13 ms·

DOJ: We don't need warrants for e-mail, Facebook chats

179 points by declan 13y ago

diminoten 13y ago
There is a certain logic to what they're saying, after all. You shared this information with Facebook or Twitter or Google. It's no longer in your private possession, because of that sharing, so if those companies feel like giving your messages to the DOJ, it's not really a "violation" of your 4th amendment rights, because you gave those up when you gave your "private" communications to those companies. I'm not saying anything about how good or bad that is for American society, but I can absolutely see an interpretation of the 4th amendment where information you share with a third party doesn't get protected as if it were private. There may be other laws that protect your emails and tweets and whatnot, but the 4th amendment specifically may not be the best place to look for that protection.
- pyre 13y ago
  The postal service, UPS, DHL, FedEx, the phone company, etc. These are all 3rd party services that people use to send private things. People have an expectation of privacy when they send a message to someone via (e.g.) Facebook Chat. Some might argue that it's an unreasonable expectation of privacy if you understand the technology behind it, but I would argue that the majority of the population doesn't understand the way the technology works (which would imply that the majority of the population expects that the communications will remain private).
  - sp332 13y ago
    If you agree to a privacy policy that says "we will give your data to the DOJ any time they ask for it" you don't have a reasonable expectation of privacy either.
    - pyre 13y ago
      If you sign an employee agreement that says, "we own all of IP you produce past, present and future," then it's obviously enforceable, right?
      - sp332 13y ago
        That's actually much more enforceable than a drive-by EULA.
        rhizome 13y ago
        Are you sure about that?
        sp332 13y ago
        Yeah, because you would actually read & physically sign an employment agreement, and that agreement actually has some bearing on how you relate to your job. OTOH an EULA is not read by most people, and their enforceability has been challenged in court. https://en.wikipedia.org/wiki/Software_license_agreement#Enforceability_of_EULAs_in_the_United_States https://en.wikipedia.org/wiki/Software_license_agreement#Enf...
        rhizome 13y ago
        You can't sign your rights away, and "we own all of IP you produce past, present and future," is a forsaking of rights that would naturally be exercisable by the person signing the contract. Employment agreements are also subject to contract law concepts such as consideration[1], which would come into play when someone stops and asks "what's in it for me?" A single job as described at the beginning of the relationship through the employment agreement is probably not going to be seen as valuable enough for someone to have legitimately signed away his future productivity. 1. http://en.wikipedia.org/wiki/Consideration http://en.wikipedia.org/wiki/Consideration
        sp332 13y ago
        Your interpretation of "consideration" is, according to the article you linked, the minority position. https://en.wikipedia.org/wiki/Consideration#Monetary_value_of_consideration https://en.wikipedia.org/wiki/Consideration#Monetary_value_o... I'm not sure what you mean by "you can't sign your rights away". IP is of course transferable.
  - MichaelApproved 13y ago
    The phone company is the best example because with a couple of alligator clips they could easy listen in on phone conversations. It's understood that listening in is a rare occurrence but we are ok with it happening. Same goes for FB, Google and other providers. They have the ability to read your mail and occasionally do just like the phone company. Bonus example: voice mail. It's just like email since its a message sitting on the service providers computer. Can the Feds just listen to those messages?
    - srumple 13y ago
      The problem here is not the level of access they get to our information. The problem is how they are allowed to use that access. The 4th Amendment doesn't really prevent the Feds from snooping on anything they want to, it just prevents them from acting on any of that information.
      - pyre 13y ago
        Huh? If the FBI busts into someone's house without a warrant there are going to be more repercussions than just "we can't use this information in court."
    - Zimahl 13y ago
      I guess what people don't have a problem with there is that at least someone is physically listening in on a phone line - it requires manpower to do and thus is very deliberate. It's when we are being data mined by the government there's a problem. I think we all don't mind being data mined for advertising (within reason) but when we are being watched to be 'kept in line' that's where there's a problem. At that point it's more like 'Minority Report' where you are being scrutinized before you even do anything.
      - err_badprocrast 13y ago
        I don't like being data mined, full stop. Advertisers don't get a free pass; I would much rather pay for any service than have companies I don't even know the names of compile mile-long paper trails of my online (and possibly offline) activities.
  - mpyne 13y ago
    The postal service is the only one of those mail carrier which you have listed that actually have legal standing for that privacy expectation though. Regarding phones, those also have specific laws attempting to protect wireless (cellular) communications from eavesdropping (with the exception of legal wiretaps, which cellular providers are required to be able to support). Likewise for pagers, those have specific laws making it illegal to intercept the communications sent to pagers. For normal phones, a specific law had to be passed to require warrants for interception of communication (the "Wiretap Statute" from 1968, later extended by the Electronic Communications Privacy Act of 1986). So the point to all of this is that those privacy "rights" that you talk about are not 4th Amendment rights at all, they are protections granted by specific legal action on the part of Congress. Had that legal action not been taken then you'd be right back in this same "interesting 4th Amendment question" that we're talking about for this. The bottom line is that if you're willing to give info to a 3rd party unencrypted you need to assume the government can be given access to the same information unless there are specific laws forbidding it.
    - axus 13y ago
      The anti-wiretapping laws are needed to prevent non-government entities from violating our security. The Fourth Amendment already clarifies that government must not violate the security of ourselves and our communications (papers), without a warrant naming the person being searched, and what is being sought.
      - mpyne 13y ago
        Yes, but before those anti-wiretapping laws the phone company could theoretically do ad-hoc wiretapping of their own and voluntarily divulge that to the government. The only limit would have been that the phone company couldn't have wiretapped at the direct behest of the government since the Supreme Court had already ruled that the 4th Amendment applied [to the government] where the person had a reasonable expectation of privacy. The statute fixed that privacy issue and then put requirements on when wiretaps could be used by the government. Before this law and the Supreme Court decision the government was very... lax regarding warrants for wiretaps. http://www.it.ojp.gov/default.aspx?area=privacy&page=1284 http://www.it.ojp.gov/default.aspx?area=privacy&page=128...
