7 ms·

They're giving over the information to a third party, which usually destroys any 4th amendment rights. The fact that the third party was actually three differe

by ikeboy 11y ago

They're giving over the information to a third party, which usually destroys any 4th amendment rights. The fact that the third party was actually three different parties who only got a piece (or six, when using hidden services) doesn't seem like it would change the law. If I split data into 6 pieces and handed it to 6 different people, the government can take those 6 pieces and put them together without violating my rights. I don't see why Tor would be any different. In fact, this particular vulnerability IIRC involved the researchers acting as both the exit node and the guard node, and finding a way to pass a message between the two so they'd notice when they're in the same circuit. That seems even better legally than my analogy above. They didn't need to take any data, the victims connected to them and gave them the info.

Lawtonfogle 11y ago
>They're giving over the information to a third party, which usually destroys any 4th amendment rights. Same reason that there is no need for a warrant to collect phone calls since you are handing data over to the phone companies to carry between you and the other party(ies). Also the same reason the government can shift through your mail, since the items are in the possession of a third party (you likely gave the items to the government itself). To me this makes as much sense as the argument that since a plane carrying people can fly over you, it is perfectly reasonable to put a blimp with an extremely high zoom camera on that spies on your home constantly, detecting not just visible light, but also infrared. Also, since when you talk things vibrate, and since it is possible to view those vibrations though a window, I'm actually broadcasting my speech to the public and thus don't have any expectation of privacy.
- ikeboy 11y ago
  Note that this is only talking constitutionally. The government is free to pass laws that disallow such gathering, or simply not pass laws that allow it. IIRC collecting mail is not in fact legal without a warrant, and only photographing the outside (which anyone who handles it can see) is allowed. I do think the fact that any member of the public can collect data legally means the government should be able to as well.
- tanker 11y ago
  I recognize the similarity between phone calls and Tor; however, I too think there is a difference in the expectation of privacy. I like your analogy with aerial surveillance, but partially because I think you are wrong. It is my understanding that aerial views available to the public, such as those available to a commercial helicopter, do not require a warrant. However, if the police go beyond public capabilities with high zoom cameras it may require a warrant. Similarly, if the state goes beyond the capabilities of the public in obtaining my IP address, they should require a warrant. The question then becomes, "Does the CMU project constitute knowledge generally available to the public?" I would argue the negative, but I could see it answered either way.
  - ikeboy 11y ago
    It doesn't need to be available to the public, only available to third parties. There are a finite number of people (either 3 or 6) that together have all the data needed to identify the user.
- cdr 11y ago
  > To me this makes as much sense as the argument that since a plane carrying people can fly over you, it is perfectly reasonable to put a blimp with an extremely high zoom camera on that spies on your home constantly, detecting not just visible light, but also infrared. Also, since when you talk things vibrate, and since it is possible to view those vibrations though a window, I'm actually broadcasting my speech to the public and thus don't have any expectation of privacy. I doubt anyone is making that argument; in Kyllo v. United States the Supreme Court held that infrared cameras constituted an unreasonable search. Recording vibrations would also likely fall in the same category. Police spying on you from a blimp is fairly unlikely, since it would be fairly conspicuous, not to mention expensive. Far more likely they just stick a camera on a utility pole as in the recent United States v. Houston, what you're most likely alluding to. The Sixth Circuit did uphold that tactic, but the law is far from settled there.
  - botrub 11y ago
    >Police spying on you from a blimp is fairly unlikely, since it would be fairly conspicuous, not to mention expensive. The Army is actually doing this: https://theintercept.com/2014/12/17/billion-dollar-surveillance-blimp-launch-maryland/ https://theintercept.com/2014/12/17/billion-dollar-surveilla...
    - fapjacks 11y ago
      The scary thing about those blimps is that we used exactly those in our various warzones. Look for them in pictures of Kabul or Baghdad while Americans were there. I used to joke to buddies in my unit that it was even the same contractor sitting in the trailer where the blimp is anchored, watching the video.
    - cdr 11y ago
      Looks pretty conspicuous to me, and also extremely unlikely to be used for sustained surveillance of a person. Also sounds likely to be discontinued when funding runs out. A load of hot air, in other words.
