Or they searched his computer and it was in the browser history.

Maybe they subpoenaed Google for the records of searches from his IP address.

Is that a thing? I don't trust incognito mode when talking to google, that's for sure.

My understanding is that incognito mode just doesn’t save local browser history. Your ISP and google can still log what you search based on IP or login state.

Your ISP can't see it because of TLS. But the search provider will know things.

Is the IP hidden if I search from my workplace, where there are 250 computers from several startups behind a single IP? (and it’s not a corporate computer) Granted, Google can identify browsers uniquely using fingerprinting, even with Incognito.

FISA. All that Patriot Act bullshit is still around most likely, including the secret courts to get secret warrants. It was supposed to be for terrorism, but just about everyone in history warned us over and over that these things get repurposed.

Guantanamo Bay is still around. The legacy of the Bush administration is for real.

There's no need to bring up FISA or Guantanamo. Normal criminal cases routinely get warrants from normal non-spooky courts for Google searches.

Yes, it happens all the time.

Search "Snowden CIA google datacenter"

It's possible they could do it without a warrant

https://en.m.wikipedia.org/wiki/National_security_letter

People are overthinking things.

The court filing says they seized his laptop and phone, and seems to suggest all this information came from examining those devices. The google searches were probably just sitting in his browser history.

Oh, and then the idiot went and bought another laptop the very next day, despite explicit military orders not to. His opsec skills seem to be lacking.

This is probably exactly what happened. I bet he used Chrome as well. It doesn't really help that Google Chrome keeps history basically forever (on the order of months), even without signing into a Google Account.

Depending on who they worked for, they may sign a document that says you will be hacked and monitored for the rest of your life.

Far better than the gag for 40 years or death, whichever comes last document.

Technically it's Google's data, so all they have to do is ask. If Google says no, then they get a warrant.