13 ms·

Bad judging all around here. Just because a home computer might be hacked does not mean that an average user doesn't expect his experience on that computer to

by grellas 10y ago

Bad judging all around here. Just because a home computer might be hacked does not mean that an average user doesn't expect his experience on that computer to be private. Every area of life might be breached by determined intruders and, if that were the test of having a expectation of privacy, then every area of life would flunk it. Your home, your car, your bathroom, your bedroom, you name it. In reality, of course, break-ins, hacks, and other intrusions are the exception and not the rule in the areas we commonly regard as private. If the legal test on protecting privacy were to turn on whether break-ins or hacks were a regular element of the environment (however infrequent), then the exception swallows the rule and privacy is no more. This judge's ruling essentially embraces such logic and is thus wildly out of line with existing law regarding protection against unreasonable searches and seizures. Also bad judging in reaching the issue gratuitously: the main issue here was whether a particular warrant was misused; it was unnecessary to decide what would have happened without a warrant of any kind. Yet the judge reached to inject his obiter dictum into the analysis as a sort of by-the-by, "here is what I would rule if other issues were before me." Why such an outcome? As the lawyers say, "hard facts make for bad law." You have a despicable perp doing vile things and the natural instinct is to want to nail him. Just as, conversely, when you have a sympathetic person who has being seriously wronged, the natural instinct is to do what you can to help him get justice. In either case, judges and juries will be more prone than otherwise to engage in results-oriented jurisprudence and will thus try to bend and shape the law to that purpose even if the law objectively says otherwise. This factor may help explain why the judge did what he did. It does not make it right. Finally, bad judging means, in this case, bad precedent and this decision will surely have pernicious effects until the day comes when its run is ended by a higher court. For this case, that day will surely come. It is a bad decision all around.

