Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I've reached the conclusion that in order to receive constitutional protection of "my papers", they need to be "on paper". So, I essentially don't put anything on the internet, or even on my computer, unless I'm comfortable with it being on the internet, permanently (meaning until my great-grandchildren retire, in 120 years).

for reference, the Fourth Amendment to the Constitution of the United States:

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

I would like to think that "papers" in the text would also refer to electronic documents, but alas that seems to not be the case.

This is one of those cases where the saying "In Theory, Practice and Theory are the same, but in practice they're not." seems to fit.



You're setting up and knocking down a strawman. Its not a matter of electronic documents versus paper. A USB key in your desk drawer is protected as much as a stack of paper documents. This was not a controversial issue. Courts have treated electronic documents uniformly with paper ones for a long time with little fanfare.

The relevant issue is where these documents are located, and whether it's reasonable to have a privacy interest in documents transmitted in plain text over the internet. As an analogy: if you leave your physical papers in someone's garage, you cannot invoke the 4th amendment if the police find those documents otherwise lawfully. It's not reasonable for you to claim a privacy interest in documents over which someone else has unrestricted control.

That's the nature of an electronic document "in the cloud." Countless people have access to that document, at the service provider and also at intermediate routing nodes. If you use Google or Facebook, that information is even routinely scanned for advertising purposes. That's the nature of the internet. It's built on routing plain text information between unrelated nodes. Treating this information that is physically not private as "logically private" is a social fiction based on trusting service providers.

That's the question courts are faced with. Not whether electronic documents enjoy 4th amendment protection (they clearly do), but whether to indulge the fiction that documents which are as a factual matter not private should nonetheless be treated as private for 4th amendment purposes. There might be good reason to do that. There might also be good reason to stop short of fully endorsing the current status quo, and requiring service providers to make certain privacy guarantees in order for documents on their systems to enjoy 4th amendment protections.


Essentially, we agree, though: treat everything on the internet accessible to everyone for the foreseeable future.

You write: "It's not reasonable for you to claim a privacy interest in documents over which someone else has unrestricted control."

If my wife has access to it, then I am not protected. If I live in an apartment, then the landlord has access. If I rent a VPS on the internet, but the files are not connected to the internet (ssh access only, no other port open), the VPS provider has access.

No, it's not about someone else having access. It's about your expectation of privacy. If you expect something to be private (like my https gmail, or my unshared google drive files, or my unshared dropbox files...) then it should be considered the same as a paper diary in a drawer in your nightstand.

If you are led to believe the information will be kept private from government access (except as outlined in the 4th amendment), then you have a right to expect privacy.

I know very well how the internet works. I know there is more that can be done physically than legally, but the privacy expectation is a legal standing, not a physical standing.

The NSA, however, and the Patriot Act (such a horribly-named law) which seems to allow it, have ignored this legal restriction, and have, because of physical access, obtained data for which US citizens had reasonable expectation of privacy from search by the government.

You write " but whether to indulge the fiction that documents which are as a factual matter not private should nonetheless be treated as private for 4th amendment purposes." Ah, but that's exactly what the 4th amendment addresses. While the government can physically obtain such information, they are prohibited to do so by law. So it's not a fiction, it's the law.


> If my wife has access to it, then I am not protected. If I live in an apartment, then the landlord has access.

Apartments and safe deposit boxes are actually an excellent example of my point. There are legal and cultural restrictions on how a landlord or bank may access your apartment or safe deposit box. So those are protected by the 4th amendment. There are no such restrictions when it comes to data hosted in the cloud. If your landlord or your bank routinely rifled through your apartment or safe deposit box, as internet companies do with your digital accounts, then they very well might not be protected by the 4th amendment.

> It's about your expectation of privacy. If you expect something to be private

No, it's about "reasonable" expectation of privacy. And it's about whether that expectation is objectively reasonable, not subjectively reasonable. The fact that people have access to your documents is not determinative of whether an expectation of privacy is objectively reasonable, but is a strong factor in the analysis. Your expectation of privacy is a lot more reasonable when you're talking about an apartment, which a landlord may enter without permission only in an emergency, then when you're talking about an online account your service provider routinely rifles through in order to target advertising.

> While the government can physically obtain such information, they are prohibited to do so by law. So it's not a fiction, it's the law.

Sure, the 4th amendment is a fiction in the sense that all law is a fiction. My point is that the boundaries of the law do not need to be coextensive with the social fiction. Just because many people treat Facebook accounts as "private" does not mean that doing so is objectively reasonable in light of how many people at Facebook have access to those accounts, and in light of Facebook's data mining of those accounts. The appropriate legal standard may well be higher. E.g. expectation of privacy is only objectively reasonable when online accounts are end-to-end encrypted and not routinely data-mined.


