Hacker News Reader

Comment by twoodfin | Hacker News Reader

I'm much less skeptical than the median HN poster about government's use of new technology in its traditional roles of criminal justice and national security, but if this article is a fair summary of the case, I can't see how the ruling makes any Constitutional sense.

Because burglars regularly break into people's homes or cars doesn't make them subject to warrant-free search. If the FBI wants to run code on my CPU in my private home without my permission, they should have a warrant, just as they'd need one to manipulate other objects in my home without my consent.

View on HN

Right? It seems trivial to tweak the judges statement:

"In today's digital world, it appears to be a virtual certainty that computers accessing the Internet can—and eventually will—be hacked."

To apply to houses:

"In today's mechanized world, it appears to be a virtual certainty that houses connected to the earth can—and eventually will—be broken into."

Thus, warrants need not apply for search and seizure in houses. QED.

> "In today's mechanized world, it appears to be a virtual certainty that houses connected to the earth can—and eventually will—be broken into."

Or rather "... houses with doors can —and eventually will—be broken into."

Also: "... houses with WINDOWS can —and eventually will—be broken into."

Even as a programmer I would much rather have to get through "… houses with WALLS …" than through reasonably strong encryption, the task might require strength, but is quite straightforward.

And its easier to break into the average house than the average pc.

Maybe, but it's definitely easier to break into a million PC's than a million houses.

Moreover, many houses also have BACK DOORS!

Sure, but you can decide if you want keep the key under the rug beside that door.

Not just broken into, just peered into. Do not have windows if you expect any privacy.

And of course, do not speak at home (or do not expect any privacy).

Having blinds on your windows still doesn't mean you should expect privacy, any window you own can - and probably will - be looked through.

Genuinely curious, do you need a warrant to look through a window.

I guess the answer is "sometimes, it's complicated"...

In California, police can peer into car windows without a warrant. That's one reason police always seem to be carrying a mag-light when they pull someone over. (The other being that mag-lights are heavy and useful as clubs.)

Oh yeah. Another piece of advice I've often heard is that, if police come to your door asking questions, it's prudent to step outside to speak with them, rather than speaking with them through an open door. If they see something suspicious through your opened door, they can reasonably claim probable cause and force entry.

This may be all BS. But it's advice I've heard more than once.

If police are doing a "knock and talk", they don't have a warrant. Barry Cooper had the best script for that:

If police are knocking, lock your door and say through a window: "I don't talk to police; have your dispatcher call me. If you have a warrant, here are my hands, go ahead and kick the door down". Then cover your ears, close your eyes, and wait.

The problem with those kind of scripts is that while they correctly account for not accidentally exposing yourself to the Police (without a lawyer present etc), they fail to account for the consequences of getting in the police's nerves and looking like a suspect in their eyes (which can get down to them downright making stuff up or planting stuff on you).

if police are targeting you, they're likely to make stuff up or plant evidence anyway.

If you feel you can't handle your affairs, make sure to lawyer up as soon as the police leave your house. You'll need to. let the lawyer know what you did, so he can take appropriate action.

Just remember that a lawyer, should (s)he put your needs above the needs of The People or The Court, (s)he would be disbarred. So don't expect magic to happen.

> Genuinely curious, do you need a warrant to look through a window.

Home windows? If it is visible from a place where a normal person going about their normal activities can see, then no warrant.

For example, if someone walks up your walk to your stoop and there are windows that can been seen through from there, then no warrant. If they have to step off your walkway, walk around the side of your house, scramble through your bushes and pull themselves up to peer through, then a warrant would be required.

I think you can be charged with public indecency if you stand in front of your window naked. So there is some sort of gray area when talking about the privacy of your home.

Depends on your location. In my state (Oregon) that's totally fine as long as your intent is not to offend anyone

Hmm. I don't agree with the ruling either. But I don't think this analogy does the original argument justice.

