Government Has a Right to Read Your Email?

gone.fishing writes to tell us that a new lawsuit is challenging the government's right to read your e-mail. The Minneapolis Star-Tribune is reporting that a seller of "natural male enhancement" products sued after a fraud indictment based on evidence gleaned from his electronic mail. Federal prosecutors say they don't need a search warrant to read your e-mail messages if those messages happen to be stored in someone else's computer."

Comments

What part of

[Marxist Hacker 42]

No Reasonable Expectation of Privacy in the Public Domain don't you understand?

Like it or not, the Internet was built by the Federal Government- and it very much is the public domain. Any message sent across it unencrypted is just as much fair game for prosecutuion as taking a picture of you mooning other cars on the freeway.

Re:What part of

[Mr. Underbridge]

Like it or not, the Internet was built by the Federal Government- and it very much is the public domain. Any message sent across it unencrypted is just as much fair game for prosecutuion as taking a picture of you mooning other cars on the freeway.

That's not the argument they're making. They're arguing that since you don't own the computer the message is stored on, you have no right to privacy.

That makes no sense, however. I don't own the phone network once it leaves my house (more precisely, the NID), but I have a right to privacy as defined by quite a bit of legislation.

Like it or not, the Internet was built by the Federal Government- and it very much is the public domain

Don't know where to start with this one. First, when we talk about "public domain," we're talking copyrightable works. The internet isn't copyrightable. Second, the government doesn't own the individual links in the internet backbone.

In short, I'm having a hard time seeing why an unsecured communication between two people should be protected when it's a phone conversation taking place over, say, Verizon-owned fiber, but not if it's an email saved on a Verizon-owned hard drive.

Re:What part of

[mattmacf]

This has nothing to do with Public Domain and everything to do with WHO has the expectation of privacy.

An analogy if you will. Suppose you and I commit a crime, the evidence of which is stashed at your house. The police come busting down your door without a warrant and find said evidence. In this case, your right to privacy has been violated and the evidence found cannot be used against you. However, this evidence can still be used against me. Why? Because I had no expectation of privacy IN YOUR HOUSE. As far as the law is concerned, the evidence found against me is as legitimate as if you had turned it in yourself.

Back to the email thing, the minute you send an email to an outside party, you voluntarily concede your expectation of privacy as YOU were the one who freely divulged whatever information was in that email.

Re:What part of

[Marxist Hacker 42]

Different public domain. When you're talking privacy laws, the Internet is more like FedEx, UPS, or your local city park than it is like a phone line or the highly protected US Mail.

Re:What part of

[Marxist Hacker 42]

Can emails you send be considered your "effects"? It's a good question.

I'd say NO- for the very reason put forth by the Feds. Once you send it out, that copy of the data belongs to the ISP, not you. No different than committing a crime in front of the local police station when you get right down to it.

Re:What part of

[ArcherB]

--> Any message sent across it unencrypted is just as much fair game for prosecutuion as taking a picture of you mooning other cars on the freeway.

You mean they can get me for that??

Only if they run the image through their new ass-recognition software.

Re:What part of

[Joebert]

If you have a Tattoo on your ass.

Re:What part of

[grylnsmn]

That's not the argument they're making. They're arguing that since you don't own the computer the message is stored on, you have no right to privacy.

That makes no sense, however. I don't own the phone network once it leaves my house (more precisely, the NID), but I have a right to privacy as defined by quite a bit of legislation.

That right there is the key. There is quite a bit of legislation protecting phone conversations. There isn't similar legislation in the case of emails.

In addition to that, the police do not need a warrant if they have permission from the owner. For example, if you get pulled over by the police, they don't need a warrant to search your car if they ask you for permission and you say "yes". Similarly, if they ask Verizon for the emails in a user's account, and Verizon gives it to them, it is perfectly legal without a warrant. The theory is that if the owner does not object to the search/seizure, then it must not be unreasonable.

Re:What part of

[vertinox]

In this case, your right to privacy has been violated and the evidence found cannot be used against you. However, this evidence can still be used against me. Why?

IANAL, but something about this tells me that a decent lawyer could find something to get this evidence dismissed against both parties due to improper police handling of evidence.

The better analogy would be that you rent out storage space at the local long term storage places and store your evidence there.

The police come and ask the storage space owner to search your space. Your a customer of his, but chances are the storage owner doesn't care enough about you to demand a warrant so it is a moot point whether they have it or not and grants them permission.

However, the key question is here does that rented space count as requiring a warrant since it is indirectly leased to you.

For some reason (someone correct me if I'm wrong about this) but as far as I know search warrants are still required for apartments for the residents even if the landlord agrees and gives the police a key to get in.

