11 ms·

To me the most bizarre part of this story is the argument that this didn't constitute an unlawful search because there is no reasonable expectation of privacy f

by pfg 11y ago

To me the most bizarre part of this story is the argument that this didn't constitute an unlawful search because there is no reasonable expectation of privacy for Tor users: > [...] it is the Court's understanding that in order for a prospective user to use the Tor network they must disclose information, including their IP addresses [...] such a submission is made despite the understanding communicated by the Tor Project that the Tor network has vulnerabilities and that users might not remain anonymous. Under these circumstances Tor users clearly lack a reasonable expectation of privacy [...]

fixermark 11y ago
I believe the argument is more focused than that: there is no expectation that one's IP address is private when the process of connecting to a server involves disclosing the IP address as the respond-to destination. I have a hard time seeing a flaw in that reasoning.
- tux3 11y ago
  The whole Internet Protocol is based on sending packets with your public IP, by a stretch of that logic are we supposed to understand that no privacy should be expected on all of the Internet? This argument seems sketchy at best.
  - chatmasta 11y ago
    That seems like a decent assumption to me. When your IP talks to another on the Internet, you no longer have any control over the metadata of that connection. It will show up in the logs of the other IP, and the owner of that IP is free to do anything with those logs. It seems far more naive to assume there is an expectation of privacy on the Internet.
    - Lawtonfogle 11y ago
      So the government mining of all meta data sent to any third party (including all texts, phone calls, and internet usage) is fine? Also, what about the data itself. You are putting the data on lines you don't own, so that is all fine too, no?
      - fixermark 11y ago
        That's why you encrypt your data, and assume it is not secure if it is not encrypted. "Here, third party, please have my meaningless binary blob. You may do with it as you wish. Thank you for transiting it across your network in accordance with the TCP/IP protocol."
        Matt3o12_ 11y ago
        Third party: "You're welcome! Since you seem to be very interested in that specific subject (the destination IP address happens to map to a site specified for that subject), we sold this information to Google and they will now show more ads regarding that subject." No, seriously. I believe it is good practice to encrypt all data over all kind of wires (public or not). However, most of the time, we do not encrypt metadata, which can be just about as useful as the actual data (and way easier to analyze). Do you really think that any government cares much about what you say to a specific person? They only care that you talk to that person, when you talked to that person, and how frequently you talked to that person. The same goes for almost anything. If your ISP were interested in your data, they would actually value metadata a lot more then the actual payload because metadata can be analyzed quite easily and reliably. Tor was (and still is) your only protection against these kinds of attacks because your ISP only knows you're talking to some Tor nodes, the Tor nodes can see very few of the websites you visit (or email recipients you send to) because you will use another nodes for the next website/email, and the website will not know who you are if you don't authenticate because many requests can come from that Tor node.
        fixermark 11y ago
        Seems like Tor is demonstrably not as good protection as people hope it to be. Hm.
        Matt3o12_ 11y ago
        Please remember that Tor has since fixed these bugs. What is important, though, is that nobody (not even the government) should be allowed to legally decipher _all_ (or most) of the traffic going through a network/service. We could say the same for HTTPs, because it also had its fair share of vulnerabilities.
  - hellbanner 11y ago
    Yes, but in the case of onion routing, the IP address is masked by layers of the onion. It's understandable that Layer 3 knows Layer 2, that Layer 2 knows Layer 1 and that Layer 1 knows the originator. But Layer 2, 3 and the website should not know Layer 1 by design. Defeating this is akin, IMHO, to circumventing a lock by photographing the key that you don't own.
    - pyre 11y ago
      That seems like a slightly different legal argument that breach of privacy though.
  - fixermark 11y ago
    Not at the base layer, not at all. That's why commercial traffic is handled by secure encryption, and not an elaborate fabric of internationally-agreed-upon laws that will assign fair and standardized punishments to people for snooping each other's IP packets on an open wifi router without permission of the packet sender.