- tannhauser23 11y ago
  These issues have actually been litigated in court. The broad consensus is that yes, the police can use a surveillance plane can take pictures of you without first obtaining a warrant (Florida v. Riley), but no, they can't use infrared camera to look inside your home without a warrant. (Kyllo v. United States) None of these cases are really analogous to the Tor case. Generally speaking, you have no reasonable expectation of privacy that information that you voluntarily provide to a third party will be kept confidential. This is why the police doesn't need a warrant to get your phone records or to obtain your IP address. You bring up mail, which is an interesting case. Conents of a sealed mail IS protected by the Fourth Amendment - it's just that the government usually relies on the "exigent circumstances" exception to the warrant requirement (basically, showing that there is probable cause to search the mail but that there is no time to obtain a warrant). The government can't just mass-open all sealed mails and look at their contents.
  - rtpg 11y ago
    Just to add a bit more information, the Kyllo v. US case was decided based on what a person would reasonably expect a member of the public to own. Many people have planes that fly about, drones or whatnot. So you could expect random members of the public to have ways of taking arial pictures of your house. Therefore those do not violate your right to privacy. It's very unlikely for a member of the public to own a helicopter with an infrared camera, so using it without a warrant is a violation of privacy. The basic example used by a court is binoculars. Most people have access to binoculars, and own them. So if you do something next to your window, police can totally look through your windows with binoculars and act on the information.
  - harry8 11y ago
    A helicopter with an infrared camera costs about $100.
    - deftnerd 11y ago
      I believe he is referring to a thermal imaging camera, which can see heat sources. They're still somewhat an expensive specialty item. The police used to use them to look for people growing marijuana in their attics, but higher courts now say that would require a warrant.
nitrogen 11y ago
We don't consider handing a letter to the USPS "giving over the information to a third party," so we have an example to apply to other supposedly third-party information that is really first-party information temporarily handled by, but not intended for, a third party.
- ikeboy 11y ago
  The USPS can't read the letter without breaking the seal. That's different from Tor, where the three parties can team up and exchange data, and they'll know who visited what, without breaking any seal. If the mail is unsealed, they're allowed to open it. See https://www.law.cornell.edu/cfr/text/39/233.3 https://www.law.cornell.edu/cfr/text/39/233.3
  - nitrogen 11y ago
    I can very easily call any of the layers in a secure connection a "seal". Besides, it's an analogy to demonstrate that there are things that are considered private while in a third party's control, not a literal point-for-point template for how to design privacy law for the Internet. The third-party doctrine does not match any non-lawyer's expectations, and it's the doctrine that needs to change, not just people's expectations.
  - pbhjpbhj 11y ago
    They can read the mail through the seal using the shirt off tech used by archaeologists to read rolled up scrolls. Surely the point is when sealed there user expects privacy just as seven using Tor a used expects privacy - in both cases there is a system in place to protect the content from being simply read. That the technical solution used can be overcome doesn't change the users expectation that the 'seal' will mean the content is carried without being read.
    - ikeboy 11y ago
      The fact that all relays working together can determine the information means that the user gave up the info. If the US were to operate all three relays, would you still consider collecting that data to be illegal?
wyager 11y ago
So when I send data over the internet, am I "giving" it to everyone who owns a router along the route? I wouldn't say so.
- ikeboy 11y ago
  They can all read it, if you're using http. In what sense are you not giving it to them? Even on https, they can see who you are and who you're visiting.
  - wyager 11y ago
    The USPS can read my mail, but I am not giving it to them (legally or morally). Also, tor isn't HTTP. It's quite heavily encrypted.
    - ikeboy 11y ago
      The only relevant information being used by the government is who visited what site. (If this is incorrect, let me know). That corresponds to the outside of letters, which the government can read legally without a warrant.
      - AnthonyMouse 11y ago
        The outside of letters isn't encrypted. The destination in Tor is encrypted by design to everyone who is expected to know who you are. It's literally the purpose of Tor to make that information private. Or to put it a different way, if Tor doesn't create a reasonable expectation of metadata privacy, what would?
        ikeboy 11y ago
