Slashdot Mirror
Google Backs Yahoo In Privacy Fight With DoJ
PatPending sends in CNET coverage of Yahoo's new allies in its fight with the DoJ to protect the privacy of its customers' email stored in the cloud. Google, the EFF, the CDT, and others have filed a friend-of-the-court brief arguing that the DoJ should be required to obtain a search warrant signed by a judge in order to compel Yahoo to turn over users' email messages. "Does email stored in the cloud have the same level of protection as the same information stored by a person at home? No, according to the Obama administration's Assistant US Attorney Pegeen Rhyne, who wrote in a government motion filed last month, 'Previously opened e-mail is not in "electronic storage." This court should therefore require Yahoo to comply with the order and produce the specified communications in the targeted accounts.' (The Justice Department's position is that what's known as a 2703(d) order — not as privacy-protective as the rules for search warrants — should let police read email.)" Update: 04/16 23:26 GMT by KD : he government backed off: "Saying the contested e-mail 'would not be helpful to the government’s investigation,' the authorities withdrew demands for e-mail in a pending and sealed criminal case." So no court ruling and no precedent.
Is in your imagination.
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated...
But of course this is the internet, so it's different.
Not trolling ... but Google seems to have found its balls again. It stood up to China and now its trying to stand up to the DoJ. Of course, backing Yahoo in this fight benefits Google as well. There's nothing wrong with protecting your own interests if you're also doing the right thing.
I'm glad we elected someone with a through understanding of constitutional law and a healthy respect for our civil liberties. It's not like he reversed himself on the issue before even becoming President or anything....
Meet the new boss, same as the old. When will we learn? Vote Democrat or Republican -- the only difference is which order you will lose your rights in.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
On one hand they tell the users on their services to hold no expectation of privacy, then join a fight to keep information from the Government. Ah of course, providing information to the Government provides no profit. Hmmm I wonder how they would react if the Government offered to pay for the same information they are currently requesting be provided free?
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
I'm still trying to wrap my head around this. If these emails can be accessed at a later date they're obviously being stored somewhere. Now I lose my right to privacy because I've opened an email?
What exactly is the problem with just getting a search warrant?
How are previously opened emails not in electronic storage? Are they electronic? Yes. Are they being stored? Yes. Thereby electronic storage. And how does the previously opened or unopened even come into play here? When I open my mail (and keep it in a filing cabinet in my house) is it any less mine than it was before I opened it? Would they still need a search warrant to find it, or is it not in "hard storage" because I opened it? I don't understand why people thing that storing things in the cloud makes them less mine (legally). When I rent a storage space barn they property I put in it is still mine, so if I'm using online servers to store information, that information should still be mine.
At the same time, I'm glad to see Google, the EFF, and such coming to help Yahoo. Obviously it's because they don't want precedent set, but still it's nice to see them playing nice.
Then post all your already read e-mails to the Internet.
No sig for you!!
Remember the thinkgeek.com tee shirt "i read your e-mail"? We as the nerd community have known for years that if its on a computer it's fair game for any one clever enough to find a way in. The only secure system is the one that isn't networked and doesn't do anything that requires personal information of any kind, so that leaves us the NES and the TI85. Now the government want's to play with this power. Who is shocked by this?
We are the Borg...
Well, this would put a damper on quite a few things if the government's motion is granted.
And what is the implication if I just keep marking things as unread?
4th Amendment:The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
It does not say that papers and effects in our houses are protected. Rather it treats them separately, with no distinguishment between them. Also, "effects" does not solely mean "possessions" though it does certainly include them. I would contend that email is an 'effect'.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
Time to fully encrypt all communications. At least an encrypted email is on par with an encrypted post card.
for the not-so-little guys! (i.e. google & co)
weinersmith
shit like this makes me glad oboingo is going to be a one-termer.
electronic storage "in transit". The key part of the phrase is in transit. after you read it, it's already delivered. Like sitting in your mailbox delivered. This is like the gov demanding the postman tell him what was written on your postcards after you get them. We have laws governing the mail system for a reason, to prevent this. Just because the gov thinks it's convenient to spy on you is no reason to treat email and snail mail different. History repeats itself, those who are ignorant of it get burned. If the government taxes tea you have a tea party. If the gov spies on honest people then honest people adopt encryption.
