Hacker News Reader

>they want the 4th amendment benefits of treating the cloud like real world private areas (e.g. bank lock boxes), without any of the obligations that come along with that.

and...

>That said, I think they're ultimately going to win.

Warning: Total Conspiracy Theory Ahead

Could this be an end-around by Microsoft to eliminate one of Google's main revenue streams? Follow me for a second.

1. Let's assume Microsoft wins this court case. By doing so, e-mails will be afforded the same protection, under the law, as physical letters.

2. A Microsoft backed plaintiff sues Google for data-mining her email's content, arguing under the same 4th Amendment ruling.

3. After years of legal procedures and court battles, Google (and all other e-mail providers) are forced throw away their master keys. Essentially all email is blind to the providers.

4. Google loses one of their larger revenue streams.

Everyone loves a good conspiracy theory, so indulge me for the moment. Why would this not work (And for the record, I'm sure it wouldn't. But I would honestly like to know why.)?

I think it goes off the rails in step 2. Private organizations are not bound by the 4th amendment. For the most part, the constitution defines the powers and limitations of the federal government (and to some extent the state governments). The government is the entity bound by the 4th amendment, not private companies.

I think a more likely scenario is that we end up with a court ruling that says something along the lines of: "In order to preserve the customer's 4th amendment rights, the company hosting the e-mail mustn't be using it for business purposes." So, Google wouldn't be able to simultaneously mine your e-mails and guarantee that your e-mails are protected under the 4th amendment.

>I think it goes off the rails in step 2.

This went off the rails well before I started to write it. But let me push back on your thoughts.

If I am understanding Microsoft's argument correctly for this court case, they are trying to equate e-mails to letters. And, by extension, equate themselves to UPS/USPS/FedEx whathaveyou. E-mails are private correspondence, just like letters in the post. And please, correct me if I'm wrong in this assessment.

It is also a felony in the US to open someone's mail. So wouldn't that same protection exist in email? Which would mean nobody can look at an email correspondence unless they were either the sender or receiver of said email.

I think the snail mail to email analogy is flawed... snail mail has an envelope, plain text email does not. However, a postcard does not generally have an envelope...

So here are some better analogies:

snail mail letter == encrypted email

snail mail postcard == plain text email

publicly posted diary == plain text gmail

(I've yet to read TFA, but:)

I'm all for privacy in email, but if we're doing analogies, unencrypted email is more like postcards, than letters. And metadata is more like what's written on the letter than in it. (And SMTP over TLS would be like the mailboxes you're not allowed to look in, unless you're delivering mail, or are the recipient...)

As far as I can gather, the US has pretty shoddy laws guarding personal information from corporations -- so a change wrt email might be a win. But I don't know if this is the best way.

As long as there doesn't appear to be any viable way to get most people to use gpg/smime -- I'm not sure we're likely to get anywhere. Perhaps that is what Microsoft should do: leverage S/MIME for outlook.com (with the caveat that they would have to keep the encrypted private keys, and being a web service, could be forced to backdoor the clients in order to get the pass-phrases/passwords...).

Hm, I wonder if there's an IMAP extension for storing encrypted key-pairs?

The fourth amendment doesn't protect you from other people reading your post. It probably _does_ protect you from the government reading your post (though, apparently not protect you from the NSA logging all your mail[1]).

It is a crime for other people to read your mail, though that protection comes from the legislative branch, not the constitution. Specifically, Title 18, Part I, Chapter 83, § 1702 [2]. If you could convince a judge that § 1702 applied to e-mail, you might be able to ruin Google's day. It'd be a very different legal argument than the fourth amendment legal claim. Whatever comes from Microsoft's legal arguments about the 4th amendment won't have a bearing on this line of argument.

I still think the best avenue for a conspiracy theory motive for Microsoft is to get a ruling that says "if the e-mail provider examines the communication for any purposes other than facilitating mail delivery, then the communication loses its 4A protections." That would allow other competitors to advertise strong 4A protections, and force Google to choose between that sweet, sweet personal data or also advertising 4A protections.

[1] http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mai...

[2] http://www.law.cornell.edu/uscode/text/18/1702

It won't work because Gmail users have agreed to what Google is doing.

(Also, as I understand it, Google works hard to limit access to email, but I don't think they have anything you would want to describe as a master key. It would be "Google deletes all customer data", not "Google blinds itself to customer data".)

