Slashdot Mirror
Federal Court: The Fourth Amendment Does Not Protect Your Home Computer (eff.org)
An anonymous reader writes: The EFF reports that a federal court in Virginia today ruled that a criminal defendant has no "reasonable expectation of privacy" in his personal computer (PDF), located inside his home. The court says the federal government does not need a warrant to hack into an individual's computer. EFF reports: "The implications for the decision, if upheld, are staggering: law enforcement would be free to remotely search and seize information from your computer, without a warrant, without probable cause, or without any suspicion at all. To say the least, the decision is bad news for privacy. But it's also incorrect as a matter of law, and we expect there is little chance it would hold up on appeal. (It also was not the central component of the judge's decision, which also diminishes the likelihood that it will become reliable precedent.) But the decision underscores a broader trend in these cases: courts across the country, faced with unfamiliar technology and unsympathetic defendants, are issuing decisions that threaten everyone's rights.
The invasion of privacy and constant violations of basic and human rights in the US, and around the rest of the Western world for that matter, are starting to have a lot in common with what George Orwell wrote in Animal Farm. The irony is of course that what he described in his book was Stalin-era Soviet Union.
-SR
You seem to have missed a couple of sections in the opinion.
A key sentence is on page 3:
"Furthermore, the Court FINDS suppression unwarranted because the Government did not need a warrant in this case. Thus, any potential defects in the issuance of the warrant or in the warrant itself could not result in constitutional violations".
There's the court's ruling that the government does "not need a warrant" to hack your computer.
Then on page 47 see the section headed "Defendant Has No Reasonable Expectation of Privacy in His Computer", which STARTS with a bit about IP address, but then goes on to cover other information retrieved from the computer. The reasoning (excuse) given is that because your computer could be hacked, you have no reasonable expectation that it won't be. Per well-established precedent, no "reasonable expectation of privacy" means no fourth amendment protection.
On the other hand, the court ALSO pointed out that the hack did not occur until the defendant tried to download child porn. They didn't hack the machine as soon as it connected to the front page of the CP site; rather it was a trojan in the child porn download. The court says that when you download child porn from foreign countries, you should expect that you might get malware and your information might be exposed.
Microsoft has no obligation to follow the Fourth Amendment, which protects individuals against intrusion by the state. An exception arises if Microsoft is acting as an agent for the state. Some other laws may occasionally protect your privacy against companies; the Fourth Amendment does not.
I don't think you understand how the third party doctrine works. Basically if you've shared information with a third party, you've shared it with the world as far as the law is concerned. Like in this case, your ISP knows your IP so you have no expectation of privacy so if the cops post some exploit code to reveal it to them that's all right. So if you've given Microsoft access to all your data, you've given the law warrantless access to all your data. Microsoft doesn't have to participate in it.
Live today, because you never know what tomorrow brings
The troubling section starts on page 47, where it states "Defendant Has No Reasonable Expectation of Privacy in His Computer".
The judge states that because home computers can be hacked so easily, it becomes a common assumption that your home computer MIGHT be hacked, therefore your expectation of privacy is forfeit. Just like a broken window blind allows police to peek into your home, an easily exploited vulnerability on your home computer means you assume your data is not private. Even a password protected file is not immune to discovery because everyone knows passwords can be easily defeated. (pages 47 - 55)
The judge's analysis is similar to saying we should not really expect any privacy in our homes because a skilled locksmith can unlock our front door at any time, and a locked safe in the home is not really private because a skilled safe cracker can open it easily. The judge is saying that because something MIGHT happen, we should assume it WILL happen, and thus give up our right to expectations of privacy.
--