5 ms·

One big question I have for the legal beagles: It's understood (if not well-liked) that Fourth Amendment protections don't apply to data given to a third-party.

by mpyne 13y ago

One big question I have for the legal beagles: It's understood (if not well-liked) that Fourth Amendment protections don't apply to data given to a third-party... What if, instead, you host server space within the U.S. and run your own software (email, listserv, whatever) and data on the leased hardware? I would think there's a good argument that Fourth Amendment protections then resume, and the domestic-ness of the server would also mean the NSA is not legally allowed to look at it, at least without a real Article III warrant. Do similar rights apply IRL, e.g. if you rent a storage closet, can law enforcement just open the door when they wish or do they need to get a warrant?

tootie 13y ago
You need a warrant, but honestly we don't know if that isn't the case here. It's come up before that the NSA, FBI et al, serve warrants for encrypted data and can demand it be decrypted. Otherwise, services like lavabit are equivalent to Swiss bank accounts that are unreachable by any means, legitimate or otherwise. Realistically, this service was almost certainly hosting a ton a illegal activities.
- mpyne 13y ago
  Well there we go then, Constitutional Fourth Amendment protections restored. But why do I get the impression that's not actually what we all were really asking for here?
  - Dylan16807 13y ago
    There are multiple overreaches. In this case the government is probably trying to pull a hushmail: getting the service provider to install spying equipment targeted at their users, and then sharing the spy data with the government. 1. The government should not be able to force this kind of spy equipment to be installed. 2. If we had good privacy laws it would be illegal for the company to even willingly share this data without a warrant.
    - tootie 13y ago
      I think the trick here is that lavabit can't share data even with a warrant. Their inability to do so is pretty much their entire business model. That protects people from unwarranted intrusions, but it also insulates people from legitimate investigation. If they build a backdoor for only duly authorized warrants, they are no more or less obligated to comply with an NSL.
      - mpyne 13y ago
        I would hope that if they've received an NSL ordering them to wiretap their own email, that the NSL is at least limited to specific targets of an investigation. But some people do strongly believe in throwing out the whole bathtub if that's what it takes to keep the data safe, and to those people I will certainly tip my hat, even if I disagree myself.
        Dylan16807 13y ago
        I can accept a company complying with a warrant and divulging data for some customers. I will not accept a company that promises complete security and then sends a trojan to customer computers. Anyone that betrays the security promises made to the entire user base (eg. hushmail) should be ostracized.
        mpyne 13y ago
        Agreed.
        tootie 13y ago
        I'm thinking now that if he had just been ordered to turn over some data, shutting down his service wouldn't let him off the hook. They must have asked for a back door or some other ongoing intrusion.
    - mpyne 13y ago
      Here, yes I agree that's what it sounds like (and that it's an overreach in general, unless there's something I don't know). I wonder though, whether this presumed requirement to install spying software is being done by only an executive-level NSL or by a court order/warrant.
  - tootie 13y ago
    Google, Yahoo, MS, etc don't encrypt their data and they had the same choice to make when served with a NSL or whatever. They fought through legal channels to some degree before caving. Shutting down operations was technically possible, though infeasible. They could have spoken out publicly and accepted the consequences. I doubt they think twice about handing over data requested in a warrant nor should they.
    - mpyne 13y ago
      I personally wouldn't have expected Google/Yahoo/MS/etc. to cave, but that's because I would have naturally assumed that as U.S.-based providers that they may eventually be served with a U.S. subpoena and simply wrote it off as a valid possibility. I think most people expect that the Fourth Amendment would have applied to email hosted at these places, but that's because they don't understand how the case law has been applied to things like this. If people really just want cloud-based email they can check from multiple devices, that does have "normal court protections", and without having to host on their own PC this kind of thing is a possible solution. There are existing turnkey software frameworks to make it work too (e.g., Kolab, which is developed by some of my fellow devs in Europe).
darkarmani 13y ago
I was thinking the same thing. Micro-virtualization for everything, to make it clear that the end-user owns their data.
sneak 13y ago
You put your data into a server owned by someone else. Game over. The real solution, I think, eventually incorporates HSMs. There have been reports of EU authorities seizing racks if servers while keeping them powered up for forensic analysis (presumably key recovery out of running RAM).
- mpyne 13y ago
  > You put your data into a server owned by someone else. Game over. That's admittedly a good point, and is the same reason I don't personally use SaaS (even in the user-brings-the-software mode) where I don't encrypt the data for myself. But most people don't seem to care about that and are perfectly willing to use SaaS, as long as they can be assured government isn't able to indiscriminately peek at all their data (just the hardware host). If you're that kind of person, this might be the thing. I am looking forward to a real solution to that problem though, as it would be useful in situations where you simply can't rely on trusting the hardware host (e.g. handling sensitive PII).

