Slashdot Mirror
The Privacy of Email
An Anonymous Coward writes "A U.S. appeals court in Ohio has ruled that e-mail messages stored on Internet servers are protected by the Constitution as are telephone conversations and that a federal law permitting warrantless secret searches of e-mail violates the Fourth Amendment.
'The Stored Communications Act is very important,' former federal prosecutor and counter-terrorism specialist Andrew McCarthy told United Press International. But the future of the law now hangs in the balance."
first post.
9 48241
Also looks like a dupe of this story http://yro.slashdot.org/article.pl?sid=07/06/18/1
I thought this balanced out to "States Secret", or better put, "You get privacy until we decide you don't need it"
http://www.eff.org/legal/cases/att/
boycott slashdot February 10th - 17th check out: altSlashdot.org
There is no more expectation of privacy in a plaintext email than there is in an open-face postcard. If you want privacy, take steps to encrypt it, not unlike putting a letter in a sealed envelope (as it pertains to the law, not ease of circumvention). This will be overturned, and with good reason.
Interested in open source engine management for your Subaru?
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
If the editors don't have time to read /. why should I? Oh yeah, the insightful comments. And the fresh jokes.
I have a few doubts. There are billions of emails flying about constantly. Anyone who beleives they can be effectivelly monitored has to be kidding themselves, so how useful is a law that says you can't do this?
Besides, if you are convicted, or suspected of crime, they can always obtain legal access to your mails, regardless, just as they could anything else you owned.
Perhaps I haven't had time to grow a sufficiently impressive tin foil hat, but I am given to think the whole idea is just plain silly.
You might as well pass laws that say you aren't allowed to follow the movement of a grain of silt in the Amazon.
Reality is that which, when we cease to believe in it, still exists. - Philip K Dick
I do like the "Where the third party is not expected to access the e-mails in the normal course of business ... the party (sending them) maintains a reasonable expectation of privacy." bit. We need more decisions like this, if we want to remain an even somewhat free society.
if I type "tempted by the fruit of her la-hoins" to a hawt secretary via e-mail....it'll be archived and private?
PS....i'm in ohio!!
Wasn't he in Weekend at Bernie's?
In a world of acronyms, the words are the real victims.
Oh no, they've amused some Slashdotters. That's about it, honestly, your average American doesn't know who Joe McCarthy was and has no notion of the reign of terror his inquisition brought about.
Sad, but true.
Despite the torrent of "email isn't private, and only stupid people think it is" posts that will follow, if a monkey at the local ISP took sensitive customer emails (to each other, not to the company) that he had plucked from their servers and posted them to a blog or whatever, there would be an outcry, criminal investigation, lawsuit, and (fake) apologies. If the prosecutor's own dirty emails to his wife|mistress|whatever were publicized, the prosecutor would suddenly discover that a crime had been committed.
When it comes to private parties, either communication is private, or it isn't. If it isn't, then Joe Schmoe who works at AOL or the local ISP can read customers' emails at random and post the amusing bits to a public forum. Anything Joe Schmoe can't legally do, his brother Officer Jim needs a warrant to do. If Officer Jim doesn't need a warrant to do it, that means Joe the private citizen can do it with impunity.
What we're saying is, "you have an expectation of privacy in your private affairs, unless it's a police eyeball/eardrum, and in those cases you have no expectation of privacy because your action was public and they don't need a warrant." Bullshit. Anything the police don't need a warrant for is something every single private citizen should be able to do with impunity. Anything we don't want the public doing (privacy-wise) is something the police should need a warrant to do. Otherwise you're giving police and prosecutors the power to arbitrarily target anytone they want, without any oversight at all. This isn't complicated, people. I can understand why they would ask for it, but not why we would be so stupid as to give it to them.
Seems like some judges are starting to understand this whole "electronic medium" stuff.
I wonder if their (grand)kids play WoW?
Vote monkeys into Congress. They are cheaper and more trustworthy.