graycat 10y ago
The post just above sounds just excellent to me. I posted https://news.ycombinator.com/item?id=12016441 https://news.ycombinator.com/item?id=12016441 then saw the above comment and concluded it was better than what I posted. So, I so indicated. Might regard this comment as a more explicit way of up voting the comment I was referring to. I'm not familiar with the universe where this is a bad thing to do.
- isolli 10y ago
  Your comment and your name are the same color ;)
  - shrugger2 10y ago
    This low-effort comment matches the low-effort comment above it! Wow! /s /s /s I am sort of tired of these comments that piggyback off of sub-optimal comments without any sort of advice on how to contribute more effectively. We don't need comments about these cases that are just "I agree with this" and we certainly don't need "Your comment was downvoted because it's bad" If someone gets downvoted, they should be expected to figure out on their own what they did wrong by referring to the guidelines and comparing their contribution with what is expected (in a general sense) from HN commenters. We are big boys, we can get along and have effective, meaningful, insightful discussions here.
nxzero 10y ago
Danger of your argument is that the majority of users expect privacy and that their systems are secure. My experience is that the average person today assumes their devices are not secure and any information they have is accessible to the government without warrants.
- sprayk 10y ago
  Same argument could be made about my house or my mail. I can only really expect privacy in both cases from the good actors in society, the people that respect a locked door, closed blinds, or the federal laws against opening my mail. I guess I expect my privacy/security in most cases, but I'm aware of the realities and try to prepare for that privacy/security to be violated.
- apendleton 10y ago
  What matters for purposes of 4th amendment jurisprudence is whether or not someone's expectation of privacy is reasonable, not whether or not their expectation is fulfilled.
  - nxzero 10y ago
    What constitutes probable cause for a search is relevant. The judge is arguing that all devices connected to the Internet are probably hacked and that as a result of the devices already being hacked, there is no reasonable expectation of privacy.
    - apendleton 10y ago
      Who said anything about probably cause?
      - nxzero 10y ago
        Please clarify your question given probable cause is at the core of rights related to the forth.
nostrademons 10y ago
Curious whether this precedent could be used to argue that Snowden acted legally. After all, leaks happen routinely, and the technical difficulty of copying documents onto a thumb drive is minimal. Clearly, then, the NSA has no reasonable expectation of privacy for any document that it keeps in electronic form.
- apendleton 10y ago
  Doubtful. Expectations of privacy and their bearings on 4th amendment search reasonableness don't have much to do with Snowden's case. The NSA isn't arguing that a government search was unreasonable, nor are their expectations germane; what Snowden took wasn't "private" in a 4th amendment sense, it was classified, and he'd be prosecuted under the Espionage Act.
- deleted 10y ago
  [deleted]
- jliptzin 10y ago
  You could argue that, but you wouldn't win, despite that being a logical next step to this ruling. Judges and legislators today seem to arrive at their preferred judgment first, then work backwards to see what kinds of precedents or reasoning they could massage to justify their rulings. If you're looking for consistency and logic in the US justice system you're going to be disappointed.
  - wry_discontent 10y ago
    To completely fair, that's how most regular people make decisions too.
    - Grishnakh 10y ago
      Most regular people are idiots and have little grasp of formal logic. Judges are supposed to be experts at the law and better at this stuff than "regular normal people". That's why they spend years in law school, and why judges aren't just randomly selected from the general population.
will_brown 10y ago
>Bad judging all around here. I am not so sure. Yes, the Judge could have ruled defendant's have a reasonable expectation of privacy for devices connected to the internet. And while it may even be true subjectively, I think the Judge did get it right objectively. A lot of people in this thread, and you to some extent, suggest that this judge's ruling is the non-digital equivalent of saying a person does not have a reasonable expectation on their home because those too can be broken into the same as an internet connected device. Even in your examples you list "your home" and "your car", but as you know, legally, a home and car don't carry the same expectation of privacy from a 4th amendment analysis. Further, just because a internet connected device and home can be broken into that does not make it a good or fair analogy. Internet connected devices can be broken into by anyone, anywhere in the world so long as they have an internet connection, that is not the case with a home. Nor can people protect their digital data with lethal force the same way one might protect their home. The threats to privacy and the privacy protections for an internet device and a physical home are simply not the same. Perhaps a better way to distinguish a home and internet connect device is to use other precedent as an analogy. A public phone booth (reasonable expectation of privacy) vs speaking on your private cell phone in public (no reasonable expectation of privacy). Trash in your house (reasonable expectation of privacy) and when you put in on the curb for pick up (no expectation of privacy), might be good for saying non-internet connect device (privacy) and internet connected device (no privacy). So why don't I think it bad decision? Lets just say if the Judge did rule there is a reasonable expectation on internet connected devices, it wouldn't