  - rayiner 13y ago
    There is no protection for UPS, DHL, FedEx, etc. The only one for which there is protection is the Postal Service, and that is because it is an organ of the government. Also: the government could always ask your friend at the other end about what you said, not just Facebook. The intention of the founders re: the 4th amendment was not to protect communications between people, it was to protect people from personal searches. Read the text: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." Persons, houses, papers, and effects? What do all those things have in common? They are personal to you. You'd feel violated if someone else entered your house or rifled through your effects. That same reasoning doesn't apply to something like a Facebook message that any of a number of people at Facebook could read. Maybe you assume that they wouldn't do that, but they certainly can. Maybe we need a law to keep the government from getting Facebook messages without a warrant. But that's a separate thing from the Constitutional issue. Personally, I don't even think we need such a law. If you're okay with Facebook or Google looking at your communications, you should be okay with the government doing so.
    - pyre 13y ago
      I didn't raise a Constitutional issue. I'm pretty sure that "reasonable expectation of privacy" is found no where in the Constitution. | If you're okay with Facebook or Google looking at | your communications, you should be okay with the | government doing so. - This treads awfully close to 'if you have nothing to hide, then you have nothing to fear.' - Government employees wield much more power than Facebook employees. - If it was common knowledge that all Google/Facebook employees had unfettered access to all communications going through their systems, then people would treat the system differently. As it stands, employees should only be looking at specific communications to deal with work functions (investigate complaints from users, look at a message that caused a back-end system to blow up, etc).
      - rayiner 13y ago
        > This treads awfully close to 'if you have nothing to hide, then you have nothing to fear.' But you're not hiding anything. You're transmitting it in clear text through Google/Facebook's services. You're not worried about the right to hide your information, you're worried about the right to hide it against the government specifically. That's the key distinction. I do have things to hide--I don't share those thing with either Google or the government, and those are the things I want protected. If I choose to share something with Google, I'm okay with the government having access to it too. > Government employees wield much more power than Facebook employees. In my mind, the government has a lot more power to screw me over, but private industry has a lot more incentive. I'm much more worried about credit ratings agencies, insurance companies, potential employers, etc, having access to my information than I am about the NSA looking at my information. > As it stands, employees should only be looking at specific communications to deal with work functions That's the same for government employees. Maybe the difference between us is that you implicitly trust the employees of Facebook not to do stuff like this, and don't trust government employees, while I feel the opposite way.
- tych0 13y ago
  Yes, in (US) legal circles this is known as the "Third Party doctrine". Justice Sotomayor has said in at least one opinion that if we want to re-vamp privacy laws, the third party doctrine is what needs to be reversed, and that she may be willing to do so.
- tshile 13y ago
  If you want to follow that line of logic then you still have an issue with Facebook, Twitter, Google, et al being forced (via national security letters, and through other means) to turn over data and gag orders issued to prevent them from disclosing it.
- declan 13y ago
  This point has been debated for quite a while: entire conferences have been held on this topic! Perhaps 20 years ago you would have found plenty of people who agree with you. But the emerging legal consensus, in academia, in Congress, and in the courts, is contrary to your view. Excerpt from the 6th Circuit's Warshak opinion: "Since the advent of e-mail, the telephone call and the letter have waned in importance, and an explosion of Internet-based communication has taken place. People are now able to send sensitive and intimate information, instantaneously, to friends, family, and colleagues half a world away... By obtaining access to someone's e-mail, government agents gain the ability to peer deeply into his activities."
- glesica 13y ago
  You share your telephone conversations with the phone company, so why did they need permission to set up a wiretap in the past? You shared your personal and business possessions with your housekeeper, janitor, plumber and other maintenance staff, so why do they need a search warrant for your home or office? It's not a logical argument, it's a ludicrous argument that sounds logical because the Internet has only existed for most people for 15 years or so and social norms are still being worked out.
  - mpyne 13y ago
    The government needs a search warrant, not your housekeeper. If your housekeeper then tells the government of your "crimes" that's whistleblowing, not government invasion of your privacy. As for the telephone conversations, read this thread a bit more... the government didn't need permission to wiretap until a specific law was passed in 1934 that required it.
    - pyre 13y ago
      This is more akin to a safety deposit box. The bank doesn't necessarily know what's in there. It's not the same as compelling testimony from a housekeeper. Sure, Facebook/Google have more access than a bank has to the safety deposit box, but the likelihood that anyone at Google or Facebook has actual knowledge of the information the government is looking for is slim to none. Maybe a better analogy would be a warehouse. Just because things are stored in the warehouse, and employees have access, doesn't mean that the employees have rifled through them.
    - glesica 13y ago
      I'm really not that interested in what the law says. The law often says horrible, stupid things. I was criticizing the OP's assertion that the policy "made sense". It does not make sense unless you also believe that it is acceptable for the government to snoop into your life through other means, using situations in which you have trusted a third party against you.
      - mpyne 13y ago
- np422 13y ago
  I think we are missing the fundamental issue here. What do "we the people" want? Do we want the government to seek out and exploit every possible loophole it can find and to make up excuses to eavesdrop on us? Or do we want to make sure that gentlemen don't read each others letters? I would very much prefer the latter. State the law as "if you are a public servant, don't listen to the conversation of people - don't even think about or try to listen - unless you have a very specific reason to do otherwise and then only if you must". "They", the government, are the people having guns and the authority to lock you up. Once we get used to the idea that "they are listening" whenever they want ... we will start to self censor what we say and very shortly thereafter what we do and think. You don't want to be the one sticking out, you don't want to catch their attention. And that is when we have killed creativity, stopped future development of society and made the entrepreneurs walk in the line at the same pace as everyone else. The quest for privacy is not about protecting the fact that I like to watch videos of midgets dressed up in leather underwear or my protecting friend who is ordering weed online. It is about the future of our society.
