Hacker News Reader

Comment by rayiner | Hacker News Reader

For better or worse, the distinction between data and metadata is deeply ingrained in 4th amendment law, specifically Smith v. Maryland. And technology hasn't changed the rationale underlying that distinction either. Back in the day, addressing on the outside of an envelope was considered "metadata" and unprotected because you had to reveal that information to the third party for the mail to get routed, so had no expectation of privacy. This same reasoning applies perfectly well to the phone calls in the 1970's in Smith, or for that matter a cell phone call, and arguably TCP/IP headers, today.

View on HN

My understanding is that the "Subject" line of emails are also considered metadata for the purpose of surveillance and warrantless information demands by police.

Subject lines are clearly not needed for routing.

There's feature creep (a.k.a. slippery slope) at work even for metadata.

They're headers, which categorically tend to be viewed as metadata even by technologists. You're right that they aren't necessary for routing, but this is not exactly the government being slippery. Even where encryption is used, metadata — including the subject — tends to be sent in the clear.

They're MUA headers, not MTA headers. That's an important distinction; those headers are generated directly by the end-users' systems, rather than by the systems responsible for routing the mail around.

Even that isn't a clear bright line. For example, the To: header also comes from the MUA, and it's crucial to the message's transit. (In fact, the To: header is very much analogous to the stuff written on the outside of an envelope.)

To: actually isn't used in routing. MTAs and MDAs route messages based on the target address that's communicated in the 'RCPT TO' command, ignoring whatever may be in the To/CC[/BCC] lines, should the MUA happen to generate those headers.

The set of metadata used in routing, aka the 'envelope', also contains a return path, which is (normally) used for things like submitting delivery failure reports.

No, the To: and From: fields you see in your MUA is the software equivalent of my saying over the phone, "Hey, this is Steve - is Dave there?" In my fairly educated opinion, of course.

Admittedly I'm only thinking of a single datapoint here, but in the case of Lavabit, the court order which was intended to grant metadata collection ability to the FBI specifically mentioned that "Subject" headers were to be stripped. At least in that case, the relevant government spooks weren't even trying to argue that "Subject" lines were in their purview.

It's too much of a jump from one person being recorded without a warrant, to everyone being recorded without a warrant. That distinction hasn't changed at all.

Well, unless we decide that we don't want the NSA reading TCP/IP headers.

As we've seen in recent commercial data breaches, the collection of a huge amount of data makes a tempting target. The potential abusers of that data, in this case, is not only identity thieves, but foreign governments and "rogue" US employees. Although I'm finding it hard to remember what "rogue" means anymore.

Reply on news.ycombinator.com