stop the Gov. They could always hide behind the non-Gov search/seizure argument in future cases. In other words, the Gov could always say they didn't hack a defendant's internet connected device, that a non-Gov actor searched/seized the data and anonymously provided the evidence to the Gov; therefore, the evidence is not subject to 4th amendment protections. Again not something likely to happen in any of these non-digital analogies (i.e. police are not going to claim the person who broke into your home, while breaking into your home seized evidence of your crimes and gave it to the police anonymously). As much as we would all like to have a reasonable expectation of privacy on our internet connected devices, we don't objectively; therefore, I think the court reached the right decision. Definitely if the security of the devices improves to keep out Gov and non-Gov actors alike (objective expectations), then our reasonable expectations (subjective) and the law can change with it.
thevardanian 10y ago
It's like saying that if a house is connected to the road that house shouldn't expect to have privacy. Just because there's easy access to the house does not mean that the house can be accessed by anyone on the road. This is not just bad judging this is bordering onto absurdity.
- themartorana 10y ago
  As I said in a sibling comment to yours, it's full-on absurdity. "Bordering on" is being very generous.
- joe_the_user 10y ago
  Yes, The term "bad judgment" implies a mistake and some good faith, something a diplomatic lawyer like Grellas would likely do by impulse. Not being a lawyer or obligated to diplomacy here, I'd call it a despicable, bad faith maneuver.
- ams6110 10y ago
  I'm not sure I completely agree. If my house is on a busy public road, I have no expectation that people won't see it, see who's coming and going, possibly even see things through open windows, etc. I probably would not walk around naked in front of the windows or outside, etc. I'd probably be more concerned about keeping doors and windows locked, or I might install a security system, because I know there's a higher risk of someone breaking in. If my house is a mile off any public road on a private drive, surrounded by trees, I have a different expectation. I might be more comfortable sunbathing nude, etc. being fairly sure that I'm in a private setting. If I have a computer and it's not on any network, or only on a private network that I fully own, I expect it is private. At least as private as any papers I have in my desk. If I use that computer to connect to a public network and access public resources, I have less expectation. I know that at minimum, the resources I access will know that I have done so. I know that it's possible for others on the network to see my traffic. I have exposed my computer to the outside world, and with that comes foreseeable risk, just as I take on foreseeable risks when I do anything else in the outside world. So I think I agree that by using the internet, I have some reduced expectation of privacy. I think I agree that warrantless monitoring of my activities on the network, e.g. tracking IP addresses and what sites I connect to, etc. is probably OK, just as anyone can follow me around in public and see what places I visit without needing a warrant. I don't think I agree that this extends into actually invading and searching my computer from the network, even though it may be possible to do that. I think this is like arguing that a warrant is not needed to enter my home and read my mail, on the basis that the correspondence was transported over a public network (the postal service). Or to listen to my phone calls because I'm using the public telephone network. So on that point the judge did go too far and I'd expect that to be overturned on appeal. So I think there is some rational argument here, but that it went too far in its conclusions.
themartorana 10y ago
The absurdity of this is everyone - and I mean everyone, judging by private browsing habits - has an "expectation of privacy" when it comes to their home computer. So the judgement here is absurd on its face. This isn't standing naked in front of a bay window, there's no real room for interpretation. So when a judge says there isn't a reasonable expectation of privacy, he/she isn't even being honest with themselves, let alone the entirety of the computer-owning public. This is a bald-faced hand-out to law "enforcement" and has no bearing in reality.
- CyberDildonics 10y ago
  It is also very easy to make hypocrites of people in cases like this. Break into the home computes of the people who brought this forward and see if they stand behind their argument.
- s_q_b 10y ago
  This is akin to ruling that there's no reasonable expectation of privacy in a home because windows aren't fully secure against burglars.
  - plandis 10y ago
    While somewhat true, analogies make for poor logical arguments. grellas' argument is much more succinct.
    - s_q_b 10y ago
      Pith is often a useful tool to expose absurdity.
  - MichaelBurge 10y ago
    That's actually true though. Not burglars exactly, but the police absolutely can peer through gaps that you accidentally leave in your windows, even if you expect to be private inside. The court ruling even refers to this example. Sometimes people on HN complain when security researchers are threatened with prosecution under the CFAA. Well, which is it - is exploiting vulnerabilities more akin to peering through someone's window blinds with unintended gaps, or burglary?
GunboatDiplomat 10y ago
Also, didn't the Supreme Court rule that cell phones, which are connected to the internet, require a warrant, which indicates that there is a certain expectation of privacy? Of course, there's no real difference between a smart phone and a computer.
- ikeboy 10y ago
