8 ms·

I'm much less skeptical than the median HN poster about government's use of new technology in its traditional roles of criminal justice and national security, b

I'm much less skeptical than the median HN poster about government's use of new technology in its traditional roles of criminal justice and national security, but if this article is a fair summary of the case, I can't see how the ruling makes any Constitutional sense. Because burglars regularly break into people's homes or cars doesn't make them subject to warrant-free search. If the FBI wants to run code on my CPU in my private home without my permission, they should have a warrant, just as they'd need one to manipulate other objects in my home without my consent.

blakesterz 10y ago
>> ...but if this article is a fair summary of the case... Thanks for that. A good reminder that we need to think that every time we read anything like this. Just asking a simple question, "Did they get this right?" and even taking a minute to read through to the actual primary source.
- mcguire 10y ago
  "For example, hacking is much more prevalent now than it was even nine years ago, and the rise of computer hacking viathe Internet has changed the public's reasonable expectations of privacy. Cf Lee Raine, How Americans balance privacy concerns with sharing personal information: 5 key findings, PewResearchCenter (January 14, 2016), http://www.pewresearch.org/fact-tank/2016/01/14/key-findings-privacy-information-sharing/ http://www.pewresearch.org/fact-tank/2016/01/14/key-findings... (reporting that members of a focus group "worried about hackers," though "some accept that [privacy tradeoffs are] a part of modern life"). Now, it seems unreasonable to think that a computer connected to the Web is immune from invasion. Indeed, the opposite holds true: in today's digital world, it appears to be a virtual certainty that computers accessing the Internet can - and eventually will - be hacked." "Thus, hacking resembles the broken blinds in Carter. 525 U.S. at 85. Just as Justice Breyer wrote in concurrence that a police officer who peers through broken blinds does not violate anyone's Fourth Amendment rights, jd. at 103 (Breyer, J., concurring), FBI agents who exploit a vulnerability in an online network do not violate the Fourth Amendment. Just as the area into which the officer in Carter peered - an apartment - usually is afforded Fourth Amendment protection, a computer afforded Fourth Amendment protection in other circumstances is not protected from Government actors who take advantage of an easily broken system to peer into a user's computer. People who traverse the Internet ordinarily understand the risk associated with doing so. Thus, the deployment of the NIT to capture identifying information found on Defendant's computer does not represent a search under the Fourth Amendment, and no warrant was needed." The section of interest starts on page 47 of the linked Opinion and Order. http://mobile.eweek.com/security/home-computers-connected-to-the-internet-arent-private-court-rules.html http://mobile.eweek.com/security/home-computers-connected-to...
  - tamana 10y ago
    So, that judge just stuck down CFAA for civilians too? Or only for Law Enforcement
    - ikeboy 10y ago
      CFAA is about exceeding authorised access, not violating expectations of privacy.
  - imbriaco 10y ago
    The judge conveniently disregards the difference between passive observation and active intrusion. Breaking into someone's computer is no different than if the officer had broken the blinds themself, which clearly would not meet the test described by Justice Breyer.
dantillberg 10y ago
Right? It seems trivial to tweak the judges statement: "In today's digital world, it appears to be a virtual certainty that computers accessing the Internet can—and eventually will—be hacked." To apply to houses: "In today's mechanized world, it appears to be a virtual certainty that houses connected to the earth can—and eventually will—be broken into." Thus, warrants need not apply for search and seizure in houses. QED.
- type0 10y ago
  > "In today's mechanized world, it appears to be a virtual certainty that houses connected to the earth can—and eventually will—be broken into." Or rather "... houses with doors can —and eventually will—be broken into."
  - type0 10y ago
    Also: "... houses with WINDOWS can —and eventually will—be broken into."
    - deleted 10y ago
      [deleted]
    - allendoerfer 10y ago
      Even as a programmer I would much rather have to get through "… houses with WALLS …" than through reasonably strong encryption, the task might require strength, but is quite straightforward.
    - spacecowboy_lon 10y ago
      And its easier to break into the average house than the average pc.
      - rqebmm 10y ago
        Maybe, but it's definitely easier to break into a million PC's than a million houses.
slowmovintarget 10y ago
I feel bad for the judge. He's bending over backward to rationalize the end justifying the means... and he's dead wrong. His argument is essentially that if your house is connected to a road, then there is no expectation of privacy. I expect the ruling, or at least that absurd part of it, will be overturned or superseded. But the counter argument (for future cases) would be that running through a physical firewall is not a direct connection to the internet (silly as it is to make the argument).
- ikeboy 10y ago
  Did you read the ruling? Do you have any specific critiques, and do you think the multiple precedents cited are applied incorrectly? Edit: I've gone through most of the relevant sections. Most of the ruling is reasonable, the section this article and the EFF are complaining about is less supported by precedent. The actual legal argument says that hacking is common enough that people don't have a reasonable expectation of privacy, then there's this paragraph: >Although this Court recently noted in dicta that the possibility of hacking "is not enough to defeat an individual's reasonable expectation of privacy" because it is illegal, see United States v. Darby, No. 2:16-cr-36, ECF No. 31 at 10-11 (E.D. Va. June 3, 2016), this Court stresses that child pornography often resembles an international crime. Similarly, much hacking occurs by foreign nations where the governments condone or participate in hacking. Child pornography is not just a national issue; it is an international issue, and at least a portion of the pornography in this case arrived from foreign sources through the World Wide Web This seems to be the weakest part. It's saying that hacking can't be the basis for a lack of expectation of privacy, but that since some countries allow hacking, it's legal there, and if you're accessing stuff from other countries you no longer have the expectation of privacy.