  - sliverstorm 11y ago
    Well, at least in who you talk to. You can encrypt the content. Perhaps like visiting your cult friend. You have an expectation of privacy for what you say in his house, but the fact that you traveled to his house does not have an expectation of privacy.
  - jsprogrammer 11y ago
    What privacy can you expect? Do a tracert to see the reporting nodes that your packets talk to before getting to their recipient. All of those nodes know about your packets, as do whomever are running them.
- pfg 11y ago
  Why do they specifically mention the fact that the Tor Project warns about possible vulnerabilities? There's a reasonable expectation of privacy in a hotel room, for example[1]. To me this argument reads like: "The hotel owner cannot guarantee that a previous patron hasn't left a listening device in your room, so there's no reasonable expectation of privacy." [1]: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1718669 http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1718669
  - dotnetchris 11y ago
    You have a reasonable expectation of privacy inside an abode. If a patron left a recording device, they likely would be in violation of Federal and/or State laws.
    - pfg 11y ago
      The same could be said for certain vulnerabilities in Tor: Exploiting them could be illegal under the CFAA (unless you're a LEA with a warrant).
  - deleted 11y ago
    [deleted]
- jimrandomh 11y ago
  No, avoiding the need to disclose one's IP address is the entire point of Tor! Yes, the Tor project does warn about ways in which this could fail. It does this in the tone of a lock-maker warning about power drills.
ikeboy 11y ago
They're giving over the information to a third party, which usually destroys any 4th amendment rights. The fact that the third party was actually three different parties who only got a piece (or six, when using hidden services) doesn't seem like it would change the law. If I split data into 6 pieces and handed it to 6 different people, the government can take those 6 pieces and put them together without violating my rights. I don't see why Tor would be any different. In fact, this particular vulnerability IIRC involved the researchers acting as both the exit node and the guard node, and finding a way to pass a message between the two so they'd notice when they're in the same circuit. That seems even better legally than my analogy above. They didn't need to take any data, the victims connected to them and gave them the info.
- Lawtonfogle 11y ago
  >They're giving over the information to a third party, which usually destroys any 4th amendment rights. Same reason that there is no need for a warrant to collect phone calls since you are handing data over to the phone companies to carry between you and the other party(ies). Also the same reason the government can shift through your mail, since the items are in the possession of a third party (you likely gave the items to the government itself). To me this makes as much sense as the argument that since a plane carrying people can fly over you, it is perfectly reasonable to put a blimp with an extremely high zoom camera on that spies on your home constantly, detecting not just visible light, but also infrared. Also, since when you talk things vibrate, and since it is possible to view those vibrations though a window, I'm actually broadcasting my speech to the public and thus don't have any expectation of privacy.
  - ikeboy 11y ago
    Note that this is only talking constitutionally. The government is free to pass laws that disallow such gathering, or simply not pass laws that allow it. IIRC collecting mail is not in fact legal without a warrant, and only photographing the outside (which anyone who handles it can see) is allowed. I do think the fact that any member of the public can collect data legally means the government should be able to as well.
  - 11y ago
samstave 11y ago
Can someone tell me where to have a reasonable expectation of privacy?
- DanBC 11y ago
  When you speak to a doctor; when you speak to a lawyer that you're paying for.
  - dotnetchris 11y ago
    Add Priest
    - justinjlynn 11y ago
      Only if you're a lawyer... and you're their lawyer... and you're talking about their legal matters.
  - bediger4000 11y ago
    Speaking to a medical doctor isn't necessarily confidential. I believe there are some categories of things that doctors must report to authorities, and that varies from US state to state. Wikipedia says: "In the United States, the Federal Rules of Evidence do not recognize doctor–patient privilege."
  - PascalsMugger 11y ago
    But not if you're speaking to them over the Internet.
    - fixermark 11y ago
