Hacker News Reader

  > I think the crux of the issue is the doctrine that, if a
  > company is a party to handling my data, whether
  > privately or as part of delivery to another person,
  > that company may voluntarily share information with the
  > government. I think it's a failing of our
  > constitutional law against unreasonable search and
  > seizure that this precedent was set.

Voluntarily supplying information to the government is not a violation of the constitution. There are many reasonable cases where private companies should share information with the government (e.g. for handling illegal content); if I hear gunshots and screaming coming from the house next door, I am allowed to call the police. Such voluntary sharing is typically limited by the privacy policies of the companies involved.

But the whole NSA debate isn't about voluntary data sharing at all, it's about the government demanding access (or simply breaking in) without a warrant. The NSA's tapping of fiber lines is equivalent to the local SWAT team walking into my bank and rifling through everyone's deposit boxes. There's not much the bank can do about that except lobby against warrantless searches.

  > Would it be reasonable to change the laws of our
  > society such that no person may share another person's
  > digital information with the government [1], except as
  > required by law

What do you do when the law says "NSA gets to demand whatever it wants for any reason?"

> the whole NSA debate isn't about voluntary data sharing at all, it's about the government demanding access (or simply breaking in) without a warrant.

Why not both? The NSA "breaking in" is certainly a problem, but I don't understand why the third party doctrine isn't.

> There are many reasonable cases where private companies should share information with the government

Yes, but the third party doctrine goes far beyond what I would consider "reasonable."

> Voluntarily supplying information to the government is not a violation of the constitution.

That's up for interpretation. The extent to which single companies held large swaths of information about our lives has changed dramatically in the last decade. Do you seriously believe that, if the constitution were written in the present day, personal information (of some description) would not be included in the 4th? Alternatively

> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause

I'd consider anything in gmail/gdocs to be "papers and effects" of mine. I understand that the US government has a different interpretation, but that doesn't mean I have to agree with it.

The root question in the 4th amendment is whether the belief that certain information is private is objectively reasonable. The premise of the third party doctrine is that it's not objectively reasonable to consider information private when you've given up control of that information to a third party. How can something be private when it's at the total discretion of someone else to disseminate that information?

Whether you agree with this or not, you have to admit: your gmail/gdocs isn't exactly "papers and effects" in the same way as the "papers and effects" in your desk drawer. Not because they are digital, but because the contents of your desk drawer aren't routinely rummaged through by other people, or data mined for targeted advertising, or anything like that. When the question is: is it reasonable to expect these documents to remain private, those things must certainly factor into the equation.

It's very relevant that "single companies [hold] large swaths of information about our lives" but that doesn't mean it's automatically protected by the 4th amendment, or that how that information is handled today justifies expecting a privacy interest to exist in that data. The 4th amendment must accommodate the transition from paper to digital, sure, but you can't erase the word "private" from "reasonable expectation of privacy."

There are certainly ways Google could make a clearer case for extending 4th amendment protection to gmail/gdocs. Essentially, make it more reasonable to expect that information to be private. Stop data-mining it for targeted advertising, encrypt it client-side, institute rigorous procedures for who has access to that information, perhaps lobby for laws to create enforceable penalties for cloud companies who allow employees to access the data without absolute need. These are essentially the analogues of what protects bank safe deposit boxes despite the third party doctrine: banks don't routinely look in safe deposit boxes, they don't ask what's inside, they have extensive protocols to prevent employee access, etc. They are "private" both legally and factually.

In order to make a convincing case that information in the cloud is "private" for the purposes of the 4th amendment, cloud companies have to move in a direction of ensuring that the information is actually "private" as a matter of fact.

> The premise of the third party doctrine is that it's not objectively reasonable to consider information private when you've given up control of that information to a third party. How can something be private when it's at the total discretion of someone else to disseminate that information?

In that case, why doesn't it cut both ways? The Gov't gave access to Snowden, so does that suddenly make it reasonable that he should be able to share that data with the world?

The fact that most people expect their telephone, email, etc records to be private should say that the 3rd party doctrine is fundamentally flawed.