  - kakarot 10y ago
    Solution: Turn all international embassies into ISPs.
  - deno 10y ago
    Any web page can include content from any country. Country TLDs don’t correspond in any way to where the content is hosted, and for most people even using DNS-resolved URLs is advanced. However, mostly thanks to IPv4 exhaustion, not even IP blocks correspond to geographical location anymore[1]. And all of this doesn’t matter anyway, because of how packet routing works. No one accessing the Internet can be reasonably expected to have any control over how their packets are routed on the network. You only control the next hop[2]. See for example: http://allthingsd.com/20131120/how-somebody-forced-the-worlds-internet-traffic-through-belarus-and-iceland/ http://allthingsd.com/20131120/how-somebody-forced-the-world... So I would agree to the extent that there can be no expectation of privacy for any unencrypted traffic. However, that’s just one type of hacking – snooping. As for actual hacking – that is someone breaking into your system – this system has to be running on something, some sort of device. This device has to be physically located somewhere. If an Elbonian comes to US and breaks into your house is it okay because in their country there are no lock on the doors, just a lot of mud, so breaking is not a crime? This is the logic here, as I see it. What it ultimately comes down to is the US government wants to have it both ways. They want to be able to extradite people that hack into devices located in the US, but they want you to have no expectation of privacy when they are the ones doing the hacking. [1] https://en.wikipedia.org/wiki/Provider-independent_address_space https://en.wikipedia.org/wiki/Provider-independent_address_s... [2] https://en.wikipedia.org/wiki/Hop_(networking) https://en.wikipedia.org/wiki/Hop_(networking)
deadtofu 10y ago
Comedy option: 3rd amendment defense. ("No Soldier shall, in time of peace be quartered in any house, without the consent of the Owner, nor in time of war, but in a manner to be prescribed by law.")
- ctdonath 10y ago
  Not comedy. One reason for "quartering soldiers" was to obtain evidence and to intimidate within a private space. I've long held any form of broadly imposed in-privacy monitoring (including compulsory back door keys) is a 3rd Amendment violation, especially if the individual is practically paying for it.
  - clarkmoody 10y ago
    It would be really interesting to see a legitimate 3rd Amendment challenge come before the courts in our time.
    - deleted 10y ago
      [deleted]
    - mindslight 10y ago
      Mitchell v. City of Henderson. Now every last amendment from the Bill of Rights has been discarded.
      - whoopdedo 10y ago
        Is there anything in the Constitution applicable to open government? I ask because the case is locked behind PACER. ... Or is it? http://www.leagle.com/decision/In%20FDCO%2020150203D28/MITCHELL%20v.%20CITY%20OF%20HENDERSON http://www.leagle.com/decision/In%20FDCO%2020150203D28/MITCH...
        mindslight 10y ago
        Wikipedia and news articles should give you the details. I'd say lack of access to law (as well as its unbearable complexity) is an issue of due process and the fundamental rule of law. But you can't look to the Constitution to dictate everything - its drafters could not anticipate all future developments, and if the government is that citizen-hostile a piece of paper won't stop it. That which the Constitution does specify should be considered more as "behavioral tests", and currently the majority of our test report is failure.
rmc 10y ago
FBI doesn't need a warrant for non-US computers.
deleted 10y ago
[deleted]
clarkmoody 10y ago
"But whether the Constitution really be one thing, or another, this much is certain - that it has either authorized such a government as we have had, or has been powerless to prevent it. In either case it is unfit to exist.” -- Lysander Spooner, No Treason
- tamana 10y ago
  That's horrid logic. The question of fitness for existence is whether the Constitution is better than its absence.
  - clarkmoody 10y ago
    Also flawed logic. Our options are not simply Constitution or No Constitution. There are a near-infinite number of unique constitutions we could have adopted, rather than the one we've got. Spooner was criticizing the actual form of our current Constitution. GP was making an appeal to the Constitution and the judicial system's ignoring of it. I agree with Spooner that a Constitution such as ours is completely powerless to prevent individual judges from rewriting every time it fits their fancy. We've basically had an ongoing Constitutional Convention in the federal courts since the founding -- without the consent of the people.
  - logfromblammo 10y ago
    That's an unanswerable question, since we cannot compare a control Earth where the U.S. Constitution was adopted in 1783 and an experimental Earth where it was never ratified. It is axiomatic that the present we now know inevitably followed from the history that preceded it. When you look at the U.S. federal government that now exists, it must have assumed its current form either by design of the Constitution, or contrary to that design. In case of the latter, the Constitution was entirely unable to prevent the government that it established from evolving into a form contrary to its design. Maybe the process was slowed somewhat. We cannot know for certain. Therefore, if you dislike the current form of US federal government, it is nonsensical to idolize the Constitution, or any other causally-related fact of history. History gave us the present. If you do not like the present, and wish the future to be different, do not repeat the mistakes of the past. Whether history could have given us another present is irrelevant, because it did not. In the end, whenever a living human fights with a document, the human will emerge victorious, and the document will become confetti. The Constitution is nothing without a living human to be its champion.
deleted 10y ago
[deleted]