dmix 13y ago
Self-defence (encryption) is the only real protection from government snooping on communications. You can't rely on policy. It moves too slowly and there are always loopholes. It's a shame there's no mainstream or accessible solutions to encrypt email while using services like gmail. Although they exist for IM.
- deleted 13y ago
  [deleted]
- KMag 13y ago
  Shameless plug for my old room mate's startup, [http://penango.com http://penango.com Penango]. Penango uses a browser plugin to implement S/MIME for GMail and several other popular webmail providers. Your private keys stay on your local machine.
  - eric_bullington 13y ago
    Awesome, thanks for the tip! I've just opened up the page and if the technology looks at all workable, I'll sign-up/purchase. EDIT: Ah no, no Chrome plugin! I may have to go back to Firefox. I've been using it lately for development and it's come a long way in 2-3 years. EDIT II: I found a very interesting open-source Chrome OpenPGP plugin built by a research team. http://gpg4browsers.recurity.com/ http://gpg4browsers.recurity.com/ (Turns out project was merged to mymail-crypt project here: http://www.openpgpjs.org/ http://www.openpgpjs.org/) But I'll be sure to check back with Penango since they have said that a Chrome plugin in coming mid-2013.
- declan 13y ago
  Yep. SSL is now viewed as a good best practice for data in transit, to the point that Apple was criticized for not enabling it for the App Store (http://news.cnet.com/8301-13579_3-57573334-37/ http://news.cnet.com/8301-13579_3-57573334-37/). But the real issue, as you indicate, is stored data. Full Gmail encryption would presumably be done in conjunction with the client via the browser. Because the server wouldn't have access to the plaintext, search becomes tricky and contextual ads problematic. One solution would be for Google to make fully encrypted Gmail a paid service.
umsm 13y ago
We need to come up with a way to communicate using these 3rd party services securely, without actually allowing them to store the information in plaintext...
mehrzad 13y ago
Is IRC safe? I have a channel as my main form of communication with friends. Some people do local logging but I know who everyone is. Ironically I plan to use IRCcloud or IRCanywhere. Self hosting of online tools should be made much easier. I plan to self-host email but it seems like a pain.
- setrofim_ 13y ago
  > IRC safe? Definitely not. It has always been a public communications channel. I don't think anyone ever had any privacy expectations regarding IRC.
  - jcrites 13y ago
    > Is IRC safe? I am pretty sure it's not. One day there was a news story on Drudge Report: http://www.drudgereportarchives.com/data/2005/05/10/20050510_030800.htm http://www.drudgereportarchives.com/data/2005/05/10/20050510... ("feds investigate huge computer attack; worldwide hunt for 'stakkato'") As a joke, my roommate at university logged into a IRC channel with the nickname and said: [01:59.16] * Stakkato (tricky_t@128.42.86.9) has joined #C++ [01:59.17] * ChanServ sets mode: +o Stakkato [01:59.21] <Stakkato> look i made drudgereport headlines! [01:59.26] <Stakkato> http://www.drudgereport.com [02:01.09] * Stakkato (tricky_t@128.42.86.9) Quit (Quit: ) It was #C++ on DALnet, a small channel of mostly regular members, in 2005. Fast forward a while -- I don't recall how long, maybe a few weeks or months -- and my friend is contacted by the FBI. A member of FBI Houston Cyber Task Force (Houston being our city of residence at the time). The investigator began asking very vague, obscure questions. Eventually my friend and I piece together the subject of the FBI's line of inquiry: that specific IRC conversation. My roommate was completely up front with them about the IRC joke, and that was the end of it. I still have copies of the email conversations from @ic.fbi.gov, where some correspondence took place. I suppose there is a chance that an informant reported the joke to the FBI, but due to the specifics of the situation, I think it is likely that the text conversation above was caught in a a general FBI dragnet of some kind (IRC server, ISP, etc.) and logged for eventual investigation. It did not seem to be a serious line of investigation by the FBI - more of a "follow all leads" situation. Someone had run a 'grep' for 'stakkato' and my friend's IP address showed up. That was the day when it became clear to me that everything in plaintext transiting the Internet is probably available to the FBI. At the time it was shocking; even though the conversation happened over a public network, it was surprising to me that the conversation was actually logged and later found. I hesitate to share this story, but I hope it illustrates in harsh relief the probable capabilities of incentivized investigators. Keep in mind this was 2005 - investigative capabilities have surely grown since then.
leeoniya 13y ago
let's say, hypothetically of course, that a colleague sent me a password to a server via email (gmail), so that password is then retrievable without a warrant from my email account because it was "shared" with the transmission medium? such a broad interpretation would apply to any and all communications where anyone delivers something on your behalf...so literally everything if fair game, i dont see a reason to specifically exclude USPS in such a case. that's pretty scary.
- sukuriant 13y ago
  Or, you mean things like all those websites that send you new passwords in plaintext because their security isn't what it should be?
  - leeoniya 13y ago
    my personal favorites are the ones that send me my current password in plaintext as a form of "recovery"
- tantalor 13y ago
  They would still need a warrant to enter the server. Discovering the password gives them nothing. If they want your server, they can subpoena for the password.
a3n 13y ago
"Warrants? We don' got no warrants. We don' need no steenkeen warrants!"
eyeareque 13y ago
Now more than ever we need an easy to use PGP solution for the masses.
GigabyteCoin 13y ago
All the more reason to support projects like BitMessage: http://reddit.com/r/bitmessage http://reddit.com/r/bitmessage
- ancarda 13y ago
  I'd use and support BitMessage but I can't figure out how to get it to run on OS X.
Fuxy 13y ago
A hacker could do some real damage with a little fake paperwork. Can't wait for it to happen and believe me it will happen eventually. The hub of information is the police and if they hand it around without any concern why not mine them? The backlash may be a bit too much to handle though if he gets caught.
josh2600 13y ago