  Smart phones are locked down, harder to hack, and as such might have a greater expectation. Note that the judge cited the Apple-FBI story: >Tor users likewise cannot reasonably expect to be safe from hackers. Even if Tor users hope that the Tor network will keep certain information private -just as terrorists seem to expect Apple to keep their data private - it is unreasonable not to expect that someone will be able to gain access
  - emodendroket 10y ago
    Really feels like there is an axe to grind here.
  - anonbanker 10y ago
    How are smart phones harder to hack? they've been information goldmines for years. java vulnerabilities, bluetooth vulnerabilities, even vulnerabilities from the charging cable. Are they just perceived to be less vulnerable?
    - ikeboy 10y ago
      iPhones in particular require all user code that runs to be signed and run in a sandbox, which makes it much harder to hack. Android also has a sandbox, but is more permissive about running things outside it: still, by default it's pretty locked down. Windows is not locked down that way, and most programs will require admin access for installation, at least.
      - anonbanker 10y ago
        Regarding android, the latest Qualcomm debacle (FDE is broken) shows that it's not a very safe platform. Add in the google services that store information unencrypted (which nerfs Signal and other "safe" apps), and you have a owned phone. iPhone's walled garden is, as John Oliver stated, akin to "dancing on the edge of a volcano"; only safe until the next vulnerability arrives. Don't forget that every iOS other than current has been jailbroken/rooted. Thankfully, Windows Phone is a joke that is being phased out, so we don't have to laugh uncomfortably at it anymore.
rayiner 10y ago
It's also worth pointing out (because the article makes a hash of things), that the case involved two different issues: expectation of privacy in the IP address, and expectation of privacy in the contents of the computer. The opinion is here: https://www.eff.org/files/2016/06/23/matish_suppression_edva.pdf https://www.eff.org/files/2016/06/23/matish_suppression_edva.... The discussion of the IP address issue starts at 43, and the discussion of the privacy issue starts at 47. The first decision is reasonable: no matter how you try to obscure things, an IP address is public information. Some third-party must have your IP address in order for you to receive packets. The second decision is, of course, unreasonable. Saying you have no expectation of privacy in the contents of your computer because it can get hacked is like saying you have no expectation of privacy in your house because it can get broken into. I suspect that on appeal, the former decision will stand and the latter will not.
- ambulancechaser 10y ago
  But they argued that the IP address is freely given, so they didn't need a warrant for this. However, the IP address was freely given to the FBI when it transmitted the other information as what was to be collected by the warrant from the NIT. So the argument that the IP address was freely given was a consequence of their software running on the person's computer. They pointed out that the warrant was legal and specific, and given in the jurisdiction of the issuing magistrate because it was a "tracking" device and the computer made a digital journey to Virginia and the tracking device went back home with them. But then they go on to say that a warrant was not necessary at all because you have no reasonable expectation of privacy when you're on the internet because a bunch of assholes will hack you anyways, and therefore this is equivalent of a police organization peering into your house through slits in your blinds. Since no expectation of privacy, there can be no 4th amendment violation.
- pera 10y ago
  From page 46: > However, the Court FINDS that any such subjective expectation of privacy - if one even existed in this case - is not objectively reasonable. SA Alfin testified that when a user connects to the Tor network, he or she must disclose his or her real IP address to the first Tor node with which he or she connects. This fact, coupled with the Tor Project's own warning that the first server can see "[t]his IP address is using Tor," destroys any expectation of privacy in a Tor user's IP address. I strongly disagree with this conclusion: the only logical conclusion one can make is that the defendant didn't have a reasonable expectation of privacy of he or she participating in the Tor network. But Tor doesn't anonymize users by magically hiding IP addresses but by making the actual origin of a request unknowable. Tor users do have a reasonable expectation of privacy of their IP addresses not being disclosed as the actual origin of some communication. So no, in my opinion the court decision is not reasonable at all. And by the way, I find the analogy of Tor anonymizing users by "masking" IP addresses, problematic, at least.
deleted 10y ago
[deleted]
adambom 10y ago
This article left out a lot of details, but to me it sounds like what happened is that the FBI infiltrated PlayPen under a warrant granting them access to do so. They then used PlayPen's tor node to trace inbound traffic across the tor network and identify the IP addresses of visitors. I could be wrong, but if that's the case, it sounds to me like the defendant didn't have a reasonable expectation of privacy. I think of it as sending a letter with no return address. If the letter is addressed to a criminal enterprise, and there is a reasonable expectation that the sender is engaged with said criminal enterprise, to the extent that the FBI can trace that letter back to the sender seems that it would be legal, in my opinion. However, the TL;DR of this article seems to be that nobody's computer can be expected to be private because everyone's computer can be hacked. I don't think that's what the judge intended with this decision.
mizchief2 10y ago
Same as saying that homes connected to public streets have no expectation of privacy because burglars can break windows and kick in doors to gain access even though you have your doors locked.