I can't wait until President Obama is voted into office over our oppressor Bush! He would never stand for warrantless wire tapping or any of this nonsense.
Vote for Obama! Change we can believe in!
Based on this, it seems that Google and Yahoo need to move their servers out of the US and into a country with stronger data protection laws. In fact let's move most of the internet into one so that the CIA/FBI don't have a virtually free hand to snoop.
Internet companies should get together and buy an island somewhere outside of US jurisdiction, and run their services from there. Then, if the state wants to snoop it will have to obey international law, rather than simply punching a loophole through US law through which to suck our personal information with a vacuum cleaner.
Maybe Google and Yahoo should do what Wikileaks did, and move to Sweden.
But what I have seen happening with regards to internet privacy is a clear, real slippery slope. Mainly because of two factors:
A. Is NOT and never has been neccessary. (I.e. if they can get a warrant to read my my snail-mail, they can surely get one to read my email.)
B. Unlike the past centurey, technology now moves so quickly that lawmakers, judges and lawyers often are in the position of making judgments about things that they don't understand. So the slippery slope starts to be a real issue as they are forced to use less and less similar reference points as precedent instead.
excitingthingstodo.blogspot.com
it does surprise me that they're helping out. they're are alot of companies push for digital due process and bring up our right into the digital age. for more info:
http://www.digitaldueprocess.org
At some level laws need to make sense. I would like someone to explain to me why I have an expectation of privacy for new messages but not those that have already been read? Does the SMTP RFC mandate previously read messages get pushed into a public space with no expectation of privacy?
Too many people acting like wise word smiths with nonsensical definitions and interpretations that have no logical bering on reality whatsoever. They know what their doing is nonsensical but intentionally set out to find an end run/statutory loophole as a direct affront to the same constitution they previously swore an oath to uphold.
Google and Yahoo have invested heavily in cloud computing infrastructure. They don't really care about protecting individual privacy except where it will come back to bite them in the bottom line.
I'm not knocking capitalism, mind you ... I kind of like it. But if you think that either of these companies are taking these actions based on an some principled appreciation of the 4th Ammendment, you're deluding yourself.
http://itlaw.wikia.com/wiki/2703(d)_order
Hmm here's supposedly whats required with a 2703 order...
it specifically states a court order is required.
Wait a minute. I'm a manager, and I've been reading a lot of case studies and watching a lot of webcasts about The Cloud. Based on all of this glorious marketing literature, I, as a manager, have absolutely no reason to doubt the safety of any data put in The Cloud.
The case studies all use words like "secure", "MD5", "RSS feeds" and "encryption" to describe the security of The Cloud. I don't know about you, but that sounds damn secure to me! Some Clouds even use SSL and HTTP. That's rock solid in my book.
And don't forget that you have to use Web Services to access The Cloud. Nothing is more secure than SOA and Web Services, with the exception of perhaps SaaS. But I think that Cloud Services 2.0 will combine the tiers into an MVC-compliant stack that uses SaaS to increase the security and partitioning of the data.
My main concern isn't with the security of The Cloud, but rather with getting my Indian team to learn all about it so we can deploy some first-generation The Cloud applications and Web Services to provide the ultimate platform upon which we can layer our business intelligence and reporting, because there are still a few verticals that we need to leverage before we can move to The Cloud 2.0.
I understand that "the man" is not allowed to go through my stuff without a warrant and stuff like that, and that I cannot invoke any "don't touch that!" type of rights when "the man" wants to go through my friends' and associates' stuff, in their attempts at finding out stuff about me. Are they now, however, required to jump through similar hoops to compel others to show them or give them stuff? If the police turn up at my mom's house and ask to see all the letters I wrote to her (email or snail-mail) does she not have the right to refuse them unless they have a search warrant? Are they not required to get a subpoena in order to compel her to turn stuff over?
I suppose even in that case, the level of review that a subpoena requires is less than that for a search warrant, and that one has less control over the actions of your mom that is desired (she might just give them the info without protest). In this case, the EFF, Yahoo and Google seem to be arguing that the third party should not even have the option of providing the material.
I guess at a minimum this points out that people might want to consider the policies in regards to searches that your online storage providers have.
