pageok
pageok
pageok
Applying the Fourth Amendment to the Internet, Part II -- Replacing the Inside/Outside Distinction with the Content/Non-Content Distinction:
(This is the second of a short series of posts on my new forthcoming article, Applying the Fourth Amendment to the Internet: A General Approach, forthcoming in the Stanford Law Review. For the first post, click here.)

  So imagine you're trying to apply the Fourth Amendment to the Internet so that it plays the same role in Internet crime investigations that the Fourth Amendment plays in traditional physical investigations. How can you do that?

  The first step is to realize that the Fourth Amendment in the physical world is based on a fundamental distinction between inside surveillance and outside surveillance. If something occurs outside, the police are free to watch it: The Fourth Amendment doesn't regulate them. On the other hand, if something occurs inside, the Fourth Amendment presumptively applies: Barring special circumstances such as consent, the Fourth Amendment regulates government access to that inside space.

  The line between inside and outside can get a little tricky, to be sure. In fact, many of the most interesting cases consider exactly where the line falls (think Kyllo or the open fields/curtilage cases). But that distinction is essential to the Fourth Amendment in the physical world. It creates a zone that the police can monitor, mostly involving transactional information about where people are and what they are doing, while carving out a private zone where the police can't go without special circumstances, mostly involving the substance our of private thoughts, writings, and expression.

  Now turn to the Internet. Online, the distinction between "inside" and "outside" no longer makes a lot of sense. Some new distinction is needed to replace the function of the outside/inside distinction.

  My article proposes that the online distinction between content and non-content information should replace the physical distinction between inside and outside surveillance. The contents of communications, such as e-mail messages, subject lines, and remotely stored files, should be presumptively protected by the Fourth Amendment. Absent special circumstances such as consent or posting documents on the Internet, the Fourth Amendment should regulate government access to contents. On the other hand, non-content information, such as IP addresses mail header information other than the subject line, should not be protected.

  I think this approach nicely translates the Fourth Amendment to the Internet because content and non-content information are network substitutes for inside and outside. To see this, you need to think about how networks work and what functions they serve. Networks are means for transporting information or property from one place to another. Instead of transporting information or property yourself, you sit back and the network does that work for you remotely. The non-content information is the information in the network that is generated and used to deliver the package: It records where the package went, when, how big it was, and the like. In contrast, the content information is the package itself: It is the actual information that the person sent.

  Replacing the inside/outside distinction with the content/non-content distinction leads to a technology-neutral Fourth Amendment because the latter is a network substitute for the former. The non-content information — that information generated to deliver the package — is the network substitute for what would have been open to public observation and therefore "outside" in a physical environment with no network. The content information is the network substitute for what would have been hidden from public observation and therefore "inside" in a physical environment.

  Replacing inside/outside with content/non-content maintains the same basic function of the legal distinction in light of the shift from physical space to network space.

Related Posts (on one page):

  1. Applying the Fourth Amendment to the Internet, Part II -- Replacing the Inside/Outside Distinction with the Content/Non-Content Distinction:
  2. Applying the Fourth Amendment to the Internet, Part I -- Technology Neutrality:
Brent Peterson:
Orin,

What about file names? A file name could, like a subject line, be considered "content," especially when the file name is substantively descriptive (e.g., "my_drug_sales.xls").

On the other hand, it could be argued that a file name is more analogous to the sort of information that is present on the outside of a physical package or envelope.
3.30.2009 4:35pm
OrinKerr:
Brent,

I'm not sure what you're asking: Are you asking me to say whether I think a file name (presumably one attached to an e-mail) is content or non-content? If that is what you're asking, can you tie that question to the argument of the paper?
3.30.2009 4:38pm
einhverfr (mail) (www):
This is quite an interesting post and I am trying to understand its ramifications. Unfortunately, I think there are some practical issues that will end up affecting it.

Suppose I drop a letter on the way back from picking it up from the mailbox. Can the police open it and search its contents? I don't know the answer so I am asking whether this counts as outside or inside.

Secondly, can police go to the post office and observe the addresses of all letters that come to me or get mailed by me? I would assume so but I am asking. What about a UPS depot? Is that inside or outside?

Can police read the contents of a postcard while it is at the post office awaiting delivery?

