Appeals Court Holds that Email Privacy Protected by Fourth Amendment | Hacker News Reader

Appeals Court Holds that Email Privacy Protected by Fourth Amendment

eff.org

172 pointsssclafani41 comments

It still seems bizarre to me that anyone would argue that e-mail is not protected by the fourth amendment.

The court's decision said it best:

  It follows that email requires strong protection under the
  Fourth Amendment; otherwise the Fourth Amendment would
  prove an ineffective guardian of private communication,
  an essential purpose it has long been recognized to serve

Remember, this is the country whose government argued "The privilege of the writ of habeas corpus shall not be suspended, unless when in cases of rebellion or invasion" actually meant "The privilege of the writ of habeas corpus shall not be suspended, unless when in cases of rebellion or invasion or we deem them a terrorist"...

They might well regard rebellion terrorism, the world their subjects.

So a terrorist is neither rebelling nor invading then?

Rebelling, maybe. If they were USA citizens (not to imply there aren't any; hell, we've got the Klan).

Invading, no. They are not a governing body.

Not sure one has to be a governing body to invade. Godzilla could invade.

Can Godzilla really be considered an invader, given they frequently simply stomp-and-leave, or defend against others - who would stomp-and-leave (or occasionally set up shop) - by stomping-and-leaving? When I think invaders, I think intent-to-occupy; Godzilla seems to have no interest in occupying any Tokyo estates. Where there's no intent to occupy, I consider them to be just destroyers.

Hmm. Would obliterating something (and leaving) count as an invasion? To take it to ridiculous proportions: say we blew up another planet. Did we invade it?

To be fair, at the time of writing, it was pretty difficult to destroy another nation's cities/property/wealth without physically entering and being next to them.

Things become a lot clearer if you replace the word "terrorist" with "murderer".

A terrorist is someone who employs terror as a political weapon, a murderer is someone who commits murder. They're not synonymous, although a terrorist may employ murder to create terror, just like they could employ facial hair in a pogonophobics group session.

If the U.S. has an official definition of terrorism, they aren't sharing it with the rest of us.

Regardless, the point of the "invasion or rebellion" exception is obviously to handle circumstances so extreme that there won't be a government to recognize habeus corpus if due process is followed. The U.S. faces no such threat from lawfully dealing with terror suspects.

Yes. The government argues that terrorism is a unique threat that requires extreme measures, such as removing rights from citizens. But the counter-argument is that it IS a unique threat: one that can never be conclusively dealt with. There will never be a time when we can say "we have won; we are safe from terrorists." Therefore, any rights we surrender in this "war" will be gone forever.

In other words, the ubiquitous, eternal possibility of terrorism is the strongest argument for why we should NOT allow "extreme measures" that involve citizens losing their rights, because that loss will be permanent.

A non-citizen terrorist is not rebelling, and it's hard to argue that terror attacks constitute an invasion - there's no intent to control territory, nor is a governmental entity involved.

So, no.

I think the rules apply to the non-citizen while they are here. I think they actually agree to that when they enter the US. So, technically, they are rebelling.

If they're "rebelling", then so are Russian agents here covertly. I'd say it's pretty clear the Constitution didn't intend for arbitrary criminal acts committed by individuals or small groups to count as rebellions.

A person part of a militant group entering US territory with the express aim of subverting the US government would be invading, not rebelling.

If you're of the country and attacking it, you're a rebel. If you're not-of the country and attacking it, you're invading.

That makes sense to me. I don't think you need to have an intent to control territory. Nor do I think we stop an examine things to make sure of the purpose.

My understanding that part of the arguments center around the idea of a reasonable expectation of privacy. You're not protected by the fourth amendment for public communications, for example.

While most people probably do expect that their emails are private, it's not necessarily a fair assumption. Email is by default completely unencrypted. (even if you are communicating with your mail server sercurly, it is likely that when your message is sent to a different server it is unencrypted.) You can make the argument that such open communication does not carry a reasonable expectation of privacy when anyone on the network could read it so easily. (Let alone people using open wifi to connect to an unsecured mail server where anyone on the network could read anything -- firesheep)

This is further complicated by the fact that we most of us hand over our emails to be stored by third parties (a very different practice from entrusting the postal service with a sealed envelope) who don't necessarily have the same legal protection to maintain the privacy of your communication as you do.

I'm glad that the courts see email as protected, but I recognize that there are legal arguments to be made for the opposite case.

Most phone calls back in the day were analog, and there was no reasonable expectation that anyone with a pair of alligator clips and a speaker couldn't listen in to their calls - but privacy laws still applied.

Same deal here.

True, there are arguments but i would say they're pretty weak.

Though emails are stored by third parties, those parties state that they won't read your email. That makes it reasonable to assume that they won't read your information and further reasonable that your communication will remain private due to those statements.

Yes email travels unencrypted through mail servers but it's not a requirement that someone read the message to pass it though the server. Someone has to overtly snoop on the message to break the users privacy. Much like a phone call passes through telco offices and someone can snoop on a call by taping two copper wires.

Contrast that with sending a telegram to someone over the phone. In order for the message to go out you have to tell the 3rd party what it says so they can type it for you.

