3 ms·

Obviously it doesn't make sense to apply the wording directly to call detail records, it was written before the invention of non-paper telecommunications. Their

by ericd 13y ago

Obviously it doesn't make sense to apply the wording directly to call detail records, it was written before the invention of non-paper telecommunications. Their intent given their context is pretty clear. And people don't generally view their call records as something that's expected to be public. Many people would be rather embarrassed if their call records were made public. Same for their search histories, and they wouldn't feel comfortable with the idea that there's a person on the other side of the screen reading their queries if they didn't think it was all completely anonymous. The government is trying to break that wall of anonymity.

worldimperator 13y ago
When ruling against government 'trojan horses' infecting private computers, the German Constitutional Court used a similar idea, thereby extending the German contitution's equivalent of integrity of the home by introducing a new 'Fundamental right to confidentiality and integrity of information systems'. So this is something that can also be interpreted in a modern way. I realize that the court ruling was about private computers, not data on servers, but as you said, it makes a difference if the informations systems you use can be expected to produce 'public' records.
- rayiner 13y ago
  4th amendment interpretation already encompasses private computers as protected. As for servers, the law talks in terms if "private" not "not public." The examples mentioned in the 4th amendment are things that are deeply private, not just "not public." It warps any sense of "private" to say that something you share with hundreds of strangers at Google, AT&T, etc, is "private" although you ca say its "not public."
  - Dylan16807 13y ago
    Consider a lockbox at a bank. Surely that is private, no matter how many hundreds of strangers work there? Physically it is located on their premises, and they can even move it around between locations, but they have no right to access the contents. What is different when the whole situation is made digital? I'm not saying all digital data held by third party companies is private, of course, but surely some of it should be. And please don't bring up encryption for the moment, that only sidesteps the issue. There is no real-world unbreakable lock. This is a discussion about search and privacy rights.
    - rayiner 13y ago
      A safety deposit box at a bank is a great example. You have 4th amendment protections for your property in one, because you're essentially renting a private space (you also have a 4th amendment interest in a rented apartment). But compare a safety deposit box to the kind of digital communications the NSA is collecting. The bank cannot open your safety deposit box. You have the key. Hundreds of strangers might work at the bank (just as hundreds of strangers might live in your apartment building), but none of them can access the contents of your box (obviously you have no privacy interest in the box itself, e.g. anything on the outside). It would be illegal for anyone at the bank to access that box. Generally the bank doesn't know whats in your box. You put it in there directly, you don't hand it to a bank employee to store. Certainly, they don't rummage through the box as a basic part of the service they provide to you. Compare that to an email in a gmail account or a Facebook profile or even a phone call made over a cell network. Your information is exposed, unprotected, to potentially hundreds of employees at those companies. And they rummage through that data as a matter of course, whether to target advertising or to do traffic shaping, etc. You have no property interest in that data. You can't sue the company for losing it, you can't sue the company for accessing it, etc. I can certainly conceive of a digital equivalent of a safety deposit box. It would involve a provider hosting encrypted data that they themselves cannot decrypt or access in unencrypted form. But the services cooperating with PRISM are nothing like that.
      - Dylan16807 13y ago
        I think if you want to get the analogy right you need to have in-transit encryption, so employees can only see the destination of the data, but once it's stored away it should be decryptable. A key part of using the lockbox analogy to explore your rights is by having it still be physically penetrable, but never expected to be penetrated. Let's look at Dropbox for a moment. If the system is working correctly the employees never have access to the contents of your files. The data flows past the employees in a TLS tunnel that only lets the destination server decrypt it. Employees are kept from accessing the contents via a mechanism similar in effectiveness to locks. Should this data be protected? I think it should. Now let's move on to Email. Most of the time, with modern server configurations, it works in a very similar way. The messages are encrypted in transit, stored in plain text, and employees are kept out. Ignoring that obsolete rule about email 'abandonment' after a certain number of days, I see no reason email shouldn't need a warrant. It comes down in part to how the data is stored in the first place. Why do you say that my email is 'unprotected'? Are there not locks on it, barriers keeping away employees in the typical case? What makes it less secure than a box with a lock that can be broken with a hammer?
rayiner 13y ago
They didn't have phones back then, sure, but the concept of "your" effects transcends time. They had records about people stored by third parties back then, but chose to limit 4th amendment protections to things that belong to you. That distinction between "your" effects and anything referring to you can't be ignored. Also, the 4th amendment does not use the phrase "not public." It gives four examples that are intensely private: your person, your home, your effects, your papers. How private is data that you share with hundreds of people you don't even know? You can't ignore the plain words on the page for your version of what you think the "spirit" of the language is. The framers could have drafted the 4th amendment much more broadly even only accounting for information sources that existed back then. They did not sue that, And you have to give effect to this conscious choice. P

