Hacker News Reader

Comment by rayiner | Hacker News Reader

So "reasonable expectation of privacy" is an objective standard. The question isn't, do you, (betterunix personally), expect information to be private, but do people in general reasonably expect information information they throw out onto the intertubes to be private (in other words, you can't create zones of privacy by having a subjective expectation of privacy).

I don't think that's the kind of clear-cut argument you'd like it to be. To me, for example, if I'm letting AT&T or Verizon see the encrypted bits (as well as any intermediate carriers and backbone operators), I don't really have a privacy expectation on the encrypted bits themselves. I might be persuaded that I have a privacy expectation on the decrypted bits, however.

View on HN

> if I'm letting AT&T or Verizon see the encrypted bits (as well as any intermediate carriers and backbone operators), I don't really have a privacy expectation

Why? Because ISPs handle your data, they get to spy on you? If you asked UPS to ship a memory card full of photos, does that give them permission to copy it and use it how they wish?

Your ISP is already "spying" on you. They subject the bits you send to traffic analysis, they might do deep packet inspection, they record your use of the network, etc.

Also, the government doesn't need a warrant to intercept a UPS package.

Also, the government doesn't need a warrant to intercept a UPS package.

[citation needed]

It's hard* to find credible sources on this on the open web, if you read something like the Silk Road[illegal eBay for drugs, you pay with bitcoin] forums on tor, this is widely reported, and verified by self-proclaimed employees of the companies(ups FedEx). More convincingly vendors universally ship through USPS explicitly because they provide a warrant.

Disclaimers: I am not a customer, and have not used the service, but believe that looking at the security methods used by those actively prosecuted is a decent way to figure out with precautions/security measures work.

*though a quick google of ups open package on warrant will reveal many on dubious forums

When in the possession of UPS, they can just ask UPS to volunteer it. They are allowed to, and will. You gave it away.

The law specifically prevents this for US mail.

I asked if UPS should be allowed to inspect your data. After all, you did hand it to them.

I would expect UPS to inspect and record anything that they would come across in the course of delivering the package. So taking pictures of the outside, recording the destination address, etc. Similarly, given that AT&T can't send your bits without at least temporarily storing or buffering them, and indeed does a lot more inspection of your traffic than that, I don't have any particular expectation of privacy with regards to the bits short of their actually decrypting them.

> Similarly, given that AT&T can't send your bits without at least temporarily storing or buffering them

They're probably buffered on a Microsoft OS. Do they get a copy too? Can I expect my Dell not to be keylogged? It seems like in a "post 9/11 era" we have no expectation to anything short of getting your balls fondled.

> I don't have any particular expectation of privacy with regards to the bits short of their actually decrypting them

None at all? Would you share your network traffic with me?

I don't think it has anything to do with "post 9/11." I think it all has to do with knowing exposure of information to third parties. If you want to keep information private, don't give it to other people.

> If you want to keep information private, don't give it to other people.

Tell this to the people going after Snowden.

Interesting, because I would look at the UPS box as the equivalent of the packet headers. Looking inside box or packet would be forbidden if I had my way.

They do this nowadays, do they not? I thought FedEx and UPS X-ray inspected boxes (at least randomly) to look for dangerous materials. They fly planes too, after all.

This is an interesting line of thought.

What if UPS could scan your package and interpret the bits on a memory stick inside? Would that be reasonable? (They could frame it as "we scanned the bits, transferred it over the internet to another memory stick, and copied and delivered those contents".

I would expect UPS to inspect whatever they wanted to, unless UPS specifically stated they would not.

Um, no.

A world in which there was truly no privacy is one in which anyone on the planet could log into your bank account, and get an itemized list of every transaction you've run through it. Obviously, that's not the case. Just as obviously, your medical records are not a matter of public record. Nor are your job performance reviews, your tax returns, or the contents of your medicine cabinet.

Indeed, there's a TON of material that people both expect to be private and which, in the normal course of life, IS private. Moreover, the "reasonable expectation of privacy" standard is not based simply on what's technically possible to conceal, but on the boundaries that are socially necessary to maintain a free and open democracy.