This is one of the reasons Landlords must give 24 hour notice before they enter the apartment etc.

The key question here if your email space on the server is considered "lease property" and technically owned by the persons paying for the space.

Re:What part of

[Marxist Hacker 42]

So if I send a work I've copyrighted through email, the ISP owns it?

They own that copy- which you as the copyright owner freely gave them by ASKING THEIR E-MAIL SERVER TO MAKE A COPY!

Damn! Should the Fed have the right to open your snail mail, too?

They did with US Mail before they passed a bunch of laws making it illegal. They still have the right to open snail mail sent through FedEx, UPS, or a half dozen other private carriers.

What's the difference?

The difference is that the laws haven't been passed to make snooping on e-mail illegal. Or for that matter, UPS and FedEx packets.

Even when in public, I have a right to reasonable privacy.

Not by the Supreme Court, who ruled that you have NO reasonable expectation of privacy in the public sphere.

For instance, it's illegal to take pictures up someone's skirt. UP their skirt, you know, from ground level? If someone happens to be leaving a car and wearing no undies, that's different.

Yes, but that's a different special exception law- like the special exception of privacy in the US Mail. No such law has been passed for the Internet yet.

You seem to be making up legal precedent to suit your argument. The internet is not "the public domain." How is it different than phone lines?

The laws haven't been passed to make ISPs common carriers yet.

I mean, your phone conversation passes through many different telcos and any of them could easily listen to your conversations, but this is illegal.

Yes, but once again, special exception laws had to be passed to create that expectation of privacy in the public sphere.

How is the Internet different?

There aren't any laws creating privacy there yet.

Don't ISPs have common carrier status, and doesn't that preclude them from monitoring your communications?

No, ISPs do NOT have common carrier status- and they can do whatever the hell they want to as far as monitoring your communications are concerned.

And doesn't the government have to play by different rules anyway?

Yes, to a certain extent- but you can't smoke a joint in front of a policeman and expect not to get arrested either.

In the US, our government is bound by the Constitution which precludes them from doing certain things that a company could do.

True, but this isn't one of them, because the Internet wasn't created at the time the Constitution was. Neither were phones or the US Mail service- which is why special laws had to be passed by Congress to create privacy in that portion of the public sphere.

In short, your argument makes no sense It almost seems as if you are being contrary just to be contrary. I can say that black is no different than white, but that won't make it so any more than your claims about our legal and governmental systems make them true.

And claiming common carrier status for ISPs when no such law has been passed is just plain stupid.

Re:What part of

[Marxist Hacker 42]

Sealed- but yes, very much so. A normal e-mail isn't a sealed envelope. A normal e-mail can contain a sealed envelope- that's what PGP is for- but since there aren't any laws protecting virtual sealed envelopes yet, you take your chance that the encryption won't be broken. They'll need a warrent to get you to give up the key though....

Re:What part of

[Fastolfe]

I suspect the parent poster is talking more about possession of the data than a transfer of your copyrights. In addition, ISPs are not considered common carriers, though they may be utilizing common carriers to send and receive your data.

If you have drugs in your car, and you loan your car to a friend, there's no law that says that they can't root around in your things, they have to be discreet about what they find, or that they can't drive up to a police station and let the cops have their way with your stuff. Your friend has lawful possession of your car, because you let them have it.

Your mail provider has lawful possession of your data, because you set up an e-mail account there. Your ISP also has lawful (though usually more brief) possession of your data, because that's the point of contracting for Internet service. You understood that by giving your data to them, they would send it over the Internet to its destination. Your ISP has business arrangements with other ISPs to make that happen. These ISPs must necessarily possess your data for a short period of time in order to perform the services you contracted with your ISP to perform. There is little (IF ANY) law that requires them to keep it confidential. (At least, that is the argument of the State.)

Even if you have some sort of contract with the friend (ISP) that says they do things to your car (data) that you don't want, there's no law that requires them to obey it. Worst case you take them to court for damages from their breach of contract. This will have no effect on the admissibility of the evidence.

Right to read

[laffer1]

This is more of a question rather than comment. Is it legal for them to read snail mail at the post office? Its stored there until you get it delivered. If no, then this lawsuit has a point.

Re:Right to read

[Marxist Hacker 42]

The difference being that the US Mail has laws protecting it's privacy. FedEx, UPS, and your local mailserver simply don't. It's perfectly legal for them to snoop on a FedEx overnight envelope while it's stored at a FedEx warehouse or when it hits the central depository in Chicago.