Mongrel News all the news that fits and froths
Letters in the mail? Sealed with glue. Glue. Wow. You must not have much expectation of privacy there, otherwise you would've used a more robust method of ensuring your privacy. Even your phone calls are unencryped, sent as electrical impulses over wires and cables. Is it okay to listen to and record cellphone conversations, because they are transmitted through the air? If not, why not? If people wanted security, they wouldn't have transmitted those radio waves all over the place. People are so stupid.
It's true that we have laws against most (or all) of this type of surveillance. But it's just to protect the stupid people. I think that anytime it's possible to intercept your message, everyone should be able to do so, no warrant or probable cause needed, and use it in any way they want. That's the only way people will stop being so stupid that they think they have an expectation of privacy.
I thought this balanced out to "States Secret", or better put, "You get privacy until we decide you don't need it"
"Those who give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety."
The cost of freedom is the risk you take that someone will use that freedom to harm you. The payback is that you and your family live your lives free.
Please help metamoderate.
To refresh your memory, think back to the 2006 Duke University lacrosse case. Sophomore Ryan McFadyen, a member of the team and an attendee of the party, sent an email that parodied a bit from the book American Psycho, which is (or at least was) required reading in one of Duke's English Lit classes. The police got their hands on the email and threatened to release it to the press if he didn't admit to witnessing the alledged rape. To his credit, McFayden refused; he was subseqently villified by the press and suspended by the university.
It seems to me that this ruling means that McFadyen now has an excellent chance to pursueing a case against the prosecuter's office.
Nothing for 6-digit uids?
When I send a postcard, I have good faith that nobody along the way (mail carrier, other postal worker, OCR systems) will read what I have written. However, if someone or something handling my postcard along its journey really wanted to read the contents, to do so would be relatively easy.
It's the same case with a plaintext e-mail. I have good faith that no system administrators or automated monitoring systems will read my plaintext e-mail along its journey, but if someone really wanted to read the contents, to do so would be relatively easy.
Preventing this requires encryption for e-mail, and for tangible mail either a sealed letter (not much of a roadblock for the determined), or by actually encrypting the text I write on the postcard.
So yeah, there are some similiarities in my mind.
Since it's impossible to see if an e-mail message has been read or tampered with, this law in effect only makes it impossible to use e-mail messages as evidence before the appropriate court order is granted. It does not (effectively) prohibit wiretapping of e-mails, because there's no way to be sure whether it happened. I've said it before, and I'll say it again: an unenforcable law is a law written on toilet paper.
If the government were serious about e-mail privacy and authentication, they would:
* Make is very easy to use encryption. Germany has done its bit by funding an initiative to make GnuPG easy to use. Let the U.S. do its bit by mandating the installation of this (or a similar) package on every new computer sold.
* Teaching. Tell people that its very easy to snoop, especially for a government agency or company. Tell them how the Internet works and why encryption is important. Start at a young age, that is, in school.
* Operate a free certication authority, so that people who want to use the service can pop by the town hall with their ID-card and public key to have it certified.
I'm guessing this is for the valid legal citizens and green card holders only. Illegals should not be protected by the Constitution.
But after seeing articles like this, where the FBI already oversteps legal boundaries pertaining to email, I wonder if this will change anything at a government level?
It has been said that 63% of all statistics are made up
There are billions of emails flying about constantly. Anyone who beleives they can be effectivelly monitored has to be kidding themselves
Why is that? I mean, how many percent of all emails pass through not just one, but many spam/virus filtering software? I'd say that number is pretty high.
so how useful is a law that says you can't do this?
If emails are seen as somehow different (when it concerns privacy) then, say, telephone calls, it is completely legal for the government to request of ISP's if they may plant a filtering mechanism between the incoming/outgoing mail servers and the storage. With such a law, that would at least require some sort of judicial process. And don't for a moment believe ISP's wouldn't be willing to help against the 'war on terror'.
<tinfoilhat>
I'm don't know much about survaillance systems such as Carnivore and Echelon, but aren't those projects exactelly what is describes above?
