Digg this story   Add to del.icio.us   (page 2 of 3 ) previous  next 
Get Off My Cloud
Mark Rasch, 2008-08-19

Story continued from Page 1

Contrast this procedure with that required by both the U.S. Constitution and the rules implementing them. If the mail was, for example, stored not by an ISP, but rather on Warshak's own internal mail server (and putting aside subpoenas to the recipients of the e-mails), the government would need a warrant, supported by probable cause, not just "reasonable grounds to believe," with an oath or affirmation to a neutral magistrate.  Under the Fourth Amendment, the warrant would have to specify exactly what was to be searched for and seized, and the evidence seized would have to be supported by probable cause. The warrant would have to be narrowly tailored to seize only the evidence for which there was probable cause, and could not be what the law calls a "general warrant." Finally, the government would have to prepare an inventory of whatever was seized, and give a copy of the warrant and a receipt to the suspect.

Thus, as a general rule, if the cops take stuff from you with a warrant, you know it, you know when, and you know what they took.  The law does permit the judge to delay notice.

So Warshak challenged the constitutionality of the Stored Communications Act, trying to get a court order preventing the government from further seizing his e-mails without an actual warrant with notice and everything.  Just as if his mail was, well, his mail, and not simply some file residing in a server at Yahoo or NuVox. The trial court ruled that Warshak was right, and issued the injunction finding that the search without notice or probable cause violated the Fourth Amendment, that the government's refusal to say that it wouldn't do it to Warshak again, coupled with the fact that the government had a policy of getting these orders without search warrants meant that there was at least a likelihood that Warshak's privacy could be violated in the future.

The Court of Appeals agreed, at least initially.

Meanwhile the government used the NuVox e-mails at Warshak's criminal trial.  When Warshak complained that they had been obtained in violation of the Constitution, the trial court held even if the statute was unconstitutional -- and allowed for illegal searches and seizures -- because the cops reasonably relied on it the seizure of the e-mails was OK. The court went on to say that because it was Warshak's e-mails that were seized, none of Warshak's co-defendants could complain even if the search was illegal.

That still left the original court order preventing the government from seizing Warshak's e-mails in the future.  Last week the Court of Appeals reconsidered its original decision, and found that the issue was -- much like a Salmonella tomato -- not "ripe."  You see, now that Warshak was in jail, there was little chance that the government would want to read his e-mail, or indeed that he would have access to e-mail.  Thus, the court found that even if the process was patently unconstitutional, you couldn't prevent it from happening, because you can't prove they are going to take it in the future, and you cant do anything about it afterwards, because the government can rely on a statute authorizing illegal conduct. Warshak's only recourse now would be to sue the FBI agents that subpoenaed his e-mail, or his ISP.

The Court of Appeals last week, not satisfied with finding that Warshak's claim was not "ripe" because he couldn't say where or when the government was going to seize his e-mail, went further in a very dangerous manner.  The Warshak court said that it had no idea if e-mails potentially seized by the government without a warrant would be subject to any expectation of privacy by Warshak.  The Court noted that ISP's have all kinds of policies and practices regarding the privacy of their customers electronic communications, with some like AOL saying that the ISP "will not read or disclose subscriber's e-mails to anyone except authorized users," some like Juno saying they "will not intentionally monitor or disclose any private email message" but that it "reserves the right to do so in some cases" and some like Yahoo stating that it shall have the right to pre-screen content, or that content may be provided to the government on request.

The court, for example relied on Google's Gmail service, which permits automated review of the contents of e-mail (for advertising purposes), or statements by corporate employers eschewing an expectation of privacy by users of the system.  The government urged the court to go even further, arguing that there is no constitutional protection of privacy in e-mail where, for example, the ISP used malware scanners to look for malicious code in e-mail or deep packet inspection of e-mail.

Couple this with prior Supreme Court precedent in Smith v. Maryland where the government sought to subpoena from a telephone company a subscriber's use data -- information such as time of calls, who they called, how long the call lasted. Just as with Warshak, the defendant claimed that the government needed a search warrant, and the government claimed that Smith had no reasonable expectation of privacy in this "non-content" information.  The Supreme Court agreed with the government, noting "we doubt that people in general entertain any actual expectation of privacy in the numbers they dial. All telephone users realize that they must "convey" phone numbers to the telephone company, since it is through telephone company switching equipment that their calls are completed. All subscribers realize, moreover, that the phone company has facilities for making permanent records of the numbers they dial, for they see a list of their long-distance (toll) calls on their monthly bills."

Story continued on Page 3 



Mark D. Rasch is an attorney and technology expert in the areas of intellectual property protection, computer security, privacy and regulatory compliance. He formerly worked at the Department of Justice, where he was responsible for the prosecution of Robert Morris, the Cornell University graduate student responsible for the so-called Morris Worm and the investigations of the Hannover hackers featured in Clifford Stoll’s book, "The Cuckoo’s Egg."
    Digg this story   Add to del.icio.us   (page 2 of 3 ) previous  next 
Comments Mode:
Get Off My Cloud 2008-08-19
Anonymous
Get Off My Cloud 2008-08-19
Anonymous
Get Off My Cloud 2008-08-19
Todd Knarr
Get Off My Cloud 2008-08-20
Bill
Get Off My Cloud 2008-08-20
MrGroove
Get Off My Cloud 2008-08-28
Anonymous
Get Off My Cloud 2008-09-03
Anonymous
Get Off My Cloud 2008-09-09
Anonymous (1 replies)
Re: Get Off My Cloud 2008-09-11
Anonymous (1 replies)
Re: Re: Get Off My Cloud 2008-09-17
Anonymous (1 replies)
Re: Re: Re: Get Off My Cloud 2008-09-19
Anonymous
Get Off My Cloud 2008-09-28
Dale


 

Privacy Statement
Copyright 2010, SecurityFocus