3 ms·

> Perhaps a better way to distinguish a home and internet connect device is to use other precedent as an analogy. A public phone booth (reasonable expectation o

by deno 10y ago

> Perhaps a better way to distinguish a home and internet connect device is to use other precedent as an analogy. A public phone booth (reasonable expectation of privacy) vs speaking on your private cell phone in public (no reasonable expectation of privacy). Trash in your house (reasonable expectation of privacy) and when you put in on the curb for pick up (no expectation of privacy), might be good for saying non-internet connect device (privacy) and internet connected device (no privacy). This seems like an argument for someone looking over your shoulder when using a mobile device, or a laptop, in a public place. How do any of those examples have any bearing on someone actually hacking the device? Most devices have policy and counter-measures built-in to specifically prevent any kind of unauthorized access. For example, every device running the popular operating system Windows has a firewall built-in and activated by default.

will_brown 10y ago
>How do any of those examples have any bearing on someone actually hacking the device? Most devices have policy and counter-measures built-in to specifically prevent any kind of unauthorized access. It is not apples to apples, but take the trash example. Case law holds that you have reasonable expectation of privacy in the trash inside your home (i.e. the Gov can not introduce evidence collected from the trash inside your house without obtaining a warrant). Lets call that the non-internet connected device, which AFAIK would still have 4th Amendment protections. Now lets say you take that trash to the crub, all the sudden case law says you no longer have reasonable expectation of privacy of said trash (i.e. the Gov can collect the trash without a warrant and introduce any evidence of your crime they collect from said trash). This in my analogy would be the internet connected device, this court says no longer has 4th Amendment protections. You could put a lock on your trash can that you remotely unlock only when the trash man gets there, but the case law says you lost expectation of privacy when the trash hit your curb (i.e. the internet connection) its not a matter of the ongoing defensive measures you took to maintain privacy. Moreover, if I shredded documents evidencing my crime that I then put on the curb, I do not regain my expectation of privacy (4th Amendment protections) because I took defensive measures to avoid anyone being able to read the documents.
- deno 10y ago
  A better analogy to taking the trash to the curb, in this example, would be disposing of your device or hard drive. So if your hard drive is not encrypted and you throw it away without securely erasing the data or adequately physically destroying it (the equivalent of shredding paper documents), then you have no reasonable expectation of privacy. By taking the trash to the curb, or throwing away your hard drive, you signal that you no longer care about said trash/data. You probably still care about the data on the device that you haven’t yet decided to throw away. The point is you can review how much of the data, if any, that you’re throwing away, you don’t care about. Someone hacking your device doesn’t give you the opportunity to make this consideration. To continue with your analogy, hacking a device that someone still owns is exactly like breaking into someone’s house to go through their trash. The internet connection is just a medium by which the break-in occurs.
  - will_brown 10y ago
    >The point is you can review how much of the data, if any, that you’re throwing away, you don’t care about. Someone hacking your device doesn’t give you the opportunity to make this consideration. I see your point, but playing devil's advocate why is the opportunity to consider what data you put on the curb or that is on a device you connect to the internet any different? Surely you can elect to drill a hole in your hard drive before putting it on the curb and you can remove any and all data (including evidence of a crime) from your device before you connect it to the internet.
    - deno 10y ago
      I do understand the argument you’re making here, but I’m not convinced. Let’s consider a few similar examples with mediums other than internet: 1) Should the government require warrant to monitor the way you use electricity to see what’s on your screen, or to steal your encryption keys?[1][2] 2) Should the government require warrant to listen to the vibrations your water pipes carry and eavesdrop on the conversations inside? (hypothetical afaik) Maybe the difference here is that Internet is not, by law, considered an utility in the U.S. Should that make a difference? I think, logically, no. If the government cannot, without a warrant, implement side-channel attacks like the one listed above, then it definitely shouldn’t be allowed to actually actively exploit a device that’s simply making use of some utility, even a digital one. More to the point, no one intends to make their data public, any of it, simply by connecting to the internet. That’s the determination you make when you actually copy that data anywhere, or when you use any web service, including this site. So no, there is no opportunity to review what you want to reveal, because there is no intent to do so in the first place. [1] https://it.slashdot.org/story/09/07/12/0259246/stealing-data-via-electrical-outlet https://it.slashdot.org/story/09/07/12/0259246/stealing-data... [2] http://www.ibtimes.co.uk/now-you-can-steal-rsa-encryption-keys-through-pcs-noises-old-am-radio-1563396 http://www.ibtimes.co.uk/now-you-can-steal-rsa-encryption-ke...