Re:Right to read

[balsy2001]

I think this is only if Fedex lets them. My guess is that Fedex etal will say you can't haveinformation on our clients without a warrant/subpoena. Otherwise why not just station a lay enforcement officer at all FEdex depot to search everything for potential criminal activity. On a kind of related note, several of my friends used to work at a UPS center during college and they said their instructions from the company in the event of accidental opening was to put it back in the box and ignore it even if it was weed or something.

Hearsay Evidence?

[wiz31337]

Even if your e-mail is stored on another individual's computer seized under a search warrant, the government cannot use this information as evidence.

According to the Federal Search and Seizure Manual written by the Department of Justice:

See United States v. Upham,168 F.3d 532, 535 (1st Cir. 1999). First, the warrant must describe the things to be seized with sufficiently precise language so that it tells the officers how to separate the items properly subject to seizure from irrelevant items. See Marron v. United States, 275 U.S. 192, 296 (1925) ("As to what is to be taken, nothing is left to the discretion of the officer executing the warrant."); Davis v. Gracey, 111 F.3d 1472, 1478 (10th Cir. 1997). Second, the description of the things to be seized must not be so broad that it encompasses items that should not be seized. See Upham, 168 F.3d at 535. Put another way, the description in the warrant of the things to be seized should be limited to the scope of the probable cause established in the warrant. See In re Grand Jury
Investigation Concerning Solid State Devices, 130 F.3d 853, 857 (9th Cir. 1997). Considered together, the elements forbid agents from obtaining "general warrants" and instead require agents to conduct narrow seizures that attempt to "minimize[] unwarranted intrusions upon privacy." Andresen v. Maryland, 427 U.S. 463, 482 n.11 (1976).

Even if found by coincidence the "natural male enhancement" e-mails would not be admissible in a court of law, they would be considered hearsay.

Specific instance of a general problem

[Jerf]

This is just a specific instantiation of a general problem with computers.

With old-style non-electronic messages, there is no distinction between the contents of the letter and the physical letter itself. Hundreds of years of laws and general ethical principles were written based on the assumption this will always be true. Now it's not, and it's all breaking down, but most people don't even notice this is the root of the problem because the assumption is so deeply ingrained. Instead, they want to just hack around the problem, not noticing you really need to rethink the whole system.

Copyright has the exact same problem.

The internet privacy advocates mentioned in the article, which the general /. populace will probably view with more sympathy than the government, by claiming that email should be treated just like physical mail are really committing the same error as the government, who are basically acting as if they do have a place where they could grab a physical letter and therefore they can, just as if it were physically sitting somewhere.

The reality is that we need to sit down and really re-think the entire situation. The old model is broken.

Catch 22...

[the_skywise]

"E-mail providers also routinely screen messages for spam, viruses and child pornography. That further undermines claims to the privacy of e-mail, government attorneys say."

Good point here. If you're allowing a company to snoop your email for spam/viruses then you're already negating the privacy issue. If the judges decide that privacy wins out then the spam companies can sue to say that the big ISP's have no right to snoop their mail for spam before reaching your computer.

On the one side you've got the phone-call analogy (where the government can't eavesdrop on your phone calls even though they go through a public system) and on the other you've got the photo developing places which can turn over photos to the government if they deem something they see is illegal.

Definitely an interesting case.

Interesting thing

[gillbates]

So, if I understand this right: The executive branch believes it has a right to read our email, because we have no "Constitutional" expectation of privacy, but the White House can refuse to turn over emails to Congress, because, alas, email is private?

So, I guess the Constitution gets interpreted differently when the subject of an investigation is the President. Hmmm....

Re:Interesting thing

[meta-monkey]

No, that's not what this is about.

The crux of the matter is that the owner of the machine on which the email resides is the focus of any attempt to read said email. So if your ISP has your email on their server, the feds can ask them if they'll hand over the email, without ever having to ask you. The ISP can either say, "Sure, here it is!" again without having to ask you, or they can say "No, we keep our customer's email private." At that point, the feds can get a warrant to search the ISP's computers, again without having to ask you.

In the case of the White House, I imagine they have their own, highly secure email servers, on which the President's email is stored. It is not stored by another outside ISP. Therefore the only way for Congress to get the President's email is to ask the White House, or subpeona it.

Not that that would matter, anyway. See Executive Privilege.

Sorry, I know a "Bush is evil" post is an easy +5 on /., but you're barking up the wrong tree on this one.

In Other News

[Aqua_boy17]

I just read that the President wants to increase the size of the military in Iraq. Maybe someone should tell him about this "natural male enhancement" so we can use it there?

What moron modded you "insightful"?

[mmell]

Your assertion is not unlike suggesting that I have no expectation of privacy in postal mail because for a length of time it was in the posession of a Federal agency, the US Post Office.

