Troubling Arguments from the Government in Smith v. Obama

For those interested, a more detailed analysis on the history of Smith can be found in this EFF blog post:

https://www.eff.org/deeplinks/2014/06/smith-v-maryland-turns...

I'm by no means a lawyer, but I'd respond by saying that the judges responsible for the original decision likely didn't realize the consequences the Smith decision would have in the Internet age. So much of the digital content we produce ends up in the cloud, whether in an online backup service, SaaS, email, or otherwise. To say that sharing information with a cloud provider eliminates your expectation of privacy is almost the same as saying that it's not really possible to have any sort of private digital records whatsoever.

The exception to that would be in cases where end to end encryption is implemented, and only the user holds the key. That seems to be where we're increasingly moving in a world where Smith stands, and it's certainly not optimal for law enforcement, who won't be able to access that information even with a warrant.

The simplest argument against your position is that users did not password protect access to information, as well as require their data to be transmitted via 'https' in 1979. These measures provide at least some evidence of the private nature of the information, which is as well secured as that which the citizen 'saves' on their home computer.

> Post "the Fappening" and the realization that there are essentially no enforceable protections for information you store in the cloud

I don't think that is a fair statement. I've got financial/billing information for many people that moves across the internet. We haven't had any serious breaches that compromise that information.

A fair statement would be "Apple et al. do not find it cost effective to secure such data while simultaneously pleasing shareholders and law enforcement."

The moment Apple, etc. wants to try to secure it more, the Government complains about it publicly and trots out bullshit about catching pedophiles. The Government's methods are actually more dangerous to children since making that data insecurable guarantees people who are willing to break the law can get to it.

The Government doesn't want the data secured because it would complicate things for them yet the Government simultaneously says they have the right to all such data.

It is really evidence of a systemic bias in how the system works. Sure, the Judge can't really do anything [without being accused of activism and likely overturned by appeal] but that doesn't make this 'less bad'.

If it wasn't a general Government position that this was true, they should have muzzled their people and/or issued statements stating it was the position of those people and not the Government as a whole.

There's also a delightful two-step whereby the government can

1) require the disclosure or retention of data for some regulatory purpose (taxing, telecom regs, "just because", etc.), and then

2) require warrantless access to the data, since after all it was turned over to a third party.

> Obviously you can argue that it was wrongly decided in the first instance, but that's a different argument.

Isn't it the same argument?

The thing that has changed over time is the nature, quantity and implications of the data held by third parties. Target now knows a daughter is pregnant before her father does, etc.

Against this level of knowledge stored by third parties, the third party doctrine eats the fourth amendment. Which means that "the proposition that the government has at least as much right to access your data for law enforcement purposes as AT&T does for billing purposes" has to be wrong. The principle is defective. Who you call is the business of the phone company because they have to route your calls; how does that make it the business of the government?

If Smith stands for straw man, then it's even stronger today.

From the horses mouth:

First, we doubt that people in general entertain any actual expectation of privacy in the numbers they dial. All telephone users realize that they must "convey" phone numbers to the telephone company, since it is through telephone company switching equipment that their calls are completed.

People dial phone numbers, they don't dial cell towers or GPS location data, and there are of course infinitely many other examples.

Second, even if petitioner did harbor some subjective expectation that the phone numbers he dialed would remain private, this expectation is not "one that society is prepared to recognize as 'reasonable.'

I guess the times they are a changin'.

>I'd say Smith v. Maryland makes as much sense as it ever did.

I'd agree, but I don't think it was a good decision then, either.

Agreed, as usual. ISTM the EFF is begging the question (in the legal sense of assuming one's preferred conclusion as a premise) here by breezily asserting that Smith v. Maryland is outdated, without making any clear showing of why. Yes, you could look at the history of someone's telephone calls and infer that they planned to get an abortion, or had cancer, or had particular preferences in takeout food...but that was equally possible in 1979. Indeed, the EFF mentions government access to 'telephone books' - and while nowadays any telephone books I receive go straight into the recycling bin, back in 1979 they were the normal way of storing information, and my understanding is that telephone companies maintained reverse directories ordered by number.

This matters because while the government can obviously process data in a mere millisecond these days (like the private sector does), efficiency of execution has no bearing whatsoever on the question of whether people have an expectation of privacy in their phone records; the holding of Smith v. Maryland is that they do not, because by choosing to place a telephone call they have opted to share that information with the phone company, and the fact of the call becomes a mere business record. The Supreme Court's position was that there's a trade-off between anonymity and convenience, and where one opts for the convenience of a telephone call (facilitated by the telephone company) then one sacrifices any expectation of privacy. This matters since if phone calls are still considered business records 35 years on, then warrants are no more necessary now than they were in 1979.

There's a much stronger argument for the privacy of things like email, since one can send encrypted messages on a peer-to-peer basis by the simple expedient of running one's on mail server, even though most people choose to outsource that job to a commercial provider. But phone calls only go through exchanges, and there's no way to bootstrap your way into the phone network that's equivalent to firing up your own SMTP server - if you make a call through Verizon from your cell, how is that fundamentally different from making a call through AT&T from your landline?

> ... the realization that there are essentially no enforceable protections for information you store in the cloud, ....

How is the question of enforceability relevant to your argument?

Then what's the point of privacy policies if they are rendered useless by Smith vs Maryland? Then the privacy policies should only have two sentences:

"We can do whatever we want with your data once you give it to us. Problem?"

The truth is the government is just using the Constitution/rulings as it suits them. They've changed the meaning of the word "relevant" to mean millions of people for 3-hops from the target. They are doing the same with Smith vs Maryland. They're just pushing it to its very limit, or even far beyond the limit. But I doubt that if the Supreme Court from back then were to rule in a contemporary case like that, it would rule the same way.

What good is a "privacy policy" if it doesn't create an expectation of privacy?