Comment by btilly | Hacker News Reader

Comment by btilly | Hacker News Reader

Parent Full thread

The Constitutional argument is supposed to be based on reasonable EXPECTATIONS of the people involved. So, for example, when most phones were party phones, people didn't have a reasonable expectation of privacy and no warrant was needed to tap phone calls. This was what was decided in Olmstead v. U.S. in 1928.

At a later date, private phones became the norm. And so in Katz v. U.S. decided in 1967, warrants for tapping phones were held to be required. That is because people's expectations of privacy had changed.

In the case of TOR, people were using a service that was advertised as being designed by the NSA to protect your online privacy EVEN IF you were under attack by state actors. In fact it was widely advertised that all anyone could know is that you were using TOR, but nobody would know what you were doing with it, who you contacted, and so on.

What do you think would have been a reasonable expectation in 2014? That using TOR meant your communication was private, or publicly available?

That advertising was false, and Tor project developers have specifically said that it's not intended to defend against global adversaries like the NSA.

I wonder if false advertising can create a legal expection of privacy. What if I sell a red filter for you to hang in your windows, and advertise that it protects against anyone seeing through. But you can just apply an anti red filter to a camera and see perfectly. Is the government allowed to do that? (I don't particularly understand optics, and this likely doesn't actually make sense, but you hopefully get the idea).

An argument can be made that if someone's using something they don't understand, they shouldn't have a reasonable expectation that it's as described, especially if they aren't paying.

Many people have misconceptions about VPNs as well. That doesn't mean the data they willingly hand over is reasonably expected to be private.

(If there's precedent for a false advertising interacting with the third party doctrine, I'd be interested in seeing it.)

> That advertising was false, and Tor project developers have specifically said that it's not intended to defend against global adversaries like the NSA.

That line of reasoning would mean there is no "reasonable expectation of privacy" ever, against global adversaries like the NSA.

They even advertise it themselves "Total Information Awareness", "Nothing is beyond our reach", etc.

And this is why codified law is nice.

Honestly, someone using Tor should know that your communication details are being held by exit nodes. Isn't it kind of common among the community to not trust your exit nodes?

I would say that the assumption is that your communication is public.

It is reasonable to assume that you are attempting to keep the information private. It is reasonable to assume that the US govt would not hack the information on that basis. If you assume it's public, why the hell are you using TOR at all? Use of TOR shows the assumption pretty clearly.

if you're attempting to keep the information private, you're not doing a good job by handing it to a third party.

Expectation of privacy is kind of based around self-incrimination, and you lose a lot of those when you hand information to a third party.

Even if it's "public" (in the legal sense of 'not protected'), Tor can be useful against non-state actors, or against weaker state actors.

I'm not saying there isn't a colloquial expectation of privacy, but that the jurisprudence on privacy doesn't apply to Tor (or at least, that there is an argument that it doesn't).

You could also say if you don't want people photographing your genitals, don't use a third-party restroom or dressing room or tanning salon. The expectation of privacy really has (or should have) nothing to do with the existence of someone's ability to violate that privacy.

I agree with you emotionally, but question your argument legally. What, 'is,' and what, 'should be', are rarely the same thing.

If government wants something forbidden, it creeps towards it. Expectations are meaningless without threats.

Someone using TOR should know that exit nodes will know that you used TOR, but by design they are not supposed to be able to find out who you were talking to, or what you were talking about.

The general assumption back when Silk Road was created was that TOR itself was safe, and the most likely way to be discovered was for your personal machine to be compromised. This belief was only strengthened by the FBI's repeated failures to take down Silk Road.

Heck, this was still a widespread belief AFTER Silk Road was taken down! For example http://motherboard.vice.com/read/the-fbis-deep-web-raid-seiz... quotes a security researcher who came to the conclusion in late 2014 that the FBI was just scanning TOR, and TOR itself had not been compromised.

For a comparison to phones, the Supreme Court has held that a list of people you called is not protected, but the contents of your phone calls are. Similarly I think they should rule in this case that the fact you're using TOR is not protected, but the details of what you were doing on TOR is covered by the 4th amendment.

By design, if the three or six nodes that you used compare notes, they can tell who you were talking to. That seems roughly the same as breaking a key into 6 parts and giving it to 6 different parties. I think the government would be able to go to each party and ask for their part, then put them together. Therefore, there's no expectation of privacy.

What actually happened is the researchers found a way to bypass the middle guy and reconstruct the info just from the two ends. That's still just comparing notes, but from fewer people.

Yes, I know how it was broken. But the question is what the expectation should have been. And given that expectation, then whether they should have had a warrant.

In our surveillance society, the government's theory is that it should never need a warrant, because terrorism. I strongly oppose that theory. I'm OK with taking down Silk Road, but get the warrant first.

Reply on news.ycombinator.com