8 ms·

Troubling Arguments from the Government in Smith v. Obama

215 points by sinak 12y ago

EGreg 12y ago
http://magarshak.com/blog/?p=169 http://magarshak.com/blog/?p=169
rayiner 12y ago
> The district court said it felt bound to dismiss her claims because of a 1979 Supreme Court case, Smith v. Maryland. That case involved the collection of the phone numbers dialed by a criminal suspect over the course of three days. It’s one of the cornerstones of the so-called “third party doctrine,” the idea that people have no expectation of privacy in information they entrust to others—and it’s outdated to say the least. Post "the Fappening" and the realization that there are essentially no enforceable protections for information you store in the cloud, I'd say Smith v. Maryland makes as much sense as it ever did. After all, back in 1979, call records were stored in a dusty database somewhere, used only for billing purposes. Today, the corresponding data stored by Facebook, Google, etc, are mined, processed, and correlated across time and space for advertising and marketing purposes. If Smith stands for the proposition that the government has at least as much right to access your data for law enforcement purposes as AT&T does for billing purposes, then replacing "AT&T" with "Google" and "Facebook" and "billing" with "advertising" doesn't undermine the rationale of the case one bit. Obviously you can argue that it was wrongly decided in the first instance, but that's a different argument.
- sinak 12y ago
  For those interested, a more detailed analysis on the history of Smith can be found in this EFF blog post: https://www.eff.org/deeplinks/2014/06/smith-v-maryland-turns-35-its-healths-declining https://www.eff.org/deeplinks/2014/06/smith-v-maryland-turns... I'm by no means a lawyer, but I'd respond by saying that the judges responsible for the original decision likely didn't realize the consequences the Smith decision would have in the Internet age. So much of the digital content we produce ends up in the cloud, whether in an online backup service, SaaS, email, or otherwise. To say that sharing information with a cloud provider eliminates your expectation of privacy is almost the same as saying that it's not really possible to have any sort of private digital records whatsoever. The exception to that would be in cases where end to end encryption is implemented, and only the user holds the key. That seems to be where we're increasingly moving in a world where Smith stands, and it's certainly not optimal for law enforcement, who won't be able to access that information even with a warrant.
  - themartorana 12y ago
    Not that I agree or disagree, but the argument is similar to the Second Amendment argument that the framers of the Constitution couldn't imagine M-16s, let alone nuclear weapons. I understand precedence, but I don't get blind adherence to it. It's a dangerous and - dare I say, lazy - to not revisit old laws and court decisions that could not imagine the present. It's odd to me for a judge not to assume (s)he has leverage to challenge old decisions - and when one does (like challenging government assertions of state secrets) they're derided as "activist." If we find an old ruling or law still valid, then so be it. But bad (and good) precedents needs constant revisiting, or we'd still have prohibition, slavery, and so on.
    - couchand 12y ago
      I believe the term you're looking for is 'precedent'.
      - themartorana 12y ago
        Indeed. I can't edit, but good catch. I got it right in the third paragraph ;)
    - daxelrod 12y ago
      This certainly does happen for court decisions [1], but part of the legitimacy of the court comes from the idea that it is consistently (and therefore fairly) interpereting law. It's also important to make a distinction between "the implications of the court's interpretation of the law are different in this new world" and "the implications of this law are different in this new world. For the latter, the legislature, not the court, should fix the law. For the former, it is still within the legeslature's power to fix the law in such a way that the previous court decision is invalidated. [1] http://www.gpo.gov/fdsys/pkg/GPO-CONAN-1992/html/GPO-CONAN-1992-13.htm http://www.gpo.gov/fdsys/pkg/GPO-CONAN-1992/html/GPO-CONAN-1...
      - john_b 12y ago
        It's a nitpick, but consistency and fairness are independent qualities in legal interpretations. As the simplest example, consistently applying an unfair ruling or precedent does not result in fairness. Only by presuming that all previous court rulings (at least those that can be used as precedents) were fair, does consistency result in fairness.
- nickff 12y ago