Is there any implementation of IMAP that encrypts the email on the server with your public key, as it is read or received? Maybe some system such as that would provide the storage service provider some ability to say to any request for data - "sorry, I do not have the key to unlock that information - you'll have to get a warrant for the suspect for that". Of course in the UK, that would not give much protection since it is a crime not to give up your keys when requested (which could make for some interesting "pranks" where you plant encrypted files on a person and then get them investigated for some nefarious thing)
http://arstechnica.com/tech-policy/news/2007/10/uk-can-now-demand-data-decryption-on-penalty-of-jail-time.ars
Hmmm I wonder how they would react if the Government offered to pay for the same information they are currently requesting be provided free?
The US government paying google with US taxpayer dollars to get information from google's international (read: not necessarily US taxpayer) end users? I don't see that going over well.
Reply to That ||
You can hook your TI-85 up to a computer connected to the internet.
indeed.
Reply to That ||
Couldn't the Opera browser's Unite feature (for things other than email) circumvent this by storing things locally? It needs more developers though.
How do all you libtards here that helped put the current Liar in Chief in the oval office feel about him now? Suckers!!!
IANAL but this seems to get close to the idea of itellectual property. If "effects" excludes email from protection because it's not physically tangible property, then why would IP enjoy protection? Of course I'm probably way off here.
I'm a yahoo customer. I like being able to access old emails from anywhere.
Of course, those old emails contain letters to and from girlfriends. I wouldn't want anyone reading those.
There are emails to and from the porn site that ripped me off. However secretly proud I am of the fact that I talked them into giving me a refund, I'd rather the feds not know about it.
There are emails negotiating gun purchases from private individuals across the country. I followed all applicable laws, but you can't tell that from the content of the emails and I'd sure prefer that the BATFE not feel the need to interview me.
There are multiple letters to the editor of local papers. I asked for those to be published anonymously because I expected to paper to protect me (at least a little) but I certainly don't trust federal authorities in the same way.
I could go on and on and on. My yahoo account doesn't contain proof of anything illegal in my life but if you are a prude, an authoritarian, my employer, etc., you would almost surely find an email or two that would strain our relationship if you were able to read them.
I guess I'll have to start relying on local storage and doing a better job of backing up.
That whole "convenience of the cloud" thing sure is a lot less attractive than it once was.
Phooey!
Here is an idea; why doesn't Google start automatically encrypting messages sent between Gmail accounts? This would pretty much close off a small, but decent, percentage of traffic from quasi-lawful snooping? Being that Google is the big player, it would provide impetuous for other email service providers to follow suit, or form agreements to cross encrypt with each other (all main from gmail to gmail will be encrypted, as will all main from gmail to yahoo, or yahoo to yahoo). It would be nice for marketing too.
I fully admit my idea is probably highly naive, and wildly unrealistic.
A patriot must always be ready to defend his country against his government. -edward abbey
This is Slashdot. There's no reason to dumb down "amicus curiae" as "friend-of-the-court".
I don't see why there is different treatment for mail, phone calls, email, SMS, online messengers, and so on. Never mind why there is differences depending on whether or not it has previously been read, or whether I'm using a pay phone.
It's all communications and I (should) have an expectation of privacy. What's the fundamental difference between a letter that is transported using a network of mail-men and one transported by a network of computers?
I don't care where it is "held". If I use a postbox I rent that postbox and it is for all intents and purposes an extension of my home. Saving emails online is the same as saving them on my home computer, it makes no odds that I am renting the mail space elsewhere in the same way that it does not matter if I rent a second home or storage space for my papers.
I suppose there is an argument that I should expect a postcard to be read by anyone coming into contact with it, and therefore the same could be said to apply to an email. But there must be a distinction between a mail man happening to come across information during the course of his duties that I have contracted him for, and where the authorities specifically monitor your communications in the hope of finding something? Surely an envelope cannot be argued to afford greater expectation of privacy than even the most basic encryption, since a child could defeat the envelope but at least some skill would be required for the encryption?
Sometimes I think rights are considered something to be given away when it would be inconvenient for the authorities to violate them anyway. Somehow there seems to be a correlation between how cheap it would be to snoop and the ease at which they are allowed to do so.
In the UK the government can now open your postal mail.