I might be too late for anyone to see this, but I think it's an important point. A lot of people assume the origin of wiretapping laws has to do with protecting citizens from the police. This isn't the case, at least not originally. Wiretapping laws were about protecting citizens from each other. Let me explain: Once upon a time, it was too expensive to run a phone line to each house. AT&T had the brilliant idea of running one phone line and having many people on a street share the line (the rich, of course, enjoyed private communications). So if there were seven houses, and you were in house number 5, you would only answer calls that rang 5 times. The problem is that since all the houses on the block shared one phone line, any one nosy enough to but in could eavesdrop just by taking their phone off hook. The original wiretapping laws were setup to protect citizens from this, not the Government. As a side note: before the North American Numbering plan, phone numbers were names followed by numbers. An example might be Oxford7 or OX7 on the number pad, which would ring the 7th house in the Oxford area (Oxford is a placeholder and doesn't refer to Oxford proper.)
- mrexroad 13y ago
  interesting. i assume you're referring to legislation at a state level? got any links? i haven't read much about that era, but from what i have, it sounds like things were awesomely crazy back then w/ PIs tapping for clients, corporations tapping each other, etc. at least at the federal level, everything i'd read places the catalyst for modern wiretapping laws as the conviction appeal of seattle bootlegger Roy Olmstead's arrest based on evidence gathered by a warrantless wiretap by "rogue federal law enforcement officers." his appeal reached the supreme court in 1928 and was upheld 5-4 on 18th century trespass laws. in 1934, congress passed The Communications Act of 1934, which made wiretapping a federal criminal offense and any evidence obtained from such would be inadmissible. it wasn't until the The Omnibus Crime Control Act of 1968 that the constitutionality of wiretapping was articulated for investigative purposes. this gives a better overview/detail compared wikipedia: http://www.americanbar.org/content/dam/aba/administrative/litigation/materials/sac_2012/29-1_history_and_law_of_wiretapping.authcheckdam.pdf http://www.americanbar.org/content/dam/aba/administrative/li...
  - josh2600 13y ago
ck2 13y ago
We're back to administrations saying "stop us if you can".
anExcitedBeast 13y ago
Don't trust policy. If you aren't good willing to handle encryption yourself, find a medium that will responsibly handle it for you (i.e. lavabit.com)
hippich 13y ago
use torchat. i was surprised how easy it is to use. and actually it have best IM user interface I've seen so far - contacts list, chat window on double click and send/receive file. That's it - nothing else. on cons side - it take a while to connect to tor network, but once started it is quite fast. i am not saying government should be allowed violate our rights, but it is much easier to assume that anything gtalk/facebook/gmail/etc is with in reach of government and do yourself a favor - use p2p encryption
markbao 13y ago
I'm confused as to why the DOJ is arguing over whether it needs a warrant or not for emails and Facebook chats and that sort of thing. This is the DOJ that we're talking about, and surely, even if a warrant is required for email, they would be able to get that warrant regardless. A warrant is simply a permission by a judge to obtain or enter certain private property, right? Wouldn't the DOJ be able to find a judge that will grant a warrant? I don't know anything about judicial law, so I'm interested in learning about how this all works.
- DannyBee 13y ago
  It's about bureaucracy in a lot of cases. It may require senior agent signoff for the warrant, etc.
ComputerGuru 13y ago
Guys, when will it sink through? The technology to protect yourself from wiretapping is in your hands. End-to-end asymmetric encryption has never been more accessible. Explain to your friends and family what PGP is and start using it. Maybe the NSA has it cracked, maybe not. But the IRS sure doesn't, nor do the FDA, DEA, FCC, FBI, Google, Apple, Facebook, Microsoft for that matter. EDIT: Here's how it works: I run PGP/GPG (GPG is the open source/free version of PGP, they're the same protocol) locally and the first time I use it, it creates two files, a "public key" and a "private key". I post/share my "public key" online (and you assume it's really me sharing it with you - this is important). gnupg --gen-key gpg --armor --output Desktop/mqudsi.asc --export "Mahmoud Al-Qudsi" For example, here is my public key: http://neosmart.net/downloads/miscellania/mqudsi.asc http://neosmart.net/downloads/miscellania/mqudsi.asc Anyone can now use this key to send me a text message encrypted only for me. They just need this file and their own pgp/gpg private key; they tell it to encrypt message X for user with public key Y. The result of that command (gpg --encrypt --recipient 'Mahmoud Al-Qudsi <mqudsi@neosmart.net>' toencrypt.txt) will be encrypted text that no one but the holder of the private key (me) (which should never be shared) will be able to decode. The result is plaintext. You can send it via email, text message, snail mail, whatever. There are apps that automate the encryption procedure as part of the sending process.
- rthomas6 13y ago
  This is slightly off topic, but I googled "PGP" as I do when I want to understand something specific better, and found that PGP stands for "Pretty Good Privacy." Ha.
- sev 13y ago
  "Maybe the NSA has it cracked?" I'm actually curious, why do you think they may have?
  - deleted 13y ago
    [deleted]
  - homosaur 13y ago
    They almost certainly don't, I'm sure he was just saying that since that's always the accusation amongst the paranoid with consumer encryption.
codex 13y ago
The DoJ doesn't need warrants to produce email and chat evidence in a lawsuit just like they don't need a warrant to produce other kinds of physical evidence from third parties. A subpoena will suffice and always has. People seem to be unaware of how critical subpoenas are to due process, and how long they've been used. See: http://en.wikipedia.org/wiki/Stored_Communications_Act http://en.wikipedia.org/wiki/Stored_Communications_Act
g8oz 13y ago
Reduce your attack surface by not leaving years and years of emails on your IMAP server. I know its convenient, but there is a privacy tradeoff.
edoceo 13y ago
Sites like http://flammo.com/ http://flammo.com/ can send private messages which the DOJ cannot see uses end-to-end asymmetric encryption
alan_cx 13y ago
Fair enough. We cant stop it. Its done. It always was. Might as well stop the "chock and horror" thing, and just accept it. In the US, both political parties love being able to spy on us, and in the UK we see the exact same thing. No main stream politicians or law enforcement will ever, ever give it up. So, have to ask, again, why the hell is any one wanting privacy from the authorities, who we know don't have our best interests at heart, still using electronic communications? It never was, isn't and never will be secure from them. If nothing else, almost every "terrorist" trial features some electronic communications evidence. Doesn't that tell us enough? Look, just ask your self why organisations like MI6 still use old skool drop boxes in Moscow. Tor? Its got government finger prints all over it. I trust it as far as I can throw it.
CurtMonash 13y ago
If you encrypt your email, you'll just raise "bad guy" flags at the traffic analysis level, even before content itself is checked. Of the top of my head, I can't think of a lever to get enough people encrypting at once so as to overcome that disadvantage.
Qantourisc 13y ago
This is one of the reason I don't have Facebook. Weird how foreign rules can affect your privacy outside Europe.