The point of mentioning "accessing the internet" is it's a lot easier for the hacker to scale up their wrongdoing with ease. It's much simpler to put a virus of some sort (say, a fake download button on a media sharing site) and reach a large audience, than it is to break into the homes of a similarly large group of people.

Where I primarily disagree with the judgment is that this notion makes it a "virtual certainty" that hacking occurs for any given person. Smart browsing habits, and general computer literacy, can make the odds decrease to near zero.

Not only that, most places(?) have fire codes that mandates that all houses are easy(ish) to break-in to. Maybe not easy to sneak into, but certainly easy to break-in to. Because the fire department and emergency services need a way in.

I suppose the analogy would be that just because Microsoft has the power to remotely upgrade your windows 10 install (and potentially install any back-door), that should not violate your expectation of privacy.

A house not connected to the earth would be pretty awesome, but you'd have to have a way to get food and stuff delivered [1].

[1] http://what-if.xkcd.com/149/

https://en.wikipedia.org/wiki/Houseboat and https://en.wikipedia.org/wiki/Up_(2009_film) are both connected to the earth. I think you need a spaceship for real freedom.

And even a spaceship will experience a gravitational connection to the earth, no matter where it goes.

Not if you can figure out how to teleport the spaceship into a different universe.

Hermicity[0] might be what you're looking for.

http://hermicity.org

drones, man. all about the drones.

I feel bad for the judge. He's bending over backward to rationalize the end justifying the means... and he's dead wrong.

His argument is essentially that if your house is connected to a road, then there is no expectation of privacy.

I expect the ruling, or at least that absurd part of it, will be overturned or superseded. But the counter argument (for future cases) would be that running through a physical firewall is not a direct connection to the internet (silly as it is to make the argument).

Did you read the ruling? Do you have any specific critiques, and do you think the multiple precedents cited are applied incorrectly?

Edit: I've gone through most of the relevant sections. Most of the ruling is reasonable, the section this article and the EFF are complaining about is less supported by precedent.

The actual legal argument says that hacking is common enough that people don't have a reasonable expectation of privacy, then there's this paragraph:

>Although this Court recently noted in dicta that the possibility of hacking "is not enough to defeat an individual's reasonable expectation of privacy" because it is illegal, see United States v. Darby, No. 2:16-cr-36, ECF No. 31 at 10-11 (E.D. Va. June 3, 2016), this Court stresses that child pornography often resembles an international crime. Similarly, much hacking occurs by foreign nations where the governments condone or participate in hacking. Child pornography is not just a national issue; it is an international issue, and at least a portion of the pornography in this case arrived from foreign sources through the World Wide Web

This seems to be the weakest part. It's saying that hacking can't be the basis for a lack of expectation of privacy, but that since some countries allow hacking, it's legal there, and if you're accessing stuff from other countries you no longer have the expectation of privacy.

No no no!!

The heinousness of the crime does not justify giving up or overriding Constitutional freedoms. Never. Not ever.

And if anyone is in place to protect us from that level of overreach, it's a judge. I cannot believe he's pulling a "won't someone think of the children!" in justifying (and creating some janky circular logic) this ruling.

The scariest precedent here is the level of crime dictating the flexibility of constitutionality.

I think you're misreading it. He's not saying that the heinousness of the crime justifies it, he's saying that by accessing child porn from another country, the defendant opened himself to hacking risk and as such has no reasonable expectation of privacy.

An unlocked car (which is the closest legal analogy, I think) is a bad fit here. If we're really going to search for analogues let's pick one that really matches what's going on in digital communication: physical communication.

  Whoever, without authority, opens, or destroys any mail
  or package of newspapers not directed to him, shall be
  fined under this title or imprisoned not more than one
  year, or both. -- Title 18 § 1703(b)

What if the "computer" on the internet is my pacemaker, and it uploads a data stream to servers in, say, Dublin. Does that mean I should not have a reasonable expectation in the U.S. for privacy of that data? That kind of rationale is bad in principle and bad law.