... to get a judge to sign a warrant. If they had to do that, that would totally stop abuses of power.
not.
Part of the Second American Revolution!
My firewall/router/DVR computer is on 24/7 anyway, so I've always just run my own mail server. Any email to delivered directly into my home from the beginning. ;)
---
the pen is mightier than the sword, the sword is mightier than the court, the court is mightier than the pen.
OK DoJ ... Then post all your already read e-mails to the Internet.
(Those still stored offsite, that is.)
While we're at it, post all your offsite filesystem backups, too. The same argument applies to them as you're using for the "opened" email.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
While we're at it, post all your offsite filesystem backups, too. The same argument applies to them as you're using for the "opened" email.
Thought I should make that more explicit. Filesystem backup services (especially the network/"cloud" based ones) are next if they get away with this.
(Or even if they don't win it. They'll just claim the loss was because it was "mail" and doesn't apply to "files". Win and they have the precedent. Lose and they start fresh.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
... why doesn't Google start automatically encrypting messages sent between Gmail accounts?
Because if they have the keys they've reduced it to the previous case - while if they don't have the keys they can't help users who lose their key, disrupting service.
However if the user is willing to take the risk on the key, it would make sense to encrypt the email for continued storage when the user "opens" it. Then Google can give the DoJ the encrypted mail and the finger. B-)
Use an asymmetric cypher and push the decryption to a client on the user's computer and Google, Yahoo, etc. never need to even HAVE the decryption keys to do the encryption. (It's more crunch intensive than symmetric "session" keys but crunch is getting 'WAY cheap.)
Anybody up for working on an upgrade to IMAP that lets the mail reader hand the user's public key to the server and have the server encrypt the mail with it before a) sending it across the wire to the user and/or b) returning it to storage?
By george I think we've got it. Everybody else: You saw it here first so after this you can use this posting as "prior art" if somebody tries to patent it. B-)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Interestingly enough, there are actually people that would be willing to give up the privacy of their email if it makes the world safer.
Put a magnet in Ben Franklin's pocket and place a coil by the casket, and his spinning in his grave would power a small town!
Free Martian Whores!
One more tweak:
The server can keep the public key and encrypt the mail when it's received. Or even optionally hand it to the sender's mail agent to encrypt it before it is shipped to the server (though this would interfere with server-based anti-malware services).
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Or even optionally hand it to the sender's mail agent to encrypt it before it is shipped to the server (though this would interfere with server-based anti-malware services).
Annnnd...
That reduces it to the case you wanted, Omestes. B-) Even without standardizing the protocol and deploying it globally, companies like Google and Yahoo can store the users' public mail keys and encrypt the mail as they send it between users within their service (as well as mail arriving from outside).
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Can I access everything on governement's servers 181 days after data was created?
The American public elected Obama, who has no respect and is in fact doing everything in his power to undermine the Constitution and Bill of Rights. Look at recent news stories. The fact that the government backed off means nothing. The next thing you know, the people who were targeted will get an IRS audit (costing tens of thousands even if nothing is found), get their home inspected by local building inspectors (costing tens of thousands if the home is more than five years old), or have the DIA make a call on the home and plant drugs. This was happening even under Clinton, a relatively innocent person by Obama's standards. It doesn't even matter if the person can successfully fight government claims or audits or evidence-planting: the government has unlimited money, and private individuals below the money level of Bill Gates do not. At the end of the fight, the private individual is broke, and that is the one crime in this society for which there is no forgiveness and no appeal. The Fed needs no warrant to read your mail. They will do whatever they want. If it becomes necessary later to produce a warrant, they will get a judge to sign a back-dated one. However, they need a warrant to use it in court. But that does not mean they can't use it in other ways, such as producing expensive problems for you, such as fighting court cases over a period of years and sometimes decades, all of which costs money that you will never see again. Remember, the only crime in this current society that you cannot defend against is being broke.
some people mat not realize this, but IMO they won the MINUTE we started changing the way we do things. The motivation behind their acts isnt to see how many buildings they can blow up, people they can kill, etc. It's to attack our way of life. The way we try to "win" the way is to kill the terrorists, but we really need to kill their (false?) hatred toward our way of life.
It is nice to see some form of unity when like causes arise. Funny how Microsoft didn't step up to....