Hacker News Reader

Comment by ikeboy | Hacker News Reader

They're giving over the information to a third party, which usually destroys any 4th amendment rights.

The fact that the third party was actually three different parties who only got a piece (or six, when using hidden services) doesn't seem like it would change the law.

If I split data into 6 pieces and handed it to 6 different people, the government can take those 6 pieces and put them together without violating my rights. I don't see why Tor would be any different.

In fact, this particular vulnerability IIRC involved the researchers acting as both the exit node and the guard node, and finding a way to pass a message between the two so they'd notice when they're in the same circuit. That seems even better legally than my analogy above. They didn't need to take any data, the victims connected to them and gave them the info.

View on HN

The Constitutional argument is supposed to be based on reasonable EXPECTATIONS of the people involved. So, for example, when most phones were party phones, people didn't have a reasonable expectation of privacy and no warrant was needed to tap phone calls. This was what was decided in Olmstead v. U.S. in 1928.

At a later date, private phones became the norm. And so in Katz v. U.S. decided in 1967, warrants for tapping phones were held to be required. That is because people's expectations of privacy had changed.

In the case of TOR, people were using a service that was advertised as being designed by the NSA to protect your online privacy EVEN IF you were under attack by state actors. In fact it was widely advertised that all anyone could know is that you were using TOR, but nobody would know what you were doing with it, who you contacted, and so on.

What do you think would have been a reasonable expectation in 2014? That using TOR meant your communication was private, or publicly available?

Honestly, someone using Tor should know that your communication details are being held by exit nodes. Isn't it kind of common among the community to not trust your exit nodes?

I would say that the assumption is that your communication is public.

It is reasonable to assume that you are attempting to keep the information private. It is reasonable to assume that the US govt would not hack the information on that basis. If you assume it's public, why the hell are you using TOR at all? Use of TOR shows the assumption pretty clearly.

if you're attempting to keep the information private, you're not doing a good job by handing it to a third party.

Expectation of privacy is kind of based around self-incrimination, and you lose a lot of those when you hand information to a third party.

Even if it's "public" (in the legal sense of 'not protected'), Tor can be useful against non-state actors, or against weaker state actors.

I'm not saying there isn't a colloquial expectation of privacy, but that the jurisprudence on privacy doesn't apply to Tor (or at least, that there is an argument that it doesn't).

You could also say if you don't want people photographing your genitals, don't use a third-party restroom or dressing room or tanning salon. The expectation of privacy really has (or should have) nothing to do with the existence of someone's ability to violate that privacy.

I agree with you emotionally, but question your argument legally. What, 'is,' and what, 'should be', are rarely the same thing.

If government wants something forbidden, it creeps towards it. Expectations are meaningless without threats.

Someone using TOR should know that exit nodes will know that you used TOR, but by design they are not supposed to be able to find out who you were talking to, or what you were talking about.

The general assumption back when Silk Road was created was that TOR itself was safe, and the most likely way to be discovered was for your personal machine to be compromised. This belief was only strengthened by the FBI's repeated failures to take down Silk Road.

Heck, this was still a widespread belief AFTER Silk Road was taken down! For example http://motherboard.vice.com/read/the-fbis-deep-web-raid-seiz... quotes a security researcher who came to the conclusion in late 2014 that the FBI was just scanning TOR, and TOR itself had not been compromised.

For a comparison to phones, the Supreme Court has held that a list of people you called is not protected, but the contents of your phone calls are. Similarly I think they should rule in this case that the fact you're using TOR is not protected, but the details of what you were doing on TOR is covered by the 4th amendment.

By design, if the three or six nodes that you used compare notes, they can tell who you were talking to. That seems roughly the same as breaking a key into 6 parts and giving it to 6 different parties. I think the government would be able to go to each party and ask for their part, then put them together. Therefore, there's no expectation of privacy.

What actually happened is the researchers found a way to bypass the middle guy and reconstruct the info just from the two ends. That's still just comparing notes, but from fewer people.

Yes, I know how it was broken. But the question is what the expectation should have been. And given that expectation, then whether they should have had a warrant.

In our surveillance society, the government's theory is that it should never need a warrant, because terrorism. I strongly oppose that theory. I'm OK with taking down Silk Road, but get the warrant first.