by deno 10y ago

will_brown 10y ago

>How do any of those examples have any bearing on someone actually hacking the device? Most devices have policy and counter-measures built-in to specifically prevent any kind of unauthorized access. It is not apples to apples, but take the trash example. Case law holds that you have reasonable expectation of privacy in the trash inside your home (i.e. the Gov can not introduce evidence collected from the trash inside your house without obtaining a warrant). Lets call that the non-internet connected device, which AFAIK would still have 4th Amendment protections. Now lets say you take that trash to the crub, all the sudden case law says you no longer have reasonable expectation of privacy of said trash (i.e. the Gov can collect the trash without a warrant and introduce any evidence of your crime they collect from said trash). This in my analogy would be the internet connected device, this court says no longer has 4th Amendment protections. You could put a lock on your trash can that you remotely unlock only when the trash man gets there, but the case law says you lost expectation of privacy when the trash hit your curb (i.e. the internet connection) its not a matter of the ongoing defensive measures you took to maintain privacy. Moreover, if I shredded documents evidencing my crime that I then put on the curb, I do not regain my expectation of privacy (4th Amendment protections) because I took defensive measures to avoid anyone being able to read the documents.

deno 10y ago
A better analogy to taking the trash to the curb, in this example, would be disposing of your device or hard drive. So if your hard drive is not encrypted and you throw it away without securely erasing the data or adequately physically destroying it (the equivalent of shredding paper documents), then you have no reasonable expectation of privacy. By taking the trash to the curb, or throwing away your hard drive, you signal that you no longer care about said trash/data. You probably still care about the data on the device that you haven’t yet decided to throw away. The point is you can review how much of the data, if any, that you’re throwing away, you don’t care about. Someone hacking your device doesn’t give you the opportunity to make this consideration. To continue with your analogy, hacking a device that someone still owns is exactly like breaking into someone’s house to go through their trash. The internet connection is just a medium by which the break-in occurs.
- will_brown 10y ago
  >The point is you can review how much of the data, if any, that you’re throwing away, you don’t care about. Someone hacking your device doesn’t give you the opportunity to make this consideration. I see your point, but playing devil's advocate why is the opportunity to consider what data you put on the curb or that is on a device you connect to the internet any different? Surely you can elect to drill a hole in your hard drive before putting it on the curb and you can remove any and all data (including evidence of a crime) from your device before you connect it to the internet.
  - deno 10y ago
    I do understand the argument you’re making here, but I’m not convinced. Let’s consider a few similar examples with mediums other than internet: 1) Should the government require warrant to monitor the way you use electricity to see what’s on your screen, or to steal your encryption keys?[1][2] 2) Should the government require warrant to listen to the vibrations your water pipes carry and eavesdrop on the conversations inside? (hypothetical afaik) Maybe the difference here is that Internet is not, by law, considered an utility in the U.S. Should that make a difference? I think, logically, no. If the government cannot, without a warrant, implement side-channel attacks like the one listed above, then it definitely shouldn’t be allowed to actually actively exploit a device that’s simply making use of some utility, even a digital one. More to the point, no one intends to make their data public, any of it, simply by connecting to the internet. That’s the determination you make when you actually copy that data anywhere, or when you use any web service, including this site. So no, there is no opportunity to review what you want to reveal, because there is no intent to do so in the first place. [1] https://it.slashdot.org/story/09/07/12/0259246/stealing-data-via-electrical-outlet https://it.slashdot.org/story/09/07/12/0259246/stealing-data... [2] http://www.ibtimes.co.uk/now-you-can-steal-rsa-encryption-keys-through-pcs-noises-old-am-radio-1563396 http://www.ibtimes.co.uk/now-you-can-steal-rsa-encryption-ke...