Slashdot Mirror
The Fourth Amendment and the Cloud
CNET has up a blog post examining the question: does the Fourth Amendment apply to data stored in the Cloud? The US constitutional amendment forbidding unreasonable searches and seizures is well settled in regard to the physical world, but its application to electronic communications and computing lags behind. The post's argument outlines a law review article (PDF) from a University of Minnesota law student, David A. Couillard. "Hypothetically, if a briefcase is locked with a combination lock, the government could attempt to guess the combination until the briefcase unlocked; but because the briefcase is opaque, there is still a reasonable expectation of privacy in the unlocked container. In the context of virtual containers in the cloud...encryption is not simply a virtual lock and key; it is virtual opacity. ... [T]he service provider has a copy of the keys to a user's cloud 'storage unit,' much like a landlord or storage locker owner has keys to a tenant's space, a bank has the keys to a safe deposit box, and a postal carrier has the keys to a mailbox. Yet that does not give law enforcement the authority to use those third parties as a means to enter a private space. The same rationale should apply to the cloud." We might wish that the courts interpreted Fourth Amendment rights in this way, but so far they have not.
Shouldn't the same privacy logic apply even more to your laptops and personal electronic devices when you're entering U.S. borders? Having these people search your hard drive is an invasion of privacy.
http://www.object404.com
If you want your data to be safe,especially when you plan to store it online in this new-fangled cloud thing, then encrypt it. You can't trust a service provider to stand up to a government access order, and you can't rely on the security of a storage system that you didn't make yourself.
Be responsible for your own data privacy instead of relying on an ambiguous interpretation of an ammendment written before the days of digital data.
You can advertise in this sig from as little as £99.99 a month!
Seriously. Can we just save everybody the trouble and travel 5 years into the future when this whole cloud FAD runs its course? Maybe by then all the hype surrounding Twitter and Facebook will have died down a bit. And hopefully use of the word "blogosphere" will be punishable by death.
Wait a minute. I'm a manager, and I've been reading a lot of case studies and watching a lot of webcasts about The Cloud. Based on all of this glorious marketing literature, I, as a manager, have absolutely no reason to doubt the safety of any data put in The Cloud.
The case studies all use words like "secure", "MD5", "RSS feeds" and "encryption" to describe the security of The Cloud. I don't know about you, but that sounds damn secure to me! Some Clouds even use SSL and HTTP. That's rock solid in my book.
And don't forget that you have to use Web Services to access The Cloud. Nothing is more secure than SOA and Web Services, with the exception of perhaps SaaS. But I think that Cloud Services 2.0 will combine the tiers into an MVC-compliant stack that uses SaaS to increase the security and partitioning of the data.
My main concern isn't with the security of The Cloud, but rather with getting my Indian team to learn all about it so we can deploy some first-generation The Cloud applications and Web Services to provide the ultimate platform upon which we can layer our business intelligence and reporting, because there are still a few verticals that we need to leverage before we can move to The Cloud 2.0.
And if the data center is in another country, would the 4th Amendment apply there?
If so, how would you enforce it? Soldiers with machine guns show up, grab all of your data, crack the encryption, and take what they want. And you'll do exactly what?
The data is gone and seen, so you're screwed. And even if you have super duper one hundred billion bit encryption, your data center and data are gone. So, you have up to the second back-ups?
Other than cost, I see no upside to cloud computing.
at the point when urine drug testing was mandated by the government for any company receiving government contracts. You know back in the days of Ronnie Raygun and the "Just Say No" crusades?
If you aren't secure against government searches OF YOUR OWN BODILY FLUIDS, do you really think that they will respect your right of privacy regarding some random 1s and 0s stored on a private corporation's computers somewhere?
Remember "News for Nerds, Stuff that Matters"? Help make it a reality again! http://soylentnews.org
Wasn't it a core value of the Internet that it was abstracted above limitations of juridical boundaries, political division and secular belief systems to provide redundant fail-safe communication world wide enabling human progress in the face of systemic failed governance?
How does advocating _for_ juridical application of the 4th virutally annexing "the cloud" as the 51st state... tell me again how that abstracts the medium above the landscape.
The US constitutional amendment forbidding unreasonable searches and seizures is well settled in regard to the physical world
Electrons in computers ARE part of the physical world.
Stop conceding that is it different!
IT'S NOT!
They can scoop some out of the bowl when I'm done having my Morning Glory, if they're that bothered about how much I had to drink last night.
They can also just ask me. The answer is "If you haven't brought me some black coffee and dry toast in 5 minutes, I'm barfing on your shoes."
Finally had enough. Come see us over at https://soylentnews.org/
[T]he service provider has a copy of the keys to a user's cloud 'storage unit'
Why the hell would I want to give a copy of the keys to the service provider?
