5 ms·

Cloud data and email are protected by the Electronic Communications Privacy Act: https://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act https://en.

Cloud data and email are protected by the Electronic Communications Privacy Act: https://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act https://en.wikipedia.org/wiki/Electronic_Communications_Priv... Under the ECPA they need to obtain a warrant for email and other cloud storage services, unless it's older than 180 days... then it's considered "abandoned". There's been some effort to remove the 180 day limit.. some states have laws that protect older data + the 6th circuit already extended it past 180 days in US v Warshark.. but we need a national law like the Email Privacy Act that the House passed last year (but the senate didn't): https://www.natlawreview.com/article/house-judiciary-committee-approves-email-privacy-act https://www.natlawreview.com/article/house-judiciary-committ... https://en.wikipedia.org/wiki/Email_Privacy_Act https://en.wikipedia.org/wiki/Email_Privacy_Act

samstave 8y ago
Fun fact: some major coporations have a defacto policy to auto delete all emails older than 180 days. Period. This alows them to bot have those emails available to government spying as a writ. One company who does this is lockheed. Basically if you are a defense contractor - you do this.
- matt4077 8y ago
  Fun fact: this is bullshit. Large companies, especially public ones and those doing business with the government, follow different sets of rules specifying retention times. For anything that has an impact on accounting, the minimum is usually 5 years. If you’re trying to get an FAA approval for anything that flies, it’s much longer. Bonus: the 180 days mentioned above is for third party service providers as the cutoff of considering information to be “in transit”. Is has absolutely no bearing on in-house systems which have first-party protection.
  - deleted 8y ago
    [deleted]
  - samstave 8y ago
    Fun fact: You havent worked for shady fortune 100 companies. Lockheed is shady as fuck. I have stories. But will not share them here..
aitchnyu 8y ago
Could a service allow fully searchable mails for 179 days and then deindex and encrypt them so only customer can access them to fully protect emails?
- deleted 8y ago
  [deleted]
kelnage 8y ago
You're not wrong, but you've missed the main distinguishing factor between the Third Party Doctrine and the ECPA. ECPA is about unauthorised access (think tapping a phone line, but for the digital age) to electronic communications/cloud data. The Third-Party Doctrine is explicitly about the Government requesting these records - thus they would do not fall under "unauthorised access" in the sense used under the ECPA. Basically they cover two completely different situations.
- randomperson1 8y ago
  I think rgbrenner's point about the ECPA is actually on point in response to the "IIRC this also comes into play when your email messages are hosted on a 3rd party server that you do not own." comment. The ECPA isn't just about unauthorized access. It also has provisions, such as the Stored Communications Act (a subset of the ECPA), that apply to the 3P situation you described where "Government request[s] these records." For example, 18 U.S.C. 2703(a) (titled "Required disclosure of customer communications or records") reads "[a] governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in ..." In response to the original comment, the State's position that "it could warrantlessly get cell phone location data to find anyone, anytime, at any place as long as it was less than six hours old" was in part based on a previous Supreme Court case, Carpenter v. United States. Carpenter concerned federal prosecutors' attempts to get CSLI information using a court order pursuant to the Stored Communications Act -- 18 U.S.C. 2703(d).

samstave 8y ago

Fun fact: some major coporations have a defacto policy to auto delete all emails older than 180 days. Period. This alows them to bot have those emails available to government spying as a writ. One company who does this is lockheed. Basically if you are a defense contractor - you do this.

matt4077 8y ago
Fun fact: this is bullshit. Large companies, especially public ones and those doing business with the government, follow different sets of rules specifying retention times. For anything that has an impact on accounting, the minimum is usually 5 years. If you’re trying to get an FAA approval for anything that flies, it’s much longer. Bonus: the 180 days mentioned above is for third party service providers as the cutoff of considering information to be “in transit”. Is has absolutely no bearing on in-house systems which have first-party protection.
- deleted 8y ago
  [deleted]
- samstave 8y ago
  Fun fact: You havent worked for shady fortune 100 companies. Lockheed is shady as fuck. I have stories. But will not share them here..

aitchnyu 8y ago

Could a service allow fully searchable mails for 179 days and then deindex and encrypt them so only customer can access them to fully protect emails?

deleted 8y ago
[deleted]

kelnage 8y ago

You're not wrong, but you've missed the main distinguishing factor between the Third Party Doctrine and the ECPA. ECPA is about unauthorised access (think tapping a phone line, but for the digital age) to electronic communications/cloud data. The Third-Party Doctrine is explicitly about the Government requesting these records - thus they would do not fall under "unauthorised access" in the sense used under the ECPA. Basically they cover two completely different situations.

randomperson1 8y ago
I think rgbrenner's point about the ECPA is actually on point in response to the "IIRC this also comes into play when your email messages are hosted on a 3rd party server that you do not own." comment. The ECPA isn't just about unauthorized access. It also has provisions, such as the Stored Communications Act (a subset of the ECPA), that apply to the 3P situation you described where "Government request[s] these records." For example, 18 U.S.C. 2703(a) (titled "Required disclosure of customer communications or records") reads "[a] governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in ..." In response to the original comment, the State's position that "it could warrantlessly get cell phone location data to find anyone, anytime, at any place as long as it was less than six hours old" was in part based on a previous Supreme Court case, Carpenter v. United States. Carpenter concerned federal prosecutors' attempts to get CSLI information using a court order pursuant to the Stored Communications Act -- 18 U.S.C. 2703(d).