Now part of the problem here ends up being what information can be easily spotted quickly and which information cannot. If I am to eavesdrop on an SMTP transaction, I get all the non-content information you are describing plus all of the contents of the email. This is fundamentally different from a packet in the mail where the packaging fundamentally obscures the contents. How do you propose to protect against this problem? Wouldn't an email be the legal equivalent of a postcard rather than a letter in a sealed envelope (though an encrypted email might be more like a sealed letter)?
3.30.2009 4:54pm
Jack of Spades:
IANAL, but I am a techie guy. The problem I see is that the inside/outside distinction reinforces a natural barrier; a wall is not transparent to the police. Any technical measure which can intercept addressing information will also be able to intercept content, and probably, in the normal course of operations, will; unusual means would need to be taken to discard the content information.

I would propose instead a legal line that reinforces a natural, technical protection. For example, prohibit the decryption of data, and/or the search of information stored on third-party systems without a warrant served on the person whose information is sought. Yes, this would expose email sent in plaintext, but encryption of email is not a difficult technical problem; it just needs market drivers to foster widespread adoption. Such a rule would be one driver.
3.30.2009 5:11pm
NatSecLawGuy:
While maybe being narrower protection that what Professor Kerr proposes, IMHO, the inside/outside distinction could still work in the internet sphere.

There are many actions I take on the internet that are outside. For example, when I write a comment on this blog I fully expect it to be in the open field of the internet. Thus, any willing eyes, including law enforcement, will see my publication. However, their is other contexts that I consider to be inside. For example, I enter a password and user account to enter my email or bank account. Here I consider the actions taken much more private and an inside action taken in the larger internet compared to the outside action of posting on a blog. Therefore, the Fourth Amendment would apply in the latter context, but not the former.

My initial thought is that this categorization would be narrower than the content/non-content categorization, but nevertheless may be a workable categorization that maintains the current logic of the Fourth Amendment.
3.30.2009 5:12pm
CDU (mail) (www):
So how does the content/non-content distinction work when someone uses technological measures, like TOR, to obscure the network routing information?
3.30.2009 5:14pm
VtFedCt:
Prof. Kerr,

Admittedly, I have read only your posts and not the entire article. But why is the goal here necessarily to analogize "normal" Fourth Amendment Jurisprudence to online Fourth Amendment Jurisprudence as closely as possible? It seems like before you even begin the argument your end goal--to articulate technology neutral Fourth Amendment principles--precludes people from using the internet to establish some kind of "extra" privacy, even assuming it would be perfectly reasonable for them to do so. In other words, it seems your approach prematurely precludes the possibility that one may have a reasonable expectation to privacy with regard to information concerning, for example, the sending and delivery of information over a network just because one does not have such an expectation over information concerning the sending and delivery of information in the "physical world." But why is this true? If the only justification is that we can now rely on "technology neutral" Fourth Amendment principles, I'm not sure that's enough.

I may not be familiar enough with how the internet works to provide concrete examples so maybe my question is actually: is there any reason to believe that people may be able to reasonably expect what would be by analogy "more" privacy by using a network to transfer for information than by traveling "outside" into the world and transferring it themselves? Perhaps ultimately the answer is they have less.
3.30.2009 5:19pm
einhverfr (mail) (www):
NatSecLawGuy:

How would your protections involve snooping on delivery information between email servers? If your email connections are ones you expect some privacy on, does that extent to all email delivery as well upstream and beyond the state of your user account? Is the cloud of internet traffic inside or outside?
3.30.2009 5:21pm
OrinKerr:
ewinverhr asks, with my comments in bracket:

Suppose I drop a letter on the way back from picking it up from the mailbox. Can the police open it and search its contents? I don't know the answer so I am asking whether this counts as outside or inside.

[Inside]

Secondly, can police go to the post office and observe the addresses of all letters that come to me or get mailed by me? I would assume so but I am asking. What about a UPS depot? Is that inside or outside?

[Outside]

Can police read the contents of a postcard while it is at the post office awaiting delivery?

[No cases on that one, actually. But it would seem to be outside: The cases talk about what is visible to the post office versus hidden from them.]
3.30.2009 5:25pm
VtFedCt:
To be clear, I do not mean to question your presumption of technology neutral, I think my question goes more to whether this content/non-content distinction goes properly addresses the need for "equal degrees of reasonableness."
3.30.2009 5:26pm
einhverfr (mail) (www):
Jack Of Spades:

I would propose instead a legal line that reinforces a natural, technical protection. For example, prohibit the decryption of data, and/or the search of information stored on third-party systems without a warrant served on the person whose information is sought. Yes, this would expose email sent in plaintext, but encryption of email is not a difficult technical problem; it just needs market drivers to foster widespread adoption. Such a rule would be one driver.