  The simplest argument against your position is that users did not password protect access to information, as well as require their data to be transmitted via 'https' in 1979. These measures provide at least some evidence of the private nature of the information, which is as well secured as that which the citizen 'saves' on their home computer.
- opendais 12y ago
  > Post "the Fappening" and the realization that there are essentially no enforceable protections for information you store in the cloud I don't think that is a fair statement. I've got financial/billing information for many people that moves across the internet. We haven't had any serious breaches that compromise that information. A fair statement would be "Apple et al. do not find it cost effective to secure such data while simultaneously pleasing shareholders and law enforcement." The moment Apple, etc. wants to try to secure it more, the Government complains about it publicly and trots out bullshit about catching pedophiles. The Government's methods are actually more dangerous to children since making that data insecurable guarantees people who are willing to break the law can get to it. The Government doesn't want the data secured because it would complicate things for them yet the Government simultaneously says they have the right to all such data. It is really evidence of a systemic bias in how the system works. Sure, the Judge can't really do anything [without being accused of activism and likely overturned by appeal] but that doesn't make this 'less bad'. If it wasn't a general Government position that this was true, they should have muzzled their people and/or issued statements stating it was the position of those people and not the Government as a whole.
- fiatmoney 12y ago
  There's also a delightful two-step whereby the government can 1) require the disclosure or retention of data for some regulatory purpose (taxing, telecom regs, "just because", etc.), and then 2) require warrantless access to the data, since after all it was turned over to a third party.
  - opendais 12y ago
    There is that too. But I'd say their public complaints about securing the data better is pretty clear evidence they want to bias the system outside of legislative channels as well.
  - nickff 12y ago
    >"require the disclosure or retention of data for some regulatory purpose (taxing, telecom regs, "just because", etc.)" Even better, they may require retention and/or disclosure for "consumer protection".
  - rayiner 12y ago
    Point well taken, but it's a bit of a red herring, isn't it? The government isn't forcing Google to sift through your email, or forcing Facebook to figure out who your friends are, or forcing Apple to track your movements via GPS. I think there is a lot of room in Smith to treat that data differently than data the government requires you to disclose.
  - anigbrowl 12y ago
    Some kinds of data have to be recorded, eg for certain sorts of financial transactions in excess of a certain amount. But you could operate an anonymous email service or some other sort of service where you don't retain any records. Government entities have been aware of/monitored 4chan for years, for example, but I've never heard of any attempt to compel Moot to engage in harvesting or storage of data (by compel I mean via litigation or legislation, not some politician saying 'there oughta be a law' on the nightly news). By all means correct me if I'm wrong.
    - musername 12y ago
- AnthonyMouse 12y ago
  > Obviously you can argue that it was wrongly decided in the first instance, but that's a different argument. Isn't it the same argument? The thing that has changed over time is the nature, quantity and implications of the data held by third parties. Target now knows a daughter is pregnant before her father does, etc. Against this level of knowledge stored by third parties, the third party doctrine eats the fourth amendment. Which means that "the proposition that the government has at least as much right to access your data for law enforcement purposes as AT&T does for billing purposes" has to be wrong. The principle is defective. Who you call is the business of the phone company because they have to route your calls; how does that make it the business of the government?
  - sanderjd 12y ago
    I agree with you, but this also doesn't seem (in my totally amateur reading) to actually be covered by the 4th amendment. If we really want this sort of privacy enshrined, we could really use a new amendment. It should be unsurprising that huge changes in society, like those of the internet age, would require fundamental changes to the Constitution - this is what amendments are for. This idea is laughably impractical though, which either suggests that amendments were made too difficult to achieve, or that the system is working well by making us wait for overwhelming consensus on the question.