  > Why not both? The NSA "breaking in" is certainly a
  > problem, but I don't understand why the third party
  > doctrine isn't.

Could you elaborate on why you think the third-party doctrine is relevant to voluntary sharing?

My understanding is that there are some privacy regulations which still apply to sharing with the government and this is why CISPA was being proposed- http://en.wikipedia.org/wiki/Cyber_Intelligence_Sharing_and_....

I do not know if the NSA is exempt, or certain data is exempt. But I share your concerns and see this as another reason why CISPA must be defeated.

"In the modern world, virtually all of our communication involves other companies, and so if those companies can voluntarily act as effectively agents of the government in providing the government data, then the Fourth Amendment is practically void."

I think the point is that the tech companies aren't sharing their users' data with the government voluntarily -- the government is using a combination of questionable, secret court rulings and strong-arm tactics to force them to share. If left to themselves, the companies in question (at least the ones that have spoken out most loudly) wouldn't voluntarily give up as much information as they have been. And not just for idealism's sake -- their own bottom line is likely affected.

EDIT: removed unclear statement meant as a joke.

(now, if the government were willing to buy user information at market prices, Google and Facebook at least seem totally cool with that based on their ever-expanding directed marketing businesses :P).

Huh?

Google and Facebook sell your detailed browsing history and social interactions to advertising companies. For a similar price, they'd likely sell this information to any government as well.

Is there a citation for this? I'm aware if I use Google (I don't) then Google will have my search history, my location and some other details (like access to my emails if I use Gmail). I understand Google uses this data when selling ads via AdSense and other Google ads networks. But I never read Google sold this data, as is, to other companies.

No, they do not. They provide access to the user preferences, likes and interests but they never ever sell user data to third parties without user authorization.

Cite your sources if you have any proof of your claim.

It's too late to add an edit comment, but I'll agree with all of the replies - this was a gross overgeneralization of how these companies structure their advertising programs. They _use_ your detailed browsing history and social interactions sell other services to advertising companies. Their internal properties (at least Google's) have direct access to this data to aid in their own advertising programs (not 3P, but maybe not what you expect).

I didn't explicitly say they give that data to 3rd-parties, but I'll clarify that they do not give the unanonymized data to third parties (analytics from campaigns provide a fair amount of anonymized data). To the best of my knowledge, there is no method of getting discrete, individual specific data directly from these companies unless you have a subpoena.

Yes, it was my impression that some companies participate voluntarily (other than by court order), because the government pays for access or otherwise awards them contracts for access.

One discussion: http://www.usatoday.com/story/money/business/2013/07/10/what...

It's easy to understand why the typical company would choose to participate if they simply need to provide a data stream to gain a new revenue stream.

It's also easy to understand why a factory will dump pollutants into a river instead of disposing them "properly". It's our job as a society to create incentives and remove options that provide this sort of "tragedy of the digital privacy commons" (not a perfect analogy).

By paying for access (at presumably a rate much greater than cost), the government makes firms who refuse to provide access less competitive in the market than firms who do.

This theme keeps repeating, and there is no evidence to support it. Just for the start, how can I buy your or any other person's browsing history?

You don't get ahead in the milk business by selling your cows.

Sorry, that was a tongue-in-cheek reference to the fact that companies like Facebook and Google that get most of their revenue from advertising tend to sell some data about their users as part of their advertising platforms. Of course, the data exposed through those interfaces isn't nearly as explicit or personal as the sort of direct access the NSA wants.

NO, they do not "tend" to sell data. Their internal systems deliver advertising to selected audiences but personal data doesn't leave Google or Facebook servers.

> As all data increasingly goes digital, it is wrong for our society to present a conflict of interest: either keep my data myself, and lose out on modern technology; or use modern technology and be subject to omnipresent surveillance.

This is a false dichotomy regardless of the state of fourth amendment jurisprudence. There is no inherent reason why you have to store all of your data on Google's servers rather than having your own storage device(s) just as you didn't need to keep your papers in your associate's office a hundred years ago. There is no insurmountable technical reason why your data can't be stored and processed locally.

