Security Focus printed an article on Friday entitled "Email Privacy to Disappear?" in response to the action on October 2nd of the United States Court of Appeals for the Sixth Circuit in Cincinnati. It granted the government's request for a full-panel hearing in United States v. Warshak, which is a key privacy case. Here are the details on the case from Regulating the Cloud: Warshak v. United States:
In March 2005, the federal government launched a criminal investigation of Steven Warshak. As part of that, the government obtained a sealed order issued under the Stored Communications Act that required Warshak’s Internet service provider to disclose customer account information to the government as well as the contents of e-mail messages. The ISP was barred from disclosing the order to its customer. More than a year after the initial order, when the magistrate unsealed the order, the United States notified Warshak of the order as well as a second order that had been issued relating to Warshak’s Yahoo account.
Warshak filed a lawsuit claiming violations of both the Stored Communications Act and the Fourth Amendment. There is a lot of search-and-seizure inside baseball here, especially about the circumstances under which the government must proceed under the higher probable cause standard of the Fourth Amendment versus when it is allowed to compel disclosure from third parties such as an Internet service provider under the weaker standards of a subpoena.
The Security Focus article latched onto email and claimed: "At issue is whether the procedure whereby the government can subpoena stored copies of your email - similar to the way they could simply subpoena any physical mail sitting on your desk - is unconstitutionally broad." I should point out that this article was copied by the Register, Prison Planet, and more.
That is a big fear, but it misses the mark. The real issue is that the case could give the government the right to read anything you store in the cloud.
Randy Picker, a law professor at my alma mater, the University of Chicago, in his blog entry: Regulating the Cloud: Warshak v. United States. He points out that the only reason that we are discussing Warshak is because his email was stored in the cloud. As a result, the government went to his ISP and was able to request the email. If his email had been stored on his personal PC, Warshak probably would have been able to insist on a warrant for the search of his house.
So, the issue is not email. The issue is storage in the cloud! You know all of those Google spreadsheets? What about that file in Groove? And, maybe even that back-up file?
Where is the line? Security Focus explains how privacy was defined:
In a seminal case (Katz v. United States in 1963) the US Supreme Court, over the strenuous objections of the US government, upheld the right of the user of a payphone to claim a right to privacy in the contents of those communications. The Court held that the Fourth Amendment right to be secure in your "persons, house, places and effects" against unreasonable searches and seizures protected people, not just places. Thus, to determine whether you had a right against unreasonable seizure - a kind of privacy right - the court adopted a two-pronged test: did you think what you were doing was private and is society willing to accept your belief as objectively reasonable?
So, lets start with Google mail. You know that Google scans your email. It scans it for viruses and spam. But, it also scans for content to generate advertising. You know this and you agreed to it? Did you also give up your right to privacy? You willingly shared the information.
Now, lets look at the next step. We are storing more and more in the cloud. Google applications are a clear example. Do you give up your rights to private drafts if they are stored on-line.
Watch carefully and think twice about the cloud. It just could be The Mist -- apologies to Stephen King, a true Red Sox fan. (Thank you to Kimo Crossman for pointing out the Security Focus article.)
Subscribe by Email