In Soviet Russia...

[Kelson]

I've woken up in the Soviet Union. No, the police cannot steam open your mail without a warrant. No, they cannot tap your phone without a warrant. (Until recently of course). Why we have given up on these principles and accepted universal wiretapping for newer technologies, I cannot imagine.

Kind of makes you wonder who really won the Cold War, doesn't it?

We've obviously been doing better than Russia and most or all of the other former Soviet republics, and capitalism clearly triumphed over communism, but when it comes to personal freedoms, we're doing to ourselves what we feared the Soviets would do to us. Did we really come out on top?

Encryption

[SirGarlon]

The gov't can read my e-mail all they want. At least, they can try to. http://enigmail.mozdev.org/

Re:Difference between phone & email

[meta-monkey]

Why more people don't use encrypted email boggles my mind.

Probably because it requires every person you send email to or receive email from to be aware of the encryption system and how to use it, and most users of email are technically illiterate? I, for one, don't want to have to try to teach my parents how to use PGP so the government won't find out I'm planning to arrive for Christmas dinner at 2PM.

Re:How I Learned to Stop Worrying...

[Qzukk]

Yes. It means that you and everyone you know are going to have to read the instructions on your mail client on how to encrypt and decrypt your mail. You can do it on any client that supports it, though most webmail clients do not directly (though you could write the email in a text editor, encrypt that, and attach the file to an email). You will all have to meet in order to exchange public keys securely and keep your private keys safe.

Hardly New

[Anonymous Coward]

This is not the slightest bit new.

As a matter of black letter law, the 4th Amendment does not protect "what a person knowingly reveals to the public." (Katz) Previous cases have held that your garbage, your bank records, and even phone records may be obtained without a warrant, provided that they are obtained from the third parties with which you are dealing and not your home.

There is federal statutory law on email (though I don't recall the precise citation) that treats email as a hybrid between telephone conversations and documents. To read your email in real-time as it comes in, the government requires a warrant. If you leave it on your ISP's mail server for longer than some period of time (not sure how long, but it's something longer than an hour and less than a month), then the email is treated as a document and can be obtained like any other record.

Normally a warrant to search a house, tap a phone or intercept email requires probable cause. However, this requirement is different if "a substantial purpose" of the investigation is foreign intelligence surveillance. In that case the warrant can be obtained with something less than probable cause under FISA as modified by USA Patriot Act (though there are still pretty stringent requirements; the gov doesn't get carte blanc to snoop on anybody)

Long story short, if you don't want it read, don't leave it on somebody else's server and don't do anything that would convince a judge that you pose a threat to the country.

Re:Sure I am guilty...

[Mathonwy]

Are you kidding? The method by which the information was gathered is INCREDIBLY important to a case. It has to be. Some brief examples of why:

Judge: "Very compelling evidence here. How did you come by it?"
Sherrif: "Me and the boys made it up. It seemed like the sort of thing he would do."

Judge: "Very compelling evidence here. How did you come by it?"
Sherrif: "One of our men went undercover and pretended to be his friend. He wasn't originally planning on doing it, but after our guy kept encouraging him, he managed to convince him to consider it. Then we nabbed him!"

Judge: "Very compelling evidence here. How did you come by it?"
Sherrif: "We broke down his door, surprising him in the act."
Judge: "Very fortunate! How did you know it was him?"
Sherrif: "Oh, we didn't. We just went down the line and kicked in all the doors on all the houses on the street until we found someone doing something guilty."

Judge: "Very compelling evidence here. How did you come by it?"
Sherrif: "We just held his head underwater until he thought he was drowning. We did it enough times, and he confessed to everything. He didn't even read the confession we prepared for him! He was just that eager to sign. Must have had a guilty concience or something."
[optional ending]
Judge: "Very fortunate! How did you know it was him?"
Sherrif: "Oh, we didn't. We just started torturing people. Eventually they always confess to SOMETHING..."

So let's review. In example #1, it matters how they got the evidence, since it matters that it actually be, you know, EVIDENCE. #2 is what is called "entrapment", and is kind of a manufactured guilt. (i. e. they woudn't have been guilty of anything except that an undercover officer went and tried to convince them to do something illegal.) #3 is an example of where [possibly] justice was done to one person, at the expense of the justice of everyone else. (How would you like to have your door kicked in some day by police, who then say "ok, you're clean. Just checking!" Would the knowledge that they MIGHT catch someone that way be enough to offset your outrage at having your privacy invaded and your posessions broken?) And finally, #4 kind of speaks for itself. (I hope.)