        >Or to put it a different way, if Tor doesn't create a reasonable expectation of metadata privacy, what would? According to the theory put forward in the second part of http://www.abajournal.com/magazine/article/the_data_question_should_the_third-party_records_doctrine_be_revisited/ http://www.abajournal.com/magazine/article/the_data_question..., nothing.
newman314 11y ago
I'm not a fan of the third party doctrine, which IMO badly needs to be updated. To me, it seems like a runaround/copout. So much of our data today is held in the cloud that it amounts to open season for data acquisition. And for data that isn't, what's there to stop a governmental agency from using the All Writs Act to compel data movement/redirection to a third party site? Just because something is technically legal today, doesn't mean it's the right thing to do.
- ikeboy 11y ago
  Remember, this is only constitutional limits. Congress is free to pass laws preventing such collection, as they in fact did with the Freedom Act, banning phone metadata collection.
- rayiner 11y ago
  Third Party doctrine isn't a runabout. It's inherent in the text of the 4th amendment: > The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated... Information I have about you is not your information, and you can't invoke the 4th amendment to protect it. Data held in the cloud is different. At least arguably, you have a property right to that data even if a cloud provider is holding it for you. You can't say that about IP addresses, IP address logs, call data records, etc. That's the company's data about you. You have no property interest in it, and mostly you don't even have access to it.
  - newman314 11y ago
    So let's work through a scenario here. Assume you are Verizon (or any other carrier). I pay you for cell phone voice & internet service. As part of that exchange, I provide billing info etc. etc. Are you saying that I don't own said information and that you are free to derive additional revenue by selling it to someone else? To me, I paid for a service, thereby a single transaction. My expectation is that as part of that transaction, the other party should not have to the ability to derive secondary benefit without explicit consent. Particularly, since I don't see any upside to secondary/tertiary usage. I guess I'm much more for the European vision of personal data privacy (you own your own data and grant it for specific use) vs. the US version (anything goes).
ul6o7gymnwt 11y ago
And one cannot use the Internet at all without giving over information to a third party. I'm going to go ahead and say we've all been "dirt roaded" by this interpretation since now we can't even watch the modern equivalent of TV without "giving away" our privacy under it. That is a step backwards to say the least.
btilly 11y ago
The Constitutional argument is supposed to be based on reasonable EXPECTATIONS of the people involved. So, for example, when most phones were party phones, people didn't have a reasonable expectation of privacy and no warrant was needed to tap phone calls. This was what was decided in Olmstead v. U.S. in 1928. At a later date, private phones became the norm. And so in Katz v. U.S. decided in 1967, warrants for tapping phones were held to be required. That is because people's expectations of privacy had changed. In the case of TOR, people were using a service that was advertised as being designed by the NSA to protect your online privacy EVEN IF you were under attack by state actors. In fact it was widely advertised that all anyone could know is that you were using TOR, but nobody would know what you were doing with it, who you contacted, and so on. What do you think would have been a reasonable expectation in 2014? That using TOR meant your communication was private, or publicly available?
- rtpg 11y ago
  Honestly, someone using Tor should know that your communication details are being held by exit nodes. Isn't it kind of common among the community to not trust your exit nodes? I would say that the assumption is that your communication is public.
  - harry8 11y ago
    It is reasonable to assume that you are attempting to keep the information private. It is reasonable to assume that the US govt would not hack the information on that basis. If you assume it's public, why the hell are you using TOR at all? Use of TOR shows the assumption pretty clearly.
    - rtpg 11y ago
      if you're attempting to keep the information private, you're not doing a good job by handing it to a third party. Expectation of privacy is kind of based around self-incrimination, and you lose a lot of those when you hand information to a third party. Even if it's "public" (in the legal sense of 'not protected'), Tor can be useful against non-state actors, or against weaker state actors. I'm not saying there isn't a colloquial expectation of privacy, but that the jurisprudence on privacy doesn't apply to Tor (or at least, that there is an argument that it doesn't).
382794 11y ago
So does this apply to encrypted information coming into my home such as cable TV? Encrypted wifi? Cell phone signals?
TheOtherHobbes 11y ago
>They're giving over the information to a third party, which usually destroys any 4th amendment rights. By that argument mail, courier, landline phone, cellphone, satellite phone, email, web chat, SMS, and everything except face to face speech aren't protected. Legally, I suspect that's a bit of a reach.