Just because you use the cloud to store bits of data doesn't mean that you'd want to store unencrypted bits of data there. Those that do risk distribution of your unencrypted data via a multitude of channels, including but certainly not limited to:
Why would anyone hand the keys to all their important data to a 3rd party that they don't personally know? Just because they're under a contract with that 3rd party? A contract drawn up exclusively by that 3rd party? With clauses designed to exclusively to protect that 3rd party?
It is worth noting that under the Constitution, there is no federal power to search or seize, at all. Thus people who say that the 4th amendment doesn't list something as protected, like a computer file, miss that point. The 4th amendment is that the government is allowed to search mail, with a warrant, and nothing else.
This is my sig.
This post starts with a false statement. 4th amendment rights are not well settled. They've been challenged and altered repeatedly within the last decade.
If you know anything at all about security, you won't let your data be stored on someone else's computers and travel on someone else's network in the first place. (Spoken in the voice of Fat Tony) Off-site storage is absolutely necessary, but there are other, more expensive, more tedious, but far more secure methods of keeping your data off site. And please don't keep a paper trail.
Seven puppies were harmed during the making of this post.
Specifically, would it be wise to assume that all, or any, backups will only be taken in america, or that the data won't get routed to or through another country.?
It's a big world out there and the USA is only a small part of it.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
t, way back in 1986.
http://en.wikipedia.org/wiki/Stored_Communications_Act
"With respect to the government’s ability to compel disclosure, the most significant distinction made by the SCA is between communications held in electronic communications services, which require a search warrant and probable cause, and those in remote computing services, which require only a subpoena or court order, with prior notice. This lower level of protection is essentially the same as would be provided by the Fourth Amendment—or potentially less, since notice can be delayed indefinitely in 90-day increments."
So no warrant is needed, just subpoena and notice. As the wiki article points out, this is essentially the "third party doctrine," which already exists for the Fourth Amendment. The third party doctrine basically states that if you reveal information to a third party, you can't make a fourth amendment claim against that info.
Rather... no warrant is needed for cloud computing services, which I'd say is the very definition of a remote computing service.
Here in Holland the landlord does not have a key to a tenant's space. The landlord is not allowed to enter the tenant's space without the express permission of the tenant. I think the same should apply to a service provider in relation to the users storage unit in the cloud.
A bit offtopic but I think it is important for lawmakers : stop doing analogies. Cryptography does not work like a lock or like an opaque case, owning cryptographic keys does not make you the landlord of anything. Cryptography works by taking a clear message and a key and mix them in a way that produces a seemingly random information but that can be made sense of thanks to the decoding key and the decoding algorithm. It is not that hard to understand. It requires 30 secondes of focus to understand and twenty minutes of thinking about and around, and you have understood the basis of crypto.
Dear lawmakers, please make laws about cryptography, not about analogies of cryptography if you don't want me to just be an analogy of a law abiding citizen.
Thanks.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
and therefore, it makes sense that it is also different legally
moving bits around is completely unlike moving pieces of paper around, in all sorts of fundamentally significant ways, with all sort of implications and ramifications for how society does work, could work, and should work
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
As far as US law is concerned in this regard, the 4th Amendment is not so much the problem as is the 40 yr old "expectation of privacy" test.
Perhaps it's time to change that one and bring it up to date particularly in light of the fact that it doesn't seem to apply to very much any longer.
The larger problem--as pointed out above by petes_PoV--is the international jurisdiction issue; "where" is the data cloud?
The answer to that question determines which laws--including any related "third party doctrines"--will apply.
Will google respect non-US law when it comes to turning over cloud data to non-US gov't agents?
if you want something private, don't put it on the internet
if you want a private conversation, walk with the person on a beach
everything else is subject to snooping, and not just by the government. there are other less savory entities out there that can pilfer your information
so if its important, just keep it off the wires. this is a complete shortcircuiting of all of the legal arguments
because even if you successfully clamped down on the government across all legal avenues, the government really is the least of your worries in terms of who can snoop on you and why. there is no protection that works except your own attempts to secure your data. that's your job, not the government's
there's people reading this comment who buy guns because they don't trust the government to protect them. so why would anyone trust the government to protect their privacy online?
protect yourself with your own protocols for how and when and what is disclosed over a wire. this shortcircuits all the needless legal arguments, since the potential list of online snoopers does not begin nor end with your friendly local government bureaucrat
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Our gov't is totally clueless when it comes to technology. We need to get rid of these Luddites and take over. Long Live the Technocracy!!!
The analogy of a locked briefcase is instructive. If the government were to try to guess the combination, aren't they ignoring my intention of privacy? That is, I locked the briefcase, intending to shield the contents from disclosure without my consent. Being a combination lock means nothing, because picking a key lock is the same effort, indeed snipping off the lock is the equivalent. Does the means of entry matter? Indeed, coercing me to divulge the combination, or give them the key, aren't these also violations of the Fifth Amendment, allowed only in the most dire of circumstances, if at all?