</tinfoilhat>
I am not the type of person who has things to hide, but I also don't want any government associated individual "looking over my shoulder" so to say as there is very little or accountability for what that person or group does with or how they disseminate that information.
Except if they're investigating mail issues, fixing user accounts, etc. Some of this can be done with permission, which actually checking into the user account should. I've had to login to clients' email accounts myself in order to verify whether a problem is on the server (misconfiguration), the client (misconfiguration, connection issues, etc), or the user (wrong password, etc). Of course, sometimes it's just a telnet to port 110/25 in order to receive/send a test email, so I never see actual messages, but at times it can involve locally popping into the user's webmail or imap account to check that things work as expected.
Now when it comes to actual server issues, let's say you have consistently large emails bogging down the system. Or a new variety of SPAM, etc. At some point you might legitimately have a strong need to investigate what it is that's causing the holdup, and/or filter it appropriately (you do want to block large spams, you don't necessarily want to block normal emails with large attachments, etc).
Actually, the postal model works quite well. While the gov't can't just decide to rifle through your mail, I believe there are procedures for postal services to inspected and/or open-to-inspect suspicious mail. The only problem with this in the e-world is that the volume of email in a minute amount of time might be much greater than snail-mail, which if there is a "permission" process could become a bottleneck.
I wouldn't want the government reading all my emails. I might be OK if the ISP potentially ran across some of them in the scenario of a real issue... provided they weren't targeting anyone specific or for the purpose of reading emails. I've used a traffic sniffer at work to identify bad packets or virus-caused flooding, and seen all sorts of interesting goodies at the same time (why would ANY website submit a login via plan http instead of https??)
The ads on the side are generated based upon content pulled from the e-mail.. Therefore Google isn't respecting the privacy of my e-mail. Also, I wonder if online virus scanners are also in violation.
Shouldn't Ohio be more worried about the personal information of over 200,000 taxpayers that it has leaked instead of keeping email secure?
Does anyone note that there is an effort to reveal the emails of our "leaders". The ones they tried to delete unsuccessfully.
Gee, I wonder what effect this might have on that effort.
I'm all for keeping email confidential, but there is more going on here than they are saying.
I can see that maybe, just maybe, there is a judge bucking for a promotion.
An email is only "like a postcard" the same way an enveloped letter is "like a postcard".
A plaintext email cannot be read by accident. It has to be 'opened'. Viewing an email as it passes on the network or on your server is analogous to shining a bright light on an enveloped letter. It is not analogous to reading a postcard.
in the Steve Jackson Games case?
So, it's pretty well established that it's legal for the US to wiretap overseas Al Qaeda suspects without a warrant... unless they are calling some random person in the US, because this would be monitoring the phone call of someone in the US without a warrant.
(This is exactly the illegal domestic wiretapping that the Bush administration has been doing, but shouldn't be doing.)
Now, add email to the mix. Emails are now to be considered private communications in the same sense as phone calls. Good. The government is supposed to get a warrant to pick stored emails off a server, rather than being able to grab all available emails to any random person.
But what if the government was supposed to monitor one end of the conversation? If there is no warrant, the privacy right supersedes the government interest in any such conversation, and the gov't should not snarf the email.
Finally, add in the White House / Gop.com email record-keeping controversy. This is the perfect excuse. They can question the constitutionality of this portion of the Federal Records Act, since routinely storing the emails of Karl Rove to J. Random Operative and forwarding the files to Congress would be tantamount to domestic intercepts of email to J. Random Operative. And we can't have that, oh no! It would be Un-Constitutional!
And so, the White House gains one minor new problem, but may get to solve one major thorn in their side. Score one for GWB, I guess.
p.s. My CAPTCHA word is 'ecombine'. What kind of word is 'ecombine' supposed to be?!? Sure as hell isn't in Webster's...
Interesting, will you feel the same when a building comes down on your kids? Your grand kids?
Darwin wins...
