3 ms·

Eleventh Circuit Decision Largely Eliminates 4th Amendment Protection in E-Mail

31 points by skennedy 17y ago

macrael 17y ago
It seems like email encryption should be a pretty solvable problem tech-wise. Does anyone here actually regularly send and receive such mail? If all the emails saved on servers were encrypted, we wouldn't have this problem.
- epochwolf 17y ago
  A friend and I use encrypted email from time to time for fun. We generated self-signed keys and we both added security exceptions for each other's keys to our email clients manually. While it works it took us both some time to figure out how to generate the keys. Our keys are also marked as untrusted so you have to manually add them to a trusted list. This method works okay for us but I doubt it would work for most people.
  - CWuestefeld 17y ago
    The web-of-trust is really a pain in the tail, but for the purist it's the only approach you can have faith in (or, more correctly, it's the only approach in which you explicitly decide how much faith you're prepared to have).
- notmyname 17y ago
  Tech-wise, it's a solved problem. I sign all of my outgoing emails using Thawte (now Verisign) certificates. The problem with encryption is finding the other person's keys. I have yet to receive a signed email from someone else, so I cannot send encrypted messages. It seems to be a problem primarily with critical mass and secondarily from implementation. Not enough people use signed/encrypted email to spur others to using it. Additionally, certs cost something. Even free certs cost effort in understanding the need for them and figuring out how to generate/download/install them. Then there is the whole problem with "trusted" certs... Implementation wise, things are only a little better. Once the certs are installed, (desktop) mail clients handle the signing/encrypting pretty well. But I can't sign messages from a webmail client or from my phone.
  - ars 17y ago
    Wrong problem. The issue here is not the sending of the message, but the storage of the message. You need your ISP to store the emails encrypted even if they were received in the clear.
pierrefar 17y ago
The 11th circuit "has jurisdiction over federal cases originating in the states of Alabama, Florida and Georgia"( Source: http://www.ca11.uscourts.gov/about/index.php http://www.ca11.uscourts.gov/about/index.php ). This is quite a conservative area of USA so without getting too political, I'm not surprised at this decision.
graphene 17y ago
Thought-provoking stuff.. While the intent of the fourth amendment is obvious and noble, I wonder whether, given the accelerating pace of creation and processing of information, it still makes sense to rely on legislation to prevent privacy violations. How can there be any hope of enforcing such laws in the face of the increasing complexity of worldwide communications, where (as one of the commenters on the article points out) the routing of any given data is nondeterministic and temporary copies are made at every step? It seems to me that the law is hopelessly on the wrong side of technological evolution here (I would make a very similar argument regarding copyright law). Looking at it from a different angle, perhaps (note a hint of devil's advocate here) we should be glad that modern cryptographic systems (enabled by the very tech that seemed to threaten privacy) offer the potential to make old-fashioned laws superfluous?
- pmccool 17y ago
  I'd say that legislation is more important than ever; privacy can now be violated in ways that were technically impossible 30 years ago. I agree that enforcing privacy laws is problematic, but that doesn't mean it's impossible, nor that it isn't worth trying.

31 points by skennedy 17y ago

It seems like email encryption should be a pretty solvable problem tech-wise. Does anyone here actually regularly send and receive such mail? If all the emails saved on servers were encrypted, we wouldn't have this problem.

epochwolf 17y ago
A friend and I use encrypted email from time to time for fun. We generated self-signed keys and we both added security exceptions for each other's keys to our email clients manually. While it works it took us both some time to figure out how to generate the keys. Our keys are also marked as untrusted so you have to manually add them to a trusted list. This method works okay for us but I doubt it would work for most people.
- CWuestefeld 17y ago
  The web-of-trust is really a pain in the tail, but for the purist it's the only approach you can have faith in (or, more correctly, it's the only approach in which you explicitly decide how much faith you're prepared to have).
notmyname 17y ago
Tech-wise, it's a solved problem. I sign all of my outgoing emails using Thawte (now Verisign) certificates. The problem with encryption is finding the other person's keys. I have yet to receive a signed email from someone else, so I cannot send encrypted messages. It seems to be a problem primarily with critical mass and secondarily from implementation. Not enough people use signed/encrypted email to spur others to using it. Additionally, certs cost something. Even free certs cost effort in understanding the need for them and figuring out how to generate/download/install them. Then there is the whole problem with "trusted" certs... Implementation wise, things are only a little better. Once the certs are installed, (desktop) mail clients handle the signing/encrypting pretty well. But I can't sign messages from a webmail client or from my phone.
- ars 17y ago
  Wrong problem. The issue here is not the sending of the message, but the storage of the message. You need your ISP to store the emails encrypted even if they were received in the clear.

pierrefar 17y ago

The 11th circuit "has jurisdiction over federal cases originating in the states of Alabama, Florida and Georgia"( Source: http://www.ca11.uscourts.gov/about/index.php http://www.ca11.uscourts.gov/about/index.php ). This is quite a conservative area of USA so without getting too political, I'm not surprised at this decision.

graphene 17y ago

Thought-provoking stuff.. While the intent of the fourth amendment is obvious and noble, I wonder whether, given the accelerating pace of creation and processing of information, it still makes sense to rely on legislation to prevent privacy violations. How can there be any hope of enforcing such laws in the face of the increasing complexity of worldwide communications, where (as one of the commenters on the article points out) the routing of any given data is nondeterministic and temporary copies are made at every step? It seems to me that the law is hopelessly on the wrong side of technological evolution here (I would make a very similar argument regarding copyright law). Looking at it from a different angle, perhaps (note a hint of devil's advocate here) we should be glad that modern cryptographic systems (enabled by the very tech that seemed to threaten privacy) offer the potential to make old-fashioned laws superfluous?

pmccool 17y ago
I'd say that legislation is more important than ever; privacy can now be violated in ways that were technically impossible 30 years ago. I agree that enforcing privacy laws is problematic, but that doesn't mean it's impossible, nor that it isn't worth trying.