    - AnthonyMouse 12y ago
      > I agree with you, but this also doesn't seem (in my totally amateur reading) to actually be covered by the 4th amendment. If we really want this sort of privacy enshrined, we could really use a new amendment. The First Amendment read literally would disallow laws against libel or copyright infringement or even fraud. On the other hand, read literally it would only protect "freedom of speech, or of the press" and provide no protection for electronic communications because they aren't spoken or printed. Literal readings are not useful. There is very little a pro-privacy amendment would accomplish that couldn't reasonably be read into the first, fourth and fifth amendments already. The problem is not the constitutional language, the problem is what the courts are letting the government get away with.
- revelation 12y ago
  If Smith stands for straw man, then it's even stronger today. From the horses mouth: First, we doubt that people in general entertain any actual expectation of privacy in the numbers they dial. All telephone users realize that they must "convey" phone numbers to the telephone company, since it is through telephone company switching equipment that their calls are completed. People dial phone numbers, they don't dial cell towers or GPS location data, and there are of course infinitely many other examples. Second, even if petitioner did harbor some subjective expectation that the phone numbers he dialed would remain private, this expectation is not "one that society is prepared to recognize as 'reasonable.' I guess the times they are a changin'.
  - rayiner 12y ago
    Users surely realize that every gmail they send and every Facebook message is both mined for information and also accessible to hundreds of people at these companies. At least, they realize that as much as they ever realized that the phone numbers you dial don't just sit in your phone but have to go out through the wires to the phone company. As for the second part--the test is whether a subjective expectation of privacy is objectively reasonable. That is to say--it's what a reasonable person would expect knowing the facts, not what the average person subjectively believes. It's possible for your average person to have a subjective expectation of privacy that is not objectively reasonable if your average person is confused about the objective facts. Looking at the objective facts: cloud data is mined and processed and accessible to many people at cloud companies, it's hard to say that any subjective belief that cloud data is private is objectively supportable. It might be widely held, though I think that's changing with every news story of iCloud leaks, but that doesn't make it objectively reasonable.
    - DanBC 12y ago
      I give my data to Facebook. Facebook tells me what they're going to do with it, and provide me with service in return. This doesn't mean I've given Facebook permission to sell my data to anyone. While Facebook makes extensive use of my data -more than is needed to present a wall to me- that doesn't mean I lose expectations of privacy. I'd want Facebook to fire people who were looking through my photos without operational reason, as one example. Perhaps it's a European thing: Companies should only ask for the data they need; they should only keep it for as long as they need it; they need to protect it against loss. I strongly believe that law enforcement and intelligence agencies should be using validly formed legal documents to get access to cloud (and other) data.
- pessimizer 12y ago
  >I'd say Smith v. Maryland makes as much sense as it ever did. I'd agree, but I don't think it was a good decision then, either.
- anigbrowl 12y ago
  Agreed, as usual. ISTM the EFF is begging the question (in the legal sense of assuming one's preferred conclusion as a premise) here by breezily asserting that Smith v. Maryland is outdated, without making any clear showing of why. Yes, you could look at the history of someone's telephone calls and infer that they planned to get an abortion, or had cancer, or had particular preferences in takeout food...but that was equally possible in 1979. Indeed, the EFF mentions government access to 'telephone books' - and while nowadays any telephone books I receive go straight into the recycling bin, back in 1979 they were the normal way of storing information, and my understanding is that telephone companies maintained reverse directories ordered by number. This matters because while the government can obviously process data in a mere millisecond these days (like the private sector does), efficiency of execution has no bearing whatsoever on the question of whether people have an expectation of privacy in their phone records; the holding of Smith v. Maryland is that they