I recall over the the years hearing that emails stored on a server belong to the owner of the server (or system). Basically, your emails belong to whom ever is storing them. So what happens if the XYZ Corp., who owns the email on it's servers, "voluntarily" submits a batch of emails to the federalies? Would the 4th still hold up?
"...a civilian some of the time, a soldier part of the time and a patriot all of the time." -Brig. Gen. James Drain
Here's how I submitted the story a few days ago:
At Volokh, Professor Orin Kerr notes a 6th circuit decision (pdf) about whether the 4th Amendment's expectation of privacy applied to Yahoo emails. Yes. Wired has more. EFF's friend of the court brief may have helped.
--
Meanwhile Dr. Kerr has more on the case, here.
Is it just coincidence that the 'sanctity of email privacy' precedent is being established at the same time there's growing attention to the practice of certain parties in the executive branch of the us gvt using non government mailservers (like partisan RNC email systems) to possibly sidestep public record retention laws?
LeetKey FF extension. Use it to keep your email privacy. Before sending a message, select it, right click on it, select 'LeetKey, Text Encryptors, AES Encrypt' menu option and type in a password. Tell the other party to use AES Decrypt and tell them the password for this email.
You can't handle the truth.
There is not a lot of things funnier in the world than seeing an article on email privacy submitted by "Anonymous Coward".
Sheesh, paranoid much?
>_>
Most of the public doesn't know how an email goes from me to you. They don't get it, and it'd be hell to try to explain it to them.
Note the difference between ease of interception and expectation of non-interception. I can send you a letter in the mail, but all it takes is someone with a finger (maybe two) to open the letter, and we no longer have that privacy. However, we still regard snail-mail as having an expectation of privacy. Hell, you can even encrypt an email and someone can intercept it and break the encryption, but we still have the same expectation of privacy. When it comes to email, most people don't know anything about TCP/IP or how the internet works.
Whether or not they encrypt their email, or obfuscate messages or just leave it as plaintext, they expect that their email will make it to its destination in its entirety without anyone looking at it. Simple? Naive? Yes, but it's a reasonable assumption for a person with limited-to-no technological knowledge to make. And those are the people that the law is trying to protect.
I draw a parallel to phone conversations. In most states, phone conversations recorded without the knowledge of both parties are inadmissible in court. That's why customer support tells you up front. We, as phone users, know the technology is available to intercept phone calls, and that it could be used to record our phone conversations, but we have an expectation that we're just talking to someone without being recorded unless they tell us otherwise. We can dig through our TOS for any email account we have, and unless we see that our emails are being logged and stored, we expect them not to be. It's easy to do, but we just expect them not to do it.
Now, forget the technical specifications of this, why shouldn't a warrant be issued for something like this? That's the crux of the case. Why should a law enforcement officer be able to go through your stuff without your knowledge or consent if no warrant has been issued? I'm sick and tired of the government taking away my liberties for law enforcement or national security. Why am I not running for office? Because the American people are sheep; I'd be painted as weak on national security and lose in a landslide. So instead, I'm treating the government like a corporation, which it essentially is, and fighting with my wallet. I'm moving the hell out of here to a country which respects my rights and liberties.
But before I do, I'm voting for Ron Paul. I'm not a fan of the Republicans, but this guy is a libertarian at heart and thinks the federal government is overstepping its bounds on just about everything it does. Give him a shot.
I, for one, would rather there be a criminal investigation of 9/11/01 - than to die in the next one.
The trouble with the "Greatest Generation" (to use that draft-dodging newsy, what's-his-face's tired, lame description) was their inability to have a full-scale criminal investigation of President Kennedy's assassination - had that actually occurred - there probably would never have been a 9/11/01 to ever take place (and the Bush family would have either been eradicated or completely run out of the country)...
When I want to talk privately, I could grab an empty office - or more reliably, talk in code. As in "Any chance of being on the team tonight, love?"
"The greatest lesson in life is to know that even fools are right sometimes" - Winston Churchill