      Right. If you're doing that, I'd recommend making sure that the tools you're using to communicate with them can encrypt your messages and their messages using some protocol that only the intended recipient can reverse. Public-private key encryption seems to generally be a good approach. Look for the "padlock" icon in your browser before talking to your doctor about Viagra. ;)
rayiner 11y ago
You're cutting out the most important parts: > The Court agrees with the government that applicable Ninth Circuit authority precludes the defendant’s success on his motion. SEI’s identification of the defendant’s IP address because of his use of the Tor network did not constitute a search subject to Fourth Amendment scrutiny. The Court reaches this conclusion primarily upon reliance on United States v. Forrester, 512 F.2d 500 (9th Cir. 2007). In Forrester, the court clearly enunciated that: “Internet users have no expectation of privacy in ...the IP address of the websites they visit because they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information.” Id. at 510. > In the instant case, it is the Court’s understanding that in order for a prospective user to use the Tor network they must disclose information, including their IP addresses, to unknown individuals running Tor nodes, so that their communications can be directed toward their destinations. Under such a system, an individual would necessarily be disclosing his identifying information to complete strangers. Again, according to the parties’ submissions, such a submission is made despite the understanding communicated by the Tor Project that the Tor network has vulnerabilities and that users might not remain anonymous. Under these circumstances Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network. In other words, they are taking a significant gamble on any real expectation of privacy under these circumstances. > [...] > The evidence before this Court indicates that SEI obtained the defendant’s IP address while he was using the Tor network and SEI was operating nodes on that network, and not by any access to his computer. SEI got the IP addresses because the Defendant's computer communicated that information to SEI. You can imagine that the briefing went something like this: Government: there is no expectation of privacy because connecting to Tor involves giving out your IP address to random people on the Internet. Defendant: but the purpose of Tor is to hide your IP address from anyone that might matter. Government: well obviously that didn't work because we figured out his IP address. The point of vulnerabilities isn't the basis for the Court's opinion--it's just a rebuttal to the idea that Tor is supposed to keep your IP address secret even though it necessarily involves giving it to at least some untrusted nodes.
ikeboy 11y ago
Huh. http://www.theatlantic.com/technology/archive/2013/12/what-you-need-to-know-about-the-third-party-doctrine/282721/ http://www.theatlantic.com/technology/archive/2013/12/what-y... says >Importantly, my defense of the third-party doctrine implies an important limit: The doctrine should apply when the third party is a recipient of information, but it should not apply when the third party is merely a conduit for information intended for someone else. Sourced from http://www.abajournal.com/magazine/article/the_data_question_should_the_third-party_records_doctrine_be_revisited/ http://www.abajournal.com/magazine/article/the_data_question... The linked argument (which is one half of a debate), argues that the third party doctrine should apply to things that you wouldn't be able to hide without third parties. So metadata is covered, because you can't hide who you communicate with, but content is not. The data collected here is metadata (who connected to the site), so it seems they would consider it collectable legally.
sathackr 11y ago
IP addresses are routinely subpoenaed. Ask the operator of any popular file sharing site how many subpoenas they get from copyright lawyers. Some large ISPs have entire departments dedicated to servicing subpoenas from law enforcement. Just because you used Tor doesn't make your IP address invulnerable to subpoena. If I connect through 7 proxies and do something illegal, my IP is no less subject to subpoena than if I weren't to use a proxy at all. If I stand in my front yard, in view of my neighbors, put on a mask, then I go rob a store, wearing that same mask, I don't have a reasonable expectation of privacy as to my identity while wearing the mask. This case is far less controversial than the recent one where the FBI hacked all the pervert's computers. It may be an issue of ethics at CMU, but, not an issue with 4th/5th amendments.
mSparks 11y ago
Do US courts still consider an ip address as personal information?