do not, because by choosing to place a telephone call they have opted to share that information with the phone company, and the fact of the call becomes a mere business record. The Supreme Court's position was that there's a trade-off between anonymity and convenience, and where one opts for the convenience of a telephone call (facilitated by the telephone company) then one sacrifices any expectation of privacy. This matters since if phone calls are still considered business records 35 years on, then warrants are no more necessary now than they were in 1979. There's a much stronger argument for the privacy of things like email, since one can send encrypted messages on a peer-to-peer basis by the simple expedient of running one's on mail server, even though most people choose to outsource that job to a commercial provider. But phone calls only go through exchanges, and there's no way to bootstrap your way into the phone network that's equivalent to firing up your own SMTP server - if you make a call through Verizon from your cell, how is that fundamentally different from making a call through AT&T from your landline?
  - couchand 12y ago
    one can send encrypted messages on a peer-to-peer basis by the simple expedient of running one's on mail server ...except that you rely on the rest of the internet to actually deliver the message. So in a sense, the argument is the same: you have a reasonable expectation of privacy on the contents but not the addressing information. But I think this argument misses a big part of the EFF's point. The reason that Smith v Maryland is outdated is that the nature of surveillance analysis has changed. The legal standard should not be based on some technicalities of implementation, but rather on the actual real effects in terms of policy and expectations. Yes, technically, the difference between looking at a handful of records manually pulled by a technician in response to a court order and examining the metadata of literally every phone call made using sophisticated machine learning algorithms is one of degree, not kind. However, the difference in result is one of kind, not degree, and it's facetious to argue otherwise. Basing our legal standard on such a technicality simply encourages the government to find loopholes. Basing it on the effective results makes the standard relevant, meaningful and future-proof.
- ggchappell 12y ago
  > ... the realization that there are essentially no enforceable protections for information you store in the cloud, .... How is the question of enforceability relevant to your argument?
- higherpurpose 12y ago
  Then what's the point of privacy policies if they are rendered useless by Smith vs Maryland? Then the privacy policies should only have two sentences: "We can do whatever we want with your data once you give it to us. Problem?" The truth is the government is just using the Constitution/rulings as it suits them. They've changed the meaning of the word "relevant" to mean millions of people for 3-hops from the target. They are doing the same with Smith vs Maryland. They're just pushing it to its very limit, or even far beyond the limit. But I doubt that if the Supreme Court from back then were to rule in a contemporary case like that, it would rule the same way.
- hammock 12y ago
  What good is a "privacy policy" if it doesn't create an expectation of privacy?
_nullandnull_ 12y ago
> Call Detail Records Don’t Actually Identify People This is one of the best videos I have ever seen countering this argument. https://www.youtube.com/watch?v=bM0PmwOlifE https://www.youtube.com/watch?v=bM0PmwOlifE
a3n 12y ago
We have an expectation of privacy from the government if we the people say that the government is simply not allowed to look for or look at something, regardless of who else may or may not have access to the something. "We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness.--That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed, ... http://www.archives.gov/exhibits/charters/declaration_transcript.html http://www.archives.gov/exhibits/charters/declaration_transc... Our government was created to serve us, as we see fit, not the other way around.
stretchwithme 12y ago
With neither party giving a damn, I shudder to think where we are heading.
junto 12y ago
Whilst the direction of the USG and its Big Brother attitude makes me fear for our collective future, it is worth pointing out that it is warming to see that there is a legal framework to challenge these actions. In the UK... there is no hope. We have no constitution. EU laws that would prevent such actions are overridden with emergency security laws that almost nobody challenges, whilst the 'Liberal Party' don't just stand by, they partake. Your constitution is unbelievably valuable. I hope you can hang on to it.

