Tuesday, April 19, 2016

Fourth Amendment, Expectations of Privacy, and Surveillance

The Fourth Amendment protects people from unreasonable searches and seizures by the government.  The Fourth Amendment, however, is not a guarantee against all searches and seizures, but only those that are deemed unreasonable under the law.  It states:
The right of the people to be secure in their person, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probably cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
The U.S. Constitution protects a right to privacy from government intrusion, most explicitly in the Fourth Amendment.  It should be clear by now that databases and surveillance technology challenge this right.

First, the government can search our homes or any physical place that holds our personal information  without entering them, and they can search our persons from a distance without our knowledge.  There are lots of examples.  Here's one:
Bridges, tunnels and toll roads use automated toll collection systems.  Sensors read a device in the car as it goes by without stopping, and the owner's credit card or bank account gets billed for the toll.  Police use toll records in investigations.
The USA PATRIOT Act and national security letters (NSLs)

Before the PATRIOT Act, the FBI could obtain various kinds of records, meta data from telephone, email, and ISP records without a court order or any court oversight, using a document called an NSL.  The FBI could only use NSLs only when it had reason to believe that the customer or entity whose records it sought was a foreign power or agent of a foreign power.  Only certain FBI officials at is headquarters could issue NSLs. 

The PATRIOT Act, significantly expanded FBI authority to use NSLs.  It allows any field office to issue them.  It eliminated the requirement that the information had to pertain to a foreign power or agent of a foreign power.  NSLs can include a person's full credit report.  Recipients of an NSL are prohibited from telling anyone about the order (this includes family members, an attorney... this is the "gag order").  The level of secrecy and lack of court review clearly presented opportunities for abuse.

Electronic Communications Privacy Act (ECPA), revisited

Driving around Silicon Valley, eavesdropping on cell phone conversations was a popular form of industrial spying in the 1980s.  ECPA (which was amended in 1994) was a significant step toward protecting privacy in cyberspace (aka the Internet) from private and governmental snooping.  It required that the government get a court order to legally intercept email or read stored e-mail.  The government argued that people give up their expectation of privacy by allowing ISPs to store their email on the ISPs computers.  Thus, strict requirements of the Fourth Amendment would not apply.

The PATRIOT Act reversed the direction of ECPA.  It loosened restrictions on government surveillance and wiretapping activities.   The story is not over, and even though the NY Times revealed domestic wiretapping of domestic phone calls in 2005, it wasn't until Edward Snowden reaveled the deep dark secrets of what was actually collected, did the public and government realize the extend of the surveillance.  And so it goes....

Feel free to comment here about these issues if you want as part of Tech Muse #3. 

Electronic Communications Privacy Act of 1986

A good source for all things related to privacy is https://epic.org.
EPIC stands for Electronic Privacy Information Center.  It's a great resource, as is the Electronic Frontier Foundation at https://www.eff.org/ -- both are added to the links on the right side of the blog.

Recently, the hot news is that the House Judiciary Committee has voted 28-0 in favor of the Email Privacy Act, H.R. 699, a bill that would establish a warrant requirement for the disclosure of all electronic communications. The law would also require notice to customers whose communications have been collected. With 314 members of the House cosponsoring, the bill is slated to be considered by the House on April 25th. Senator Leahy, who has sponsored an identical bill in the Senate, said that "Congress has waited far too long to enact these reforms."

To understand the importance of all the news related to domestic "snooping" on devices and apps without informed consent, you have to first understand ECPA.  According to the Epic site:
The Electronic Communications Privacy Act ("ECPA") was passed in 1986 to expand and revise federal wiretapping and electronic eavesdropping provisions. It was envisioned to create "a fair balance between the privacy expectations of citizens and the legitimate needs of law enforcement." Congress also sought to support the creation of new technologies by assuring consumers that their personal information would remain safe.
ECPA includes the Wiretap Act, the Stored Communications Act, and the Pen-Register Act. Wire communication refers to "any aural transfer made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection"; in short, it refers to phone conversations. An oral communication is "any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectation"; this constitutes any oral conversation in person where there is the expectation no third party is listening
 You can read more about ECPA, and pay close attention to the section on Disclosure of Records as well as reasons for Reform At the top of the page, you can access recent news on this topic.

Feel free to add what you know.  The new bill being considered now in the House and Senate is intended to close the loop on disclosure and informed consent, but Epic and others think it hasn't gone far enough.

Tuesday, April 5, 2016