I think that is a good approach. Along with no dragnet searches (searches of public information still need to be reaonably scoped), I think this is sufficient.
3.30.2009 5:26pm
OrinKerr:
Suppose I drop a letter on the way back from picking it up from the mailbox. Can the police open it and search its contents? I don't know the answer so I am asking whether this counts as outside or inside.

[Oh, and I should add an addendum here: If you drop the letter and never return to pick it up, at some point it will become abandoned and the presumptive privacy will dissipate.]
3.30.2009 5:27pm
OrinKerr:
VtFedCt,

I talk about this in the article at the end of Part II. (The short answer is that you appear to be assuming that a "reasonable expectation of privacy" is what a reasonable person would expect would remain private. It's not.)
3.30.2009 5:29pm
einhverfr (mail) (www):
OrinKerr:

Thanks for your answers. It seems to be a common sense conclusion to understand that postcards could be read by third parties, probably including police. If it would be outside, how would this differ then from an email, where the headers and the body are delivered with no obscuring technology surrounding the contents?

Wouldn't an unencrypted email end up being more or less like an internet equivalent of a postcard assuming it was intercepted in transit?

Also use of networks like Tor would seem to me to be effective at rendering routing and destination information t be "inside" the protected zone. This would be like bundling and mailing to a third party for forwarding.
3.30.2009 5:30pm
OrinKerr:
Oh, and in response to the idea of having the line be encryption, I have written about why I don't think that works. To be sure, encryption creates lots of privacy: Just not Fourth Amendment privacy.
3.30.2009 5:31pm
pintler:
1)I concur with the paper that URLs are tricky. If I supply my Barbie fetish by ordering out of the paper Sears &Roebuck catalog, the nosy policeman hasn't a clue, but when I go to amazon: http://www.amazon.com/Barbie%C2%AE-Diamond-Castle-Princes...

IIRC, several years ago when the FBI was pushing carnivore, the device they wanted to install was smart enough to pull just the hostname out of the URL.


2)On the top of page 36 of the article, you discuss the relative difficulties of physical and virtual surveillance. I don't agree that online surveillance isn't vastly easier. If you want to know who I am sending mail to in the real world, you need a large team to follow me around 24x7 to see when I drop a letter in the box, and grab it. Online, you just ask my ISP to email you the headers for every piece of email I have sent in the last year (or whatever retention period is mandated). By the time the ISP gets a couple of requests, they will have automated the process so it's easy for them to do. Worse (from a maintaining parity with the present, if maybe better for law enforcement), when you suspect Joe, you can get a list of everyone Joe ever emailed, and retrospectively see everyone they emailed, and so on. You can build maps of who knows Joe and who do they know. To me, it seems so different quantitatively that it is qualitatively different.

Encryption and mail forwarding proxies work for paper letters too, so I don't think you can use those as somehow balancing the lower cost of data collection.

I guess I am so used to writing programs that troll through the millions and millions of lines of logging output I get in my day job that it seems like an easy thing to do.

BTW - I think this is an important area the law needs to address, thanks for doing it.
3.30.2009 5:49pm
Brent Peterson:

I'm not sure what you're asking: Are you asking me to say whether I think a file name (presumably one attached to an e-mail) is content or non-content? If that is what you're asking, can you tie that question to the argument of the paper?

Sure. In your paper, you argue that courts, when applying the Fourth Amendment to internet communications, should distinguish between content and non-content information. The former should be presumptively protected by the Fourth Amendment; the latter should not. I am wondering whether the file name of an email attachment should be considered "content."

Under your definition of content, it is clear that the contents of an attached file are protected. If the government opens a file and reads its contents, then that action is regulated by the Fourth Amendment. But what if the government merely views the file's name and not the file's contents? Is the file name more like the information in content of the email (e.g., the subject line and message body) or is it more like the information in the header of the email?

