Digg this story   Add to del.icio.us  
Of Dog Sniffs and Packet Sniffs
Mark Rasch, 2005-02-08

Why a Supreme Court decision on canine-assisted roadside searches opens the door to a new regime of Internet surveillance.

The Fourth Amendment to the U.S. Constitution is supposed to be the one that protects people and their "houses, places and effects" against "unreasonable searches." Forty-two years ago, the U.S. Supreme Court held that attaching a listening device to a public pay phone violated this provision because the Constitution protects people, not places, and because the Fourth Amendment prohibits warrantless searches without probable cause if the target enjoys a reasonable expectation of privacy.

Last month the U.S. Supreme Court effectively decimated this principle in a case that could have a profound impact on privacy rights online.

The case, decided by the court on January 24th, had nothing to do with the Information Superhighway, but rather an ordinary interstate highway in Illinois. Roy Caballes was pulled over by the Illinois State Police for speeding. While one officer was writing him a ticket, another officer in another patrol car came by with a drug sniffing dog.

There was absolutely no reason to believe that Caballes was a drug courier -- no profile, no suspicious activity, no large amounts of cash. The driver could have been a soccer mom with a minivan filled with toddlers. Under established Supreme Court precedent, while the cops could have looked in the window to see what was in "plain view," the officers had neither probable cause nor reasonable suspicion to search Caballes' car, trunk, or person.

Well, you know what happened next -- the dog "sniff" indicated that there might be drugs in the trunk, which established probable cause to open the trunk, where the cops found some marijuana.

Now here is where things get dicey for the Internet. In upholding the dog's sniff-search of the trunk, the Supreme Court held that it did not "compromise any legitimate interest in privacy." Why? Because, according to the court, "any interest in possessing contraband cannot be deemed 'legitimate.'" The search was acceptable to the court because it could only reveal the possession of contraband, the concealment of which "compromises no legitimate privacy interest."

The expectation "that certain facts will not come to the attention of the authorities" is not the same as an interest in "privacy that society is prepared to consider reasonable," the court wrote.

In other words, the search by the dog into, effectively, the entire contents of a closed container inside a locked trunk, without probable cause, was "reasonable" even though the driver and society would consider the closed container "private" because the search only revealed criminal conduct.

The same reasoning could easily apply to an expanded use of packet sniffers for law enforcement.

Currently, responsible law enforcement agencies limit their warrantless Internet surveillance to the "wrapper" of a message, i.e., e-mail addresses or TCP/IP packet headers, unless they have a court order permitting a more intrusive search. Looking at the "outside" of the communication has been treated as similar to looking at the outside of a vehicle -- and maybe peering into the window a bit. To peek inside the communication -- read the content -- required that you first get someone in a black robe involved.

The experiences of Mr. Caballes (the soccer mom, or me or you ) changed all that. The government is practically invited to peek inside Internet traffic and sniff out evidence of wrongdoing. As long as the technology -- like a well-trained dog -- only alerts when a crime is detected, it's now legal.

As context-based search technology improves, the government may soon have the ability to take Carnivore one better and deploy "intelligent" packet search filters that will seek out only those communications that relate to criminal activity. They may already have it.

Although these packet sniffing dogs sniff the packets of sinner and saint alike, they only bark at the sinner's e-mails. Thus, according to the new Supreme Court precedent, the sinner has no privacy rights, and the saint's privacy has not been invaded. In fact, the saint would not even know the search had taken place -- Internet surveillance is less noticeable than a dog sniff.

I think Sun Microsystems' president Scott McNealy was only slightly ahead of his time when he said, "You already have zero privacy, get over it." We could pass a aconstitutional amendment to protect our privacy rights, but I thought we did that on Dec 15th, 1791 when the Bill of Rights was ratified.

Hopefully, this case will be limited to a dark desert highway, and not find its way onto the Infobahn. But somehow I doubt it.