A letter that's sealed can still be read fairly easily. If not by breaking the seal with steam then simply by someone holding it up to a light. The seal is a very weak protection mechanism.

Edit: flow of statements.

"While most people probably do expect that their emails are private..." fairly well sums up the "reasonable expectation of privacy" standard. So, you know, full stop.

I'm just astonished that it's taken more than 30 years to reach this decision, and a least at decade of very widespread use.

Encryption has nothing to do with whether I have a reasonable expectation of privacy.

To me, this sounds a lot like "you didn't bother to lock the door, so obviously it's legal for me to come in," or even "you used a lock that's easily picked" with the same conclusion.

If I'm a non-technical person, I send an email, I address it to a single person, expressing my expectation that only that person will read it. Just because someone CAN violate that privacy doesn't mean they should be allowed to. Just like when I have a private conversation in my house with the door closed, I'm expressing an expectation of privacy. Just because someone CAN bounce laser beams off my windows, read the vibrations, and reconstruct the sound waves doesn't give them the right to do so at will.

The interesting question is how and when mail providers such as Gmail accept warrants issued by other countries. From some articles I've read in the past it seems that such warrants are accepted by Google - which does also make sense, as Google needs to adhere to local laws (at least if they have offices in a given country).

But when do Google or other mail providers comply to such a requests? Each time a warrant is issued by any (more or less) democratic country (also if I have no relation to the country issuing the warrant)? Only if I've chosen the given country as my home country during registration? If I've used an IP address of a given country in the past?

This question is especially important, as the standards for warrants between countries differ. For some countries (such as Germany) it seems to be sufficient to be suspected for illegal filesharing in order for a court to issue a warrant for a "house search".

http://www.google.com/transparencyreport/governmentrequests/

That shows where requests come from. It doesn't explain the rules on when a given jurisdiction can make a request about someone who might or might not be in that jurisdiction.

Thanks for the link. Unfortunately it doesn't state under what conditions Google complies with requests:

"The “data requests” numbers reflect the number of requests we received about the users of our services and products from government agencies like local and federal police. They don’t indicate whether we complied with a request for data in any way. When we receive a request for user information, we review it carefully and only provide information within the scope and authority of the request. We may refuse to produce information or try to narrow the request in some cases."

Has anyone else read the judgement? The case itself is super fun. Some sweet justice was served on the jackasses behind Enzyte. They lied through their teeth to convince people to buy their product, enrolled them in recurring payments against their wishes, and lied to banks to let them keep running.

Almost all the convictions were upheld in this ruling. In fact, the ruling that the defendant's fourth amendment right was violated ended up having no bearing on the case. The evidence was not thrown out because they ruled that the agents acted in good faith according to the law (which they didn't even follow correctly). The fault is put on the law.

Does that mean that if the law (stored communications act) is challenged as unconstitutional that the case could be re-ajudicated and the charges overturned?

(Also, sad to see this sentence in a legal document: "All told, the electronic evidence originating at Berkeley filled three “tera-drives” and numbered 17 million pages." pretty sure they meant terabytes.)

Wonder if the same ruling would cover text messages. Can the police peruse your cell phone under "reasonable suspicion", or would an explicit search warrant be necessary.

It should, but I suspect it'll still need to be separately tested in court.

Interesting timing on the day Richard Stallman pointed out the dangers of the cloud and its lack of legal protections... this might be the first big legal ruling connecting your data in the cloud to you personally. Let's hope it sticks and expands as precedent... https://www.eff.org/deeplinks/2010/12/breaking-news-eff-vict...

It will be interesting to see if this morphs into an expectation that email providers offer a minimum level of protection, as a floor. And then, once the floor is established, will be a race to the bottom?

Edit: I'm not saying that such an outcomes logically follows, only that the vagaries of society may shift in that direction.

Good. Hopefully this is the beginning of restoration of some common sense in these matters. It would be even nicer if we could get rid of the Patriot Act and the crotch-grabby TSA POSs while we're at it, but I know better than to dream.

amazon/paypal/visa/mastercard dropping wikileaks demonstrates that its not worth the hassle for them to stand up to the government. I speculate that most service providers will continue to comply with warrant-less requests.

When you operate on the scale of Amazon or under financial regulation like the other three, it pays to be on the government's good side. If you're merely an ISP or hosting provider that does email, your business doesn't need to interact with the feds much, so there's very little extra-legal leverage they can use against you if the necessity of a warrant is well-backed by the courts. In cases like that, you may have much more to fear from your clients than from the feds.

I suppose that's just one of the problems with an ever-expanding government.

Imagine if the authors of the bill of rights had not had the vision to append these 1400+ words to the Constitution?

The constitution simply wouldn't have been ratified: too many states demanded that a bill of rights be added as a condition for ratification of a constitution establishing a strong central government.

Perhaps we would instead be asking under which of the "few and defined" Constitutionally-granted powers is the Federal government basing its demand that one private entity retain the personal communications of another private entity.

yeah, I don't see this in the enumerated powers.

I heard an excellent discussion of the rights of the people and the powers of the government. One was meant to be expanded and the other only further constrained. And of course the government is confused about which is which.

Nice work, EFF. Thanks.

Reply on news.ycombinator.com