In some cases, a file name could be so descriptive that it hints at the file's contents. In the example I used above, a file could be named "my_drug_sales.xls." The sender does not, however, need to use a descriptive file name. The sender could just as easily could use a less suspicious file name, like "sls_0330.xls." Is using a descriptive file name somewhat like writing "Drugs Inside" on the outside of a physical package (which, I assume, would not be protected by the Fourth Amendment)?
3.30.2009 5:59pm
OrinKerr:
Pintler,

Thanks for the interesting comments. You write:

If you want to know who I am sending mail to in the real world, you need a large team to follow me around 24x7 to see when I drop a letter in the box, and grab it. Online, you just ask my ISP to email you the headers for every piece of email I have sent in the last year (or whatever retention period is mandated).
There's a lot here, so let's unpack it.

1) What kind of criminal commits a crime using his own ISP? You'd instead use someone else's wireless point or some other means of accessing you to the net that isn't so clearly linked to you.

2) You're assuming that the police have a known suspect. In most cases, though, they know someone committed a crime but they don't know who did it. In that case, there is no ISP to go to.

3) Note also that the Government has the mail cover authority, not regulated at all by the Fourth Amendmnet, that lets them get a copy of the outside of all postal mail that is going to a target. They don't need to follow anyone around 24x7 for that (although it wouldn't cover mail sent by the person, just to them).
3.30.2009 6:02pm
OrinKerr:
Brent,

I would think that file names are probably contents, but I'm not sure. I'm curious, though, why do you think it matters?

Also, note that there's an interesting new article on the content/non-content line: The Content/Envelope Distinction in Internet Surveillance Law.
3.30.2009 6:05pm
einhverfr (mail) (www):
OrinKerr:

Ok, you have me convinced that encryption shouldn't be THE line, but I still think it is the most equivalent method to putting a document inside an opaque envelope. If the document is in a transparent envelope (say it was clear plastic), I would expect police to be able to read what they could through the envelope.

I am not saying that every use of encryption should automatically put it "inside" or that the federal government couldn't regulate encryption (though as a policy matter, I think that would be highly unwise). However, just as opening an envelope requires a separate act, decryption could be seen in the same light.

Assume for the purpose of this that I am talking about breakable encryption, like DES.

So I think these are entirely different questions than the ones in your encryption article.
3.30.2009 6:09pm
OrinKerr:
einhverfr,

These are hard issues, but at least my own view is that it's a mistake to focus on what information is easier or harder to see. The Fourth Amendment isn't there to stop the Government from doing things that are hard, so I don't think it works to draw the analogy based on that similarity. But that's probably pretty clear from my articles -- thanks for reading them.
3.30.2009 6:18pm
TriggerFinger (mail) (www):
Orin,

You have a bit of a problem in that it's not readily practical to access message header information without also accessing content information. Technically, there are three portions of a typical internet mail message:

1) The envelope information (typically exchanged as part of the SMTP protocol prior to content delivery and usually duplicated in the message headers)

2) The header information (information about the message intended to be read and processed by machines; this includes the subject line, information about when the message was written, where responses should be sent, and what type of content the message contains, etc)

3) The message body information (entered by the user directly, and displayed to the receipient; usually text paragraphs but also attached files and so on).

The problem is that both 2 and 3 reside in the same file when messages are stored in (standard) RFC822 format. To preserve access to 2 for law enforcement, you have to obtain access to the message content as well. This would normally involve looking on the user's computer, seizing it, since the ISP normally does not keep either parts 2 or 3 of the message once the user has retrieved it.

If you truly want only address information, then you only want the information in 1. That information is stored in SMTP logfiles and can probably be provided by the ISP without invading the user's home or setting up an ongoing monitoring process, simply by examining their existing log data. The burden to everyone involved is much lower, and the analogy to a pen trace on a telephone line (which, as I understand it, provides who-called-who data but no access to the content of the call) is clearer.
3.30.2009 6:29pm
pintler:

1) What kind of criminal commits a crime using his own ISP?


The same ones that write the hold up note on the back of one of their deposit slips :-)

I'm not thinking just of crooks. I try pretty hard to obey the law, but I don't want people reading my mail or listening to my phone conversations, boring as they might be, without good cause, i.e. a warrant. I view the function of the 4th as enabling my privacy fetish, not helping crooks.


2) You're assuming that the police have a known suspect. In most cases, though, they know someone committed a crime but they don't know who did it. In that case, there is no ISP to go to.