So if I password protect my files in the 'cloud', don't I have a similar expectation of privacy? The government could indeed coerce the service provider to open the files (snip the lock). And if I encrypt the files, why should the government be allowed to even attempt to decrypt them by any means (guess the combination or pick the lock) including coercing me to offer the key (Fifth Amendment again)?
The slope we are slipping down is an old one - new technology doesn't change the principles. It just changes the means. As the government does not have the right to enter my home and search my papers without due process, so they should not have the right to rifle through my 'papers' online, either.
While any expectation of privacy in normal email is futile, if I choose to use Gmail, for instance, via SSL, then I should be granted the expectation of privacy also in that communication. And since I need my user ID and password to access my GMail account, I epxect my stored email data to also be granted that expectation of privacy.
The only reason that protections against unreasonable searches and seizures of electronically stored items should be 'lagging behind' the protections that 'more' physical items enjoys is twofold; 1. The government is charging in where they should not be, in the absence of court decisions, and 2. The courts have not yet handed down decisions that would retrain the governemnt.
But to point 1; Our goverment in the U.S. should not be seeking ways to expand their influence in the absence of restraint by the courts. They should act like the officers of the court they should be and consider the legality in favor of the people. And I'm sure they would claim to be doing so now and always. I disagree. Our government seeks to assume power in every area where the restrictions are unclear, or where the courts have not yet decided, or where they can justify the effort in the name of some greater good. We would be better off if our government considered first, "should we be doing this?".
I know I am probably in the minority with this belief. That doesn't make it wrong. Our government was devised from documents that also described its limits.
deleting the extra space after periods so i can stay relevant, yeah.
In order for a search to be 'reasonable' I think the Amendment should be interpreted to require a good reason to have a search. It says, 'probable cause', after all, and requires a sworn affidavit.
It is not good enough just because the Government can tax the people to raise funds and use those funds to spy on everything they do. Then everyone is a suspect, and since nobody is perfect, everyone is a criminal.
Sorry, I spend my time trying to do good for the world. I do not feel like a criminal and deeply resent being treated like one.
it doesn't apply to email, so why would it apply here?
I guess those old fuddie duddies that PRINT everything have the right idea...
TSCOTUS only honors physical papers as your effects.
Ideally, encrypted data in the cloud would be decrypted at the user's computer, much like PGP-enabled email.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If, like nearly 2/3 of the US population, you live within 100 miles of an international border or coastline -- the Constitution is a dead letter:
http://www.aclu.org/national-security_technology-and-liberty/are-you-living-constitution-free-zone
Solution: just don't give anyone else the key to your encrypted data. And certainly not the third-parties.
The problem is, though, that web-browsers don't (yet) have good support for encryption/decryption of data.
The only encryption supported well is the TLS connection to the webserver, but that one doesn't count since it merely allows you to talk to the webserver (i.e., the third-party).
Another problem with client-side-encryption is that the third-parties cannot manipulate or index your data, but that could also be done on the client, i suppose.
If Pandora's box is destined to be opened, *I* want to be the one to open it.
First issue - 4th Amendment protections in the US - what search and seizure protections do you have. Despite the so-called newness of the cloud (some of us remember big iron - dumb terminal models from way back) it is another way to electronically transmit information - so it would seem that all the existing wiretap laws would apply. Just like they can tap your phone they can intercept other electronic transmission, with a proper warrant. To the extent such information is publicly available (such as via a Google search), they should be able to get it without w warrant. if you fail to set security to prevent others from seeing it you, IMHO, have no expectation of privacy. To expand on the briefcase example, you may have an expectation of privacy for stuff in the briefcase, but the law can watch and videotape you putting something in in Starbucks.
The other issue, and to me the more important one, is collateral damage. As the referenced article pointed out, the physical search and seizure impacted a lot of innocent third parties. I doubt a court would say "you can't do a seizure because you'll grab other peoples stuff," but might say "you can only look at the target's info." So, rather tahn worry about the 4th companies should ensure their data centers have adequate disaster recovery plans to deal with such situations (along with fires, power outages, etc.) If a data center can't recover from the loss of some servers they have bigger problems than privacy rights.
I'm a consultant - I convert gibberish into cash-flow.
Nothing is "well settled" with the current Supreme Court.
http://www.youtube.com/watch?v=gaa9iw85tW8
EGOTIST, n. A person of low taste, more interested in himself than in me.