215 points by sinak 12y ago

EGreg 12y ago

http://magarshak.com/blog/?p=169 http://magarshak.com/blog/?p=169

> The district court said it felt bound to dismiss her claims because of a 1979 Supreme Court case, Smith v. Maryland. That case involved the collection of the phone numbers dialed by a criminal suspect over the course of three days. It’s one of the cornerstones of the so-called “third party doctrine,” the idea that people have no expectation of privacy in information they entrust to others—and it’s outdated to say the least. Post "the Fappening" and the realization that there are essentially no enforceable protections for information you store in the cloud, I'd say Smith v. Maryland makes as much sense as it ever did. After all, back in 1979, call records were stored in a dusty database somewhere, used only for billing purposes. Today, the corresponding data stored by Facebook, Google, etc, are mined, processed, and correlated across time and space for advertising and marketing purposes. If Smith stands for the proposition that the government has at least as much right to access your data for law enforcement purposes as AT&T does for billing purposes, then replacing "AT&T" with "Google" and "Facebook" and "billing" with "advertising" doesn't undermine the rationale of the case one bit. Obviously you can argue that it was wrongly decided in the first instance, but that's a different argument.

sinak 12y ago
For those interested, a more detailed analysis on the history of Smith can be found in this EFF blog post: https://www.eff.org/deeplinks/2014/06/smith-v-maryland-turns-35-its-healths-declining https://www.eff.org/deeplinks/2014/06/smith-v-maryland-turns... I'm by no means a lawyer, but I'd respond by saying that the judges responsible for the original decision likely didn't realize the consequences the Smith decision would have in the Internet age. So much of the digital content we produce ends up in the cloud, whether in an online backup service, SaaS, email, or otherwise. To say that sharing information with a cloud provider eliminates your expectation of privacy is almost the same as saying that it's not really possible to have any sort of private digital records whatsoever. The exception to that would be in cases where end to end encryption is implemented, and only the user holds the key. That seems to be where we're increasingly moving in a world where Smith stands, and it's certainly not optimal for law enforcement, who won't be able to access that information even with a warrant.
- themartorana 12y ago
  Not that I agree or disagree, but the argument is similar to the Second Amendment argument that the framers of the Constitution couldn't imagine M-16s, let alone nuclear weapons. I understand precedence, but I don't get blind adherence to it. It's a dangerous and - dare I say, lazy - to not revisit old laws and court decisions that could not imagine the present. It's odd to me for a judge not to assume (s)he has leverage to challenge old decisions - and when one does (like challenging government assertions of state secrets) they're derided as "activist." If we find an old ruling or law still valid, then so be it. But bad (and good) precedents needs constant revisiting, or we'd still have prohibition, slavery, and so on.
  - couchand 12y ago
    I believe the term you're looking for is 'precedent'.
    - themartorana 12y ago
      Indeed. I can't edit, but good catch. I got it right in the third paragraph ;)
  - daxelrod 12y ago
    This certainly does happen for court decisions [1], but part of the legitimacy of the court comes from the idea that it is consistently (and therefore fairly) interpereting law. It's also important to make a distinction between "the implications of the court's interpretation of the law are different in this new world" and "the implications of this law are different in this new world. For the latter, the legislature, not the court, should fix the law. For the former, it is still within the legeslature's power to fix the law in such a way that the previous court decision is invalidated. [1] http://www.gpo.gov/fdsys/pkg/GPO-CONAN-1992/html/GPO-CONAN-1992-13.htm http://www.gpo.gov/fdsys/pkg/GPO-CONAN-1992/html/GPO-CONAN-1...
    - john_b 12y ago
      It's a nitpick, but consistency and fairness are independent qualities in legal interpretations. As the simplest example, consistently applying an unfair ruling or precedent does not result in fairness. Only by presuming that all previous court rulings (at least those that can be used as precedents) were fair, does consistency result in fairness.
nickff 12y ago
The simplest argument against your position is that users did not password protect access to information, as well as require their data to be transmitted via 'https' in 1979. These measures provide at least some evidence of the private nature of the information, which is as well secured as that which the citizen 'saves' on their home computer.
opendais 12y ago
> Post "the Fappening" and the realization that there are essentially no enforceable protections for information you store in the cloud I don't think that is a fair statement. I've got financial/billing information for many people that moves across the internet. We haven't had any serious breaches that compromise that information. A fair statement would be "Apple et al. do not find it cost effective to secure such data while simultaneously pleasing shareholders and law enforcement." The moment Apple, etc. wants to try to secure it more, the Government complains about it publicly and trots out bullshit about catching pedophiles. The Government's methods are actually more dangerous to children since making that data insecurable guarantees people who are willing to break the law can get to it. The Government doesn't want the data secured because it would complicate things for them yet the Government simultaneously says they have the right to all such data. It is really evidence of a systemic bias in how the system works. Sure, the Judge can't really do anything [without being accused of activism and likely overturned by appeal] but that doesn't make this 'less bad'. If it wasn't a general Government position that this was true, they should have muzzled their people and/or issued statements stating it was the position of those people and not the Government as a whole.