That advertising was false, and Tor project developers have specifically said that it's not intended to defend against global adversaries like the NSA.

I wonder if false advertising can create a legal expection of privacy. What if I sell a red filter for you to hang in your windows, and advertise that it protects against anyone seeing through. But you can just apply an anti red filter to a camera and see perfectly. Is the government allowed to do that? (I don't particularly understand optics, and this likely doesn't actually make sense, but you hopefully get the idea).

An argument can be made that if someone's using something they don't understand, they shouldn't have a reasonable expectation that it's as described, especially if they aren't paying.

Many people have misconceptions about VPNs as well. That doesn't mean the data they willingly hand over is reasonably expected to be private.

(If there's precedent for a false advertising interacting with the third party doctrine, I'd be interested in seeing it.)

> That advertising was false, and Tor project developers have specifically said that it's not intended to defend against global adversaries like the NSA.

That line of reasoning would mean there is no "reasonable expectation of privacy" ever, against global adversaries like the NSA.

They even advertise it themselves "Total Information Awareness", "Nothing is beyond our reach", etc.

And this is why codified law is nice.

>They're giving over the information to a third party, which usually destroys any 4th amendment rights.

Same reason that there is no need for a warrant to collect phone calls since you are handing data over to the phone companies to carry between you and the other party(ies). Also the same reason the government can shift through your mail, since the items are in the possession of a third party (you likely gave the items to the government itself).

To me this makes as much sense as the argument that since a plane carrying people can fly over you, it is perfectly reasonable to put a blimp with an extremely high zoom camera on that spies on your home constantly, detecting not just visible light, but also infrared. Also, since when you talk things vibrate, and since it is possible to view those vibrations though a window, I'm actually broadcasting my speech to the public and thus don't have any expectation of privacy.

Note that this is only talking constitutionally. The government is free to pass laws that disallow such gathering, or simply not pass laws that allow it.

IIRC collecting mail is not in fact legal without a warrant, and only photographing the outside (which anyone who handles it can see) is allowed.

I do think the fact that any member of the public can collect data legally means the government should be able to as well.

I recognize the similarity between phone calls and Tor; however, I too think there is a difference in the expectation of privacy.

I like your analogy with aerial surveillance, but partially because I think you are wrong. It is my understanding that aerial views available to the public, such as those available to a commercial helicopter, do not require a warrant. However, if the police go beyond public capabilities with high zoom cameras it may require a warrant. Similarly, if the state goes beyond the capabilities of the public in obtaining my IP address, they should require a warrant. The question then becomes, "Does the CMU project constitute knowledge generally available to the public?" I would argue the negative, but I could see it answered either way.

It doesn't need to be available to the public, only available to third parties. There are a finite number of people (either 3 or 6) that together have all the data needed to identify the user.

> To me this makes as much sense as the argument that since a plane carrying people can fly over you, it is perfectly reasonable to put a blimp with an extremely high zoom camera on that spies on your home constantly, detecting not just visible light, but also infrared. Also, since when you talk things vibrate, and since it is possible to view those vibrations though a window, I'm actually broadcasting my speech to the public and thus don't have any expectation of privacy.

I doubt anyone is making that argument; in Kyllo v. United States the Supreme Court held that infrared cameras constituted an unreasonable search. Recording vibrations would also likely fall in the same category.

Police spying on you from a blimp is fairly unlikely, since it would be fairly conspicuous, not to mention expensive. Far more likely they just stick a camera on a utility pole as in the recent United States v. Houston, what you're most likely alluding to. The Sixth Circuit did uphold that tactic, but the law is far from settled there.

>Police spying on you from a blimp is fairly unlikely, since it would be fairly conspicuous, not to mention expensive. The Army is actually doing this: https://theintercept.com/2014/12/17/billion-dollar-surveilla...

The scary thing about those blimps is that we used exactly those in our various warzones. Look for them in pictures of Kabul or Baghdad while Americans were there. I used to joke to buddies in my unit that it was even the same contractor sitting in the trailer where the blimp is anchored, watching the video.

Looks pretty conspicuous to me, and also extremely unlikely to be used for sustained surveillance of a person. Also sounds likely to be discontinued when funding runs out. A load of hot air, in other words.

