5 ms·

It's the EFF's job to advocate for a strong position on this kind of stuff, but it's a little hard to square those strong 4th Amendment claims with the existenc

It's the EFF's job to advocate for a strong position on this kind of stuff, but it's a little hard to square those strong 4th Amendment claims with the existence of the third party doctrine.

klyrs 7y ago
The third party doctrine applies to voluntary disclosure, whereas this law compels it.
- cyphar 7y ago
  No, the third party doctrine allows for compelled disclosure (through warrants) of a user's data which the service acted as a carrier for. That's why law enforcement can send warrants to Google (or your ISP) to get the contents of your email account, rather than having to serve you a warrant. The part that is often cited as being "voluntary" is that you decided to volunteer your information to a third-party (even if the service requires you to do so, and thus you actually had no meaningful choice in the matter) and thus you have "no reasonable expectation of privacy".
ncallaway 7y ago
Let's say a service builds a system with end-to-end encryption, such that the service provider itself is unable to decrypt and read any messages sent using the service. How would the third party doctrine apply to that scenario? I haven't voluntarily given any decrypted information to the service provider. Instead, I specifically avoided voluntarily giving them that information. So, at least in the context that the EARN IT act may threaten end-to-end encryption (or may attach significant civil liability to adopting end-to-end encryption) I'm not sure I understand how the third party doctrine applies. Can you expand on that?
- zerocrates 7y ago
  The trouble is that the argument isn't that pressuring providers to eliminate end to end encryption itself violates the 4th Amendment, but that, in the new scheme required under EARN IT, that when a provider does scan your information, that will violate the 4th Amendment. So at the time this argument applies, you have provided them readable information and the doctrine would apply. To be fairer to EFF in the light of the morning, their argument actually does account for the third-party doctrine: it instead rests on the theory that courts would find EARN IT so coercive that the service providers should be effectively treated as an arm of the state. I take a pretty dim view of the likelihood of such an argument's success, but it's a game attempt. The 1st Amendment case is probably stronger, especially given the tendency toward maximalism in that area by the Supreme Court lately... but I wouldn't call it very strong. Defeating this politically is a much better bet.
  - ncallaway 7y ago
    > So at the time this argument applies, you have provided them readable information and the doctrine would apply. Ah, yes, that tracks. Basically: The customer doesn't have a strong 4A argument because for the customer to be impacted the provider is already looking at your data, so the third-party doctrine applies. The company probably doesn't have a strong 4A argument because they are making the choice (albiet a potentially coerced one) to eliminate end-to-end encryption. The company itself isn't suffering any undue search or seizure. Thanks for explaining! With that clarification I'm totally with you. I agree that the 4A argument that the coercion is sufficient to treat the service provider as an extension of the state is colorable, but much less strong than the 1A argument.
  - salawat 7y ago
    This only holds water actually if you accept a program run on someone's computer is not 'theirs'. I.e. it going into an encryption routine as part of the software package does not constitute me accepting the service provider's access to meta information about the transaction or to the contents of the original stream. That's like saying putting something in a Post Office envelope/box is to accept that the post office can open and inspect it will. Which is patently ridiculous. The legal system needs to come to terms with the fact that the usage of a program to transfer or transform information to the ends of achieving communication is in and of itself A) an act of speech, and B) qualifies as letters, papers, etc on light of the 4th Amendment. Further, the Court needs to do a better job at holding companies to account for informing when their tools are built in such a way that Third Party Doctrine applies. Furthermore, the implementation of that communication that Third Party Doctrine applies of should not be tolerated if it turns into some traditional template document that everyone tucks into something no one is going to read if we really care about civil rights at all. It's worthy of ridicule the way we've let legal doublespeak undermine our fundamental civil rights.
    - zerocrates 7y ago
      The trouble is that there's already a significant amount of precedent here holding that the Constitution doesn't treat this kind of information passing through intermediaries the same as letters through the mail. Congress had to pass the Stored Communications Act to provide any sort of halfway-reasonable protections for email stored on third-party servers, for example. And it can be pretty un-reasonable itself. Encryption changes things substantially, at least for practical purposes, but the whole idea of EARN IT is to coerce services to disincentivize the kind of encryption that would matter. The Court has made some baby steps in the direction of fixing the more "core" deficiencies of the 4th Amendment's protections given the realities of the modern world, but they're not showing any signs of rushing to go further.
lvs 7y ago
The third party doctrine arises from an era where much less information was held by third parties. It obviously can't be claimed that information I share with integral service providers, e.g. when sending an email to my daughter, carries no expectation of privacy. Third party doctrine is therefore highly problematic, and it is already seeing a small number of court decisions picking away at it. It inevitably has to be reworked.
- zerocrates 7y ago
  I agree with you that the third party doctrine is itself a problem, particularly as more and more of daily life is recorded and conducted through such "third parties." End to end encryption is one way of fighting back against that regime: if the third party has nothing it can use to respond to a subpoena then that's that. Of course we see here that the government quite likes their access (and sees encryption as standing in the way even of warrant-based access) and so they're stirring to action. I suppose I'm just a pessimist about the prospects of courts stepping in here to "fix" their mistakes (or prevent the legislature from making new ones).