fiatmoney 12y ago
There's also a delightful two-step whereby the government can 1) require the disclosure or retention of data for some regulatory purpose (taxing, telecom regs, "just because", etc.), and then 2) require warrantless access to the data, since after all it was turned over to a third party.
- opendais 12y ago
  There is that too. But I'd say their public complaints about securing the data better is pretty clear evidence they want to bias the system outside of legislative channels as well.
- nickff 12y ago
  >"require the disclosure or retention of data for some regulatory purpose (taxing, telecom regs, "just because", etc.)" Even better, they may require retention and/or disclosure for "consumer protection".
- rayiner 12y ago
  Point well taken, but it's a bit of a red herring, isn't it? The government isn't forcing Google to sift through your email, or forcing Facebook to figure out who your friends are, or forcing Apple to track your movements via GPS. I think there is a lot of room in Smith to treat that data differently than data the government requires you to disclose.
- anigbrowl 12y ago
  Some kinds of data have to be recorded, eg for certain sorts of financial transactions in excess of a certain amount. But you could operate an anonymous email service or some other sort of service where you don't retain any records. Government entities have been aware of/monitored 4chan for years, for example, but I've never heard of any attempt to compel Moot to engage in harvesting or storage of data (by compel I mean via litigation or legislation, not some politician saying 'there oughta be a law' on the nightly news). By all means correct me if I'm wrong.
  - musername 12y ago
AnthonyMouse 12y ago
> Obviously you can argue that it was wrongly decided in the first instance, but that's a different argument. Isn't it the same argument? The thing that has changed over time is the nature, quantity and implications of the data held by third parties. Target now knows a daughter is pregnant before her father does, etc. Against this level of knowledge stored by third parties, the third party doctrine eats the fourth amendment. Which means that "the proposition that the government has at least as much right to access your data for law enforcement purposes as AT&T does for billing purposes" has to be wrong. The principle is defective. Who you call is the business of the phone company because they have to route your calls; how does that make it the business of the government?
- sanderjd 12y ago
  I agree with you, but this also doesn't seem (in my totally amateur reading) to actually be covered by the 4th amendment. If we really want this sort of privacy enshrined, we could really use a new amendment. It should be unsurprising that huge changes in society, like those of the internet age, would require fundamental changes to the Constitution - this is what amendments are for. This idea is laughably impractical though, which either suggests that amendments were made too difficult to achieve, or that the system is working well by making us wait for overwhelming consensus on the question.
  - AnthonyMouse 12y ago
    > I agree with you, but this also doesn't seem (in my totally amateur reading) to actually be covered by the 4th amendment. If we really want this sort of privacy enshrined, we could really use a new amendment. The First Amendment read literally would disallow laws against libel or copyright infringement or even fraud. On the other hand, read literally it would only protect "freedom of speech, or of the press" and provide no protection for electronic communications because they aren't spoken or printed. Literal readings are not useful. There is very little a pro-privacy amendment would accomplish that couldn't reasonably be read into the first, fourth and fifth amendments already. The problem is not the constitutional language, the problem is what the courts are letting the government get away with.
revelation 12y ago
If Smith stands for straw man, then it's even stronger today. From the horses mouth: First, we doubt that people in general entertain any actual expectation of privacy in the numbers they dial. All telephone users realize that they must "convey" phone numbers to the telephone company, since it is through telephone company switching equipment that their calls are completed. People dial phone numbers, they don't dial cell towers or GPS location data, and there are of course infinitely many other examples. Second, even if petitioner did harbor some subjective expectation that the phone numbers he dialed would remain private, this expectation is not "one that society is prepared to recognize as 'reasonable.' I guess the times they are a changin'.
- rayiner 12y ago
  Users surely realize that every gmail they send and every Facebook message is both mined for information and also accessible to hundreds of people at these companies. At least, they realize that as much as they ever realized that the phone numbers you dial don't just sit in your phone but have to go out through the wires to the phone company. As for the second part--the test is whether a subjective expectation of privacy is objectively reasonable. That is to say--it's what a reasonable person would expect knowing the facts, not what the average person subjectively believes. It's possible for your average person to have a subjective expectation of privacy that is not objectively reasonable if your average person is confused about the objective facts. Looking at the objective facts: cloud data is mined and processed and accessible to many people at cloud companies, it's hard to say that any subjective belief that cloud data is private is objectively supportable. It might be widely held, though I think that's changing with every news story of iCloud leaks, but that doesn't make it objectively reasonable.
  - DanBC 12y ago
    I give my data to Facebook. Facebook tells me what they're going to do with it, and provide me with service in return. This doesn't mean I've given Facebook permission to sell my data to anyone. While Facebook makes extensive use of my data -more than is needed to present a wall to me- that doesn't mean I lose expectations of privacy. I'd want Facebook to fire people who were looking through my photos without operational reason, as one example. Perhaps it's a European thing: Companies should only ask for the data they need; they should only keep it for as long as they need it; they need to protect it against loss. I strongly believe that law enforcement and intelligence agencies should be using validly formed legal documents to get access to cloud (and other) data.