179 points by declan 13y ago

There is a certain logic to what they're saying, after all. You shared this information with Facebook or Twitter or Google. It's no longer in your private possession, because of that sharing, so if those companies feel like giving your messages to the DOJ, it's not really a "violation" of your 4th amendment rights, because you gave those up when you gave your "private" communications to those companies. I'm not saying anything about how good or bad that is for American society, but I can absolutely see an interpretation of the 4th amendment where information you share with a third party doesn't get protected as if it were private. There may be other laws that protect your emails and tweets and whatnot, but the 4th amendment specifically may not be the best place to look for that protection.

pyre 13y ago
The postal service, UPS, DHL, FedEx, the phone company, etc. These are all 3rd party services that people use to send private things. People have an expectation of privacy when they send a message to someone via (e.g.) Facebook Chat. Some might argue that it's an unreasonable expectation of privacy if you understand the technology behind it, but I would argue that the majority of the population doesn't understand the way the technology works (which would imply that the majority of the population expects that the communications will remain private).
- sp332 13y ago
  If you agree to a privacy policy that says "we will give your data to the DOJ any time they ask for it" you don't have a reasonable expectation of privacy either.
  - pyre 13y ago
    If you sign an employee agreement that says, "we own all of IP you produce past, present and future," then it's obviously enforceable, right?
    - sp332 13y ago
      That's actually much more enforceable than a drive-by EULA.
      - rhizome 13y ago
        Are you sure about that?
        sp332 13y ago
        Yeah, because you would actually read & physically sign an employment agreement, and that agreement actually has some bearing on how you relate to your job. OTOH an EULA is not read by most people, and their enforceability has been challenged in court. https://en.wikipedia.org/wiki/Software_license_agreement#Enforceability_of_EULAs_in_the_United_States https://en.wikipedia.org/wiki/Software_license_agreement#Enf...
        rhizome 13y ago
        You can't sign your rights away, and "we own all of IP you produce past, present and future," is a forsaking of rights that would naturally be exercisable by the person signing the contract. Employment agreements are also subject to contract law concepts such as consideration[1], which would come into play when someone stops and asks "what's in it for me?" A single job as described at the beginning of the relationship through the employment agreement is probably not going to be seen as valuable enough for someone to have legitimately signed away his future productivity. 1. http://en.wikipedia.org/wiki/Consideration http://en.wikipedia.org/wiki/Consideration
        sp332 13y ago
        Your interpretation of "consideration" is, according to the article you linked, the minority position. https://en.wikipedia.org/wiki/Consideration#Monetary_value_of_consideration https://en.wikipedia.org/wiki/Consideration#Monetary_value_o... I'm not sure what you mean by "you can't sign your rights away". IP is of course transferable.
- MichaelApproved 13y ago
  The phone company is the best example because with a couple of alligator clips they could easy listen in on phone conversations. It's understood that listening in is a rare occurrence but we are ok with it happening. Same goes for FB, Google and other providers. They have the ability to read your mail and occasionally do just like the phone company. Bonus example: voice mail. It's just like email since its a message sitting on the service providers computer. Can the Feds just listen to those messages?
  - srumple 13y ago
    The problem here is not the level of access they get to our information. The problem is how they are allowed to use that access. The 4th Amendment doesn't really prevent the Feds from snooping on anything they want to, it just prevents them from acting on any of that information.
    - pyre 13y ago
      Huh? If the FBI busts into someone's house without a warrant there are going to be more repercussions than just "we can't use this information in court."
  - Zimahl 13y ago
    I guess what people don't have a problem with there is that at least someone is physically listening in on a phone line - it requires manpower to do and thus is very deliberate. It's when we are being data mined by the government there's a problem. I think we all don't mind being data mined for advertising (within reason) but when we are being watched to be 'kept in line' that's where there's a problem. At that point it's more like 'Minority Report' where you are being scrutinized before you even do anything.
    - err_badprocrast 13y ago
      I don't like being data mined, full stop. Advertisers don't get a free pass; I would much rather pay for any service than have companies I don't even know the names of compile mile-long paper trails of my online (and possibly offline) activities.
- mpyne 13y ago
  The postal service is the only one of those mail carrier which you have listed that actually have legal standing for that privacy expectation though. Regarding phones, those also have specific laws attempting to protect wireless (cellular) communications from eavesdropping (with the exception of legal wiretaps, which cellular providers are required to be able to support). Likewise for pagers, those have specific laws making it illegal to intercept the communications sent to pagers. For normal phones, a specific law had to be passed to require warrants for interception of communication (the "Wiretap Statute" from 1968, later extended by the Electronic Communications Privacy Act of 1986). So the point to all of this is that those privacy "rights" that you talk about are not 4th Amendment rights at all, they are protections granted by specific legal action on the part of Congress. Had that legal action not been taken then you'd be right back in this same "interesting 4th Amendment question" that we're talking about for this. The bottom line is that if you're willing to give info to a 3rd party unencrypted you need to assume the government can be given access to the same information unless there are specific laws forbidding it.
  - axus 13y ago
    The anti-wiretapping laws are needed to prevent non-government entities from violating our security. The Fourth Amendment already clarifies that government must not violate the security of ourselves and our communications (papers), without a warrant naming the person being searched, and what is being sought.
    - mpyne 13y ago
      Yes, but before those anti-wiretapping laws the phone company could theoretically do ad-hoc wiretapping of their own and voluntarily divulge that to the government. The only limit would have been that the phone company couldn't have wiretapped at the direct behest of the government since the Supreme Court had already ruled that the 4th Amendment applied [to the government] where the person had a reasonable expectation of privacy. The statute fixed that privacy issue and then put requirements on when wiretaps could be used by the government. Before this law and the Supreme Court decision the government was very... lax regarding warrants for wiretaps. http://www.it.ojp.gov/default.aspx?area=privacy&page=1284 http://www.it.ojp.gov/default.aspx?area=privacy&page=128...
- rayiner 13y ago
