Hacker News Reader

Comment by pyre | Hacker News Reader

The postal service, UPS, DHL, FedEx, the phone company, etc. These are all 3rd party services that people use to send private things. People have an expectation of privacy when they send a message to someone via (e.g.) Facebook Chat. Some might argue that it's an unreasonable expectation of privacy if you understand the technology behind it, but I would argue that the majority of the population doesn't understand the way the technology works (which would imply that the majority of the population expects that the communications will remain private).

View on HN

The postal service is the only one of those mail carrier which you have listed that actually have legal standing for that privacy expectation though.

Regarding phones, those also have specific laws attempting to protect wireless (cellular) communications from eavesdropping (with the exception of legal wiretaps, which cellular providers are required to be able to support).

Likewise for pagers, those have specific laws making it illegal to intercept the communications sent to pagers.

For normal phones, a specific law had to be passed to require warrants for interception of communication (the "Wiretap Statute" from 1968, later extended by the Electronic Communications Privacy Act of 1986).

So the point to all of this is that those privacy "rights" that you talk about are not 4th Amendment rights at all, they are protections granted by specific legal action on the part of Congress. Had that legal action not been taken then you'd be right back in this same "interesting 4th Amendment question" that we're talking about for this.

The bottom line is that if you're willing to give info to a 3rd party unencrypted you need to assume the government can be given access to the same information unless there are specific laws forbidding it.

The anti-wiretapping laws are needed to prevent non-government entities from violating our security. The Fourth Amendment already clarifies that government must not violate the security of ourselves and our communications (papers), without a warrant naming the person being searched, and what is being sought.

Yes, but before those anti-wiretapping laws the phone company could theoretically do ad-hoc wiretapping of their own and voluntarily divulge that to the government. The only limit would have been that the phone company couldn't have wiretapped at the direct behest of the government since the Supreme Court had already ruled that the 4th Amendment applied [to the government] where the person had a reasonable expectation of privacy.

The statute fixed that privacy issue and then put requirements on when wiretaps could be used by the government. Before this law and the Supreme Court decision the government was very... lax regarding warrants for wiretaps.

http://www.it.ojp.gov/default.aspx?area=privacy&page=128...

This is an interesting point. What about a safe deposit box at a bank, can the government search it without a warrant?

You're mixing things up a bit. The government can't search things without a warrant where there is a reasonable expectation of privacy. This applies to even things like DHL packages, the government can't tell the DHL delivery guy to hand over a package to them.

On the other hand, it's not a privacy violation for the DHL guy to voluntarily turn over material to the government and the government to use that as evidence against you. Think of the stereotypical "guy at the photo lab" who notices that someone dropped off child porn to be developed, you (sadly) used to see that in the news yearly, and no one thought anything of that being turned over to the government.

In some cases third-party services have privacy protections added by law. E.g. the cellular communications interception thing, it used to be very easy indeed to intercept a cell phone call just by sticking up an antenna. In 1994 the law was changed to make it illegal to intercept those calls in most scenarios, and require search warrants even for that "public transmission" of communications (but the law also required cell phone companies to make it possible to wiretap, the "CALEA" provisions).

Given how strictly regulated banks are I would be very surprised if there are not similar laws providing some semblance of legal protection to the contents of safe deposit boxes, but I'm not sure and don't have time to Google it.

There is no protection for UPS, DHL, FedEx, etc. The only one for which there is protection is the Postal Service, and that is because it is an organ of the government.

Also: the government could always ask your friend at the other end about what you said, not just Facebook.

The intention of the founders re: the 4th amendment was not to protect communications between people, it was to protect people from personal searches. Read the text: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures."

Persons, houses, papers, and effects? What do all those things have in common? They are personal to you. You'd feel violated if someone else entered your house or rifled through your effects. That same reasoning doesn't apply to something like a Facebook message that any of a number of people at Facebook could read. Maybe you assume that they wouldn't do that, but they certainly can.

Maybe we need a law to keep the government from getting Facebook messages without a warrant. But that's a separate thing from the Constitutional issue. Personally, I don't even think we need such a law. If you're okay with Facebook or Google looking at your communications, you should be okay with the government doing so.

I didn't raise a Constitutional issue. I'm pretty sure that "reasonable expectation of privacy" is found no where in the Constitution.

  | If you're okay with Facebook or Google looking at
  | your communications, you should be okay with the
  | government doing so.

- This treads awfully close to 'if you have nothing to hide, then you have nothing to fear.'

- Government employees wield much more power than Facebook employees.

- If it was common knowledge that all Google/Facebook employees had unfettered access to all communications going through their systems, then people would treat the system differently. As it stands, employees should only be looking at specific communications to deal with work functions (investigate complaints from users, look at a message that caused a back-end system to blow up, etc).

> This treads awfully close to 'if you have nothing to hide, then you have nothing to fear.'