The problem is really economic. The problem is that you are about to buy a television and it won't change your life one bit whether the television is made by Samsung or LG, whereas that decision of yours will change Samsung's bottom line to the tune of a couple hundred bucks. Which means that Samsung et al are willing to pay more to influence your purchasing decision than you are willing to pay for e.g. email service, and allowing them to doesn't cost you anything. Which means that it's more profitable to offer "free" ad-supported email (and document hosting and blogging etc. etc.) than it is to sell you a product that allows you to seamlessly operate the service using your own hardware. That's the problem -- economics. The fact that the economic value of invading privacy in order to target advertising exceeds the value of not having it invaded for that purpose.

But once you have a system designed to allow surveillance for the purpose of targeting advertising, which most people have no significant objections to, you get every organization and government lining up who wants to do surveillance for purposes people do strongly object to, and the infrastructure to do it is already in place. So now there's trouble: Either you have exclude from government surveillance the data shared with corporations for targeting advertising, which governments don't like, or you have customers withdrawing that information from the advertisers in order to keep it from being exposed to government surveillance, which cloud companies and advertisers don't like.

Somebody is going to be unhappy. And there's a good chance that it will be the cloud companies -- even if the US government relents and announces that it's going to discontinue SIGINT operations against Americans without a warrant, there is very little chance that they'll actually stop against foreign citizens (though they may claim to officially), and even less chance that China and non-state actors (i.e. organized crime) will refrain from doing something similar. Which means that the cost in privacy is no longer just privacy against targeted advertising, it's also privacy against surveillance by governments and criminals.

On the plus side, new market demand for data hosting products without third party central servers.

> I'm not saying that's the only reason.

I will. If it didn't have a negative effect on large American businesses, no one would be giving any real thought to the matter. Even then, I expect only a show of reform will be given so that those large American businesses can continue on. I do not expect to see any real change.

> As all data increasingly goes digital, it is wrong for our society to present a conflict of interest: either keep my data myself, and lose out on modern technology; or use modern technology and be subject to omnipresent surveillance.

I don't think that dichotomy is so stark. Ultimately, the root of the 4th amendment is "reasonable expectation of privacy." That definition should adapt to new technology, but must still be rooted in whether the expectation of privacy is objectively reasonable in light of the actual nature of that technology.

I contend that, however we reform our law to adapt to new technological requirements, data that is encrypted and not accessible broadly within service providers merits a higher standard of protection than data that is exposed in plain text to potentially hundreds or thousands of people. In other words, I think whether it's "reasonable" to expect digital information to be private depends on a common sense evaluation of whether that information is, in fact, private.

I think a lot of our digital infrastructure fails that test, and often by design.

> no person may share another person's digital information with the government

AFAIK, this is already the case in Europe; it goes even further - no company/person is allowed to share any information willingly given by a customer with anyone, except as clearly stated in the privacy agreement the customer has signed prior to sharing of data.

It also affect some of tech companies' own private data which is why Google etc have to encrypt the links.

>US firms lose contracts and relationships sour.

This meme is not based on facts. American companies dominate the internet space even more now than they did before Snowden. Anti-Americanism is great but you need other companies to replace their services.

> American companies dominate the internet space even more now than they did before Snowden

I am sure that is true in many countries, but it is not true in all of them, e.g. China. China has its own tech giants and market leaders.

> US firms lose contracts and relationships sour.

It will be difficult to find hard data on the topic. Perhaps we could look at the market as a whole: overall international sales across a set of US tech companies over time.

Personal anecdotes (from people doing business internationally) lead me to believe there is a chilling effect or loss of trust for US firms - of what magnitude I am not sure. Perhaps the real business impact is not that significant, and it's just getting a lot of press.

I hope my comments do not come across as Anti-American. That is certainly not the tone I'm looking to set. I am solely looking to have a constructive discussion.

The types of changes that the Snowden documents will prompt other countries' governments and corporations to make do not happen overnight. This is a game of strategy, not tactics.

That isn't "Anti-Americanism." Have some perspective.