  There is no protection for UPS, DHL, FedEx, etc. The only one for which there is protection is the Postal Service, and that is because it is an organ of the government. Also: the government could always ask your friend at the other end about what you said, not just Facebook. The intention of the founders re: the 4th amendment was not to protect communications between people, it was to protect people from personal searches. Read the text: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." Persons, houses, papers, and effects? What do all those things have in common? They are personal to you. You'd feel violated if someone else entered your house or rifled through your effects. That same reasoning doesn't apply to something like a Facebook message that any of a number of people at Facebook could read. Maybe you assume that they wouldn't do that, but they certainly can. Maybe we need a law to keep the government from getting Facebook messages without a warrant. But that's a separate thing from the Constitutional issue. Personally, I don't even think we need such a law. If you're okay with Facebook or Google looking at your communications, you should be okay with the government doing so.
  - pyre 13y ago
    I didn't raise a Constitutional issue. I'm pretty sure that "reasonable expectation of privacy" is found no where in the Constitution. | If you're okay with Facebook or Google looking at | your communications, you should be okay with the | government doing so. - This treads awfully close to 'if you have nothing to hide, then you have nothing to fear.' - Government employees wield much more power than Facebook employees. - If it was common knowledge that all Google/Facebook employees had unfettered access to all communications going through their systems, then people would treat the system differently. As it stands, employees should only be looking at specific communications to deal with work functions (investigate complaints from users, look at a message that caused a back-end system to blow up, etc).
    - rayiner 13y ago
      > This treads awfully close to 'if you have nothing to hide, then you have nothing to fear.' But you're not hiding anything. You're transmitting it in clear text through Google/Facebook's services. You're not worried about the right to hide your information, you're worried about the right to hide it against the government specifically. That's the key distinction. I do have things to hide--I don't share those thing with either Google or the government, and those are the things I want protected. If I choose to share something with Google, I'm okay with the government having access to it too. > Government employees wield much more power than Facebook employees. In my mind, the government has a lot more power to screw me over, but private industry has a lot more incentive. I'm much more worried about credit ratings agencies, insurance companies, potential employers, etc, having access to my information than I am about the NSA looking at my information. > As it stands, employees should only be looking at specific communications to deal with work functions That's the same for government employees. Maybe the difference between us is that you implicitly trust the employees of Facebook not to do stuff like this, and don't trust government employees, while I feel the opposite way.
tych0 13y ago
Yes, in (US) legal circles this is known as the "Third Party doctrine". Justice Sotomayor has said in at least one opinion that if we want to re-vamp privacy laws, the third party doctrine is what needs to be reversed, and that she may be willing to do so.
tshile 13y ago
If you want to follow that line of logic then you still have an issue with Facebook, Twitter, Google, et al being forced (via national security letters, and through other means) to turn over data and gag orders issued to prevent them from disclosing it.
declan 13y ago
This point has been debated for quite a while: entire conferences have been held on this topic! Perhaps 20 years ago you would have found plenty of people who agree with you. But the emerging legal consensus, in academia, in Congress, and in the courts, is contrary to your view. Excerpt from the 6th Circuit's Warshak opinion: "Since the advent of e-mail, the telephone call and the letter have waned in importance, and an explosion of Internet-based communication has taken place. People are now able to send sensitive and intimate information, instantaneously, to friends, family, and colleagues half a world away... By obtaining access to someone's e-mail, government agents gain the ability to peer deeply into his activities."
glesica 13y ago
You share your telephone conversations with the phone company, so why did they need permission to set up a wiretap in the past? You shared your personal and business possessions with your housekeeper, janitor, plumber and other maintenance staff, so why do they need a search warrant for your home or office? It's not a logical argument, it's a ludicrous argument that sounds logical because the Internet has only existed for most people for 15 years or so and social norms are still being worked out.
- mpyne 13y ago
  The government needs a search warrant, not your housekeeper. If your housekeeper then tells the government of your "crimes" that's whistleblowing, not government invasion of your privacy. As for the telephone conversations, read this thread a bit more... the government didn't need permission to wiretap until a specific law was passed in 1934 that required it.
  - pyre 13y ago
    This is more akin to a safety deposit box. The bank doesn't necessarily know what's in there. It's not the same as compelling testimony from a housekeeper. Sure, Facebook/Google have more access than a bank has to the safety deposit box, but the likelihood that anyone at Google or Facebook has actual knowledge of the information the government is looking for is slim to none. Maybe a better analogy would be a warehouse. Just because things are stored in the warehouse, and employees have access, doesn't mean that the employees have rifled through them.
  - glesica 13y ago
    I'm really not that interested in what the law says. The law often says horrible, stupid things. I was criticizing the OP's assertion that the policy "made sense". It does not make sense unless you also believe that it is acceptable for the government to snoop into your life through other means, using situations in which you have trusted a third party against you.
    - mpyne 13y ago
np422 13y ago
I think we are missing the fundamental issue here. What do "we the people" want? Do we want the government to seek out and exploit every possible loophole it can find and to make up excuses to eavesdrop on us? Or do we want to make sure that gentlemen don't read each others letters? I would very much prefer the latter. State the law as "if you are a public servant, don't listen to the conversation of people - don't even think about or try to listen - unless you have a very specific reason to do otherwise and then only if you must". "They", the government, are the people having guns and the authority to lock you up. Once we get used to the idea that "they are listening" whenever they want ... we will start to self censor what we say and very shortly thereafter what we do and think. You don't want to be the one sticking out, you don't want to catch their attention. And that is when we have killed creativity, stopped future development of society and made the entrepreneurs walk in the line at the same pace as everyone else. The quest for privacy is not about protecting the fact that I like to watch videos of midgets dressed up in leather underwear or my protecting friend who is ordering weed online. It is about the future of our society.