by grellas 10y ago

graycat 10y ago

The post just above sounds just excellent to me. I posted https://news.ycombinator.com/item?id=12016441 https://news.ycombinator.com/item?id=12016441 then saw the above comment and concluded it was better than what I posted. So, I so indicated. Might regard this comment as a more explicit way of up voting the comment I was referring to. I'm not familiar with the universe where this is a bad thing to do.

isolli 10y ago
Your comment and your name are the same color ;)
- shrugger2 10y ago
  This low-effort comment matches the low-effort comment above it! Wow! /s /s /s I am sort of tired of these comments that piggyback off of sub-optimal comments without any sort of advice on how to contribute more effectively. We don't need comments about these cases that are just "I agree with this" and we certainly don't need "Your comment was downvoted because it's bad" If someone gets downvoted, they should be expected to figure out on their own what they did wrong by referring to the guidelines and comparing their contribution with what is expected (in a general sense) from HN commenters. We are big boys, we can get along and have effective, meaningful, insightful discussions here.

nxzero 10y ago

Danger of your argument is that the majority of users expect privacy and that their systems are secure. My experience is that the average person today assumes their devices are not secure and any information they have is accessible to the government without warrants.

sprayk 10y ago
Same argument could be made about my house or my mail. I can only really expect privacy in both cases from the good actors in society, the people that respect a locked door, closed blinds, or the federal laws against opening my mail. I guess I expect my privacy/security in most cases, but I'm aware of the realities and try to prepare for that privacy/security to be violated.
apendleton 10y ago
What matters for purposes of 4th amendment jurisprudence is whether or not someone's expectation of privacy is reasonable, not whether or not their expectation is fulfilled.
- nxzero 10y ago
  What constitutes probable cause for a search is relevant. The judge is arguing that all devices connected to the Internet are probably hacked and that as a result of the devices already being hacked, there is no reasonable expectation of privacy.
  - apendleton 10y ago
    Who said anything about probably cause?
    - nxzero 10y ago
      Please clarify your question given probable cause is at the core of rights related to the forth.

nostrademons 10y ago

Curious whether this precedent could be used to argue that Snowden acted legally. After all, leaks happen routinely, and the technical difficulty of copying documents onto a thumb drive is minimal. Clearly, then, the NSA has no reasonable expectation of privacy for any document that it keeps in electronic form.

apendleton 10y ago
Doubtful. Expectations of privacy and their bearings on 4th amendment search reasonableness don't have much to do with Snowden's case. The NSA isn't arguing that a government search was unreasonable, nor are their expectations germane; what Snowden took wasn't "private" in a 4th amendment sense, it was classified, and he'd be prosecuted under the Espionage Act.
deleted 10y ago
[deleted]
jliptzin 10y ago
You could argue that, but you wouldn't win, despite that being a logical next step to this ruling. Judges and legislators today seem to arrive at their preferred judgment first, then work backwards to see what kinds of precedents or reasoning they could massage to justify their rulings. If you're looking for consistency and logic in the US justice system you're going to be disappointed.
- wry_discontent 10y ago
  To completely fair, that's how most regular people make decisions too.
  - Grishnakh 10y ago
    Most regular people are idiots and have little grasp of formal logic. Judges are supposed to be experts at the law and better at this stuff than "regular normal people". That's why they spend years in law school, and why judges aren't just randomly selected from the general population.

will_brown 10y ago

>Bad judging all around here. I am not so sure. Yes, the Judge could have ruled defendant's have a reasonable expectation of privacy for devices connected to the internet. And while it may even be true subjectively, I think the Judge did get it right objectively. A lot of people in this thread, and you to some extent, suggest that this judge's ruling is the non-digital equivalent of saying a person does not have a reasonable expectation on their home because those too can be broken into the same as an internet connected device. Even in your examples you list "your home" and "your car", but as you know, legally, a home and car don't carry the same expectation of privacy from a 4th amendment analysis. Further, just because a internet connected device and home can be broken into that does not make it a good or fair analogy. Internet connected devices can be broken into by anyone, anywhere in the world so long as they have an internet connection, that is not the case with a home. Nor can people protect their digital data with lethal force the same way one might protect their home. The threats to privacy and the privacy protections for an internet device and a physical home are simply not the same. Perhaps a better way to distinguish a home and internet connect device is to use other precedent as an analogy. A public phone booth (reasonable expectation of privacy) vs speaking on your private cell phone in public (no reasonable expectation of privacy). Trash in your house (reasonable expectation of privacy) and when you put in on the curb for pick up (no expectation of privacy), might be good for saying non-internet connect device (privacy) and internet connected device (no privacy). So why don't I think it bad decision? Lets just say if the Judge did rule there is a reasonable expectation on internet connected devices, it wouldn't stop the Gov. They could always hide behind the non-Gov search/seizure argument in future cases. In other words, the Gov could always say they didn't hack a defendant's internet connected device, that a non-Gov actor searched/seized the data and anonymously provided the evidence to the Gov; therefore, the evidence is not subject to 4th amendment protections. Again not something likely to happen in any of these non-digital analogies (i.e. police are not going to claim the person who broke into your home, while breaking into your home seized evidence of your crimes and gave it to the police anonymously). As much as we would all like to have a reasonable expectation of privacy on our internet connected devices, we don't objectively; therefore, I think the court reached the right decision. Definitely if the security of the devices improves to keep out Gov and non-Gov actors alike (objective expectations), then our reasonable expectations (subjective) and the law can change with it.