by ikeboy 11y ago

Lawtonfogle 11y ago

>They're giving over the information to a third party, which usually destroys any 4th amendment rights. Same reason that there is no need for a warrant to collect phone calls since you are handing data over to the phone companies to carry between you and the other party(ies). Also the same reason the government can shift through your mail, since the items are in the possession of a third party (you likely gave the items to the government itself). To me this makes as much sense as the argument that since a plane carrying people can fly over you, it is perfectly reasonable to put a blimp with an extremely high zoom camera on that spies on your home constantly, detecting not just visible light, but also infrared. Also, since when you talk things vibrate, and since it is possible to view those vibrations though a window, I'm actually broadcasting my speech to the public and thus don't have any expectation of privacy.

ikeboy 11y ago
Note that this is only talking constitutionally. The government is free to pass laws that disallow such gathering, or simply not pass laws that allow it. IIRC collecting mail is not in fact legal without a warrant, and only photographing the outside (which anyone who handles it can see) is allowed. I do think the fact that any member of the public can collect data legally means the government should be able to as well.
tanker 11y ago
I recognize the similarity between phone calls and Tor; however, I too think there is a difference in the expectation of privacy. I like your analogy with aerial surveillance, but partially because I think you are wrong. It is my understanding that aerial views available to the public, such as those available to a commercial helicopter, do not require a warrant. However, if the police go beyond public capabilities with high zoom cameras it may require a warrant. Similarly, if the state goes beyond the capabilities of the public in obtaining my IP address, they should require a warrant. The question then becomes, "Does the CMU project constitute knowledge generally available to the public?" I would argue the negative, but I could see it answered either way.
- ikeboy 11y ago
  It doesn't need to be available to the public, only available to third parties. There are a finite number of people (either 3 or 6) that together have all the data needed to identify the user.
cdr 11y ago
> To me this makes as much sense as the argument that since a plane carrying people can fly over you, it is perfectly reasonable to put a blimp with an extremely high zoom camera on that spies on your home constantly, detecting not just visible light, but also infrared. Also, since when you talk things vibrate, and since it is possible to view those vibrations though a window, I'm actually broadcasting my speech to the public and thus don't have any expectation of privacy. I doubt anyone is making that argument; in Kyllo v. United States the Supreme Court held that infrared cameras constituted an unreasonable search. Recording vibrations would also likely fall in the same category. Police spying on you from a blimp is fairly unlikely, since it would be fairly conspicuous, not to mention expensive. Far more likely they just stick a camera on a utility pole as in the recent United States v. Houston, what you're most likely alluding to. The Sixth Circuit did uphold that tactic, but the law is far from settled there.
- botrub 11y ago
  >Police spying on you from a blimp is fairly unlikely, since it would be fairly conspicuous, not to mention expensive. The Army is actually doing this: https://theintercept.com/2014/12/17/billion-dollar-surveillance-blimp-launch-maryland/ https://theintercept.com/2014/12/17/billion-dollar-surveilla...
  - fapjacks 11y ago
    The scary thing about those blimps is that we used exactly those in our various warzones. Look for them in pictures of Kabul or Baghdad while Americans were there. I used to joke to buddies in my unit that it was even the same contractor sitting in the trailer where the blimp is anchored, watching the video.
  - cdr 11y ago
    Looks pretty conspicuous to me, and also extremely unlikely to be used for sustained surveillance of a person. Also sounds likely to be discontinued when funding runs out. A load of hot air, in other words.
tannhauser23 11y ago
These issues have actually been litigated in court. The broad consensus is that yes, the police can use a surveillance plane can take pictures of you without first obtaining a warrant (Florida v. Riley), but no, they can't use infrared camera to look inside your home without a warrant. (Kyllo v. United States) None of these cases are really analogous to the Tor case. Generally speaking, you have no reasonable expectation of privacy that information that you voluntarily provide to a third party will be kept confidential. This is why the police doesn't need a warrant to get your phone records or to obtain your IP address. You bring up mail, which is an interesting case. Conents of a sealed mail IS protected by the Fourth Amendment - it's just that the government usually relies on the "exigent circumstances" exception to the warrant requirement (basically, showing that there is probable cause to search the mail but that there is no time to obtain a warrant). The government can't just mass-open all sealed mails and look at their contents.
- rtpg 11y ago
  Just to add a bit more information, the Kyllo v. US case was decided based on what a person would reasonably expect a member of the public to own. Many people have planes that fly about, drones or whatnot. So you could expect random members of the public to have ways of taking arial pictures of your house. Therefore those do not violate your right to privacy. It's very unlikely for a member of the public to own a helicopter with an infrared camera, so using it without a warrant is a violation of privacy. The basic example used by a court is binoculars. Most people have access to binoculars, and own them. So if you do something next to your window, police can totally look through your windows with binoculars and act on the information.
- harry8 11y ago
  A helicopter with an infrared camera costs about $100.
  - deftnerd 11y ago
    I believe he is referring to a thermal imaging camera, which can see heat sources. They're still somewhat an expensive specialty item. The police used to use them to look for people growing marijuana in their attics, but higher courts now say that would require a warrant.

