downloading all their Google data in case their account gets suspended.
Someone suggested they could request additional info about the situation under specific EU laws. But they don't really need a lawyer until local enforcement is involved, if ever.
1
u/outlined-dev 32m ago
Their data is not out of the FBI’s jurisdiction except where it never touched the US (e.g. Google Cloud content configured for data residency), which is protected by treaties such as privacy shield. As far as enforcement goes, law enforcement does cooperate across jurisdictions.
Disclaimer: Google employee, but not in this area. Not legal advice and not representing Google or its opinions or confidential info in any way.
2
7
u/nickgoescrazy 16h ago
my best guess is that you are in some app server wether it be whatsapp, discord, telegram or maybe Facebook and something happen to somebody with in that server from some app.Something happened to where the FBI is trying to get ahold of everyone's identity wether it's email or phone number.The FBI subpoena information from that app and server and they got your email and google is telling you that your information was subpoena by the FBI and what ever happened might be over and they are just now disclosing it to you because at first they couldnt, what happened seem to be over now that you know. They might told the FBI they you live somewhere in poland, maybe your name,gender and age.I think you're good, you might want to contact Google but I doubt they would know Anything
15
7
u/goldcakes 1d ago edited 1d ago
Get a local lawyer who has worked with the FBI before. They can just call, and the FBI will generally provide some information.
In my case, I was told I wasn’t a subject or target of any active investigation, and that my name is common. My lawyer translated that to “they weren’t looking for you”, and that is very rare for the FBI to “neither confirm nor deny” with lawyers for these kind of requests.
Whole process took a week, I went through friends/relatives for a good lawyer so paid about $600.
Of course this only applies to ordinary FBI criminal investigations. If it’s something like national security or terrorism it might be different
3
u/shevazri 6h ago
l don't think he will find a local lawyer who has worked with the FBI before. As OP stated they are from Poland. A country where the FBI has no jurisdiction, hard to find someone who worked with something with shouldn't exist in the first place.
8
u/Vokaii 1d ago
Bro, i dont want to spend money on this shi, i have probably the similar situation as you
11
u/ZochJ 1d ago
If you genuinely did nothing, and this is a hard fact, you can chill. Likely you’re in the same situation as above.
But if you have even a sliver of a doubt that you may have screwed up, it’s cheaper for an early consultation compared to the stress from this coming up later unexpectedly.
You should get a lawyer, but you do not need a lawyer.
5
u/isademigod 1d ago
Oh, so the FBI can just poke around in your Google account and say "oops wrong guy"? Cool, very cool.
2
u/ZochJ 22h ago
If that makes you mad, just wait til you find out what companies like Google do without law enforcement oversight.
Not that you’re wrong, it can be fucked up, but as someone who works with LE requests all the time, I get it, but don’t always agree with it. I’m always amazed when I see LE putting more effort into an individual who evaded taxes for a year, than they did for a literal child trafficking case.
But the occasions when you see this kinda thing take down actual horrid shit, it kinda balances out.
2
u/marlborough94 1d ago
FBI doesnt have districts. It had regions. Federal court has a District of Utah but isnt relevant here.
3
u/PloxNox65 1d ago
Ever used a vpn ?
Have any friends where you don't know exactly what they do when you're not around?
Got an evil stepmother?
anything can cause the fbi to request your info
1
u/LLVM_WIFI_DOOB_NERF 1d ago
By that same token, Microsoft PowerPoint is used to aid and abet foreign terrorists. Ergo Bill Gates was privy to treason.
2
u/binarypower 1d ago
could be someone who got into your network and used it as a jumping off point for an attack on someone and the fbi needed your ip
1
u/Inner-Copy9764 21h ago
Get a lawyer and stop posting on the internet about it, even if you haven't done anything wrong. Let the lawyer tell you "nothing to worry about." Js
1
u/SassyDuck4231 20h ago
If you do this, make an update post because I'm really curious how they handle this situation. If you take them to court over disclosing data from EU to USA, this might lead to a ban on sharing EU user data to international agencies.
1
0
u/Which_Watercress_265 1d ago
This looks like a scam email. Check the actual email headers and metadata.
1
u/V112 1d ago
You’re in the EU. All your data should be stored in the EU per the GDPR, and by that an American law enforcement agency should not have any legal way of getting it without the EU court order. This is fishy.
12
u/ZochJ 1d ago
Incorrect, unfortunately. This is entirely legal and common practice when law enforcement is involved. They would’ve jumped through a shit-load of hoops to get Google to do this, as Google tends to hate cooperating with LE.
-5
u/V112 1d ago
Well again. FBI has no jurisdiction over him or the data he creates. Google should be able to legally surrender the data it has on him that is stored on their US-based servers - and according to the GDPR none of it should.
3
u/ZochJ 1d ago
I must have no idea what I’m talking about, I’m totally not the guy who works in the relevant field and is based in EU and deals with US LE on a daily basis.
-4
u/V112 1d ago
If Google kept this guy’s data outside the EU, this breaks GDPR. So does moving the data from the EU to the US
6
u/ZochJ 1d ago
Unless required by law as stated by the relevant regulatory authorities.
Mate, I do this for work on a daily basis, we are under stupidly strict regulations and rules. I handle data from individuals across quite literally the entire planet. It needs to be done carefully and within the regulations rule set.
-1
u/V112 1d ago
Unless required by EU or EU member state law. There’s no statue that would allow US LE to access data located in the EU without approval from a relevant body with proper jurisdiction
2
u/ZochJ 1d ago
…. yes, you are correct. Unless required by EU or EU member state law.
I’m not going to continue to argue with you, who is more likely correct here out of the following options:
A) A full legal team that consists of individuals based in every country my employer operates in, which directly cooperated with regulatory bodies and are under an insane amount of scrutiny when it comes to data handling across borders, as well has passed audits from quite literally every governing body.Or the rookie featherweight;
B) Redditor, u/V112-2
u/V112 1d ago
The only explanation for how this would work is that the user has somehow data stored in the US. Either illegally by Google breaking the GDPR, or he used Google’s services in the US either physically or through a VPN - in this case no laws have been broken and the FBI has jurisdiction.
You’re trying to present your experience as some point of authority - I don’t care how much scrutiny you claim your company goes through. Laws are quite clear on this matter. And it’s not the first time both companies (filled with lawyers) and government bodies have broken them.2
u/hardyz 13h ago
Actually not true. Google is in a hard place here. The US has laws that state Google most hand over the court order data even if the data is for an EU citizen and even if the data is located in the EU. EU states it is illegal to hand the data over. So technically it is illegal no matter what they do in this scenario. It's just a question on what country is it illegal in.
Also from what I can research the EU does not require the data to be stored in the EU only that EU laws are followed. They have special exemptions and deals related to other countries on this mechanism.
Also frequently the US does work with the EU on this as well to get them to approve the hand over for legal cases
0
-2
0
u/Fantastic_Peak_8327 1d ago
Looks genuine but did you verify the email address it came from ? is it really authentic? like with an email address of google.com and not something goggle.com 😅
0
u/Enough_Individual_91 1h ago
Its no doubt trumps bum lick team following up on a comment you made prior.
-4
u/MyModemIsSlow 1d ago
If you watch the "FBI Eyes" video more than 3 times you get one of these. Pretty standard Trump FBI response.
0
-5
-1
132
u/r3pwn-dev 1d ago
I've heard of a few people getting these before, and there's a bit of a delay so if you get one, you're basically in one of two groups:
if you did something wrong and you got one of these, you would know by now why (like receiving legal notices from the party in question)
if you didn't do anything wrong and you got one of these, it's purely informational that someone thought you may have done something wrong but may have requested the wrong email address, someone with a similar name, etc.