This one went right over my head. If there isn't a suspect, or anyone under surveillance, whose 4th amendment rights are we talking about?


3) Note also that the Government has the mail cover authority, not regulated at all by the Fourth Amendmnet, that lets them get a copy of the outside of all postal mail that is going to a target. They don't need to follow anyone around 24x7 for that (although it wouldn't cover mail sent by the person, just to them).


Interesting. That's still got to be more expensive that doing it electronically, and also doesn't let you build retrospective contact networks. It may not offer a lot of information about what is in the no return address plain envelopes, either, and not putting on a return address is easier than arranging a chain of anonymous forwarding. Or maybe I need to bone up on my internet crime techniques :-)
3.30.2009 6:29pm
einhverfr (mail) (www):
OrinKerr:

You misunderstand my concern. It isn't about what is easy or hard, but what is likely to be observed in the process of observing other data.

Suppose I employ a simple packet sniffer to eavesdrop on email communication on a network including an email server. I can set capture to the following modes:

1) I could capture all IP-level packet header information. Under your view this is all non-content.

2) I could capture all IP and all TCP, UDP, ICMP, etc. packet header information. In your view this would all be non-content.

However, none of the above levels gathers all non-content information that would be helpful. In all likelihood I get connections of end users TO the email server, and email delivery information from other email servers. I don't get material specifically related to who sent the emails.

To do this, I have to capture the TCP packet payload, which includes both the SMTP header information and the email contents together. Unlike the TCP and IP header information, this is not a matter of fixed widths, and the functionality is not built into general purpose network surveillance at least as far as they are used by sysadmins. Furthermore, the email subject is delivered as an SMTP header, suggesting that that this would be non-content at least if I automatically harvest the higher-level packet data.

So I am not sure that this distinction works when internet protocols were not designed with that distinction made along ways conducive to that legal line.

Of course the other option is simply to say that the line would be drawn at the packet header level, but that is likely to be unusable from an email perspective.

Now, looking at your examples:

THe Lex Luthor Hypothetical is simple. The material was published with no legitimate expectation of privacy, it is outside. We are not eavesdropping in transit of point-to-point communications, so that doesnt apply.

Similarly, in the cases you cite in your encryption article, material had been seized pursuant a warrant, etc. Similarly if one has a warrant and seizes information or overhears it, that would be distinguishable as well.

There is a second place line one could draw, though, and you are convincing me that it might be better. There are no public places on the internet where anyone can just run network scanners etc. It might be better to see "outside" as being "publicly available" and inside being "not publicly available." Hence the government can read this web site to their hearts' content and mine the data in it, but they can't go to an ISP without a warrant and get email traffic data.
3.30.2009 6:43pm
themighthypuck (mail):
I like your idea and think the content/non-content distinction satisfies the 4th amendment but has some practical problems. For some reason I don't think so-called firewalls work well in practice, which to my mind reflects 4th amendment jurisprudence in the last 50 years. If the gearheads are right about there being little distinction between content and non-content in the real world, I doubt you can hang a legal principle on that distinction.
3.30.2009 6:52pm
OrinKerr:
einhverfr,

Why should the likelihood of interception be the key issue? As the Supreme Court has repeatedly said, "the expectation that certain facts will not come to the attention of the authorities is not the same as an interest in privacy that society is prepared to consider reasonable." The Fourth Amendment does not just protect against surprises.
3.30.2009 7:42pm
Brent Peterson:
Orin,


I would think that file names are probably contents, but I'm not sure. I'm curious, though, why do you think it matters?

I think it matters for the same reason that a subject line--which you highlight as being deserving of protection--matters: If the government may view it without restriction, then the government has free access to (arguably private) information that it can use as a basis to conduct a more detailed search.

Thanks for the link to the article on the content/non-content line; it looks interesting.
3.30.2009 7:43pm
einhverfr (mail) (www):
Hmmm.... After reading a bunch more of the articles, I think I am coming to the conclusion that the content/non-content distinction makes the most sense at least in terms of the standards under which search warrants can be issued. However, what I am still struggling with is how some of this would actually work in the real world.

For example, email subjects can be stored anywhere in the SMTP header block. If they are contents, it seems that one has to look inside the contents to sanitize them. Similarly if URL's are content, but some other HTTP headers are not (for example, the user agent header), then obtaining these through an automatic search might be somewhat problematic.