nitrogen 11y ago

We don't consider handing a letter to the USPS "giving over the information to a third party," so we have an example to apply to other supposedly third-party information that is really first-party information temporarily handled by, but not intended for, a third party.

ikeboy 11y ago
The USPS can't read the letter without breaking the seal. That's different from Tor, where the three parties can team up and exchange data, and they'll know who visited what, without breaking any seal. If the mail is unsealed, they're allowed to open it. See https://www.law.cornell.edu/cfr/text/39/233.3 https://www.law.cornell.edu/cfr/text/39/233.3
- nitrogen 11y ago
  I can very easily call any of the layers in a secure connection a "seal". Besides, it's an analogy to demonstrate that there are things that are considered private while in a third party's control, not a literal point-for-point template for how to design privacy law for the Internet. The third-party doctrine does not match any non-lawyer's expectations, and it's the doctrine that needs to change, not just people's expectations.
- pbhjpbhj 11y ago
  They can read the mail through the seal using the shirt off tech used by archaeologists to read rolled up scrolls. Surely the point is when sealed there user expects privacy just as seven using Tor a used expects privacy - in both cases there is a system in place to protect the content from being simply read. That the technical solution used can be overcome doesn't change the users expectation that the 'seal' will mean the content is carried without being read.
  - ikeboy 11y ago
    The fact that all relays working together can determine the information means that the user gave up the info. If the US were to operate all three relays, would you still consider collecting that data to be illegal?

wyager 11y ago

So when I send data over the internet, am I "giving" it to everyone who owns a router along the route? I wouldn't say so.

ikeboy 11y ago
They can all read it, if you're using http. In what sense are you not giving it to them? Even on https, they can see who you are and who you're visiting.
- wyager 11y ago
  The USPS can read my mail, but I am not giving it to them (legally or morally). Also, tor isn't HTTP. It's quite heavily encrypted.
  - ikeboy 11y ago
    The only relevant information being used by the government is who visited what site. (If this is incorrect, let me know). That corresponds to the outside of letters, which the government can read legally without a warrant.
    - AnthonyMouse 11y ago
      The outside of letters isn't encrypted. The destination in Tor is encrypted by design to everyone who is expected to know who you are. It's literally the purpose of Tor to make that information private. Or to put it a different way, if Tor doesn't create a reasonable expectation of metadata privacy, what would?
      - ikeboy 11y ago
        >Or to put it a different way, if Tor doesn't create a reasonable expectation of metadata privacy, what would? According to the theory put forward in the second part of http://www.abajournal.com/magazine/article/the_data_question_should_the_third-party_records_doctrine_be_revisited/ http://www.abajournal.com/magazine/article/the_data_question..., nothing.