It's the EFF's job to advocate for a strong position on this kind of stuff, but it's a little hard to square those strong 4th Amendment claims with the existence of the third party doctrine.

klyrs 7y ago

The third party doctrine applies to voluntary disclosure, whereas this law compels it.

cyphar 7y ago
No, the third party doctrine allows for compelled disclosure (through warrants) of a user's data which the service acted as a carrier for. That's why law enforcement can send warrants to Google (or your ISP) to get the contents of your email account, rather than having to serve you a warrant. The part that is often cited as being "voluntary" is that you decided to volunteer your information to a third-party (even if the service requires you to do so, and thus you actually had no meaningful choice in the matter) and thus you have "no reasonable expectation of privacy".

ncallaway 7y ago

Let's say a service builds a system with end-to-end encryption, such that the service provider itself is unable to decrypt and read any messages sent using the service. How would the third party doctrine apply to that scenario? I haven't voluntarily given any decrypted information to the service provider. Instead, I specifically avoided voluntarily giving them that information. So, at least in the context that the EARN IT act may threaten end-to-end encryption (or may attach significant civil liability to adopting end-to-end encryption) I'm not sure I understand how the third party doctrine applies. Can you expand on that?

zerocrates 7y ago
The trouble is that the argument isn't that pressuring providers to eliminate end to end encryption itself violates the 4th Amendment, but that, in the new scheme required under EARN IT, that when a provider does scan your information, that will violate the 4th Amendment. So at the time this argument applies, you have provided them readable information and the doctrine would apply. To be fairer to EFF in the light of the morning, their argument actually does account for the third-party doctrine: it instead rests on the theory that courts would find EARN IT so coercive that the service providers should be effectively treated as an arm of the state. I take a pretty dim view of the likelihood of such an argument's success, but it's a game attempt. The 1st Amendment case is probably stronger, especially given the tendency toward maximalism in that area by the Supreme Court lately... but I wouldn't call it very strong. Defeating this politically is a much better bet.
- ncallaway 7y ago
  > So at the time this argument applies, you have provided them readable information and the doctrine would apply. Ah, yes, that tracks. Basically: The customer doesn't have a strong 4A argument because for the customer to be impacted the provider is already looking at your data, so the third-party doctrine applies. The company probably doesn't have a strong 4A argument because they are making the choice (albiet a potentially coerced one) to eliminate end-to-end encryption. The company itself isn't suffering any undue search or seizure. Thanks for explaining! With that clarification I'm totally with you. I agree that the 4A argument that the coercion is sufficient to treat the service provider as an extension of the state is colorable, but much less strong than the 1A argument.
- salawat 7y ago
  This only holds water actually if you accept a program run on someone's computer is not 'theirs'. I.e. it going into an encryption routine as part of the software package does not constitute me accepting the service provider's access to meta information about the transaction or to the contents of the original stream. That's like saying putting something in a Post Office envelope/box is to accept that the post office can open and inspect it will. Which is patently ridiculous. The legal system needs to come to terms with the fact that the usage of a program to transfer or transform information to the ends of achieving communication is in and of itself A) an act of speech, and B) qualifies as letters, papers, etc on light of the 4th Amendment. Further, the Court needs to do a better job at holding companies to account for informing when their tools are built in such a way that Third Party Doctrine applies. Furthermore, the implementation of that communication that Third Party Doctrine applies of should not be tolerated if it turns into some traditional template document that everyone tucks into something no one is going to read if we really care about civil rights at all. It's worthy of ridicule the way we've let legal doublespeak undermine our fundamental civil rights.
  - zerocrates 7y ago
    The trouble is that there's already a significant amount of precedent here holding that the Constitution doesn't treat this kind of information passing through intermediaries the same as letters through the mail. Congress had to pass the Stored Communications Act to provide any sort of halfway-reasonable protections for email stored on third-party servers, for example. And it can be pretty un-reasonable itself. Encryption changes things substantially, at least for practical purposes, but the whole idea of EARN IT is to coerce services to disincentivize the kind of encryption that would matter. The Court has made some baby steps in the direction of fixing the more "core" deficiencies of the 4th Amendment's protections given the realities of the modern world, but they're not showing any signs of rushing to go further.

lvs 7y ago

The third party doctrine arises from an era where much less information was held by third parties. It obviously can't be claimed that information I share with integral service providers, e.g. when sending an email to my daughter, carries no expectation of privacy. Third party doctrine is therefore highly problematic, and it is already seeing a small number of court decisions picking away at it. It inevitably has to be reworked.

zerocrates 7y ago
I agree with you that the third party doctrine is itself a problem, particularly as more and more of daily life is recorded and conducted through such "third parties." End to end encryption is one way of fighting back against that regime: if the third party has nothing it can use to respond to a subpoena then that's that. Of course we see here that the government quite likes their access (and sees encryption as standing in the way even of warrant-based access) and so they're stirring to action. I suppose I'm just a pessimist about the prospects of courts stepping in here to "fix" their mistakes (or prevent the legislature from making new ones).