by pfg 11y ago

fixermark 11y ago

I believe the argument is more focused than that: there is no expectation that one's IP address is private when the process of connecting to a server involves disclosing the IP address as the respond-to destination. I have a hard time seeing a flaw in that reasoning.

tux3 11y ago
The whole Internet Protocol is based on sending packets with your public IP, by a stretch of that logic are we supposed to understand that no privacy should be expected on all of the Internet? This argument seems sketchy at best.
- chatmasta 11y ago
  That seems like a decent assumption to me. When your IP talks to another on the Internet, you no longer have any control over the metadata of that connection. It will show up in the logs of the other IP, and the owner of that IP is free to do anything with those logs. It seems far more naive to assume there is an expectation of privacy on the Internet.
  - Lawtonfogle 11y ago
    So the government mining of all meta data sent to any third party (including all texts, phone calls, and internet usage) is fine? Also, what about the data itself. You are putting the data on lines you don't own, so that is all fine too, no?
    - fixermark 11y ago
      That's why you encrypt your data, and assume it is not secure if it is not encrypted. "Here, third party, please have my meaningless binary blob. You may do with it as you wish. Thank you for transiting it across your network in accordance with the TCP/IP protocol."
      - Matt3o12_ 11y ago
        Third party: "You're welcome! Since you seem to be very interested in that specific subject (the destination IP address happens to map to a site specified for that subject), we sold this information to Google and they will now show more ads regarding that subject." No, seriously. I believe it is good practice to encrypt all data over all kind of wires (public or not). However, most of the time, we do not encrypt metadata, which can be just about as useful as the actual data (and way easier to analyze). Do you really think that any government cares much about what you say to a specific person? They only care that you talk to that person, when you talked to that person, and how frequently you talked to that person. The same goes for almost anything. If your ISP were interested in your data, they would actually value metadata a lot more then the actual payload because metadata can be analyzed quite easily and reliably. Tor was (and still is) your only protection against these kinds of attacks because your ISP only knows you're talking to some Tor nodes, the Tor nodes can see very few of the websites you visit (or email recipients you send to) because you will use another nodes for the next website/email, and the website will not know who you are if you don't authenticate because many requests can come from that Tor node.
        fixermark 11y ago
        Seems like Tor is demonstrably not as good protection as people hope it to be. Hm.
        Matt3o12_ 11y ago
        Please remember that Tor has since fixed these bugs. What is important, though, is that nobody (not even the government) should be allowed to legally decipher _all_ (or most) of the traffic going through a network/service. We could say the same for HTTPs, because it also had its fair share of vulnerabilities.
- hellbanner 11y ago
  Yes, but in the case of onion routing, the IP address is masked by layers of the onion. It's understandable that Layer 3 knows Layer 2, that Layer 2 knows Layer 1 and that Layer 1 knows the originator. But Layer 2, 3 and the website should not know Layer 1 by design. Defeating this is akin, IMHO, to circumventing a lock by photographing the key that you don't own.
  - pyre 11y ago
    That seems like a slightly different legal argument that breach of privacy though.
- fixermark 11y ago
  Not at the base layer, not at all. That's why commercial traffic is handled by secure encryption, and not an elaborate fabric of internationally-agreed-upon laws that will assign fair and standardized punishments to people for snooping each other's IP packets on an open wifi router without permission of the packet sender.
- sliverstorm 11y ago
  Well, at least in who you talk to. You can encrypt the content. Perhaps like visiting your cult friend. You have an expectation of privacy for what you say in his house, but the fact that you traveled to his house does not have an expectation of privacy.
- jsprogrammer 11y ago
  What privacy can you expect? Do a tracert to see the reporting nodes that your packets talk to before getting to their recipient. All of those nodes know about your packets, as do whomever are running them.
pfg 11y ago
Why do they specifically mention the fact that the Tor Project warns about possible vulnerabilities? There's a reasonable expectation of privacy in a hotel room, for example[1]. To me this argument reads like: "The hotel owner cannot guarantee that a previous patron hasn't left a listening device in your room, so there's no reasonable expectation of privacy." [1]: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1718669 http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1718669
- dotnetchris 11y ago
  You have a reasonable expectation of privacy inside an abode. If a patron left a recording device, they likely would be in violation of Federal and/or State laws.
  - pfg 11y ago
    The same could be said for certain vulnerabilities in Tor: Exploiting them could be illegal under the CFAA (unless you're a LEA with a warrant).
- deleted 11y ago
  [deleted]
jimrandomh 11y ago
No, avoiding the need to disclose one's IP address is the entire point of Tor! Yes, the Tor project does warn about ways in which this could fail. It does this in the tone of a lock-maker warning about power drills.

ikeboy 11y ago

They're giving over the information to a third party, which usually destroys any 4th amendment rights. The fact that the third party was actually three different parties who only got a piece (or six, when using hidden services) doesn't seem like it would change the law. If I split data into 6 pieces and handed it to 6 different people, the government can take those 6 pieces and put them together without violating my rights. I don't see why Tor would be any different. In fact, this particular vulnerability IIRC involved the researchers acting as both the exit node and the guard node, and finding a way to pass a message between the two so they'd notice when they're in the same circuit. That seems even better legally than my analogy above. They didn't need to take any data, the victims connected to them and gave them the info.

Lawtonfogle 11y ago
>They're giving over the information to a third party, which usually destroys any 4th amendment rights. Same reason that there is no need for a warrant to collect phone calls since you are handing data over to the phone companies to carry between you and the other party(ies). Also the same reason the government can shift through your mail, since the items are in the possession of a third party (you likely gave the items to the government itself). To me this makes as much sense as the argument that since a plane carrying people can fly over you, it is perfectly reasonable to put a blimp with an extremely high zoom camera on that spies on your home constantly, detecting not just visible light, but also infrared. Also, since when you talk things vibrate, and since it is possible to view those vibrations though a window, I'm actually broadcasting my speech to the public and thus don't have any expectation of privacy.
- ikeboy 11y ago
  Note that this is only talking constitutionally. The government is free to pass laws that disallow such gathering, or simply not pass laws that allow it. IIRC collecting mail is not in fact legal without a warrant, and only photographing the outside (which anyone who handles it can see) is allowed. I do think the fact that any member of the public can collect data legally means the government should be able to as well.
- 11y ago

samstave 11y ago

Can someone tell me where to have a reasonable expectation of privacy?