These issues have actually been litigated in court. The broad consensus is that yes, the police can use a surveillance plane can take pictures of you without first obtaining a warrant (Florida v. Riley), but no, they can't use infrared camera to look inside your home without a warrant. (Kyllo v. United States)

None of these cases are really analogous to the Tor case. Generally speaking, you have no reasonable expectation of privacy that information that you voluntarily provide to a third party will be kept confidential. This is why the police doesn't need a warrant to get your phone records or to obtain your IP address.

You bring up mail, which is an interesting case. Conents of a sealed mail IS protected by the Fourth Amendment - it's just that the government usually relies on the "exigent circumstances" exception to the warrant requirement (basically, showing that there is probable cause to search the mail but that there is no time to obtain a warrant). The government can't just mass-open all sealed mails and look at their contents.

Just to add a bit more information, the Kyllo v. US case was decided based on what a person would reasonably expect a member of the public to own.

Many people have planes that fly about, drones or whatnot. So you could expect random members of the public to have ways of taking arial pictures of your house. Therefore those do not violate your right to privacy.

It's very unlikely for a member of the public to own a helicopter with an infrared camera, so using it without a warrant is a violation of privacy.

The basic example used by a court is binoculars. Most people have access to binoculars, and own them. So if you do something next to your window, police can totally look through your windows with binoculars and act on the information.

A helicopter with an infrared camera costs about $100.

I believe he is referring to a thermal imaging camera, which can see heat sources. They're still somewhat an expensive specialty item. The police used to use them to look for people growing marijuana in their attics, but higher courts now say that would require a warrant.

He may be, but over the last few years some models have come out with much lower prices: http://appleinsider.com/articles/14/11/23/review-flir-one-an...

I wouldn't be surprised if there are usable thermal imaging sensors out there for $100.

It's probably worth noting that Kyllo is one of the cases where the recently deceased Justice Scalia's "conservatism" produced a decision favorable to privacy advocates:

  We have said that the Fourth Amendment draws "a firm line 
  at the entrance to the house," Payton, 445 U. S., at 590. 
  That line, we think, must be not only firm but also bright— 
  which requires clear specification of those methods of 
  surveillance that require a warrant. While it is certainly 
  possible to conclude from the videotape of the thermal 
  imaging that occurred in this case that no "significant" 
  compromise of the homeowner's privacy has occurred, we must 
  take the long view, from the original meaning of the Fourth 
  Amendment forward.

    "The Fourth Amendment is to be construed in the light of 
    what was deemed an unreasonable search and seizure when 
    it was adopted, and in a manner which will conserve 
    public interests as well as the interests and rights of 
    individual citizens." Carroll v. United States, 267 U. S. 
    132, 149 (1925).

  Where, as here, the Government uses a device that is not in   
  general public use, to explore details of the home that 
  would previously have been unknowable without physical 
  intrusion, the surveillance is a "search" and is 
  presumptively unreasonable without a warrant.

https://scholar.google.com/scholar_case?case=158400455911157...

I'm not a fan of the third party doctrine, which IMO badly needs to be updated. To me, it seems like a runaround/copout.

So much of our data today is held in the cloud that it amounts to open season for data acquisition. And for data that isn't, what's there to stop a governmental agency from using the All Writs Act to compel data movement/redirection to a third party site?

Just because something is technically legal today, doesn't mean it's the right thing to do.

Remember, this is only constitutional limits. Congress is free to pass laws preventing such collection, as they in fact did with the Freedom Act, banning phone metadata collection.

Third Party doctrine isn't a runabout. It's inherent in the text of the 4th amendment:

> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated...

Information I have about you is not your information, and you can't invoke the 4th amendment to protect it. Data held in the cloud is different. At least arguably, you have a property right to that data even if a cloud provider is holding it for you. You can't say that about IP addresses, IP address logs, call data records, etc. That's the company's data about you. You have no property interest in it, and mostly you don't even have access to it.

So let's work through a scenario here.

Assume you are Verizon (or any other carrier). I pay you for cell phone voice & internet service. As part of that exchange, I provide billing info etc. etc.

Are you saying that I don't own said information and that you are free to derive additional revenue by selling it to someone else? To me, I paid for a service, thereby a single transaction. My expectation is that as part of that transaction, the other party should not have to the ability to derive secondary benefit without explicit consent. Particularly, since I don't see any upside to secondary/tertiary usage.

