Digg this story   Add to del.icio.us   (page 3 of 3 ) previous 
Get Off My Cloud
Mark Rasch, 2008-08-19

Story continued from Page 2

Applying that rationale to e-mail, all (well, most) Internet users realize that they must "convey" e-mail content to the ISP, since it is through the ISP's routers that their e-mails are transferred.  All -- well, most -- users realize that the ISP has facilities for making permanent records of the contents of their e-mail -- storing it -- for they see a list of their e-mails when they log on."

The Smith court went further. It noted that the Court "consistently has held that a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties and that:

When [Smith] used his phone, [he] voluntarily conveyed numerical information to the telephone company and "exposed" that information to its equipment in the ordinary course of business. In so doing, [he] assumed the risk that the company would reveal to police the numbers he dialed.
Thus, when you "voluntarily" turn stuff over to a third party -- a bank, an accountant, the phone company, or presumably an ISP, you run the risk that they can turn it over to the cops, and therefore you have "no expectation of privacy."

More persuasive is Justices Brennan and Stewart's dissent in Smith where they note:

The Court today says that [Constitutional] safeguards do not extend to the numbers dialed from a private telephone, apparently because when a caller dials a number the digits may be recorded by the telephone company for billing purposes. But that observation no more than describes the basic nature of telephone calls. A telephone call simply cannot be made without the use of telephone company property and without payment to the company for the service. The telephone conversation itself must be electronically transmitted by telephone company equipment, and may be recorded or overheard by the use of other company equipment. Yet we have squarely held that the user of even a public telephone is entitled "to assume that the words he utters into the mouthpiece will not be broadcast to the world."

Justice Thurgood Marshall went further in Smith noting:

Implicit in the concept of assumption of risk is some notion of choice. . .  [U]nless a person is prepared to forgo use of what for many has become a personal or professional necessity [the telephone or the Internet], he cannot help but accept the risk of surveillance.  It is idle to speak of "assuming" risks in contexts where, as a practical matter, individuals have no realistic alternative. More fundamentally, to make risk analysis dispositive in assessing the reasonableness of privacy expectations would allow the government to define the scope of Fourth Amendment protections. For example, law enforcement officials, simply by announcing their intent to monitor the content of random samples of first-class mail or private phone conversations, could put the public on notice of the risks they would thereafter assume in such communications.

The same holds true for Warshak's e-mail, Apple's MobileMe service, Google's GMail or Google Documents, or any remote storage facility. Almost by definition you have to use a third party to transmit this information, and almost by definition the third party has to make a "copy" of the communication.  This is, in fact, the essential nature of "cloud" computing -- the data resides somewhere else and you just "access" it.

The real problem with the Warshak Court's ruling -- and here is where it gets dangerous -- is that it essentially held that your expectation of privacy with respect to the government's seizure of your e-mail is dictated by the terms of the contract with the ISP. These terms of use, which generally may provide the ISP or storage facility a limited "right of entry" or "right of inspection" are intended to protect the ISP from liability, not to establish the balance of privacy vis a vis the government.  Indeed, even if your employer said you had "no right of privacy" in your corporate e-mail, this wouldn't necessarily mean that the cops could read the e-mail without a warrant or a subpoena.  It might mean that if the ISP or employer examined your email pursuant to their policy and then saw something and called the cops that this would be appropriate.

Privacy is not binary -- it's not that you either have it or you don't. You may have an xpectation of privacy vis a vis the FBI, and less with respect to your ISP.  In fact, this is exactly the opposite of the position that the government took a few days later when it charged (pdf) a Philadelphia news anchor with reading his co-anchor's email, stating:

Our e-mail is private, just like our telephone conversations and mail. Our expectation of privacy for e-mail is even higher, due to the high level of security used in transmitting Email messages.

The government went on to say "people expect that e-mail in a password-protected, personal e-mail account is private."

Sure. Unless, of course, the government wants to read it.  In that case, according to both the government's brief and the court's opinion, you have no expectation of privacy.



Mark D. Rasch is an attorney and technology expert in the areas of intellectual property protection, computer security, privacy and regulatory compliance. He formerly worked at the Department of Justice, where he was responsible for the prosecution of Robert Morris, the Cornell University graduate student responsible for the so-called Morris Worm and the investigations of the Hannover hackers featured in Clifford Stoll’s book, "The Cuckoo’s Egg."
    Digg this story   Add to del.icio.us   (page 3 of 3 ) previous 
Comments Mode:
Get Off My Cloud 2008-08-19
Anonymous
Get Off My Cloud 2008-08-19
Anonymous
Get Off My Cloud 2008-08-19
Todd Knarr
Get Off My Cloud 2008-08-20
Bill
Get Off My Cloud 2008-08-20
MrGroove
Get Off My Cloud 2008-08-28
Anonymous
Get Off My Cloud 2008-09-03
Anonymous
Get Off My Cloud 2008-09-09
Anonymous (1 replies)
Re: Get Off My Cloud 2008-09-11
Anonymous (1 replies)
Re: Re: Get Off My Cloud 2008-09-17
Anonymous (1 replies)
Re: Re: Re: Get Off My Cloud 2008-09-19
Anonymous
Get Off My Cloud 2008-09-28
Dale


 

Privacy Statement
Copyright 2010, SecurityFocus