DanBC 11y ago
When you speak to a doctor; when you speak to a lawyer that you're paying for.
- dotnetchris 11y ago
  Add Priest
  - justinjlynn 11y ago
    Only if you're a lawyer... and you're their lawyer... and you're talking about their legal matters.
- bediger4000 11y ago
  Speaking to a medical doctor isn't necessarily confidential. I believe there are some categories of things that doctors must report to authorities, and that varies from US state to state. Wikipedia says: "In the United States, the Federal Rules of Evidence do not recognize doctor–patient privilege."
- PascalsMugger 11y ago
  But not if you're speaking to them over the Internet.
  - fixermark 11y ago
    Right. If you're doing that, I'd recommend making sure that the tools you're using to communicate with them can encrypt your messages and their messages using some protocol that only the intended recipient can reverse. Public-private key encryption seems to generally be a good approach. Look for the "padlock" icon in your browser before talking to your doctor about Viagra. ;)

rayiner 11y ago

You're cutting out the most important parts: > The Court agrees with the government that applicable Ninth Circuit authority precludes the defendant’s success on his motion. SEI’s identification of the defendant’s IP address because of his use of the Tor network did not constitute a search subject to Fourth Amendment scrutiny. The Court reaches this conclusion primarily upon reliance on United States v. Forrester, 512 F.2d 500 (9th Cir. 2007). In Forrester, the court clearly enunciated that: “Internet users have no expectation of privacy in ...the IP address of the websites they visit because they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information.” Id. at 510. > In the instant case, it is the Court’s understanding that in order for a prospective user to use the Tor network they must disclose information, including their IP addresses, to unknown individuals running Tor nodes, so that their communications can be directed toward their destinations. Under such a system, an individual would necessarily be disclosing his identifying information to complete strangers. Again, according to the parties’ submissions, such a submission is made despite the understanding communicated by the Tor Project that the Tor network has vulnerabilities and that users might not remain anonymous. Under these circumstances Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network. In other words, they are taking a significant gamble on any real expectation of privacy under these circumstances. > [...] > The evidence before this Court indicates that SEI obtained the defendant’s IP address while he was using the Tor network and SEI was operating nodes on that network, and not by any access to his computer. SEI got the IP addresses because the Defendant's computer communicated that information to SEI. You can imagine that the briefing went something like this: Government: there is no expectation of privacy because connecting to Tor involves giving out your IP address to random people on the Internet. Defendant: but the purpose of Tor is to hide your IP address from anyone that might matter. Government: well obviously that didn't work because we figured out his IP address. The point of vulnerabilities isn't the basis for the Court's opinion--it's just a rebuttal to the idea that Tor is supposed to keep your IP address secret even though it necessarily involves giving it to at least some untrusted nodes.

ikeboy 11y ago

Huh. http://www.theatlantic.com/technology/archive/2013/12/what-you-need-to-know-about-the-third-party-doctrine/282721/ http://www.theatlantic.com/technology/archive/2013/12/what-y... says >Importantly, my defense of the third-party doctrine implies an important limit: The doctrine should apply when the third party is a recipient of information, but it should not apply when the third party is merely a conduit for information intended for someone else. Sourced from http://www.abajournal.com/magazine/article/the_data_question_should_the_third-party_records_doctrine_be_revisited/ http://www.abajournal.com/magazine/article/the_data_question... The linked argument (which is one half of a debate), argues that the third party doctrine should apply to things that you wouldn't be able to hide without third parties. So metadata is covered, because you can't hide who you communicate with, but content is not. The data collected here is metadata (who connected to the site), so it seems they would consider it collectable legally.

sathackr 11y ago

IP addresses are routinely subpoenaed. Ask the operator of any popular file sharing site how many subpoenas they get from copyright lawyers. Some large ISPs have entire departments dedicated to servicing subpoenas from law enforcement. Just because you used Tor doesn't make your IP address invulnerable to subpoena. If I connect through 7 proxies and do something illegal, my IP is no less subject to subpoena than if I weren't to use a proxy at all. If I stand in my front yard, in view of my neighbors, put on a mask, then I go rob a store, wearing that same mask, I don't have a reasonable expectation of privacy as to my identity while wearing the mask. This case is far less controversial than the recent one where the FBI hacked all the pervert's computers. It may be an issue of ethics at CMU, but, not an issue with 4th/5th amendments.

mSparks 11y ago

Do US courts still consider an ip address as personal information?