I guess I'm much more for the European vision of personal data privacy (you own your own data and grant it for specific use) vs. the US version (anything goes).

You can't own facts (such as the fact you live at 123 XYZ Street or that you made a 4 minute call last week to your mother). You can own documents (digital or otherwise) containing facts. But the documents you're talking about here are Verizon's database files. You have no right to them.

I'm not familiar with European data privacy laws, but I imagine they're like U.S. privacy laws in the sense that they're not based on ownership. E.g. it's illegal for schools to disclose your educational information to third parties. But your student records are still the school's records, not yours.

EU style grants much more in terms of data ownership for an individual. So, comprehensive vs. patchwork coverage.

From the EU DPD (1 of 2 key documents),

"Pursuant to the Directive 1995/46/EC, the data controller should ensure compliance with several principles relating to data quality. These principles include: (1) the collected data should be processed fairly and lawfully; (2) the collected data should be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; (3) the collected data should be adequate, relevant, and not excessive in relation to the purposes for which they are collected and/or further processed; (4) the collected data should be accurate and, where necessary, kept up to date, and; (5) the collected data should be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed."

* http://resources.infosecinstitute.com/differences-privacy-la...

* http://politicsandpolicy.org/article/european-union-and-inte...

* http://www.nbcnews.com/id/15221111/ns/technology_and_science...

* http://privacylawblog.fieldfisher.com/2014/how-do-eu-and-us-...

* http://www.wsj.com/articles/SB100014241278873243386045783283...

PS. This is not a wholesale endorsement of EU style privacy, there are things that need to be fixed too but IMO is much more respectful of the individual in general.

Wouldn't it make sense to consider that, for instance, my dropbox or google accounts are amongst "my effects"?

Yes, in a sense I'm handling data to a 3rd party, but in another sense they're just today's notebooks and drawers.

No, the EULA for those services is also quite explicative about this.

I haven't looked at these EULAs for a while, but didn't Google Docs' EULA basically reserve the right for Google to publicly display your document whenever they wanted? http://www.cnet.com/news/does-google-own-your-content. Something like that would, in my opinion, squarely take something out of the scope of the 4th amendment.

It's tricky, basically once you have stored those documents on a 3rd party service you have effectively shared them with that party.

The government can request or compel that party to disclose that information they do not have to go through you any more, this means that you can't claim 4th amendment rights as you aren't even "involved" in the process.

It would but that's not how US law is being interpreted today. That's what I would like to see fixed.

The lack of proper data protection laws (such as the ones in the EU) are clearly starting to show how just having vague constitutional interpretations isn't enough to actually protect your information.

We don't consider handing a letter to the USPS "giving over the information to a third party," so we have an example to apply to other supposedly third-party information that is really first-party information temporarily handled by, but not intended for, a third party.

The USPS can't read the letter without breaking the seal. That's different from Tor, where the three parties can team up and exchange data, and they'll know who visited what, without breaking any seal.

If the mail is unsealed, they're allowed to open it. See https://www.law.cornell.edu/cfr/text/39/233.3

I can very easily call any of the layers in a secure connection a "seal". Besides, it's an analogy to demonstrate that there are things that are considered private while in a third party's control, not a literal point-for-point template for how to design privacy law for the Internet. The third-party doctrine does not match any non-lawyer's expectations, and it's the doctrine that needs to change, not just people's expectations.

They can read the mail through the seal using the shirt off tech used by archaeologists to read rolled up scrolls.

Surely the point is when sealed there user expects privacy just as seven using Tor a used expects privacy - in both cases there is a system in place to protect the content from being simply read. That the technical solution used can be overcome doesn't change the users expectation that the 'seal' will mean the content is carried without being read.

The fact that all relays working together can determine the information means that the user gave up the info. If the US were to operate all three relays, would you still consider collecting that data to be illegal?

"Consider...illegal" sounds like a trap. It should be illegal, and is definitely wrong.

Should it be illegal for a private person to do so? If it's legal to run a single relay, what changes when you spin up more?

Yes, it should. It's illegal for a private person to steal unencrypted cable, it's illegal for a private person to spin up a bunch of servers to siphon information from a corporation's computers, it's illegal for a private person to tap into someone else's unencrypted phone calls, etc.

All of those are illegal under the CFAA, because they accessed a computer without authorization. In this case, every use of a computer was authorized.