However, I suppose one could simply assume that screwups, while inevitable, can be handled using the poisonous fruit doctrine.
3.30.2009 7:45pm
early bird (mail):
Adam Gershowitz, at South Texas College of Law, recently wrote an article proposing teams of super prosecutors and super defense attornesy, at the state rather than the county level, who would handle all death penalty cases in a state. It was quite neutral in tone and very much about improving the way the death penalty works, so that poor counties don't fail to pursue death for lack of funds, and prosecutors in wealthy counties don't pursue death purely for political reasons. A very interesting article.

I'm an articles editor, and we narrowly rejected it. Some of my colleagues felt the proposal wasn't realistic enough. I thought they had a point, but still thought it worth publishing. It had an expedite request, I'm pretty sure, so it should be coming out next year. Look for it.
3.30.2009 9:15pm
early bird (mail):
Uh, for some reason the above comment got posted on this thread, instead of the death penalty one. Sorry.
3.30.2009 9:16pm
pintler:

If they are contents, it seems that one has to look inside the contents to sanitize them.


If the material is made available by the gov't requesting it from an ISP, then I think the ISP should ensure they only send the redacted data. You can't really avoid your ISP having access to the data - while I'm sure they have policies against snooping, the practical difference between snooping and troubleshooting is one of intent, not what the sysadmin sees.
3.30.2009 9:31pm
theycallmecontent:
Orin,

The underlying problem with the distinction between content and non content is the assumption that there is a finite number of known protocols that are publicly defined and adhered to. To reverse engineer an unknown protocol you must examine both content and non content.

We end up with a situation where either every byte is up for grabs or monitoring without a warrant is limited to known, published protocols. I could drive a truck through both of those loopholes.

By the time there are rulings and established precedent relating to what specific pieces of information are and are not content for one specific protocol there will be one hundred more protocols that we know about and countless more that we don't.

If nothing else, we will certainly have full employment for lawyers and judges.

The AT&T metaphor of stark contrast between call content and identifying information only works when you can control the protocols. The internet doesn't work that way.
3.30.2009 11:34pm
gattsuru (mail) (www):
Mr. Kerr, do you believe that the Fourth Amendment's right to privacy is meant solely to protect the guilty, or that it applies to both guilty and innocent? There seems rather little use for a right to private communications that only protects a person in the court room, to those who have followed the laws, especially if the actual communications may be effectively and regularly spied upon.

The nature of common internet communications, as einhverfr has already noted, make any attempt to discern content and non-content data without reading the content difficult or near-impossible; the communications is rather similar to a postcard, with both tracking and plaintext equally visible.

As a law-abiding citizen who still values privacy, it seems a bit lackluster a right if it is regularly broken. My place of business sends a non-trivial amount of vital communications across encrypted channels. While we're at the point where we think it can not be reasonable broken, there's really no guarantee that modern cryptographic techniques lack the intentional flaws some earlier methods had. Breaking this communication enough to read the non-content information (username, access control calls) also opens the content itself to easy inspection, and it's not difficult to imagine such a thing resulting in significant economic losses for a corporation. Nor, for that matter, is it difficult to imagine a typical person's private information revealed from such a communication to even a single police officer resulting in horrible social consequences.

Normally an ISP's disclosure of private information would be a violation of contract, but it's not like you can effectively sue the government or public officials for distributing private information these days, no matter how intentional the damage.

It seems that the effect on the innocent needs to be the first goal for any matter of new judicial interpretation, and having data which the average user has just reason to believe are private (inside internal wired networks, secured wireless communications, encrypted communication) needs to be the core of that matter.
3.30.2009 11:39pm
einhverfr (mail) (www):
I hope professor Kerr will correct me if I am wrong but it seems what is at stake is not whether a search warrant is required but the standards used to get a warrant, what exclusionary rules apply, etc.

I think that this is somewhat misleading because the article summary sounds as if Prof. Kerr is saying non-contents material would be accessible without a warrant but further reading suggests this is not the case, and that what is at issue is the standard upon when a warrant would be issued and what would be excluded from that warrant.

For example, I don't think police could ask every ISP in the country for all their logs of non-content data just because it might be useful for ongoing investigations. The search still needs to be reasonable in scope and so something like the stored communications act governs something like non-content elements of emails. However, to get the contents of the emails, one has to go through the wiretap act warrant procedures which are more cumbersome.