But you're not hiding anything. You're transmitting it in clear text through Google/Facebook's services. You're not worried about the right to hide your information, you're worried about the right to hide it against the government specifically. That's the key distinction. I do have things to hide--I don't share those thing with either Google or the government, and those are the things I want protected. If I choose to share something with Google, I'm okay with the government having access to it too.

> Government employees wield much more power than Facebook employees.

In my mind, the government has a lot more power to screw me over, but private industry has a lot more incentive. I'm much more worried about credit ratings agencies, insurance companies, potential employers, etc, having access to my information than I am about the NSA looking at my information.

> As it stands, employees should only be looking at specific communications to deal with work functions

That's the same for government employees. Maybe the difference between us is that you implicitly trust the employees of Facebook not to do stuff like this, and don't trust government employees, while I feel the opposite way.

  | But you're not hiding anything. You're
  | transmitting it in clear text through
  | Google/Facebook's services. You're not worried
  | about the right to hide your information, you're
  | worried about the right to hide it against the
  | government specifically.

That's not true. If I send a person-to-person message that goes through Facebook or Google, am I ok with that information broadcast across the globe to everyone? Probably not.

  | If I choose to share something with Google, I'm
  | okay with the government having access to it too.

Are you ok with the government having unfettered, unrestricted access with little or no oversight? That doesn't make any sense to me. Even if you don't care about the information that Google/Facebook have on you, do you really want government agencies to get used to accessing information without a warrant? It only incentives them to push for more access to information without a warrant.

  | Maybe the difference between us is that you
  | implicitly trust the employees of Facebook not
  | to do stuff like this, and don't trust government
  | employees, while I feel the opposite way.

Facebook is more accountable that the government is. To be fair, there are bad actors in all places, but the FBI/US Attorney General has more incentive to pull people into court, and send them to jail than Facebook employees do[1]. FBI agents 'doing their job' is more of a risk than Facebook employees doing their job, because the FBI agents' jobs are about arresting people and charging them with crimes.

When was the last time that an FBI agent was fired for overstepping their authority? On the other hand, I feel more trust that Facebook/Google would fire an employee that overstepped their authority.

[1] And they are always testing the bounds of how they can apply the law. See the case of trying to charge the mother that drove her daughter's classmate to suicide, where they tried to charge her with 'hacking' because she violated the Terms of Service of MySpace.

> Facebook is more accountable that the government is.

How do you figure that?

> To be fair, there are bad actors in all places, but the FBI/US Attorney General has more incentive to pull people into court, and send them to jail than Facebook employees do.

The difference is that only a small fraction of people do things that causes the federal government to become interested in putting them in jail. Most people do things that arise the interest of private industry. See, e.g., the credit ratings agency mafia. Those companies would have a field day if they had access to Facebook's information. See also, all the hiring managers that would have to have access to peoples' social networking information in order to blacklist them for jobs. Or insurance companies looking for any reason to drop people from healthcare plans, etc.

How much you worry about something is generally proportional to the product of how likely that something is to happen and how bad that thing would be if it did happen. It's exceedingly unlikely that you'll be at the receiving end of a federal prosecution, even if that would be a really bad thing. But having trouble with your credit, having trouble getting a job, being dropped from your health insurance--all of these things are much more likely, and they can be pretty bad in and of themselves. Yeah, sure, the government can bankrupt me defending a prosecution, but then again so can my HMO dropping me from my health plan if I get sick.

As I said, I imagine this is a matter of outlook. I don't see myself as a revolutionary who might get railroaded by the government for fighting for a just cause. I do see myself as a guy with a wife and a kid looking to buy a house some day, worrying about health care costs for my aging parents, etc. Given that, the ways private industry can screw me over are a lot more real to me.

    I'm pretty sure that "reasonable expectation
    of privacy" is found no where in the
    Constitution.

No, but it was established in Katz v. United States[1] as one part of a two-part test of whether a search is constitutional under the Fourth Amendment.

[1] http://en.wikipedia.org/wiki/Katz_v._United_States

While I find this line of thought personally abhorrent, I give you my glad upvote for helping me to understand what must be the reasoning of the government.

If you could help me follow the idea further: In my mind, a communication is mine until I send it, at which point it is my property in the trust of another, until delivered to whom I'm communicating with, at which point it becomes their property.

I know legal reasoning doesn't always follow what I may consider to be common sense- can you shine any light on what I'm missing?

(Prefer not to focus on the DHL/UPS etc side of things, because I understand their right to snoop is a part of their TOS.)

The difference between the legal reasoning and your reasoning is the "property in trust" part. Legally, once you hand your communication over to Google, it's their property. If they choose to hand it over to the government, that's their business.

Think of this hypothetical. Say Google reads your g-mail and tells people you ordered green shirts. Do you have a lawsuit against Google for disclosing your private information? I doubt it. If the information is sensitive for a different reason (e.g. it's about your herpes diagnosis), you might have a suit, but then you'd also have a suit against a friend to whom you told that information in confidence. I.e. it's a suit based on the nature of the sensitive information, not the disclosure by itself.