newman314 11y ago

I'm not a fan of the third party doctrine, which IMO badly needs to be updated. To me, it seems like a runaround/copout. So much of our data today is held in the cloud that it amounts to open season for data acquisition. And for data that isn't, what's there to stop a governmental agency from using the All Writs Act to compel data movement/redirection to a third party site? Just because something is technically legal today, doesn't mean it's the right thing to do.

ikeboy 11y ago
Remember, this is only constitutional limits. Congress is free to pass laws preventing such collection, as they in fact did with the Freedom Act, banning phone metadata collection.
rayiner 11y ago
Third Party doctrine isn't a runabout. It's inherent in the text of the 4th amendment: > The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated... Information I have about you is not your information, and you can't invoke the 4th amendment to protect it. Data held in the cloud is different. At least arguably, you have a property right to that data even if a cloud provider is holding it for you. You can't say that about IP addresses, IP address logs, call data records, etc. That's the company's data about you. You have no property interest in it, and mostly you don't even have access to it.
- newman314 11y ago
  So let's work through a scenario here. Assume you are Verizon (or any other carrier). I pay you for cell phone voice & internet service. As part of that exchange, I provide billing info etc. etc. Are you saying that I don't own said information and that you are free to derive additional revenue by selling it to someone else? To me, I paid for a service, thereby a single transaction. My expectation is that as part of that transaction, the other party should not have to the ability to derive secondary benefit without explicit consent. Particularly, since I don't see any upside to secondary/tertiary usage. I guess I'm much more for the European vision of personal data privacy (you own your own data and grant it for specific use) vs. the US version (anything goes).

ul6o7gymnwt 11y ago

And one cannot use the Internet at all without giving over information to a third party. I'm going to go ahead and say we've all been "dirt roaded" by this interpretation since now we can't even watch the modern equivalent of TV without "giving away" our privacy under it. That is a step backwards to say the least.

btilly 11y ago

The Constitutional argument is supposed to be based on reasonable EXPECTATIONS of the people involved. So, for example, when most phones were party phones, people didn't have a reasonable expectation of privacy and no warrant was needed to tap phone calls. This was what was decided in Olmstead v. U.S. in 1928. At a later date, private phones became the norm. And so in Katz v. U.S. decided in 1967, warrants for tapping phones were held to be required. That is because people's expectations of privacy had changed. In the case of TOR, people were using a service that was advertised as being designed by the NSA to protect your online privacy EVEN IF you were under attack by state actors. In fact it was widely advertised that all anyone could know is that you were using TOR, but nobody would know what you were doing with it, who you contacted, and so on. What do you think would have been a reasonable expectation in 2014? That using TOR meant your communication was private, or publicly available?

rtpg 11y ago
Honestly, someone using Tor should know that your communication details are being held by exit nodes. Isn't it kind of common among the community to not trust your exit nodes? I would say that the assumption is that your communication is public.
- harry8 11y ago
  It is reasonable to assume that you are attempting to keep the information private. It is reasonable to assume that the US govt would not hack the information on that basis. If you assume it's public, why the hell are you using TOR at all? Use of TOR shows the assumption pretty clearly.
  - rtpg 11y ago
    if you're attempting to keep the information private, you're not doing a good job by handing it to a third party. Expectation of privacy is kind of based around self-incrimination, and you lose a lot of those when you hand information to a third party. Even if it's "public" (in the legal sense of 'not protected'), Tor can be useful against non-state actors, or against weaker state actors. I'm not saying there isn't a colloquial expectation of privacy, but that the jurisprudence on privacy doesn't apply to Tor (or at least, that there is an argument that it doesn't).

382794 11y ago

So does this apply to encrypted information coming into my home such as cable TV? Encrypted wifi? Cell phone signals?

TheOtherHobbes 11y ago

>They're giving over the information to a third party, which usually destroys any 4th amendment rights. By that argument mail, courier, landline phone, cellphone, satellite phone, email, web chat, SMS, and everything except face to face speech aren't protected. Legally, I suspect that's a bit of a reach.