blakesterz 10y ago

>> ...but if this article is a fair summary of the case... Thanks for that. A good reminder that we need to think that every time we read anything like this. Just asking a simple question, "Did they get this right?" and even taking a minute to read through to the actual primary source.

mcguire 10y ago
"For example, hacking is much more prevalent now than it was even nine years ago, and the rise of computer hacking viathe Internet has changed the public's reasonable expectations of privacy. Cf Lee Raine, How Americans balance privacy concerns with sharing personal information: 5 key findings, PewResearchCenter (January 14, 2016), http://www.pewresearch.org/fact-tank/2016/01/14/key-findings-privacy-information-sharing/ http://www.pewresearch.org/fact-tank/2016/01/14/key-findings... (reporting that members of a focus group "worried about hackers," though "some accept that [privacy tradeoffs are] a part of modern life"). Now, it seems unreasonable to think that a computer connected to the Web is immune from invasion. Indeed, the opposite holds true: in today's digital world, it appears to be a virtual certainty that computers accessing the Internet can - and eventually will - be hacked." "Thus, hacking resembles the broken blinds in Carter. 525 U.S. at 85. Just as Justice Breyer wrote in concurrence that a police officer who peers through broken blinds does not violate anyone's Fourth Amendment rights, jd. at 103 (Breyer, J., concurring), FBI agents who exploit a vulnerability in an online network do not violate the Fourth Amendment. Just as the area into which the officer in Carter peered - an apartment - usually is afforded Fourth Amendment protection, a computer afforded Fourth Amendment protection in other circumstances is not protected from Government actors who take advantage of an easily broken system to peer into a user's computer. People who traverse the Internet ordinarily understand the risk associated with doing so. Thus, the deployment of the NIT to capture identifying information found on Defendant's computer does not represent a search under the Fourth Amendment, and no warrant was needed." The section of interest starts on page 47 of the linked Opinion and Order. http://mobile.eweek.com/security/home-computers-connected-to-the-internet-arent-private-court-rules.html http://mobile.eweek.com/security/home-computers-connected-to...
- tamana 10y ago
  So, that judge just stuck down CFAA for civilians too? Or only for Law Enforcement
  - ikeboy 10y ago
    CFAA is about exceeding authorised access, not violating expectations of privacy.
- imbriaco 10y ago
  The judge conveniently disregards the difference between passive observation and active intrusion. Breaking into someone's computer is no different than if the officer had broken the blinds themself, which clearly would not meet the test described by Justice Breyer.

