8 ms·

Statement from the Tor Project Re: The Court's Feb. 23 Order in U.S. v. Farrell

82 points by jakobdabo 11y ago

lucb1e 11y ago
A few years ago this kinda bugged me. Now I am beginning to seriously wonder how judges can still get away with this. If you have no clue what you are judging, how can you do your very important job at all? Your vital role in society? When is some high ranking dude in the government going to recognize it and think of something to get them the hell out of making incorrect judgements? "No reasonable expectation of privacy in the Tor network"? That's like saying warrantless searches are legal because your house has windows, thus giving you no privacy either.
- droffel 11y ago
  While I agree with you on principle, legally, the boundaries of the 4th amendment's "Reasonable expectation of privacy" end the moment you give your data to a third party. In Tor's case, you give your data to the Tor nodes (third parties). The 4th amendment unfortunately doesn't apply, the precedent here is rock-solid.
  - lucb1e 11y ago
    Except that they had to hack the network first, like the post says. There is definitely a very reasonable expectation.
  - codys 11y ago
    If one gives a locked safe to someone else for safekeeping, do they really expect the keeper to break open the safe and search through the contents? I don't think 3rd party doctrine is really a good idea if the above is OK.
    - URSpider94 11y ago
      If you put a safe in a storage locker, the police could gain access to the safe and crack it by serving a search warrant on the storage facility, without ever notifying you -- and in fact they could get a companion gag order to prevent the storage facility from telling you or anyone else that they had done so. If the service were willing, the police could even gain access by just asking. In that case, you might have a legal claim against the service, but not against the cops. That's probably the best analogy to data in cloud services.
- deleted 11y ago
  [deleted]
- joshribakoff 11y ago
  Often the law is not intuitive. Just because a ruling may seem wrong based on a blog post, doesn't mean the judge is inept as his job (although that's certainly a possibility)
- maxlybbert 11y ago
  Courts have the ability to appoint a special master to help with things like this. And interested parties -- such as Tor -- can usually file briefs with the court to introduce legally relevant information. But I'm not sure that's enough.
eykanal 11y ago
This statement is pretty confusing to me. It seems that they're attempting to use the _legal_ phrase "reasonable expectation of privacy" in a decidedly non-legal sense. The term is in fact a legal one (see here [1] for a definition, or just google the term), and after reading through the definition, I find it hard for anyone to argue that they _should_ have a "reasonable expectation of privacy" when using _any_ public network. Sure, Tor users are using the network because it provides anonymity, but anonymity and "expectation of privacy" are two very distinct concepts. Tor allows them to PUBLICLY communicate ANONYMOUSLY. You can have an anonymous communication without any expectation of privacy, the same way you can have privacy without anonymity. Note that I am not a lawyer and am making assumptions and inferences about legal matters based on internet searches. YMMV. [1]: http://injury.findlaw.com/torts-and-personal-injuries/what-is-the--reasonable-expectation-of-privacy--.html http://injury.findlaw.com/torts-and-personal-injuries/what-i...
- upofadown 11y ago
  The discussion in your link specifically says it does not apply to "searches by persons acting on behalf of a city, state, or federal government.". It links to this discussion of Fourth Amendment rights which seems more applicable to the case here: * http://criminal.findlaw.com/criminal-rights/when-the-fourth-amendment-applies.html http://criminal.findlaw.com/criminal-rights/when-the-fourth-... That page contains this quote: >The Supreme Court has explained that what "a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection ... " But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected (see Katz v. United States, 389 U.S. 347 [1967]).
- ajross 11y ago
  > anonymity and "expectation of privacy" are two very distinct concepts Can you elaborate on that? I don't think I understand the point you're trying to make. One can construct a semantic distinction, but it doesn't seem relevant here. Clearly, Tor users are using Tor because they believe the copious online content describing it as either or both of "private" and "anonymous". To argue that their "expectation of {privacy|anonymity}" is "unreasonable" seems to strain logic by any definition, be it "legal" or not.
rayiner 11y ago
> It is clear that the court does not understand how the Tor network works. The entire purpose of the network is to enable users to communicate privately and securely. The order demonstrates a perfectly adequate understanding of the technology: https://motherboard.vice.com/read/carnegie-mellon-university-attacked-tor-was-subpoenaed-by-feds https://motherboard.vice.com/read/carnegie-mellon-university.... Tor does not actually hide your IP address from the public Internet. Someone technically ignorant might believe that (in which case, his expectation of privacy is based on a false assumption and is thus objectively unreasonable), but that's not the guarantee Tor provides. What onion routing does is ensure that someone sitting in the middle cannot identify both the source and destination of a packet. But the legally relevant technical question is not whether someone can track the packet from the source to the destination. It's whether the user's IP address has been revealed to the public. That's necessarily the case even when communicating over Tor; that's just how the Internet works.
- AnthonyMouse 11y ago
  > But the legally relevant technical question is not whether someone can track the packet from the source to the destination. It's whether the user's IP address has been revealed to the public. That's necessarily the case even when communicating over Tor; that's just how the Internet works. But you're only getting there with some kind of unusual globally omniscient consolidated definition of "the user's IP address" where because one member of the public knows the user but not the IP address (exit node) and a different member of the public knows the IP address but not the user (entry node) then "the public" knows the user's IP address, even though under expected operation there is no member of the public that actually knows the user's IP address. By this logic "the public" knows the identity of every pseudonymous author because some members of the public know the pseudonymous work and different members of the public know the author in person, even if not one member of the public actually knows who writes under that pseudonym.
  - rayiner 11y ago
    I think you'd be hard pressed to argue that you have a 4th amendment right not to have the government link your pseudonym to your real name.