by ericd 13y ago

worldimperator 13y ago

When ruling against government 'trojan horses' infecting private computers, the German Constitutional Court used a similar idea, thereby extending the German contitution's equivalent of integrity of the home by introducing a new 'Fundamental right to confidentiality and integrity of information systems'. So this is something that can also be interpreted in a modern way. I realize that the court ruling was about private computers, not data on servers, but as you said, it makes a difference if the informations systems you use can be expected to produce 'public' records.

rayiner 13y ago
4th amendment interpretation already encompasses private computers as protected. As for servers, the law talks in terms if "private" not "not public." The examples mentioned in the 4th amendment are things that are deeply private, not just "not public." It warps any sense of "private" to say that something you share with hundreds of strangers at Google, AT&T, etc, is "private" although you ca say its "not public."
- Dylan16807 13y ago
  Consider a lockbox at a bank. Surely that is private, no matter how many hundreds of strangers work there? Physically it is located on their premises, and they can even move it around between locations, but they have no right to access the contents. What is different when the whole situation is made digital? I'm not saying all digital data held by third party companies is private, of course, but surely some of it should be. And please don't bring up encryption for the moment, that only sidesteps the issue. There is no real-world unbreakable lock. This is a discussion about search and privacy rights.
  - rayiner 13y ago
    A safety deposit box at a bank is a great example. You have 4th amendment protections for your property in one, because you're essentially renting a private space (you also have a 4th amendment interest in a rented apartment). But compare a safety deposit box to the kind of digital communications the NSA is collecting. The bank cannot open your safety deposit box. You have the key. Hundreds of strangers might work at the bank (just as hundreds of strangers might live in your apartment building), but none of them can access the contents of your box (obviously you have no privacy interest in the box itself, e.g. anything on the outside). It would be illegal for anyone at the bank to access that box. Generally the bank doesn't know whats in your box. You put it in there directly, you don't hand it to a bank employee to store. Certainly, they don't rummage through the box as a basic part of the service they provide to you. Compare that to an email in a gmail account or a Facebook profile or even a phone call made over a cell network. Your information is exposed, unprotected, to potentially hundreds of employees at those companies. And they rummage through that data as a matter of course, whether to target advertising or to do traffic shaping, etc. You have no property interest in that data. You can't sue the company for losing it, you can't sue the company for accessing it, etc. I can certainly conceive of a digital equivalent of a safety deposit box. It would involve a provider hosting encrypted data that they themselves cannot decrypt or access in unencrypted form. But the services cooperating with PRISM are nothing like that.
    - Dylan16807 13y ago
      I think if you want to get the analogy right you need to have in-transit encryption, so employees can only see the destination of the data, but once it's stored away it should be decryptable. A key part of using the lockbox analogy to explore your rights is by having it still be physically penetrable, but never expected to be penetrated. Let's look at Dropbox for a moment. If the system is working correctly the employees never have access to the contents of your files. The data flows past the employees in a TLS tunnel that only lets the destination server decrypt it. Employees are kept from accessing the contents via a mechanism similar in effectiveness to locks. Should this data be protected? I think it should. Now let's move on to Email. Most of the time, with modern server configurations, it works in a very similar way. The messages are encrypted in transit, stored in plain text, and employees are kept out. Ignoring that obsolete rule about email 'abandonment' after a certain number of days, I see no reason email shouldn't need a warrant. It comes down in part to how the data is stored in the first place. Why do you say that my email is 'unprotected'? Are there not locks on it, barriers keeping away employees in the typical case? What makes it less secure than a box with a lock that can be broken with a hammer?

rayiner 13y ago

They didn't have phones back then, sure, but the concept of "your" effects transcends time. They had records about people stored by third parties back then, but chose to limit 4th amendment protections to things that belong to you. That distinction between "your" effects and anything referring to you can't be ignored. Also, the 4th amendment does not use the phrase "not public." It gives four examples that are intensely private: your person, your home, your effects, your papers. How private is data that you share with hundreds of people you don't even know? You can't ignore the plain words on the page for your version of what you think the "spirit" of the language is. The framers could have drafted the 4th amendment much more broadly even only accounting for information sources that existed back then. They did not sue that, And you have to give effect to this conscious choice. P