dantillberg 10y ago

Right? It seems trivial to tweak the judges statement: "In today's digital world, it appears to be a virtual certainty that computers accessing the Internet can—and eventually will—be hacked." To apply to houses: "In today's mechanized world, it appears to be a virtual certainty that houses connected to the earth can—and eventually will—be broken into." Thus, warrants need not apply for search and seizure in houses. QED.

type0 10y ago
> "In today's mechanized world, it appears to be a virtual certainty that houses connected to the earth can—and eventually will—be broken into." Or rather "... houses with doors can —and eventually will—be broken into."
- type0 10y ago
  Also: "... houses with WINDOWS can —and eventually will—be broken into."
  - deleted 10y ago
    [deleted]
  - allendoerfer 10y ago
    Even as a programmer I would much rather have to get through "… houses with WALLS …" than through reasonably strong encryption, the task might require strength, but is quite straightforward.
  - spacecowboy_lon 10y ago
    And its easier to break into the average house than the average pc.
    - rqebmm 10y ago
      Maybe, but it's definitely easier to break into a million PC's than a million houses.

slowmovintarget 10y ago

I feel bad for the judge. He's bending over backward to rationalize the end justifying the means... and he's dead wrong. His argument is essentially that if your house is connected to a road, then there is no expectation of privacy. I expect the ruling, or at least that absurd part of it, will be overturned or superseded. But the counter argument (for future cases) would be that running through a physical firewall is not a direct connection to the internet (silly as it is to make the argument).

ikeboy 10y ago
Did you read the ruling? Do you have any specific critiques, and do you think the multiple precedents cited are applied incorrectly? Edit: I've gone through most of the relevant sections. Most of the ruling is reasonable, the section this article and the EFF are complaining about is less supported by precedent. The actual legal argument says that hacking is common enough that people don't have a reasonable expectation of privacy, then there's this paragraph: >Although this Court recently noted in dicta that the possibility of hacking "is not enough to defeat an individual's reasonable expectation of privacy" because it is illegal, see United States v. Darby, No. 2:16-cr-36, ECF No. 31 at 10-11 (E.D. Va. June 3, 2016), this Court stresses that child pornography often resembles an international crime. Similarly, much hacking occurs by foreign nations where the governments condone or participate in hacking. Child pornography is not just a national issue; it is an international issue, and at least a portion of the pornography in this case arrived from foreign sources through the World Wide Web This seems to be the weakest part. It's saying that hacking can't be the basis for a lack of expectation of privacy, but that since some countries allow hacking, it's legal there, and if you're accessing stuff from other countries you no longer have the expectation of privacy.
- kakarot 10y ago
  Solution: Turn all international embassies into ISPs.
- deno 10y ago
  Any web page can include content from any country. Country TLDs don’t correspond in any way to where the content is hosted, and for most people even using DNS-resolved URLs is advanced. However, mostly thanks to IPv4 exhaustion, not even IP blocks correspond to geographical location anymore[1]. And all of this doesn’t matter anyway, because of how packet routing works. No one accessing the Internet can be reasonably expected to have any control over how their packets are routed on the network. You only control the next hop[2]. See for example: http://allthingsd.com/20131120/how-somebody-forced-the-worlds-internet-traffic-through-belarus-and-iceland/ http://allthingsd.com/20131120/how-somebody-forced-the-world... So I would agree to the extent that there can be no expectation of privacy for any unencrypted traffic. However, that’s just one type of hacking – snooping. As for actual hacking – that is someone breaking into your system – this system has to be running on something, some sort of device. This device has to be physically located somewhere. If an Elbonian comes to US and breaks into your house is it okay because in their country there are no lock on the doors, just a lot of mud, so breaking is not a crime? This is the logic here, as I see it. What it ultimately comes down to is the US government wants to have it both ways. They want to be able to extradite people that hack into devices located in the US, but they want you to have no expectation of privacy when they are the ones doing the hacking. [1] https://en.wikipedia.org/wiki/Provider-independent_address_space https://en.wikipedia.org/wiki/Provider-independent_address_s... [2] https://en.wikipedia.org/wiki/Hop_(networking) https://en.wikipedia.org/wiki/Hop_(networking)