82 points by jakobdabo 11y ago

A few years ago this kinda bugged me. Now I am beginning to seriously wonder how judges can still get away with this. If you have no clue what you are judging, how can you do your very important job at all? Your vital role in society? When is some high ranking dude in the government going to recognize it and think of something to get them the hell out of making incorrect judgements? "No reasonable expectation of privacy in the Tor network"? That's like saying warrantless searches are legal because your house has windows, thus giving you no privacy either.

droffel 11y ago
While I agree with you on principle, legally, the boundaries of the 4th amendment's "Reasonable expectation of privacy" end the moment you give your data to a third party. In Tor's case, you give your data to the Tor nodes (third parties). The 4th amendment unfortunately doesn't apply, the precedent here is rock-solid.
- lucb1e 11y ago
  Except that they had to hack the network first, like the post says. There is definitely a very reasonable expectation.
- codys 11y ago
  If one gives a locked safe to someone else for safekeeping, do they really expect the keeper to break open the safe and search through the contents? I don't think 3rd party doctrine is really a good idea if the above is OK.
  - URSpider94 11y ago
    If you put a safe in a storage locker, the police could gain access to the safe and crack it by serving a search warrant on the storage facility, without ever notifying you -- and in fact they could get a companion gag order to prevent the storage facility from telling you or anyone else that they had done so. If the service were willing, the police could even gain access by just asking. In that case, you might have a legal claim against the service, but not against the cops. That's probably the best analogy to data in cloud services.
deleted 11y ago
[deleted]
joshribakoff 11y ago
Often the law is not intuitive. Just because a ruling may seem wrong based on a blog post, doesn't mean the judge is inept as his job (although that's certainly a possibility)
maxlybbert 11y ago
Courts have the ability to appoint a special master to help with things like this. And interested parties -- such as Tor -- can usually file briefs with the court to introduce legally relevant information. But I'm not sure that's enough.

eykanal 11y ago

This statement is pretty confusing to me. It seems that they're attempting to use the _legal_ phrase "reasonable expectation of privacy" in a decidedly non-legal sense. The term is in fact a legal one (see here [1] for a definition, or just google the term), and after reading through the definition, I find it hard for anyone to argue that they _should_ have a "reasonable expectation of privacy" when using _any_ public network. Sure, Tor users are using the network because it provides anonymity, but anonymity and "expectation of privacy" are two very distinct concepts. Tor allows them to PUBLICLY communicate ANONYMOUSLY. You can have an anonymous communication without any expectation of privacy, the same way you can have privacy without anonymity. Note that I am not a lawyer and am making assumptions and inferences about legal matters based on internet searches. YMMV. [1]: http://injury.findlaw.com/torts-and-personal-injuries/what-is-the--reasonable-expectation-of-privacy--.html http://injury.findlaw.com/torts-and-personal-injuries/what-i...

upofadown 11y ago
The discussion in your link specifically says it does not apply to "searches by persons acting on behalf of a city, state, or federal government.". It links to this discussion of Fourth Amendment rights which seems more applicable to the case here: * http://criminal.findlaw.com/criminal-rights/when-the-fourth-amendment-applies.html http://criminal.findlaw.com/criminal-rights/when-the-fourth-... That page contains this quote: >The Supreme Court has explained that what "a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection ... " But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected (see Katz v. United States, 389 U.S. 347 [1967]).
ajross 11y ago
> anonymity and "expectation of privacy" are two very distinct concepts Can you elaborate on that? I don't think I understand the point you're trying to make. One can construct a semantic distinction, but it doesn't seem relevant here. Clearly, Tor users are using Tor because they believe the copious online content describing it as either or both of "private" and "anonymous". To argue that their "expectation of {privacy|anonymity}" is "unreasonable" seems to strain logic by any definition, be it "legal" or not.

rayiner 11y ago

> It is clear that the court does not understand how the Tor network works. The entire purpose of the network is to enable users to communicate privately and securely. The order demonstrates a perfectly adequate understanding of the technology: https://motherboard.vice.com/read/carnegie-mellon-university-attacked-tor-was-subpoenaed-by-feds https://motherboard.vice.com/read/carnegie-mellon-university.... Tor does not actually hide your IP address from the public Internet. Someone technically ignorant might believe that (in which case, his expectation of privacy is based on a false assumption and is thus objectively unreasonable), but that's not the guarantee Tor provides. What onion routing does is ensure that someone sitting in the middle cannot identify both the source and destination of a packet. But the legally relevant technical question is not whether someone can track the packet from the source to the destination. It's whether the user's IP address has been revealed to the public. That's necessarily the case even when communicating over Tor; that's just how the Internet works.

AnthonyMouse 11y ago
> But the legally relevant technical question is not whether someone can track the packet from the source to the destination. It's whether the user's IP address has been revealed to the public. That's necessarily the case even when communicating over Tor; that's just how the Internet works. But you're only getting there with some kind of unusual globally omniscient consolidated definition of "the user's IP address" where because one member of the public knows the user but not the IP address (exit node) and a different member of the public knows the IP address but not the user (entry node) then "the public" knows the user's IP address, even though under expected operation there is no member of the public that actually knows the user's IP address. By this logic "the public" knows the identity of every pseudonymous author because some members of the public know the pseudonymous work and different members of the public know the author in person, even if not one member of the public actually knows who writes under that pseudonym.
- rayiner 11y ago
  I think you'd be hard pressed to argue that you have a 4th amendment right not to have the government link your pseudonym to your real name.