Uh, but this end-to-end encrypted stuff is exactly what happens: We use https to upload stuff to our amazon servers, and crunch the data, and bring it back to us using https.

Should there not be 4th amendment protection in that case? And if so, and if the NSA accessed such data, how could their access possibly have been legal? The Patriot Act is not allowed to contradict the Constitution, and if it does, the Constitution takes precedence.


Oh, forgot, since it's held by a third-party, of course the government can collect this. I bet they take "unscheduled" snapshots that don't show up in the console. The Amazon workers are told to "just do your job" by their legal department. Right? Prove me this is not happening already.

Also, it matters not if it's encrypted, on the way, because the NSA has the capability to compromise the machines that contain the private keys. (Hackers with keyboards or goons with guns in datacenters).


Its not encrypted in the AWS instance if I understand correctly. And I'm not sure the NSA has in fact compromised AWS in that way.


You not being sure one way or another does not mean they haven't. So you must assume they have. Which is what Europeans and Canadians are doing and keeping their stuff off the US cloud servers.


It's pointless to talk to someone who concludes that the NSA is willing to ignore the law simply by extrapolating from things it has done that demonstrate intent to stay within the law as understood.


It doesn't matter whether you left your documents in your house, or your neighbors if "they police find those documents otherwise lawfully." So I'm not sure what your point is. I do have a reasonable claim of privacy if I leave a box of papers at my friends house. I can't claim that privacy if my friend gives the box to the police. But that doesn't give the police the right to barge into my friends house and take my property (without reasonable suspicion) Lets suppose the cops don't have reasonable suspicion to search my house for that box... If I give the box to a friend, and they don't have reasonable suspicion to search his house, they still don't have it, because I gave him the box. The only thing I don't have control of, is what my friend does with my box. In the Google case, I have a claim to privacy. I expect my mail to be private. It is my expectation, and the police should require the same warrants to get my data from Google than they would have to get it from my house.


How do I know my computer is not compromised? How do I know the files on my cell phone are not compromised?

We've already established the NSA is not acting within the constraints of law. That's what Snowden revealed. One cannot rely on the law (the constitution or any other) to gain safety from government spying.


> We've already established the NSA is not acting within the constraints of law.

What we've established is that the NSA is acting enough within the constraints of the law that different courts disagree as to the legality of its actions.


If I drive the speed limit for 300 miles on the freeway, but I speed on the last 10 miles, and a policeman gives me a ticket during the last 10 miles, can I say: "Officer, I was following the law most of the time, so it's ok?"

Acting within the constraint of the law means always acting within the constraint of the law, not just when it's convenient.


It's more like driving in a 60 mph zone and multiple officers with radar guns that disagree whether you were driving 59 or 65 mph.


If someone let's you borrow their desk, you place it in your home. Does that person have the right to enter your home and use that desk whenever that person sees fit?

    Oh, I forgot that I left my [really important item] in 
    that desk I let you borrow, and your backdoor was unlocked. 
    Just thought I'd come in and grab it.
What if the person sends their best friend over to retrieve said important item?

Could this person ask a police officer to retrieve it (say the person is handicapped)?

So we're borrowing these "cloud desks". Does that mean the stuff I've placed in the desk is also up for grabs?

Under your analogy, not only can they retrieve the item from the desk, but they also get to know all sorts of things about how I personally used the desk.

    I'm sorry, but I don't like it when you leave the 
    drawers of my cloud desk open like that. So, I 
    took a picture of it so I can keep track of its use.
Now, would you agree to a borrow of a desk if you are expected to not only maintain its quality of state, but also it is that you are expected to record your every interaction with it?

They're recording it for you — fair enough, but is the loaner permitted to share those photos with other people? When does it end?

So the loaner isn't a government. But extrapolating from this: The Fourth Amendment gives us a clear answer to this question. Sure, it's not private, but that is beside the point. How I use the desk, technically, is not private, but something stops the loaner from telling the entire neighborhood about how I used the desk. That something is unwritten, often described in terms of "the rules of decorum" or simply: it's not worth it.

Thank Goodness Our Founding Fathers Decided to Write Something Down that Explicitly Answers this Question — When does it end? — in an Explicit Context that Can Be Governed.

Heck, by this Decision, our government can share our metadata with FOREIGN ENEMIES at their whimsy based on international agreements that statistically legislate over terror. This Decision just makes us a metastatistic, ultimately collatoral damage of a digital war.

They're exacerbating this institutionalized equivocation exactly so that they can cultivate our consumerist behavior and behavior as content producers for their own financial gain. They're exploiting exactly the fact that the Founding Fathers could not have foreseen the digital age. They're doing this on purpose:

ooops sry i didn't know what an internat wuz im just too old i guess

They're not doing their due diligence to correctly interpret, adapt, and apply these laws. And the Judicial Branch is folding to monied interest indirectly.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: