Amazon’s Law Enforcement Data Requests Skyrocketed in 2020
European Countries Spiked the Numbers
Every six months, Amazon puts out a transparency report showing the number of government information requests that it received. These requests come in from a variety of courts and law enforcement agencies around the world.
Amazon looks at each request and judges its legality, for example, to ensure that the request isn’t overly broad. Amazon rejects requests that don’t meet their criteria. But for the majority of these compelled data requests, Amazon hands over its users’ data to the requesting government entity.
I’ve dug into Amazon’s transparency reports before, and at that time, Amazon’s numbers were a drop in the bucket compared to Google and Microsoft. Presumably, this is because people’s emails are generally more in demand from law enforcement than purchase histories.
But in the second half of 2020, the number of requests to Amazon went through the roof. In the first half of 2020, these requests were up modestly at about 18% over the same period the previous year. Then sometime after June, law enforcement shifted it into a new gear.
At the start of July, Amazon was on track for around 6,500 compelled access requests for all of 2020. Instead, they were inundated with over 27,000 requests in the second half of the year.
By the end of 2020, the number of requests was up 472% if we look only at Amazon users and ignore AWS. (AWS had a pretty good increase in requests, but the numbers are a rounding error compared to the Amazon retail numbers.)
Where are these requests coming from?
We don’t have any inside information here, but Amazon gave us some clues. Since 2015, they’ve reported on requests by type: subpoena, search warrant, court order, or non-US. In the second half of 2020, they withheld information about the type of request and instead gave per-country numbers.
Again looking only at Amazon data, there were a total of 498 non-US requests in 2019. In the first half of 2020, the pace was down with only 177 non-US requests.
But in the second half of 2020, there were 24,604 requests from non-US sources.
Germany had the most requests, with 11,735 in this period. Spain and Italy also had significant request numbers, but they weren’t the only ones.
Another stat Amazon stopped reporting on was the number of requests where they returned data vs. ones they deemed to be unlawful. So we don’t know if this data is skewed in some way, which is certainly possible.
The only extra bit of information they give us is around an arbitrary distinction between “content” requests and “non-content” requests, which feels a bit misleading.
For example, if a court orders the production of a person’s purchase history and all their address and contact info, that is counted as “non-content.” But if the request asks for the user’s avatar photo, then it’s a content request. We didn’t learn anything from this info, and it wasn’t broken out by country or by type.
Why is Europe suddenly making so many requests?
As far as I can tell (and please correct me if you know differently), there were no changes to the mutual legal assistance treaties with the EU (though the UK did have some recent post-Brexit changes), and nothing in the CLOUD Act is tied to a date in 2020 as far as I can see.
So I’m stumped. It’s like a massive backlog of requests suddenly got unstuck and came through at once. Perhaps some court case was decided and opened the flood gates?
Is it just Amazon?
As far as I can tell, yes.
Google and Twitter still haven’t released transparency data for the second half of 2020, but Microsoft is more on the ball.
Microsoft had approximately 22k law enforcement requests in the second half of 2019 and 25k in the second half of 2020 (a 14% increase). Over the same two periods, Germany’s requests went from approximately 3k to 5k, a 50% increase. That’s substantial, but nothing like what Amazon saw where requests went from a handful to nearly 12k.
—
What do you think? What could explain Amazon’s European law enforcement requests going from a few hundred per year to tens of thousands in just six months?
—
UPDATE: My search foo failed to find any reporting on this, but it turns out Zack Whittaker beat me to it back in February on Techcrunch. He reported, “An Amazon spokesperson would not say what led to the sharp rise in data demands.” So though the report is old news, the mystery is still as unresolved now as it was then.