So yeah. The reason that there is a mindset that "how the evidence is gained matters as much as the guilt" is because it kinda does. Or how about this: Think of it from a logic perspective - Your proofs are only as strong as the axioms they are based on. Legal judgements only have as much justice as the evidence they are based on. So before handing out judgements, it's INCREDIBLY IMPORTANT to make sure that the evidence is all on the up-and-up. You are probably thinking of cases where "well, everyone knew he did it, who cares how they proved it? If he walks, it's on a technicality", but YOU CAN'T CONVICT SOMEONE BASED ON "everyone knows they did it." And you SHOULDN'T be able to. (That way leads to mob-rule.)

Re:Difference between phone & email

[Fastolfe]

Why more people don't use encrypted email boggles my mind.

Is there some keyboard shortcut in Google Mail that I'm missing? People don't use encrypted mail because it's not readily available. Yes, the technology has been around for decades, but until it's pointy-clicky accessible via all of the major e-mail providers, it'll never go anywhere.

Re:Email should be protected.

[Todd Knarr]

It was protected as well. But it wasn't in his home, it was in the homes of the people he sent it to. He's claiming not that the government shouldn't be able to search his mail, but that the government shouldn't be able to search the mail of the people filing complaints about him even if they give permission for the search. In short, he's claiming that mail in someone else's mailbox belongs to him and he can control access to it. Which is wrong.

Spammer

[pluther]

Smart of them to go try this out against a spamming fraudster (or is that fraudulent spammer)?

Certainly there is easily enough evidence out there to obtain a search warrant.

And it's not like search warrants are difficult to obtain.

The only reason I can think of not to bother in this case would be because someone wanted to set a precedent. And who better to set one against than someone hated by everyone?

Laws need to be updated

[Wiseazz]

The "Stored Communications Act of 1986" clearly needs to be updated, which is another example of why we need to keep a close eye on technology-specific legislation. Today's good idea becomes tomorrows loophole (for gov and criminals alike - both of which will take full advantage without thinking twice).

But the one thing that has never changed since the dawn of written communication is this: If you don't want something read, then don't write it down. Especially if you're laundering money from the insecure and poorly-endowed... because that's just wrong!

Doesn't even apply here!

[RvLeshrac]

You've all (or at least the vast majority of you) failed to notice that this case does not even invoke this act.

If you send me a letter describing in great detail how you intend to blow up with on , that letter then becomes my property. I can pass it along to law enforcement agencies as I see fit, etc.

If you send me spam, I can then pass that spam along to law enforcement agencies as I see fit. If you give me a 3 lb brick of black-tar heroin, I can do the same.

This act affects electronic messages which are stored by a recipient and then siezed, not messages which are voluntarily submitted to law enforcement. There is very little you can do if someone else legally obtains evidence against you and then hands it over to someone else, save for a lawsuit against the individual in question.

That said, the defendant in this case (The US Government) will be defending this act to the end, regardless of whether or not the act violates personal liberties - it DOES appear to, but again, this act has absolutely no bearing here.

Yet Another Reason...

[eno2001]

...why I say; run your own mail server. I do it. I've done it since 2001. I've had too many instances of incompetence at ISPs and large mail service providers losing my mail and not restoring it. Sure, they can read it on the way in or out, but then it's a different beast than actually getting onto my system without a warrant. Plus I have the added benefit of having a private mail system that is not accessible to anyone on the net as it's on a darknet used by friends and family. Simple solutions really. Until someone decides to make them "illegal".

Re:And I would argue

[Agelmar]

Does it tell you how to get someone else's public key? Does it walk you through how finding out if the key on pgpkeys.mit.edu is really *my* key or someone else's? And please, do tell me how the hell I'm supposed to get the public key for my bank - any of the five I have a relationship with. Try calling up Bank of America and telling them that you want to send them an email about your account and need their PGP key. If you're lucky you might get someone who has a clue after five transfers, who will just tell you that "Sorry, this is not supported." That's if you're lucky. Now try to get me a key for DeutscheBank. Or, if you really want an exercise in futility, try to tell me how to get a key for Bank of .

Encryption is all well and good, and if you look on pgpkeys.mit.edu you will find my key. I drank the kool-aid a long time ago, but I certainly don't consider encrypted email to be a solved problem. Keyservers, as they are today, are basically a hack. There's no guarantee that you have the correct key. Sure, we could start reading fingerprints and hashes to each other over the phone, but that's far from ideal, and still doesn't solve the problem that if Alice doesn't already know Bob, calling who she believes to be Bob is really not doing all that much to verify any sort of real-world identity if she found Bob's phone number online (the same place she found Bob's key).

The fact that there's a "help" topic does not mean it's a solved problem.