The idea of this "information trustee" doesn't really exist in the law. Google is treated no differently than a guy on the street you tell to relay a message to your friend. And as for the 4th amendment, as I said, wiretapping aside it's more of a "personal search" protection than a "communication protection." This is a good summary of the relevant precedent: http://www.cs.duke.edu/~chase/cps49s/carnivore-history.html

  | Legally, once you hand your communication over
  | to Google, it's their property.

If I put some of my belongings in a storage unit, I don't lose ownership of them. If I accidentally leave (e.g.) my sunglasses at a restaurant, the restaurant doesn't own them now. If I give a package to DHL, they can't decide that they don't want to deliver it, and it's theirs now.

There is in the law the idea of trusteeship of personal property (the law of bailments). There is no such analogue for information.

I'm arguing that the analogue should be there. When I mail a letter to someone it's just a physical manifestation of the information. The fact that it's physical is a by-product of the transfer medium. I don't feel like rights should be lost just because we can represent the content of that letter as an email, and send it over a 'series of tubes.'

If I store files on Dropbox, I am arguably paying for them to store the files for me, not giving them to Dropbox to do with what they like. It should not be treated any differently than a rented storage space in the physical world (regardless of implementation details like de-duplication).

Here is where you get into the tricky difference between what makes sense, and legal definitions. You may very well be right- I certainly feel you are. But that line of reasoning must be established by legal means.

It's like right now you have the idea, but haven't written the code.

But if you leave your sunglasses in a restaurant, and the government wants to take fingerprints off of them, they can.

The statement that once (e.g.) Google has the message that they are supposed to be passing on my behalf, that it's now theirs to do with as they please is a much more bold statement then the original discussion of whether or not they should be allowed to hand it over to the government.

Not really. That is nothing more than a civil contract issue between two parties. And to have a valid contract there must be an offer, acceptance, and consideration. Not just the promise of future consideration either, so saying that Google could make money off of you later (by e.g. directed advertising) wouldn't make an enforceable contract.

But as it stands things are even more lopsided towards Google. Go check their terms of service, I'd bet they have a half dozen different ways of indemnifying themselves from liability in the event they don't deliver that email.

If you agree to a privacy policy that says "we will give your data to the DOJ any time they ask for it" you don't have a reasonable expectation of privacy either.

If you sign an employee agreement that says, "we own all of IP you produce past, present and future," then it's obviously enforceable, right?

That's actually much more enforceable than a drive-by EULA.

Are you sure about that?

Yeah, because you would actually read & physically sign an employment agreement, and that agreement actually has some bearing on how you relate to your job. OTOH an EULA is not read by most people, and their enforceability has been challenged in court. https://en.wikipedia.org/wiki/Software_license_agreement#Enf...

You can't sign your rights away, and "we own all of IP you produce past, present and future," is a forsaking of rights that would naturally be exercisable by the person signing the contract.

Employment agreements are also subject to contract law concepts such as consideration[1], which would come into play when someone stops and asks "what's in it for me?" A single job as described at the beginning of the relationship through the employment agreement is probably not going to be seen as valuable enough for someone to have legitimately signed away his future productivity.

1. http://en.wikipedia.org/wiki/Consideration

Your interpretation of "consideration" is, according to the article you linked, the minority position. https://en.wikipedia.org/wiki/Consideration#Monetary_value_o...

I'm not sure what you mean by "you can't sign your rights away". IP is of course transferable.

IP is of course transferable.

Not without a signature on a document itemizing the IP being transferred.

Do you actually know - and have the appropriate backing from precedent - or are you just guessing? One thing I've found out about contract law is that it doesn't look anything like you'd think it does just from reading the things you sign, so it seems to me that it's very easy to make mistakes in this area without realising them if you just sort of read it in a tourist-y fashion from time to time.

The phone company is the best example because with a couple of alligator clips they could easy listen in on phone conversations. It's understood that listening in is a rare occurrence but we are ok with it happening.

Same goes for FB, Google and other providers. They have the ability to read your mail and occasionally do just like the phone company.

Bonus example: voice mail. It's just like email since its a message sitting on the service providers computer. Can the Feds just listen to those messages?

The problem here is not the level of access they get to our information. The problem is how they are allowed to use that access. The 4th Amendment doesn't really prevent the Feds from snooping on anything they want to, it just prevents them from acting on any of that information.

Huh? If the FBI busts into someone's house without a warrant there are going to be more repercussions than just "we can't use this information in court."

I guess what people don't have a problem with there is that at least someone is physically listening in on a phone line - it requires manpower to do and thus is very deliberate.

It's when we are being data mined by the government there's a problem. I think we all don't mind being data mined for advertising (within reason) but when we are being watched to be 'kept in line' that's where there's a problem. At that point it's more like 'Minority Report' where you are being scrutinized before you even do anything.

I don't like being data mined, full stop. Advertisers don't get a free pass; I would much rather pay for any service than have companies I don't even know the names of compile mile-long paper trails of my online (and possibly offline) activities.

Reply on news.ycombinator.com