Hacker News Reader

Comment by perihelions | Hacker News Reader

Just to clarify a point for discussion: this is already the law in the USA, and always has been [0]. European privacy law formerly prohibited private entities from reading personal communications, and handing them over warrantlessly to governments (as I understand it (?)); but this was never a thing in the US.

[0] https://en.wikipedia.org/wiki/Third-party_doctrine

View on HN

From that source:

In 1986, the United States Congress updated the Omnibus Crime Control and Safe Streets Act of 1968 by enacting the Electronic Communications Privacy Act which included an updated "Wiretap Act" and also extended Fourth Amendment-like protections to electronic communications in Title II of the Electronic Communications Privacy Act, known as the Stored Communications Act.

In Carpenter v. United States (2018), the Supreme Court ruled warrants are needed for gathering cell phone tracking information, remarking that cell phones are almost a “feature of human anatomy”, “when the Government tracks the location of a cell phone it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone’s user”. and that

[cell-site location information] provides officers with “an all-encompassing record of the holder’s whereabouts” and “provides an intimate window into a person’s life, revealing not only [an individual’s] particular movements, but through them [their] familial, political, professional, religious, and sexual associations.”[5]

AND

From https://www.legalmatch.com/law-library/article/e-mail-and-wa...

Are there Any Laws that Protect Your Email Privacy?

Under the Electronic Communications Privacy Act (ECPA), police can access emails without a warrant if the emails are stored in the cloud and at least 180 days old. However, this law is outdated and lawmakers are attempting to pass the E-mail Privacy Act. This would update the ECPA by requiring warrants for all email searches. At the moment, in July 2018, the ECPA has yet to pass.

E-mails that are in remote storage and opened or older than 180 days do not require a warrant. Instead, the police only need to obtain an administrative subpoena. Administrative subpoenas are issued by federal agencies without any approval by a judge, so they are much easier to obtain.

So.. run your own email server in your basement if you're concerned (which would require a warrant). Or try end-to-end encryption solutions.

Think you're glossing over the distinction between compelling material (by warrant, subpoena, &c.) -- what the Fourth Amendment covers -- and private entities voluntarily giving the government material that third parties have entrusted them. Nothing regulates the latter: that's the third-party doctrine.

> Nothing regulates the latter

That's not true. The Stored Communications Act _does_ regulate this. In fact, it was passed in response to concerns that the third-party doctrine would mean that nothing would be protected from the government if it was stored by a third-party service provider.

The law says that the contents of communications may not be divulged unless certain conditions are met, even voluntarily. See 18 U.S. Code § 2702.

The people you're replying to aren't glossing over it, the posted article (and the comments predicting the end of the European tech industry) is glossing over it. "European Parliament approves mass surveillance" really means "European Parliament suspends portion of privacy law that prevents third parties from voluntarily monitoring information entrusted to them" - as they're able to do in the US.

The European Parliament isn't (in this action, at least) compelling anyone to surveil anything.

This is a bizarre distinction to make when the third party doctrine has resulted in mass surveillance in the US.

> The European Parliament isn't (in this action, at least) compelling anyone to surveil anything.

Why shoot down something that you're adding to the article? Who said the European Parliament was compelling anyone to do anything?

This is true.. not much to be done with the major providers are all in bed with the Feds. I mean, the telcos literally allow the Feds to port mirror all their traffic. End to end encryption on your own encrypted storage perhaps.

I'm not sure if "allow" is the right word here. Really the NSA can set up another Room 641A at any company they want regardless of that company's wishes and with a national security letter the company can be prevented from even telling anyone (like their customers or the media) about it. I was furious when Obama granted telecom companies immunity from prosecution for their role in the warrantless spying, but really it's not exactly fair to pushing people who are strong-armed into compliance.

Perhaps, but if it became public that my telco was allowing NSA to backdoor comms, I’d say the devil made me do it, too.

https://www.propublica.org/article/nsa-spying-relies-on-atts...

There is a fairly large caveat to this and it happens to also deal with children.

18 U.S. Code § 2258A - Reporting requirements of providers

In short, it requires ESPs to report incidents of child exploitation that they become aware of to the National Center for Missing & Exploited Children.

According to NCMEC's published data there were over 20 million reports in 2020. The latest breakdown by ESP I could find was from 2019, which shows facebook making 15 million reports.

https://www.missingkids.org/content/dam/missingkids/gethelp/...

EDIT: Here's the 2020 report:

https://www.missingkids.org/content/dam/missingkids/gethelp/...

That's what ECPA says, but the Fourth Amendment does apply to e-mails as well as ECPA. Today, pretty much no significant commercial e-mail provider is going to give up e-mail contents without a warrant, even when over 180 days old.

In 2010, the Sixth Circuit held ECPA to be unconstitutional as it relates to email and compelled disclosure without a warrant (at least for large volumes of private email) [0]. This hasn't been tested at the Supreme Court, although the Warshak opinion has been cited approvingly, mostly because providers don't disclose content without a warrant so nobody has had a case to take up.

Carpenter shows 4A can protect metadata under some circumstances too (for more than 7 days of CSLI), even if law enforcement obtain a court order, which requires less evidence than a search warrant.

[0] https://en.wikipedia.org/wiki/United_States_v._Warshak

Those are great. Thanks for posting a very clear summary of two important points. It seems to be very hard to find and define on your own. Too bad they didn't make the same thing for credit card transactions, which are almost, and becoming more so, part of our anatomy. (Will the rules change if they are (injected chips, for instance.)

This makes the EU look pretty hypocritical for striking down the "Privacy Shield" agreement that they had with the US for GDPR.

In fact, I have to wonder if this will put that ruling in danger of being overturned now?

(And how much do you want to bet that the lawyers at Facebook are gearing up for that very fight right now?)

So it is okay then.

Then when EU will start running concentration camps for thought criminals, we will say it's okay China already do it...

Reply on news.ycombinator.com