100 people around the world want that piece of paper
this will involve copying and mailing that paper, a lengthy task. it is indeed, protected, because it is a time consuming and expensive. therefore, there are natural hurdles to sharing this information, which means that publishing, or, the large scale movement of media, is the domain of a few rich players. laws governing their behavior can easily be enforced, mainly gentleman's agreements in the club house. a closet holding cd duplicators or a warehouse holding vhs machine copiers can be located and shut down, and it is expensive to set up these shops. for these many reasons, it is easy to enforce the rules
#2: i have a file on on my computer
100 people around the world want that file
this will involve nothing but installing a free easily available program, which requires no monitoring or effort to use to distribute. it is not protected, because it is effortless and cost-free. therefore, there are no natural hurdles to sharing this information, which means publishing, or, the large scale movement of media, can be performed by any teenager in any basement. a 13 year old in novosibirsk or johannesburg or pasadena has the same publishing might of bertelsmann or time warner or disney in 1980. laws governing the behavior of these teenagers cannot easily be enforced: they're teenagers. the sharing software is headless, encrypted, obfuscated, made sparse and otherwise untraceable. for these many reasons, it is no longer possible to enforce rules created in the age of vinyl records or even player pianos
this technological progress. it is not moved by legal standards, legal standards change in response to technological progress. read up on your history. when you say "The fact that one is physical and one is not doesn't change that they're both carrying the same protected thing" all i see is someone living in colossal denial about how the world is changing around them
the world is changing friend. the whole edifice of ip law is now completely unenforceable. and therefore completely useless. welcome to reality
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
The two are Orthogonal and complimentary, so basically, use both.
If an American citizen has data stored on "the cloud" (be it email, documents, images, videos). Not all of that data is necessarily stored in the U.S. In fact, the citizen may have a video on the cloud that is split up and stored across the cloud in different countries. How does that fit with the 4th amendment. If their data is stored in another country, I'm not sure the U.S. could get that info without permission of another government.
America, Home of the Brave.
Well that's actually a fairly slim difference.
Generally speaking, if you can get a court order, you can get a warrant. It's not like the damned things are hard to get.
Quite simply, don't store any data in "the cloud" that you would object to seeing printed on the front page of a newspaper the next morning. If you want to keep something confidential, store it on a server controlled by you, and use adequate encryption when transmitting it.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
This is not a "law review article" - it is a "note." Published law review articles by students are extremely rare. Law review articles are also generally quite a bit longer and more in-depth. When a student who works on the school's law review writes something and it gets published, it is usually called a "note" or a "comment," specifically to distinguish it from the actual articles, which themselves are usually the product of a law professor or, in some cases, a practicing attorney.
But that's just pedantry at its finest. Mr. Couillard's note is now on my reading list and he should be proud of having tackled a controversial subject and certainly of having been published in a prestigious law review.
Banks don't have keys to your safety deposit box. If you lose your keys, they have to drill the box. That is a REAL expectation of privacy.
My issue is reciprocity: If it is legal for the government to "peer into" my private data they should not be allowed to take umberage if I peer into theirs. (note: this is a joke do not put me in jail)
If privacy is dead it should be dead for *everyone*.
If privacy is not dead then it should be enforced for everyone.
[signature]
It's well known, for example, that the US agencies got around the prohibitions on spying on Americans by letting other countries do it. Heck, they even outsourced interrogation to countries where black rubber hose and jumper cables are cheaper. The only question is how much access to NSA tech do you want the Brits or Canadians or Germans to have, in return for eavesdropping on your fellow citizens? Of course, the USA scrateches their back too.
This is exactly why I donate to the Electronic Frontier Foundation every year. Until these rights are tested for the 'new' electronic medium in a court of law, we need a lobby group dedicated to securing them.
Where would we be if Wheel had hid her round rock in a cave instead of showing everyone how it rolls?
to my safety deposit box. There are 2 keys to open the box. The bank inserts their key and I insert mine
in order to open the box. If I lose mine, they have made it very clear that it will cost me a couple of hundred
bucks for them to drill open the lock and re-key it. I think they will also drill it open under a subpoena. But
I will know next time I go to open it...
That why I use wuala (wuala.com), my files are encrypted BEFORE they are given to the server, that way even the people storing my information can't access my files.
law student, David A. Couillard.
David A. Couillard anagrams:
- D Avid Cloud Liar
- D Liar A Cloud Diva
- Diovular Clad Aid
- Virucidal DAO Lad
- D Avid Cloud Rail
- Did AV Cloud Lair
- Cordial Dual Diva
- Lucid Variola Dad
How many more of the 1321 anagrams I found do I need to post for Slashdot users to realize this story is a hoax?
Freakin collective WHOOOSH!
4th Amendment to the Constitution - hahahahahahahahahaa I had a whole lot more hahas but the censor bot said - "oh no you don't..." Oh well - so much for attempting humor as a way of salving my broken heart...