If you're uploading information to a third party, you no longer have privacy rights under the third party doctrine. That's very well established precedent.

As I said in another comment here, the issue is when it goes beyond such information like IP addresses and goes to actually hacking, which involves running code on the victim's computer.

Any web page can include content from any country. Country TLDs don’t correspond in any way to where the content is hosted, and for most people even using DNS-resolved URLs is advanced. However, mostly thanks to IPv4 exhaustion, not even IP blocks correspond to geographical location anymore[1].

And all of this doesn’t matter anyway, because of how packet routing works. No one accessing the Internet can be reasonably expected to have any control over how their packets are routed on the network. You only control the next hop[2].

See for example: http://allthingsd.com/20131120/how-somebody-forced-the-world...

So I would agree to the extent that there can be no expectation of privacy for any unencrypted traffic. However, that’s just one type of hacking – snooping.

As for actual hacking – that is someone breaking into your system – this system has to be running on something, some sort of device. This device has to be physically located somewhere.

If an Elbonian comes to US and breaks into your house is it okay because in their country there are no lock on the doors, just a lot of mud, so breaking is not a crime? This is the logic here, as I see it.

What it ultimately comes down to is the US government wants to have it both ways. They want to be able to extradite people that hack into devices located in the US, but they want you to have no expectation of privacy when they are the ones doing the hacking.

[1] https://en.wikipedia.org/wiki/Provider-independent_address_s...

[2] https://en.wikipedia.org/wiki/Hop_(networking)

>If an Elbonian comes to US and breaks to your house is it okay because in their country there are no lock on the doors, just a lot of mud, so breaking is not a crime? This is the logic here, as I see it.

If they came to the US they would be subject to US jurisdiction. Hackers from other countries aren't, at least not always.

Edit: I mean prosecution. Jurisdiction applies whenever there are effects in the US, see link below.

This is my point though. The US government claims they have jurisdiction when it suits them. Guccifer is still in the news and fresh on everyone’s mind.

Personally it never made sense to me how one can be subject to some random foreign country’s law by just using the Internet. But if that’s the doctrine it should at least be applied consistently.

I spoke incorrectly above. They always have jurisdiction if there was damage in the US. The point is that they can't get access to the person if they don't have an extradition treaty with the country they're in, but that's not jurisdiction, my mistake.

See http://www.kktg.net/Notes/hacking-jurisdiction/ which explains this.

Thanks for the link. It’s an interesting read.

Solution: Turn all international embassies into ISPs.

Comedy option: 3rd amendment defense.

("No Soldier shall, in time of peace be quartered in any house, without the consent of the Owner, nor in time of war, but in a manner to be prescribed by law.")

Not comedy. One reason for "quartering soldiers" was to obtain evidence and to intimidate within a private space. I've long held any form of broadly imposed in-privacy monitoring (including compulsory back door keys) is a 3rd Amendment violation, especially if the individual is practically paying for it.

It would be really interesting to see a legitimate 3rd Amendment challenge come before the courts in our time.

Mitchell v. City of Henderson.

Now every last amendment from the Bill of Rights has been discarded.

Is there anything in the Constitution applicable to open government? I ask because the case is locked behind PACER.

... Or is it? http://www.leagle.com/decision/In%20FDCO%2020150203D28/MITCH...

Wikipedia and news articles should give you the details.

I'd say lack of access to law (as well as its unbearable complexity) is an issue of due process and the fundamental rule of law.

But you can't look to the Constitution to dictate everything - its drafters could not anticipate all future developments, and if the government is that citizen-hostile a piece of paper won't stop it. That which the Constitution does specify should be considered more as "behavioral tests", and currently the majority of our test report is failure.

For what it's worth, the Third Amendment claims were thrown out: http://www.reviewjournal.com/news/las-vegas/judge-police-tak...

The counter-point presumably being that law enforcement are not soldiers? Maybe the 3rd amendment has been interpreted as applicable to all government agents.

