Wireless Firms Are Flooded by Requests to Aid Surveillance | Hacker News Reader

Wireless Firms Are Flooded by Requests to Aid Surveillance

nytimes.com

112 pointswallflower29 comments

The Constitutional questions here are very interesting and rapidly evolving. For example, is requesting cell site location data like tracking a beeper in a can of ether on a public highway or like a pen register? Or is it more like a wiretap of a search of a building? What happens when GPS is turned on?

There isn't a lot of case law here. In general though courts have expressed concern about the sorts of surveillance that are becoming possible. See, for example the cell site location arguments at the 3rd circuit appeals court or the opinions of Sotomayor and Alito in Jones v. United States last year (Alito's opinion concurring in judgement was joined by Kagan, Breyer, and Ginsberg. Sotomayor joined the majority of Roberts, Scalia, Thomas, and Kennedy as a narrow way to resolve the case, but she also went beyond that and endorsed Alito's logic as well, which complicates counting votes).

I highly recommend Orin Kerr's article, The Case For The Third Party Doctrine, on this issue (available here: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1138128).

A much different constitutional analysis when the data is requested from a cellular service provider, versus when it is gathered directly by state actors (police).

Kerr is simply fantastic on these issues. Worth reading more of his Fourth Amendment writing if you are interested.

Kerr is an important professor and author in this area. He has also been a staunch academic opponent to further Constitutional controls, which has made his writings on Jones v United States and the 3rd Circuit cell site location case interesting to read. Look up things he has written about "Matrix" theory of fourth amendment protections.

I don't think Kerr really grasps the level of unease that the courts are developing regarding the capability of dragnet surveillance by the government of this sort.

But definitely, anything he has written is pretty much a must-read in this field.

Edit: Also Prof. Kerr blogs at http://www.volokh.com and http://www.scotusblog.com

I am actually surprised that this is the first public accounting of its kind in US. I live in South Korea, and Korea Communications Commission publishes these numbers broken down by request types in accordance with Electronic Communications Privacy Act. This has been the case since 2005.

My question is: why are they storing the data anyways? Pass it along and don't keep it on the servers! Ignore all requests not authorized by a Warrant issued by a Judge.

Or maybe it's time for phones to adopt PGP for text messages? You could collect your friends or colleagues public keys and then the telephone companies haven't the slightest idea what you're texting back and forth.

If you're using iMessage or BBM, they already can't provide any of that data to law enforcement. I'm not sure how Apple or RIM handles requests for users data from law enforcement though.

A while back there was talk of BBM being banned in some countries (India was one of them) because of the problem of monitoring BBM messaging.

http://www.time.com/time/world/article/0,8599,2009585,00.htm...

Miraculously, they were allowed to remain in service in those countries. It's safe to assume the nations didn't just give up on their quest to obtain access to the messaging data.

It wasn't miraculous, RIM capitulated and provided the keys to the kingdom. BBM is vulnerable.

I would not go that far, but I'd do make the data retention and disclosure policy clear.

And why wouldn't you go that far? There's no reason for a third party THAT I PAY SERVICE FEES TO to save my conversation. Transmission of the material until it reaches its client is the limit. ONLY WHEN any agency gets a warrant from a judge should they be given LIMITED ACCESS to the CURRENT messages being transmitted. Not have the ability to peruse the history of.

The danger here is that surveillance becomes something that is the norm, that is not questioned.

Completely agree. While the Government doing something wrong here is bad enough, what worries me most is the change in culture for both the authorities and the people. If the people start getting used to it, that means there could be decades of abuses until people decide that maybe accepting it wasn't such a good idea to begin with, and they need to reverse the trend (which could take another couple of decades).

Is anyone really surprised?

When you agree to use a service, you agree to the service using you--regardless of tos. You become the commodity. There will always be concessions that need to be made in the name of convenience. It's natural. See power, telephony, medical and other technology for reference--should you need to.

The framers of the constitution would be surprised. The fourth amendment prohibits the government from fishing around in our private affairs without probable cause:

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

Agreed. A "is anyone really surprised?" attitude is not compatible with American values. As actors in the technology industry we should do more to protect the civil rights and privacy of our users.

Compromising these ideals in my mind is weak behavior especially when used as part of a monetization strategy. Towing the line of your TOS should be iron-glad, especially in the face of government inquiries.

Vigilance begets liberty. Liberty must always be defended or someone will easily take it away. Not to say that we haven't already lost a lot of ground, but giving up and saying "thats the way it is" is simply not an option for me as I am an American citizen.

For those internationals, give in at your own peril.

"That's the way it is" is indeed unacceptable. What you have to consider, though, is the fact that many (read most) have no concept, no idea that there is another option.

On a very base level, when you opt-in to a service of convenience, you are handing over your data--your information. As such, it should not be a surprise--given the current circumstances--when that data is used against you.

I am not saying don't fight it--quite the contrary. But I question whether fighting it on this level is more or less productive than fighting the issue at root, whatever that is.

Technology that works to encrypt all data when it goes to the cloud and decrypt it when it comes back would be a big step in the right direction. Simply make it impossible to compromise your privacy without a warranty for the private key. Makes it much easier to tell overreaching governments to politely "go fuck themselves."

Until encryption gets classified as a munition again...

That boat has sailed. If that happens, we might as well just require banks to hand credit card numbers over to Russian organized crime lords....

Unfortunately that boat sailed in the 1970's with "California Bankers Association v. Shultz" which upheld the requirement of banks to report large transactions to the federal government in order to engage in surveillance against organized crime. I think that decision more than any other has been responsible for the collapse of protections against surveillance. Indeed in a remarkably prescient dissent, Justice Douglass more or less described where this was leading by describing in accurate detail some of the current anti-drug laws that have been tacked onto the USAPATRIOT Act as it has come up for renewal....

There is hope. The logic of Alito (joined by all liberal justices, except Sotomayor) and Sotomayor (who joined the conservative justices, but also endorsed Alito's logic) in Jones v. United States is quite incompatible with that earlier decision and it provides some hope that lower courts will say "oh there are five votes for tightening things up" and start to do so.

Privacy standards are much higher when you rent a house.

Why should they be lower when you rent some bits?

Because "A man's phone is his castle" doesn't have much of a ring to it....

Rights in renting a home are interesting though. In 1982, the Supreme Court decided the one and only 3rd Amendment case to come before it, where a state evicted striking prison guards and placed national guardsmen in their state-owned workforce apartments. The state lost.

Um, nope. The state won on the fact that government bureaucrats are given an immunity if a "reasonable person would not have known" of the law that they were breaking.

See http://en.wikipedia.org/wiki/Engblom_v._Carey for verification.

Ok, so they lost on qualified immunity on remand, but I suppose if it ever happened again the state would lose.

You suppose wrong.

The immunity was because a bureaucrat could not be expected to know about the 3rd amendment. Any future violation would be a decision made by a bureaucrat, the same immunity would apply, and the precedent would say that the state wins.

For all intents at this point, the 3rd amendment is null and void.

That's not what qualified immunity does.

Qualified immunity gives immunity to many government actors who violate Constitutional rights unintentionally, because the law is not clear at the time. Getting qualified immunity on remand is basically a one-time victory. If you win on qualified immunity because the rights are not clear, but at the same time hold that there are such rights, then that gives fair notice to government actors and they don't get to do it again.

The idea is that you don't want to make the government too cautious because they might get sued if they arguably violate someone's rights so you give them the benefit of the doubt, until the law is clear enough and there is no more doubt.

There was a recent case of a woman who was tazed in Seattle for refusing to sign a parking ticket. She lost on QI grounds, but they also held that it was excessive force. That basically establishes that if the police do it again, the next person can successfully sue. That doesn't mean the police are free to taze people for refusing to sign traffic tickets. It just means that the court says "this is your only warning" and lets that case go at that.

This is different from absolute immunity, which means for example, you can never sue a prosecutor for unfair prosecution tactics used in the courtroom, and you can never sue a judge for ruling unfairly.

The standard for qualified immunity is that bureaucrats are protected "insofar as their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known." So if there was a case with publicity, after which that fact changes, then qualified immunity would not apply.

However an obscure case decided in a superior court 30 years ago does not provide sufficient publicity to reverse the fact that reasonable people don't know about the third amendment. So it would in all likelihood apply again.

Incidentally this is not my line of reasoning. I got it from In Our Defense: The Bill of Rights In Action by Caroline Kennedy and Ellen Alderman. Given that they were lawyers writing on a legal topic, I'm inclined to accept their reasoning.

At least in the cases I have read have not assumed publicity. Most of what I have gotten on the subject has been from Orin Kerr's discussion of Ashcroft v. Al-Kidd and a number of other cases (he's a law prof), and some stuff another law prof (Eugene Volokh) has blogged about on some other cases. I make a hobby of actually reading what the courts have said.

Now all this being said, it isn't out of the question for different circuits to have subtly different standards.

As a note dissents on several relatively obscure cases I have read have noted that after the finding of violation that the law will be sufficiently clear for the next case to proceed.

My understanding at least in the circuits I have looked at is that "reasonable person" includes "reasonable person having been advised by a lawyer." Note that a lot of cases really do fall into the case where beforehand reasonable lawyers could disagree as to whether a violation occurred. I think this is what this is usually intended to resolve.

But again there are so many areas of law where circuits adopt remarkably different tests (a hot one right now is airport searches with the 5th and 11th circuits giving the TSA largely a blank check and the the 3rd and 9th circuits saying there are limits but not yet having found that those limits have been exceeded).

I believe that the point made before the courts was that a legal principle that had not shown up once in litigation in nearly two hundred years is obscure enough that even a lawyer could be excused for failing to remember its existence.

At this point that would be a legal principle that has shown up only once in over 200 years, and which created precedent supporting the claim that it is so obscure that even a lawyer could be excused for failing to remember its existence.

Obviously a lawyer whose attention was drawn to the 3rd should draw a correct inference. But there is so much to the law, and lawyers focus so much on precedent from previous cases, that a lawyer can be excused for forgetting about it.

Reply on news.ycombinator.com