If someone's calling up random numbers and talking into them, my predicting which number they'll call and buying it, then listening to it doesn't violate any laws (although you can argue it should).

The CFAA has nothing to do with stealing cable or tapping phones, both of which existed (and were almost certainly illegal) before the CFAA and before digital cable or digital phone systems.

Regarding buying random phone numbers, I'd say again, analogies are only useful to demonstrate the existence of an area of law in which something is legal or illegal, but not useful for designing in detail the laws governing digital/networked activities. There's not a sufficient parallel to make any decisions based on any analogy to a previous situation or technology; there's only enough parallel to prevent closing off the discussion of making privacy violations illegal by saying "it's not".

I think the argument I summarized in https://news.ycombinator.com/item?id=11171344 is reasonable. In a nutshell, they say that we should apply the third party doctrine as if we're in a world without third parties. So in the tor case, if they would need to manually transfer information, then the identity of both people would be known. The basic intuition is that technology shouldn't allow more hiding. (This is a simplification, read the sources to understand the point being made.)

Actually when you give USPS a letter you are giving the recipient's address, and optionally yours, by writing it in plain text on top of the envelope. The same argument could be made about IP addresses. By connecting to a Tor node you are willingly giving your IP address.

There is evidence that the USPS has been logging all that metadata.

http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mai...

https://en.wikipedia.org/wiki/Mail_Isolation_Control_and_Tra...

I'm not saying that it's right but it apparently is happening.

>They're giving over the information to a third party, which usually destroys any 4th amendment rights.

By that argument mail, courier, landline phone, cellphone, satellite phone, email, web chat, SMS, and everything except face to face speech aren't protected.

Legally, I suspect that's a bit of a reach.

And one cannot use the Internet at all without giving over information to a third party. I'm going to go ahead and say we've all been "dirt roaded" by this interpretation since now we can't even watch the modern equivalent of TV without "giving away" our privacy under it. That is a step backwards to say the least.

So when I send data over the internet, am I "giving" it to everyone who owns a router along the route? I wouldn't say so.

They can all read it, if you're using http. In what sense are you not giving it to them?

Even on https, they can see who you are and who you're visiting.

The USPS can read my mail, but I am not giving it to them (legally or morally).

Also, tor isn't HTTP. It's quite heavily encrypted.

The only relevant information being used by the government is who visited what site. (If this is incorrect, let me know). That corresponds to the outside of letters, which the government can read legally without a warrant.

The outside of letters isn't encrypted. The destination in Tor is encrypted by design to everyone who is expected to know who you are. It's literally the purpose of Tor to make that information private.

Or to put it a different way, if Tor doesn't create a reasonable expectation of metadata privacy, what would?

>Or to put it a different way, if Tor doesn't create a reasonable expectation of metadata privacy, what would?

According to the theory put forward in the second part of http://www.abajournal.com/magazine/article/the_data_question..., nothing.

How does the absurdity of that result not serve as its own refutation?

Why is that absurd? The theory is well defined and defended.

The theory doesn't work. It's based on the idea that if you go out into public the police could traditionally have followed you to see where you go.

Which isn't actually true. They didn't have the resources to follow everyone everywhere all the time. And if they were following you, it was possible for you to observe them. There are methods to detect a tail, so you could employ them and then not go to the secret place until there is no one watching. To maintain "technological neutrality" it would require there to exist equivalent digital methods for people to use to prevent being observed.

Kerr's whole premise of technological neutrality is also questionable unless you apply it both ways. But does it really make sense to say that the police can't use fingerprints or DNA evidence because it wasn't traditionally available? How does that framework make any sense at all?

>There are methods to detect a tail, so you could employ them and then not go to the secret place until there is no one watching. To maintain "technological neutrality" it would require there to exist equivalent digital methods for people to use to prevent being observed.

Honestly Tor seems like a great analogy here. It makes it far more difficult to be observed, but it's fallible, as is trying to spot a tail.

But the question isn't whether someone could use a welding torch to break into your safe, the question is whether you have a reasonable expectation of privacy.

Because the consequence isn't that the police can't get the information, it's only that they need a warrant first.

So does this apply to encrypted information coming into my home such as cable TV? Encrypted wifi? Cell phone signals?

Reply on news.ycombinator.com