And I'm sorry, but this is a VERY clear cut argument. The lines are as straight and as bright and as shining as they've ever been. For the government to search records that a citizen has made a legal effort to shield from public view, it must have specific and articulable cause to suspect that citizen of a specific crime. Whether my correspondence is printed on paper or stored in my smartphone has exactly zero bearing on the fundamental law governing the government itself. None, zero, nada, zip.

Apologies for the caps used as emphasis. I try not to use them unless the comment in question is not just stupid and wrong, but dangerously stupid and wrong. And this comment is about as stupidly dangerous and wrong as asserting "if you've got nothing to hide, you've got nothing to fear."

You fundamentally misunderstand what "privacy" refers to in this context. "Private" information is not everything that is not public. The assumption is not that the government can only access that information you make freely available to the whole world. "Private" information is that information that is within your personal sphere of privacy. The archetypal examples, specifically enumerated in the Constitution, are your physical person, your home, and your personal property. The farther away you get from these examples, the more other people that have access to your information, the greater the expectation that the government should be able to access that information without a warrant.

It is interesting you give the examples that you give, because the government can get, at least Constitutionally, your bank records without a warrant: https://ssd.eff.org/your-computer/govt/privacy, or your medical records: http://www.aclu.org/technology-and-liberty/faq-government-ac.... To the extent that such information is protected, the protections are statutory in nature, not Constitutional.

> For the government to search records that a citizen has made any effort to shield from public view, it much have specific and articulable cause to suspect that citizen of a specific crime

This is "alexqgb's interpretation of what the law should be" not what the framers had in mind when they drafted the 4th amendment.

Again, no. And as your own links demonstrate, this is not simply what I personally believe. It's also what the ACLU believes. Seriously, did you even read what you posted?

For instance, the one about medical records is discussing warrants, and whether the government needs one IN ADDITION to clear and articulable suspicion pertaining to a crime, and not just suspicion. Even in cases where the constraints on searches are eased, the reasonable expectation that privacy exists remains very real. Indeed, if there weren't a reasonable expectation of privacy, there wouldn't need to be clear rules describing how and when it can be pierced.

The article goes on to discuss the additional exemptions to the need for warrants pertaining to national security concerns, but as it points out, the existence of these provisions in law IS NOT to be interpreted as a validation of their constitutionality. In fact, the whole point of the link you provided is to underscore how dubious the claims to constitutionality really are.

Here's the crux of it:

Q: Is it Constitutional for the government to get my medical information without a warrant?

A: The ACLU believes that this easy, warrantless access to our medical information violates the U.S. Constitution, especially the Fourth Amendment, which generally bars the government from engaging in unreasonable searches and seizures.[viii] However, because the Patriot Act and the HIPAA regulations have only recently gone into effect, their constitutionality remains largely untested, although at least one legal challenge to the HIPAA rules is underway, and more challenges are likely.

Don't read what you want the articles to say, read what the articles actually say.

Specifically (from the first article): "Thus, some Supreme Court cases have held that you have no reasonable expectation of privacy in information you have 'knowingly exposed' to a third party — for example, bank records or records of telephone numbers you have dialed — even if you intended for that third party to keep the information secret."

Going on: "Records stored by others. As the Supreme Court has stated, 'The Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities, even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed.' This means that you will often have no Fourth Amendment protection in the records that others keep about you, because most information that a third party will have about you was either given freely to them by you, thus knowingly exposed, or was collected from other, public sources."

That's the law, that's what the Supreme Court has said, not what the ACLU hopes or believes.

From the second article: "Q: Can the police get my medical information without a warrant?

A: Yes. The HIPAA rules provide a wide variety of circumstances under which medical information can be disclosed for law enforcement-related purposes without explicitly requiring a warrant."

That's the statutory law, at this moment, based on the Congress's reasonable interpretation of the Constitutional basis above.

Of course the ACLU hopes to get the courts to go the other way, but as they tacitly admit: courts have not done so to date. E.g. http://www.law360.com/articles/376791/warrantless-seizure-of... (Warrantless Seizure Of Medical Records OK'd In Drug Case).

At this moment, it's hard to describe 4th amendment protections as applied to medical records anything other than aspirational on the part of the ACLU.

Holy crap dude, don't blame the weatherman for making it rain. He's telling you how it actually is. If that's not what you think it should be then he's telling you exactly what you need to (help) get fixed.

Reply on news.ycombinator.com