dmix 13y ago

Self-defence (encryption) is the only real protection from government snooping on communications. You can't rely on policy. It moves too slowly and there are always loopholes. It's a shame there's no mainstream or accessible solutions to encrypt email while using services like gmail. Although they exist for IM.

deleted 13y ago
[deleted]
KMag 13y ago
Shameless plug for my old room mate's startup, [http://penango.com http://penango.com Penango]. Penango uses a browser plugin to implement S/MIME for GMail and several other popular webmail providers. Your private keys stay on your local machine.
- eric_bullington 13y ago
  Awesome, thanks for the tip! I've just opened up the page and if the technology looks at all workable, I'll sign-up/purchase. EDIT: Ah no, no Chrome plugin! I may have to go back to Firefox. I've been using it lately for development and it's come a long way in 2-3 years. EDIT II: I found a very interesting open-source Chrome OpenPGP plugin built by a research team. http://gpg4browsers.recurity.com/ http://gpg4browsers.recurity.com/ (Turns out project was merged to mymail-crypt project here: http://www.openpgpjs.org/ http://www.openpgpjs.org/) But I'll be sure to check back with Penango since they have said that a Chrome plugin in coming mid-2013.
declan 13y ago
Yep. SSL is now viewed as a good best practice for data in transit, to the point that Apple was criticized for not enabling it for the App Store (http://news.cnet.com/8301-13579_3-57573334-37/ http://news.cnet.com/8301-13579_3-57573334-37/). But the real issue, as you indicate, is stored data. Full Gmail encryption would presumably be done in conjunction with the client via the browser. Because the server wouldn't have access to the plaintext, search becomes tricky and contextual ads problematic. One solution would be for Google to make fully encrypted Gmail a paid service.

umsm 13y ago

We need to come up with a way to communicate using these 3rd party services securely, without actually allowing them to store the information in plaintext...

mehrzad 13y ago

Is IRC safe? I have a channel as my main form of communication with friends. Some people do local logging but I know who everyone is. Ironically I plan to use IRCcloud or IRCanywhere. Self hosting of online tools should be made much easier. I plan to self-host email but it seems like a pain.

setrofim_ 13y ago
> IRC safe? Definitely not. It has always been a public communications channel. I don't think anyone ever had any privacy expectations regarding IRC.
- jcrites 13y ago
  > Is IRC safe? I am pretty sure it's not. One day there was a news story on Drudge Report: http://www.drudgereportarchives.com/data/2005/05/10/20050510_030800.htm http://www.drudgereportarchives.com/data/2005/05/10/20050510... ("feds investigate huge computer attack; worldwide hunt for 'stakkato'") As a joke, my roommate at university logged into a IRC channel with the nickname and said: [01:59.16] * Stakkato (tricky_t@128.42.86.9) has joined #C++ [01:59.17] * ChanServ sets mode: +o Stakkato [01:59.21] <Stakkato> look i made drudgereport headlines! [01:59.26] <Stakkato> http://www.drudgereport.com [02:01.09] * Stakkato (tricky_t@128.42.86.9) Quit (Quit: ) It was #C++ on DALnet, a small channel of mostly regular members, in 2005. Fast forward a while -- I don't recall how long, maybe a few weeks or months -- and my friend is contacted by the FBI. A member of FBI Houston Cyber Task Force (Houston being our city of residence at the time). The investigator began asking very vague, obscure questions. Eventually my friend and I piece together the subject of the FBI's line of inquiry: that specific IRC conversation. My roommate was completely up front with them about the IRC joke, and that was the end of it. I still have copies of the email conversations from @ic.fbi.gov, where some correspondence took place. I suppose there is a chance that an informant reported the joke to the FBI, but due to the specifics of the situation, I think it is likely that the text conversation above was caught in a a general FBI dragnet of some kind (IRC server, ISP, etc.) and logged for eventual investigation. It did not seem to be a serious line of investigation by the FBI - more of a "follow all leads" situation. Someone had run a 'grep' for 'stakkato' and my friend's IP address showed up. That was the day when it became clear to me that everything in plaintext transiting the Internet is probably available to the FBI. At the time it was shocking; even though the conversation happened over a public network, it was surprising to me that the conversation was actually logged and later found. I hesitate to share this story, but I hope it illustrates in harsh relief the probable capabilities of incentivized investigators. Keep in mind this was 2005 - investigative capabilities have surely grown since then.

leeoniya 13y ago

let's say, hypothetically of course, that a colleague sent me a password to a server via email (gmail), so that password is then retrievable without a warrant from my email account because it was "shared" with the transmission medium? such a broad interpretation would apply to any and all communications where anyone delivers something on your behalf...so literally everything if fair game, i dont see a reason to specifically exclude USPS in such a case. that's pretty scary.

sukuriant 13y ago
Or, you mean things like all those websites that send you new passwords in plaintext because their security isn't what it should be?
- leeoniya 13y ago
  my personal favorites are the ones that send me my current password in plaintext as a form of "recovery"
tantalor 13y ago
They would still need a warrant to enter the server. Discovering the password gives them nothing. If they want your server, they can subpoena for the password.

a3n 13y ago

"Warrants? We don' got no warrants. We don' need no steenkeen warrants!"

eyeareque 13y ago

Now more than ever we need an easy to use PGP solution for the masses.

GigabyteCoin 13y ago

All the more reason to support projects like BitMessage: http://reddit.com/r/bitmessage http://reddit.com/r/bitmessage

ancarda 13y ago
I'd use and support BitMessage but I can't figure out how to get it to run on OS X.

Fuxy 13y ago

A hacker could do some real damage with a little fake paperwork. Can't wait for it to happen and believe me it will happen eventually. The hub of information is the police and if they hand it around without any concern why not mine them? The backlash may be a bit too much to handle though if he gets caught.

josh2600 13y ago

I might be too late for anyone to see this, but I think it's an important point. A lot of people assume the origin of wiretapping laws has to do with protecting citizens from the police. This isn't the case, at least not originally. Wiretapping laws were about protecting citizens from each other. Let me explain: Once upon a time, it was too expensive to run a phone line to each house. AT&T had the brilliant idea of running one phone line and having many people on a street share the line (the rich, of course, enjoyed private communications). So if there were seven houses, and you were in house number 5, you would only answer calls that rang 5 times. The problem is that since all the houses on the block shared one phone line, any one nosy enough to but in could eavesdrop just by taking their phone off hook. The original wiretapping laws were setup to protect citizens from this, not the Government. As a side note: before the North American Numbering plan, phone numbers were names followed by numbers. An example might be Oxford7 or OX7 on the number pad, which would ring the 7th house in the Oxford area (Oxford is a placeholder and doesn't refer to Oxford proper.)