by mpyne 13y ago

tootie 13y ago

You need a warrant, but honestly we don't know if that isn't the case here. It's come up before that the NSA, FBI et al, serve warrants for encrypted data and can demand it be decrypted. Otherwise, services like lavabit are equivalent to Swiss bank accounts that are unreachable by any means, legitimate or otherwise. Realistically, this service was almost certainly hosting a ton a illegal activities.

mpyne 13y ago
Well there we go then, Constitutional Fourth Amendment protections restored. But why do I get the impression that's not actually what we all were really asking for here?
- Dylan16807 13y ago
  There are multiple overreaches. In this case the government is probably trying to pull a hushmail: getting the service provider to install spying equipment targeted at their users, and then sharing the spy data with the government. 1. The government should not be able to force this kind of spy equipment to be installed. 2. If we had good privacy laws it would be illegal for the company to even willingly share this data without a warrant.
  - tootie 13y ago
    I think the trick here is that lavabit can't share data even with a warrant. Their inability to do so is pretty much their entire business model. That protects people from unwarranted intrusions, but it also insulates people from legitimate investigation. If they build a backdoor for only duly authorized warrants, they are no more or less obligated to comply with an NSL.
    - mpyne 13y ago
      I would hope that if they've received an NSL ordering them to wiretap their own email, that the NSL is at least limited to specific targets of an investigation. But some people do strongly believe in throwing out the whole bathtub if that's what it takes to keep the data safe, and to those people I will certainly tip my hat, even if I disagree myself.
      - Dylan16807 13y ago
        I can accept a company complying with a warrant and divulging data for some customers. I will not accept a company that promises complete security and then sends a trojan to customer computers. Anyone that betrays the security promises made to the entire user base (eg. hushmail) should be ostracized.
        mpyne 13y ago
        Agreed.
      - tootie 13y ago
        I'm thinking now that if he had just been ordered to turn over some data, shutting down his service wouldn't let him off the hook. They must have asked for a back door or some other ongoing intrusion.
  - mpyne 13y ago
    Here, yes I agree that's what it sounds like (and that it's an overreach in general, unless there's something I don't know). I wonder though, whether this presumed requirement to install spying software is being done by only an executive-level NSL or by a court order/warrant.
- tootie 13y ago
  Google, Yahoo, MS, etc don't encrypt their data and they had the same choice to make when served with a NSL or whatever. They fought through legal channels to some degree before caving. Shutting down operations was technically possible, though infeasible. They could have spoken out publicly and accepted the consequences. I doubt they think twice about handing over data requested in a warrant nor should they.
  - mpyne 13y ago
    I personally wouldn't have expected Google/Yahoo/MS/etc. to cave, but that's because I would have naturally assumed that as U.S.-based providers that they may eventually be served with a U.S. subpoena and simply wrote it off as a valid possibility. I think most people expect that the Fourth Amendment would have applied to email hosted at these places, but that's because they don't understand how the case law has been applied to things like this. If people really just want cloud-based email they can check from multiple devices, that does have "normal court protections", and without having to host on their own PC this kind of thing is a possible solution. There are existing turnkey software frameworks to make it work too (e.g., Kolab, which is developed by some of my fellow devs in Europe).

darkarmani 13y ago

I was thinking the same thing. Micro-virtualization for everything, to make it clear that the end-user owns their data.

sneak 13y ago

You put your data into a server owned by someone else. Game over. The real solution, I think, eventually incorporates HSMs. There have been reports of EU authorities seizing racks if servers while keeping them powered up for forensic analysis (presumably key recovery out of running RAM).

mpyne 13y ago
> You put your data into a server owned by someone else. Game over. That's admittedly a good point, and is the same reason I don't personally use SaaS (even in the user-brings-the-software mode) where I don't encrypt the data for myself. But most people don't seem to care about that and are perfectly willing to use SaaS, as long as they can be assured government isn't able to indiscriminately peek at all their data (just the hardware host). If you're that kind of person, this might be the thing. I am looking forward to a real solution to that problem though, as it would be useful in situations where you simply can't rely on trusting the hardware host (e.g. handling sensitive PII).