>> ...but if this article is a fair summary of the case...

Thanks for that. A good reminder that we need to think that every time we read anything like this. Just asking a simple question, "Did they get this right?" and even taking a minute to read through to the actual primary source.

"For example, hacking is much more prevalent now than it was even nine years ago, and the rise of computer hacking viathe Internet has changed the public's reasonable expectations of privacy. Cf Lee Raine, How Americans balance privacy concerns with sharing personal information: 5 key findings, PewResearchCenter (January 14, 2016), http://www.pewresearch.org/fact-tank/2016/01/14/key-findings... (reporting that members of a focus group "worried about hackers," though "some accept that [privacy tradeoffs are] a part of modern life"). Now, it seems unreasonable to think that a computer connected to the Web is immune from invasion. Indeed, the opposite holds true: in today's digital world, it appears to be a virtual certainty that computers accessing the Internet can - and eventually will - be hacked."

"Thus, hacking resembles the broken blinds in Carter. 525 U.S. at 85. Just as Justice Breyer wrote in concurrence that a police officer who peers through broken blinds does not violate anyone's Fourth Amendment rights, jd. at 103 (Breyer, J., concurring), FBI agents who exploit a vulnerability in an online network do not violate the Fourth Amendment. Just as the area into which the officer in Carter peered - an apartment - usually is afforded Fourth Amendment protection, a computer afforded Fourth Amendment protection in other circumstances is not protected from Government actors who take advantage of an easily broken system to peer into a user's computer. People who traverse the Internet ordinarily understand the risk associated with doing so. Thus, the deployment of the NIT to capture identifying information found on Defendant's computer does not represent a search under the Fourth Amendment, and no warrant was needed."

The section of interest starts on page 47 of the linked Opinion and Order. http://mobile.eweek.com/security/home-computers-connected-to...

The judge conveniently disregards the difference between passive observation and active intrusion. Breaking into someone's computer is no different than if the officer had broken the blinds themself, which clearly would not meet the test described by Justice Breyer.

So, that judge just stuck down CFAA for civilians too? Or only for Law Enforcement

CFAA is about exceeding authorised access, not violating expectations of privacy.

FBI doesn't need a warrant for non-US computers.

  "But whether the Constitution really be one thing, or another, this much 
  is certain - that it has either authorized such a government as we have 
  had, or has been powerless to prevent it. In either case it is unfit to exist.”

  -- Lysander Spooner, No Treason

That's horrid logic. The question of fitness for existence is whether the Constitution is better than its absence.

That's an unanswerable question, since we cannot compare a control Earth where the U.S. Constitution was adopted in 1783 and an experimental Earth where it was never ratified.

It is axiomatic that the present we now know inevitably followed from the history that preceded it. When you look at the U.S. federal government that now exists, it must have assumed its current form either by design of the Constitution, or contrary to that design. In case of the latter, the Constitution was entirely unable to prevent the government that it established from evolving into a form contrary to its design. Maybe the process was slowed somewhat. We cannot know for certain.

Therefore, if you dislike the current form of US federal government, it is nonsensical to idolize the Constitution, or any other causally-related fact of history. History gave us the present. If you do not like the present, and wish the future to be different, do not repeat the mistakes of the past. Whether history could have given us another present is irrelevant, because it did not.

In the end, whenever a living human fights with a document, the human will emerge victorious, and the document will become confetti. The Constitution is nothing without a living human to be its champion.

Also flawed logic. Our options are not simply Constitution or No Constitution. There are a near-infinite number of unique constitutions we could have adopted, rather than the one we've got.

Spooner was criticizing the actual form of our current Constitution. GP was making an appeal to the Constitution and the judicial system's ignoring of it. I agree with Spooner that a Constitution such as ours is completely powerless to prevent individual judges from rewriting every time it fits their fancy.

We've basically had an ongoing Constitutional Convention in the federal courts since the founding -- without the consent of the people.

Reply on news.ycombinator.com