pessimizer 12y ago
>I'd say Smith v. Maryland makes as much sense as it ever did. I'd agree, but I don't think it was a good decision then, either.
anigbrowl 12y ago
Agreed, as usual. ISTM the EFF is begging the question (in the legal sense of assuming one's preferred conclusion as a premise) here by breezily asserting that Smith v. Maryland is outdated, without making any clear showing of why. Yes, you could look at the history of someone's telephone calls and infer that they planned to get an abortion, or had cancer, or had particular preferences in takeout food...but that was equally possible in 1979. Indeed, the EFF mentions government access to 'telephone books' - and while nowadays any telephone books I receive go straight into the recycling bin, back in 1979 they were the normal way of storing information, and my understanding is that telephone companies maintained reverse directories ordered by number. This matters because while the government can obviously process data in a mere millisecond these days (like the private sector does), efficiency of execution has no bearing whatsoever on the question of whether people have an expectation of privacy in their phone records; the holding of Smith v. Maryland is that they do not, because by choosing to place a telephone call they have opted to share that information with the phone company, and the fact of the call becomes a mere business record. The Supreme Court's position was that there's a trade-off between anonymity and convenience, and where one opts for the convenience of a telephone call (facilitated by the telephone company) then one sacrifices any expectation of privacy. This matters since if phone calls are still considered business records 35 years on, then warrants are no more necessary now than they were in 1979. There's a much stronger argument for the privacy of things like email, since one can send encrypted messages on a peer-to-peer basis by the simple expedient of running one's on mail server, even though most people choose to outsource that job to a commercial provider. But phone calls only go through exchanges, and there's no way to bootstrap your way into the phone network that's equivalent to firing up your own SMTP server - if you make a call through Verizon from your cell, how is that fundamentally different from making a call through AT&T from your landline?
- couchand 12y ago
  one can send encrypted messages on a peer-to-peer basis by the simple expedient of running one's on mail server ...except that you rely on the rest of the internet to actually deliver the message. So in a sense, the argument is the same: you have a reasonable expectation of privacy on the contents but not the addressing information. But I think this argument misses a big part of the EFF's point. The reason that Smith v Maryland is outdated is that the nature of surveillance analysis has changed. The legal standard should not be based on some technicalities of implementation, but rather on the actual real effects in terms of policy and expectations. Yes, technically, the difference between looking at a handful of records manually pulled by a technician in response to a court order and examining the metadata of literally every phone call made using sophisticated machine learning algorithms is one of degree, not kind. However, the difference in result is one of kind, not degree, and it's facetious to argue otherwise. Basing our legal standard on such a technicality simply encourages the government to find loopholes. Basing it on the effective results makes the standard relevant, meaningful and future-proof.
ggchappell 12y ago
> ... the realization that there are essentially no enforceable protections for information you store in the cloud, .... How is the question of enforceability relevant to your argument?
higherpurpose 12y ago
Then what's the point of privacy policies if they are rendered useless by Smith vs Maryland? Then the privacy policies should only have two sentences: "We can do whatever we want with your data once you give it to us. Problem?" The truth is the government is just using the Constitution/rulings as it suits them. They've changed the meaning of the word "relevant" to mean millions of people for 3-hops from the target. They are doing the same with Smith vs Maryland. They're just pushing it to its very limit, or even far beyond the limit. But I doubt that if the Supreme Court from back then were to rule in a contemporary case like that, it would rule the same way.
hammock 12y ago
What good is a "privacy policy" if it doesn't create an expectation of privacy?

_nullandnull_ 12y ago

> Call Detail Records Don’t Actually Identify People This is one of the best videos I have ever seen countering this argument. https://www.youtube.com/watch?v=bM0PmwOlifE https://www.youtube.com/watch?v=bM0PmwOlifE

a3n 12y ago

We have an expectation of privacy from the government if we the people say that the government is simply not allowed to look for or look at something, regardless of who else may or may not have access to the something. "We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness.--That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed, ... http://www.archives.gov/exhibits/charters/declaration_transcript.html http://www.archives.gov/exhibits/charters/declaration_transc... Our government was created to serve us, as we see fit, not the other way around.

stretchwithme 12y ago

With neither party giving a damn, I shudder to think where we are heading.

junto 12y ago

Whilst the direction of the USG and its Big Brother attitude makes me fear for our collective future, it is worth pointing out that it is warming to see that there is a legal framework to challenge these actions. In the UK... there is no hope. We have no constitution. EU laws that would prevent such actions are overridden with emergency security laws that almost nobody challenges, whilst the 'Liberal Party' don't just stand by, they partake. Your constitution is unbelievably valuable. I hope you can hang on to it.