thevardanian 10y ago

It's like saying that if a house is connected to the road that house shouldn't expect to have privacy. Just because there's easy access to the house does not mean that the house can be accessed by anyone on the road. This is not just bad judging this is bordering onto absurdity.

themartorana 10y ago
As I said in a sibling comment to yours, it's full-on absurdity. "Bordering on" is being very generous.
joe_the_user 10y ago
Yes, The term "bad judgment" implies a mistake and some good faith, something a diplomatic lawyer like Grellas would likely do by impulse. Not being a lawyer or obligated to diplomacy here, I'd call it a despicable, bad faith maneuver.
ams6110 10y ago
I'm not sure I completely agree. If my house is on a busy public road, I have no expectation that people won't see it, see who's coming and going, possibly even see things through open windows, etc. I probably would not walk around naked in front of the windows or outside, etc. I'd probably be more concerned about keeping doors and windows locked, or I might install a security system, because I know there's a higher risk of someone breaking in. If my house is a mile off any public road on a private drive, surrounded by trees, I have a different expectation. I might be more comfortable sunbathing nude, etc. being fairly sure that I'm in a private setting. If I have a computer and it's not on any network, or only on a private network that I fully own, I expect it is private. At least as private as any papers I have in my desk. If I use that computer to connect to a public network and access public resources, I have less expectation. I know that at minimum, the resources I access will know that I have done so. I know that it's possible for others on the network to see my traffic. I have exposed my computer to the outside world, and with that comes foreseeable risk, just as I take on foreseeable risks when I do anything else in the outside world. So I think I agree that by using the internet, I have some reduced expectation of privacy. I think I agree that warrantless monitoring of my activities on the network, e.g. tracking IP addresses and what sites I connect to, etc. is probably OK, just as anyone can follow me around in public and see what places I visit without needing a warrant. I don't think I agree that this extends into actually invading and searching my computer from the network, even though it may be possible to do that. I think this is like arguing that a warrant is not needed to enter my home and read my mail, on the basis that the correspondence was transported over a public network (the postal service). Or to listen to my phone calls because I'm using the public telephone network. So on that point the judge did go too far and I'd expect that to be overturned on appeal. So I think there is some rational argument here, but that it went too far in its conclusions.

themartorana 10y ago

The absurdity of this is everyone - and I mean everyone, judging by private browsing habits - has an "expectation of privacy" when it comes to their home computer. So the judgement here is absurd on its face. This isn't standing naked in front of a bay window, there's no real room for interpretation. So when a judge says there isn't a reasonable expectation of privacy, he/she isn't even being honest with themselves, let alone the entirety of the computer-owning public. This is a bald-faced hand-out to law "enforcement" and has no bearing in reality.

CyberDildonics 10y ago
It is also very easy to make hypocrites of people in cases like this. Break into the home computes of the people who brought this forward and see if they stand behind their argument.
s_q_b 10y ago
This is akin to ruling that there's no reasonable expectation of privacy in a home because windows aren't fully secure against burglars.
- plandis 10y ago
  While somewhat true, analogies make for poor logical arguments. grellas' argument is much more succinct.
  - s_q_b 10y ago
    Pith is often a useful tool to expose absurdity.
- MichaelBurge 10y ago
  That's actually true though. Not burglars exactly, but the police absolutely can peer through gaps that you accidentally leave in your windows, even if you expect to be private inside. The court ruling even refers to this example. Sometimes people on HN complain when security researchers are threatened with prosecution under the CFAA. Well, which is it - is exploiting vulnerabilities more akin to peering through someone's window blinds with unintended gaps, or burglary?

GunboatDiplomat 10y ago

Also, didn't the Supreme Court rule that cell phones, which are connected to the internet, require a warrant, which indicates that there is a certain expectation of privacy? Of course, there's no real difference between a smart phone and a computer.