mrexroad 13y ago
interesting. i assume you're referring to legislation at a state level? got any links? i haven't read much about that era, but from what i have, it sounds like things were awesomely crazy back then w/ PIs tapping for clients, corporations tapping each other, etc. at least at the federal level, everything i'd read places the catalyst for modern wiretapping laws as the conviction appeal of seattle bootlegger Roy Olmstead's arrest based on evidence gathered by a warrantless wiretap by "rogue federal law enforcement officers." his appeal reached the supreme court in 1928 and was upheld 5-4 on 18th century trespass laws. in 1934, congress passed The Communications Act of 1934, which made wiretapping a federal criminal offense and any evidence obtained from such would be inadmissible. it wasn't until the The Omnibus Crime Control Act of 1968 that the constitutionality of wiretapping was articulated for investigative purposes. this gives a better overview/detail compared wikipedia: http://www.americanbar.org/content/dam/aba/administrative/litigation/materials/sac_2012/29-1_history_and_law_of_wiretapping.authcheckdam.pdf http://www.americanbar.org/content/dam/aba/administrative/li...
- josh2600 13y ago

ck2 13y ago

We're back to administrations saying "stop us if you can".

anExcitedBeast 13y ago

Don't trust policy. If you aren't good willing to handle encryption yourself, find a medium that will responsibly handle it for you (i.e. lavabit.com)

hippich 13y ago

use torchat. i was surprised how easy it is to use. and actually it have best IM user interface I've seen so far - contacts list, chat window on double click and send/receive file. That's it - nothing else. on cons side - it take a while to connect to tor network, but once started it is quite fast. i am not saying government should be allowed violate our rights, but it is much easier to assume that anything gtalk/facebook/gmail/etc is with in reach of government and do yourself a favor - use p2p encryption

markbao 13y ago

I'm confused as to why the DOJ is arguing over whether it needs a warrant or not for emails and Facebook chats and that sort of thing. This is the DOJ that we're talking about, and surely, even if a warrant is required for email, they would be able to get that warrant regardless. A warrant is simply a permission by a judge to obtain or enter certain private property, right? Wouldn't the DOJ be able to find a judge that will grant a warrant? I don't know anything about judicial law, so I'm interested in learning about how this all works.

DannyBee 13y ago
It's about bureaucracy in a lot of cases. It may require senior agent signoff for the warrant, etc.

ComputerGuru 13y ago

Guys, when will it sink through? The technology to protect yourself from wiretapping is in your hands. End-to-end asymmetric encryption has never been more accessible. Explain to your friends and family what PGP is and start using it. Maybe the NSA has it cracked, maybe not. But the IRS sure doesn't, nor do the FDA, DEA, FCC, FBI, Google, Apple, Facebook, Microsoft for that matter. EDIT: Here's how it works: I run PGP/GPG (GPG is the open source/free version of PGP, they're the same protocol) locally and the first time I use it, it creates two files, a "public key" and a "private key". I post/share my "public key" online (and you assume it's really me sharing it with you - this is important). gnupg --gen-key gpg --armor --output Desktop/mqudsi.asc --export "Mahmoud Al-Qudsi" For example, here is my public key: http://neosmart.net/downloads/miscellania/mqudsi.asc http://neosmart.net/downloads/miscellania/mqudsi.asc Anyone can now use this key to send me a text message encrypted only for me. They just need this file and their own pgp/gpg private key; they tell it to encrypt message X for user with public key Y. The result of that command (gpg --encrypt --recipient 'Mahmoud Al-Qudsi <mqudsi@neosmart.net>' toencrypt.txt) will be encrypted text that no one but the holder of the private key (me) (which should never be shared) will be able to decode. The result is plaintext. You can send it via email, text message, snail mail, whatever. There are apps that automate the encryption procedure as part of the sending process.

rthomas6 13y ago
This is slightly off topic, but I googled "PGP" as I do when I want to understand something specific better, and found that PGP stands for "Pretty Good Privacy." Ha.
sev 13y ago
"Maybe the NSA has it cracked?" I'm actually curious, why do you think they may have?
- deleted 13y ago
  [deleted]
- homosaur 13y ago
  They almost certainly don't, I'm sure he was just saying that since that's always the accusation amongst the paranoid with consumer encryption.

codex 13y ago

The DoJ doesn't need warrants to produce email and chat evidence in a lawsuit just like they don't need a warrant to produce other kinds of physical evidence from third parties. A subpoena will suffice and always has. People seem to be unaware of how critical subpoenas are to due process, and how long they've been used. See: http://en.wikipedia.org/wiki/Stored_Communications_Act http://en.wikipedia.org/wiki/Stored_Communications_Act

g8oz 13y ago

Reduce your attack surface by not leaving years and years of emails on your IMAP server. I know its convenient, but there is a privacy tradeoff.

edoceo 13y ago

Sites like http://flammo.com/ http://flammo.com/ can send private messages which the DOJ cannot see uses end-to-end asymmetric encryption

alan_cx 13y ago

Fair enough. We cant stop it. Its done. It always was. Might as well stop the "chock and horror" thing, and just accept it. In the US, both political parties love being able to spy on us, and in the UK we see the exact same thing. No main stream politicians or law enforcement will ever, ever give it up. So, have to ask, again, why the hell is any one wanting privacy from the authorities, who we know don't have our best interests at heart, still using electronic communications? It never was, isn't and never will be secure from them. If nothing else, almost every "terrorist" trial features some electronic communications evidence. Doesn't that tell us enough? Look, just ask your self why organisations like MI6 still use old skool drop boxes in Moscow. Tor? Its got government finger prints all over it. I trust it as far as I can throw it.

CurtMonash 13y ago

If you encrypt your email, you'll just raise "bad guy" flags at the traffic analysis level, even before content itself is checked. Of the top of my head, I can't think of a lever to get enough people encrypting at once so as to overcome that disadvantage.

Qantourisc 13y ago

This is one of the reason I don't have Facebook. Weird how foreign rules can affect your privacy outside Europe.