I think you give Microsoft too much credit. But, you correctly identified the importance of this case.

Interestingly, I predict that if your outcome were to happen then Google will rapidly invest in Gmail to turn it into more than an email system, so that they'd have reason to argue that the messages are business records.

So cloud companies that want to preserve user's rights w/r/t to user data and doing email should not be able to do spam detection? Should they be able to adjust the markup in HTML emails such that the composition of emails into the web UI does not compromise the well-formed-ness of the page? Should they not be able to provide a "search" feature to locate emails that are relevant to a user's query?

These sorts of things are all capabilities I expect in a local mail client; I think it's a reasonable to apply 4th amendment protections to the user's data, even if computation done on behalf of the user (including selecting relevant ads) happens in a remote datacenter using code the user didn't write.

It is pretty ridiculous to treat users' emails the same as a grocery store's payroll when deciding whether customers have constitutional privacy safeguards.

At the end of the day, the lynchpin of the 4th amendment is an objectively reasonable expectation of privacy. Not merely a subjective desire that the government not see certain information.

With that in mind, I just don't see how you can say you have an objectively reasonable expectation of privacy over e-mails in the cloud, when a system operator can pull up all your personal information going back years at the touch of a button. When the e-mail service not only has incidental access to the data, but actively looks into that "private" data and uses that "private" data for commercial purposes. It's a distorted, results-oriented definition of "privacy."

That said, you're likely going to get precisely that results-oriented interpretation, because apparently the Supreme Court, like most users, doesn't fully understand the scope of how cloud providers access and use and commercialize your data.

How is that different from regular mail? Any postman can open the mail, copy/read the content and then close envelope. It is maybe 5 minutes of work.

Its different because not only do mailmen not open mail as a matter of course, for advertising or operational purposes, its a felony to do so.

Do you have a reasonable expectation of privacy for your bedroom or can the government freely search that too? Does your answer change after you hire a housekeeper (or housekeeping company) to dust your furniture and put away your socks?

You can't exclude the testimony of your housekeeper that your sock drawer was full of cocaine on the basis that you had an expectation of privacy, so yes, it changes a lot.

But, under the ECPA, it is not a felony for system operators to do the same thing (for operational and diagnostic reasons) on networks carrying voice traffic. And yet nobody is suggesting that voice traffic isn't subject to wiretap laws.

While I wouldn't expect much privacy from the provider holding my email, I would expect privacy from the government ... assuming there wasn't a warrant to access it.

Does anyone know the case law for services that filter a person's mail for them? E.G if I employ a service that will open mail for me to weed out the junk and send me the good stuff, do my letters become business records?

What if I also employ them to (going a step further), pay any bills that come in from my bank account?

I think that this line has already been drawn.

Tangential question: since the Supreme Court recently decided "do it with software" by itself is not sufficient (by itself) for software patents, can that precedent also be used for differentiating between letters and email? E.g. - letters with software is not enough distinction for 4th amendment bypass?

I do not know how it works in the US, but in many countries, you can already opt out of receiving junk mail through your letterbox.

It does not work that way in the US, unfortunately.

> The "reasonable expectation of privacy" in things like safe deposit boxes or storage units is based on the actual fact that service providers generally do not and cannot access the contents of those rented spaces.

And the "reasonable expectation of privacy" in cloud email is based on the fact that, while computers necessarily have access to the data (it is not possible to provide email service otherwise), humans generally don't.

If you don't think that humans have access to the contents of your cloud hosted email service then I've got a bridge to sell you.

They have access to it yes, they just risk being fired if they nose into data unrelated to their job.

(That is, at least for employees at one of the big ones. ;-)

Exactly. Employees at the UPS store can steam open your physical mail too. The question is whether you have a reasonable expectation of privacy, not whether you have actual privacy.

Gmail is not the only cloud. Does Apple datamine icloud.com or me.com emails? The fact that the email may exist on multiple servers around the world (aka, cloud) doesn't per se mean the company is abusing the customer's trust.

Are you telling me that a banker does not have the capabilities to access a rented lock-box? That only the renter has that key? What then happens if a renter dies and that key is missing?

If you're referring to safe deposit boxes, I believe they drill the lock and replace it.