ikeboy 10y ago
Smart phones are locked down, harder to hack, and as such might have a greater expectation. Note that the judge cited the Apple-FBI story: >Tor users likewise cannot reasonably expect to be safe from hackers. Even if Tor users hope that the Tor network will keep certain information private -just as terrorists seem to expect Apple to keep their data private - it is unreasonable not to expect that someone will be able to gain access
- emodendroket 10y ago
  Really feels like there is an axe to grind here.
- anonbanker 10y ago
  How are smart phones harder to hack? they've been information goldmines for years. java vulnerabilities, bluetooth vulnerabilities, even vulnerabilities from the charging cable. Are they just perceived to be less vulnerable?
  - ikeboy 10y ago
    iPhones in particular require all user code that runs to be signed and run in a sandbox, which makes it much harder to hack. Android also has a sandbox, but is more permissive about running things outside it: still, by default it's pretty locked down. Windows is not locked down that way, and most programs will require admin access for installation, at least.
    - anonbanker 10y ago
      Regarding android, the latest Qualcomm debacle (FDE is broken) shows that it's not a very safe platform. Add in the google services that store information unencrypted (which nerfs Signal and other "safe" apps), and you have a owned phone. iPhone's walled garden is, as John Oliver stated, akin to "dancing on the edge of a volcano"; only safe until the next vulnerability arrives. Don't forget that every iOS other than current has been jailbroken/rooted. Thankfully, Windows Phone is a joke that is being phased out, so we don't have to laugh uncomfortably at it anymore.

rayiner 10y ago

It's also worth pointing out (because the article makes a hash of things), that the case involved two different issues: expectation of privacy in the IP address, and expectation of privacy in the contents of the computer. The opinion is here: https://www.eff.org/files/2016/06/23/matish_suppression_edva.pdf https://www.eff.org/files/2016/06/23/matish_suppression_edva.... The discussion of the IP address issue starts at 43, and the discussion of the privacy issue starts at 47. The first decision is reasonable: no matter how you try to obscure things, an IP address is public information. Some third-party must have your IP address in order for you to receive packets. The second decision is, of course, unreasonable. Saying you have no expectation of privacy in the contents of your computer because it can get hacked is like saying you have no expectation of privacy in your house because it can get broken into. I suspect that on appeal, the former decision will stand and the latter will not.

ambulancechaser 10y ago
But they argued that the IP address is freely given, so they didn't need a warrant for this. However, the IP address was freely given to the FBI when it transmitted the other information as what was to be collected by the warrant from the NIT. So the argument that the IP address was freely given was a consequence of their software running on the person's computer. They pointed out that the warrant was legal and specific, and given in the jurisdiction of the issuing magistrate because it was a "tracking" device and the computer made a digital journey to Virginia and the tracking device went back home with them. But then they go on to say that a warrant was not necessary at all because you have no reasonable expectation of privacy when you're on the internet because a bunch of assholes will hack you anyways, and therefore this is equivalent of a police organization peering into your house through slits in your blinds. Since no expectation of privacy, there can be no 4th amendment violation.
pera 10y ago
From page 46: > However, the Court FINDS that any such subjective expectation of privacy - if one even existed in this case - is not objectively reasonable. SA Alfin testified that when a user connects to the Tor network, he or she must disclose his or her real IP address to the first Tor node with which he or she connects. This fact, coupled with the Tor Project's own warning that the first server can see "[t]his IP address is using Tor," destroys any expectation of privacy in a Tor user's IP address. I strongly disagree with this conclusion: the only logical conclusion one can make is that the defendant didn't have a reasonable expectation of privacy of he or she participating in the Tor network. But Tor doesn't anonymize users by magically hiding IP addresses but by making the actual origin of a request unknowable. Tor users do have a reasonable expectation of privacy of their IP addresses not being disclosed as the actual origin of some communication. So no, in my opinion the court decision is not reasonable at all. And by the way, I find the analogy of Tor anonymizing users by "masking" IP addresses, problematic, at least.

deleted 10y ago

[deleted]

adambom 10y ago

This article left out a lot of details, but to me it sounds like what happened is that the FBI infiltrated PlayPen under a warrant granting them access to do so. They then used PlayPen's tor node to trace inbound traffic across the tor network and identify the IP addresses of visitors. I could be wrong, but if that's the case, it sounds to me like the defendant didn't have a reasonable expectation of privacy. I think of it as sending a letter with no return address. If the letter is addressed to a criminal enterprise, and there is a reasonable expectation that the sender is engaged with said criminal enterprise, to the extent that the FBI can trace that letter back to the sender seems that it would be legal, in my opinion. However, the TL;DR of this article seems to be that nobody's computer can be expected to be private because everyone's computer can be hacked. I don't think that's what the judge intended with this decision.

mizchief2 10y ago

Same as saying that homes connected to public streets have no expectation of privacy because burglars can break windows and kick in doors to gain access even though you have your doors locked.