Eleventh Circuit Decision Largely Eliminates 4th Amendment Protection in E-Mail | Hacker News Reader

Eleventh Circuit Decision Largely Eliminates 4th Amendment Protection in E-Mail

volokh.com

31 pointsskennedy8 comments

The 11th circuit "has jurisdiction over federal cases originating in the states of Alabama, Florida and Georgia"( Source: http://www.ca11.uscourts.gov/about/index.php ). This is quite a conservative area of USA so without getting too political, I'm not surprised at this decision.

Thought-provoking stuff.. While the intent of the fourth amendment is obvious and noble, I wonder whether, given the accelerating pace of creation and processing of information, it still makes sense to rely on legislation to prevent privacy violations. How can there be any hope of enforcing such laws in the face of the increasing complexity of worldwide communications, where (as one of the commenters on the article points out) the routing of any given data is nondeterministic and temporary copies are made at every step? It seems to me that the law is hopelessly on the wrong side of technological evolution here (I would make a very similar argument regarding copyright law).

Looking at it from a different angle, perhaps (note a hint of devil's advocate here) we should be glad that modern cryptographic systems (enabled by the very tech that seemed to threaten privacy) offer the potential to make old-fashioned laws superfluous?

I'd say that legislation is more important than ever; privacy can now be violated in ways that were technically impossible 30 years ago. I agree that enforcing privacy laws is problematic, but that doesn't mean it's impossible, nor that it isn't worth trying.

It seems like email encryption should be a pretty solvable problem tech-wise. Does anyone here actually regularly send and receive such mail? If all the emails saved on servers were encrypted, we wouldn't have this problem.

A friend and I use encrypted email from time to time for fun. We generated self-signed keys and we both added security exceptions for each other's keys to our email clients manually. While it works it took us both some time to figure out how to generate the keys. Our keys are also marked as untrusted so you have to manually add them to a trusted list. This method works okay for us but I doubt it would work for most people.

The web-of-trust is really a pain in the tail, but for the purist it's the only approach you can have faith in (or, more correctly, it's the only approach in which you explicitly decide how much faith you're prepared to have).

Tech-wise, it's a solved problem.

I sign all of my outgoing emails using Thawte (now Verisign) certificates. The problem with encryption is finding the other person's keys. I have yet to receive a signed email from someone else, so I cannot send encrypted messages.

It seems to be a problem primarily with critical mass and secondarily from implementation. Not enough people use signed/encrypted email to spur others to using it. Additionally, certs cost something. Even free certs cost effort in understanding the need for them and figuring out how to generate/download/install them. Then there is the whole problem with "trusted" certs...

Implementation wise, things are only a little better. Once the certs are installed, (desktop) mail clients handle the signing/encrypting pretty well. But I can't sign messages from a webmail client or from my phone.

Wrong problem. The issue here is not the sending of the message, but the storage of the message.

You need your ISP to store the emails encrypted even if they were received in the clear.

Reply on news.ycombinator.com