Mark D. Rasch is an attorney and technology expert in the areas of intellectual property protection, computer security, privacy and regulatory compliance. He formerly worked at the Department of Justice, where he was responsible for the prosecution of Robert Morris, the Cornell University graduate student responsible for the so-called Morris Worm and the investigations of the Hannover hackers featured in Clifford Stoll’s book, "The Cuckoo’s Egg."
    Digg this story   Add to del.icio.us  
Comments Mode:
Logic a bit flawed 2005-02-08
Anonymous (1 replies)
Logic a bit flawed 2005-02-09
Mark D. Rasch (5 replies)
Logic a bit flawed 2005-02-10
Anonymous (1 replies)
Logic a bit flawed 2005-02-10
Anonymous
Logic a bit flawed 2005-02-10
Anonymous
Kind of off 2005-02-10
MattJordan
Logic a bit flawed 2005-02-10
Anonymous (1 replies)
Logic a bit flawed 2005-02-11
Anonymous
Logic a bit flawed 2005-02-11
Anonymous
Weak analysis 2005-02-08
Anonymous (1 replies)
Weak analysis 2005-02-09
Mark D. Rasch (1 replies)
That makes no sense, Mark. 2005-02-09
Anonymous
Of Dog Sniffs and Packet Sniffs 2005-02-08
Anonymous (2 replies)
Of Dog Sniffs and Packet Sniffs 2005-02-10
MDH (1 replies)
Of Dog Sniffs and Packet Sniffs 2005-02-10
Anonymous
Does not follow (non sequiter) 2005-02-09
Anonymous
Of Dog Sniffs and Packet Sniffs 2005-02-09
Michael Britt
Of Dog Sniffs and Packet Sniffs 2005-02-09
A.W. Montville (1 replies)
Of Dog Sniffs and Packet Sniffs 2005-02-10
Anonymous
Of Dog Sniffs and Packet Sniffs 2005-02-09
Anonymous
Of Dog Sniffs and Packet Sniffs 2005-02-09
Anonymous (1 replies)
On Unreasonable Searches 2005-02-09
Mark Rasch (7 replies)
On Unreasonable Searches 2005-02-09
Bob Radvanovsky
On Unreasonable Searches 2005-02-09
Anonymous
On Unreasonable Searches 2005-02-10
Anonymous (1 replies)
On Unreasonable Searches 2005-02-11
Bob Radvanovsky
On Unreasonable Searches 2005-02-10
Anonymous
On Unreasonable Searches 2005-02-10
Unanimous
On Unreasonable Searches 2005-02-10
Anonymous (1 replies)
On Unreasonable Searches 2005-02-10
Anonymous (1 replies)
On Unreasonable Searches 2005-02-10
Mark D. Rasch
Scary... 2005-02-10
Anonymous
Analysis Flaw Revised 2005-02-10
Anonymous (2 replies)
Analysis Flaw Revised 2005-02-10
Anonymous (1 replies)
Analysis Flaw Revised 2005-02-10
Anonymous
Analysis Flaw Revised 2005-02-10
Mark Rasch (1 replies)
Of Dog Sniffs and Packet Sniffs 2005-02-10
RealisticCanadian
Of Dog Sniffs and Packet Sniffs 2005-02-10
Louis Helmke
Of Dog Sniffs and Packet Sniffs 2005-02-10
Caged Rat
Of Dog Sniffs and Packet Sniffs 2005-02-10
Anonymous
Of Dog Sniffs and Packet Sniffs 2005-02-10
Anonymous (2 replies)
Of Dog Sniffs and Packet Sniffs 2005-02-10
Anonymous (1 replies)
Of Dog Sniffs and Packet Sniffs 2005-02-11
Anonymous
Of Dog Sniffs and Packet Sniffs 2005-02-12
Anonymous
Of Dog Sniffs and Packet Sniffs 2005-02-10
a Seat Sniffer
Of Dog Sniffs and Packet Sniffs 2005-02-10
Edgar Whipple (2 replies)
Of Dog Sniffs and Packet Sniffs 2005-02-10
Anonymous (1 replies)
Of Dog Sniffs and Packet Sniffs 2005-02-11
Edgar Whipple
Of Dog Sniffs and Packet Sniffs 2005-02-10
Walt Donovan (1 replies)
Of Dog Sniffs and Packet Sniffs 2005-02-10
Caged Rat
Of Dog Sniffs and Packet Sniffs 2005-02-10
Anonymous
There is no "right to privacy" 2005-02-10
Andrew C. (1 replies)
Of Dog Sniffs and Packet Sniffs 2005-02-12
Anonymous
Privacy 2005-02-12
Anonymous


 

Privacy Statement
Copyright 2010, SecurityFocus