deadtofu 10y ago

Comedy option: 3rd amendment defense. ("No Soldier shall, in time of peace be quartered in any house, without the consent of the Owner, nor in time of war, but in a manner to be prescribed by law.")

ctdonath 10y ago
Not comedy. One reason for "quartering soldiers" was to obtain evidence and to intimidate within a private space. I've long held any form of broadly imposed in-privacy monitoring (including compulsory back door keys) is a 3rd Amendment violation, especially if the individual is practically paying for it.
- clarkmoody 10y ago
  It would be really interesting to see a legitimate 3rd Amendment challenge come before the courts in our time.
  - deleted 10y ago
    [deleted]
  - mindslight 10y ago
    Mitchell v. City of Henderson. Now every last amendment from the Bill of Rights has been discarded.
    - whoopdedo 10y ago
      Is there anything in the Constitution applicable to open government? I ask because the case is locked behind PACER. ... Or is it? http://www.leagle.com/decision/In%20FDCO%2020150203D28/MITCHELL%20v.%20CITY%20OF%20HENDERSON http://www.leagle.com/decision/In%20FDCO%2020150203D28/MITCH...
      - mindslight 10y ago
        Wikipedia and news articles should give you the details. I'd say lack of access to law (as well as its unbearable complexity) is an issue of due process and the fundamental rule of law. But you can't look to the Constitution to dictate everything - its drafters could not anticipate all future developments, and if the government is that citizen-hostile a piece of paper won't stop it. That which the Constitution does specify should be considered more as "behavioral tests", and currently the majority of our test report is failure.

rmc 10y ago

FBI doesn't need a warrant for non-US computers.

deleted 10y ago

[deleted]

clarkmoody 10y ago

"But whether the Constitution really be one thing, or another, this much is certain - that it has either authorized such a government as we have had, or has been powerless to prevent it. In either case it is unfit to exist.” -- Lysander Spooner, No Treason

tamana 10y ago
That's horrid logic. The question of fitness for existence is whether the Constitution is better than its absence.
- clarkmoody 10y ago
  Also flawed logic. Our options are not simply Constitution or No Constitution. There are a near-infinite number of unique constitutions we could have adopted, rather than the one we've got. Spooner was criticizing the actual form of our current Constitution. GP was making an appeal to the Constitution and the judicial system's ignoring of it. I agree with Spooner that a Constitution such as ours is completely powerless to prevent individual judges from rewriting every time it fits their fancy. We've basically had an ongoing Constitutional Convention in the federal courts since the founding -- without the consent of the people.
- logfromblammo 10y ago
  That's an unanswerable question, since we cannot compare a control Earth where the U.S. Constitution was adopted in 1783 and an experimental Earth where it was never ratified. It is axiomatic that the present we now know inevitably followed from the history that preceded it. When you look at the U.S. federal government that now exists, it must have assumed its current form either by design of the Constitution, or contrary to that design. In case of the latter, the Constitution was entirely unable to prevent the government that it established from evolving into a form contrary to its design. Maybe the process was slowed somewhat. We cannot know for certain. Therefore, if you dislike the current form of US federal government, it is nonsensical to idolize the Constitution, or any other causally-related fact of history. History gave us the present. If you do not like the present, and wish the future to be different, do not repeat the mistakes of the past. Whether history could have given us another present is irrelevant, because it did not. In the end, whenever a living human fights with a document, the human will emerge victorious, and the document will become confetti. The Constitution is nothing without a living human to be its champion.

deleted 10y ago

[deleted]