3 ms·

Why isn't the first line of the Tor EULA or info page (and I wondered the same about Lavabit email) "This software/service is intended to provide its users a re

Why isn't the first line of the Tor EULA or info page (and I wondered the same about Lavabit email) "This software/service is intended to provide its users a reasonable expectation of privacy under US and international law." Or some such. It's unreasonable to expect every user of a tech service to understand how it all works so they can know their level of legal protection. Phone taps require a warrant even if the phone user doesn't know how switching or tapping works. What's wrong with this idea?

wlesieutre 11y ago
(Not a lawyer but) I don't think it legally holds any water, once your data is out on the public network it's out on the public network. It's the electronic equivalent of a sticker on your car that says "This car is intended to provide its users a reasonable expectation of privacy under US and international law."
- ViViDboarder 11y ago
  When I make a phone call it routes through a public network. Tapping a phone is illegal due to my expectation that the call is private. I dunno. I've seen some good arguments either way here, and I'm also not a lawyer.
fixermark 11y ago
I wonder if that would impose liability on the tor project itself or tor node runners. If it did, you can substitute out this SEI story with the CIA just secretly directing multiple tor node owners to run special versions of their software without notifying users.
twblalock 11y ago
I could put a sign on my living room wall that says "Anyone who sees this sign owes me $100." Do you think that would hold up in court? Of course it wouldn't. Asserting something does not make it true. Your example is as trivial as mine, from a legal point of view -- you can't create constitutional rights that don't exist simply by asserting them. The courts decide where people have an expectation of privacy; you can't just create that expectation by writing it down.
- dgacmu 11y ago
  But you might be able to create it contractually. Before establishing a connection with a node, exchange a sequence of packets whose contents contains an agreement that neither node will keep a persistent record of the IP address or any other data or metadata associated with the connection. Refuse to connect a node that does not send a (signed) agreement. It's still tricky about identifying the parties, etc., but it'd be interesting to explore with a techno-lawyercat.
ridgeguy 11y ago
I like this, because it points to addressing user silence with respect to expectation of privacy. Take your idea one step further. Suppose Tor provided a box that users could (optionally) click to affirmatively declare they were using Tor with an expectation of privacy. Maybe this selection could be locally stored in an encrypted form so that users, if they later needed to prove they had an expectation of privacy, could show they had ticked the box declaring that. This could provide an affirmative declaration that the user expected privacy when using Tor. Would that be useful? Thoughts, anyone?
rtpg 11y ago
"intended to do something" does not magically make Tor actually meet the smell test that the courts have set up. The expectation of privacy (at least in the US) is not necessarily about what the users actually think about their level of privacy, but of what a well-informed user might expect. A well-informed user of Tor knows its handing the exit nodes a lot of information, and thus using Tor makes what you're doing semi-public.

wlesieutre 11y ago

(Not a lawyer but) I don't think it legally holds any water, once your data is out on the public network it's out on the public network. It's the electronic equivalent of a sticker on your car that says "This car is intended to provide its users a reasonable expectation of privacy under US and international law."

ViViDboarder 11y ago
When I make a phone call it routes through a public network. Tapping a phone is illegal due to my expectation that the call is private. I dunno. I've seen some good arguments either way here, and I'm also not a lawyer.

fixermark 11y ago

I wonder if that would impose liability on the tor project itself or tor node runners. If it did, you can substitute out this SEI story with the CIA just secretly directing multiple tor node owners to run special versions of their software without notifying users.

twblalock 11y ago

I could put a sign on my living room wall that says "Anyone who sees this sign owes me $100." Do you think that would hold up in court? Of course it wouldn't. Asserting something does not make it true. Your example is as trivial as mine, from a legal point of view -- you can't create constitutional rights that don't exist simply by asserting them. The courts decide where people have an expectation of privacy; you can't just create that expectation by writing it down.

dgacmu 11y ago
But you might be able to create it contractually. Before establishing a connection with a node, exchange a sequence of packets whose contents contains an agreement that neither node will keep a persistent record of the IP address or any other data or metadata associated with the connection. Refuse to connect a node that does not send a (signed) agreement. It's still tricky about identifying the parties, etc., but it'd be interesting to explore with a techno-lawyercat.

ridgeguy 11y ago

I like this, because it points to addressing user silence with respect to expectation of privacy. Take your idea one step further. Suppose Tor provided a box that users could (optionally) click to affirmatively declare they were using Tor with an expectation of privacy. Maybe this selection could be locally stored in an encrypted form so that users, if they later needed to prove they had an expectation of privacy, could show they had ticked the box declaring that. This could provide an affirmative declaration that the user expected privacy when using Tor. Would that be useful? Thoughts, anyone?

rtpg 11y ago

"intended to do something" does not magically make Tor actually meet the smell test that the courts have set up. The expectation of privacy (at least in the US) is not necessarily about what the users actually think about their level of privacy, but of what a well-informed user might expect. A well-informed user of Tor knows its handing the exit nodes a lot of information, and thus using Tor makes what you're doing semi-public.