Is this what Prof. Kerr is saying? I hope so. I could agree with it if this is the direction at least to a point.

However, the article suggests that police would not need cause to ask for ISP email header information outside of the subject line, etc. I don't know about this though. Everything else I have read suggests that a subpoena at least or a search warrant is still required for this sort of thing even if it has a much lower bar.

So maybe there might be an "outside" (publicly published material, for example his Lex Luthor hypothesis), "inside but largely unprotected" being non-content material, where search warrants would be issued if the police testify that they expect the results will be relevant to an ongoing investigation (still probable cause but a less restrictive process), and the fully protected (contents) which are subject to more substantial burdens.

However, this seems to impose content/non-content distinctions ON TOP OF existing inside/outside distinctions. For example, this web site would be fully "outside" and whit doesn't need a search warrant to read what is on the site. If someone confesses to a crime on this site and he reads it, that is still not subject to 4A protections in any way. However, legal processes which require SOME show of cause are required to access personal communications.
3.30.2009 11:55pm
Paul Allen:
Orin:

I'm having trouble with your distinction. The trouble is activity on the Internet still fundamentally amounts to actions between private parties, in private facilities; not actions on public-land, using public-resources.

But I can see where you want to go, you want the same distinction as we have between a pen register and a wiretap, but the distinction is missing. The theory behind the pen register stems from the notion that it records information that those on a private-call nonetheless expect the telephone company to monitor and record (for billing purposes).

When I send mail to a user at a mail service, I expect the mail service to log me (my IP) and log the delivery of the message. So far your analogy of content vs. non-content is okay.

But suppose I send an email directly to the recipient's computer. In this scenario, I expect the network provider to only inspect IP headers, not anything about the message contained inside. Further, I do not expect the network provider to log any details about the packet--no network provider does so in the normal course of business. So the pen register argument breaks down.

Your inside/outside distinction doesn't help either.
3.31.2009 12:01am
Ari Tai (mail) (www):
Is there an equivalent to a "wanted poster" displayed in the post office in this discussion? Seems there should be a civil society role for both individuals and enterprises in (voluntary) policing.
3.31.2009 12:27am
OrinKerr:
Theycallmecontent:
To reverse engineer an unknown protocol you must examine both content and non content.

We end up with a situation where either every byte is up for grabs or monitoring without a warrant is limited to known, published protocols. I could drive a truck through both of those loopholes.
Can you explain what this means? What unknown protocols? Are you making a point about deep packet inspection>

Gattsuru: I think the Fourth Amendment protects everyone in the United States and U.S. citizens and permanent resident aliens outside the United States, innocent or guilty. As for your concern about what you as an innocent person think, doesn't that same concern apply to public surveillance?

Paul Allen: I completely disagree. The reason contents of calls are protected and non-contents are not protected has nothing to do with typical user expectations. To be sure, there is some language in Justice Blackmun's Smith opinion that could be construed that way, but then it often happens that there is stray language in Blackmun opinions that doesn't make much sense. As a general matter, the logging that a typical user expects to occur is entirely irrelevant for Fourth Amendment purposes.
3.31.2009 3:03am
xyzzy:
Professor Kerr,

Forgive me if this sounds a little harsh, but you seem to me a little bit like a mechanical engineer, inexperienced and unsophisticated in communications protocol design, who is (perhaps unknowingly) stepping outside of his competence: We see a lot of that in SCADA systems.

You are ignoring the abstraction of layers.

The engineering distinction between "header" "content" [ "trailer" ] depends on what layer of the stack you're working with. That is, it depends on your point of view. Or, in another sense, it's arbitrary.

By way of concrete example, consider a TIFF, encapsulated in MIME, in a RFC822 message, enveloped by a SMTP transaction, using TCP, over IP, in ethernet over ATM.

Where do you think the legal line between "header" and "content" ought to be drawn? Inside the TIFF? Or at the ethernet / ATM boundary? What's the logic for your rule? And how do you expect a judge to apply that logic?
3.31.2009 5:18am
xyzzy:
To make the example above even more concrete, take the ATM cells and put them on a customer's DS3, then multiplex that into SONET on a carrier's OC-48.

Which photons can the government look at without a warrant? And which photons need a warrant?
3.31.2009 7:25am
pintler:

Can you explain what this means? What unknown protocols?


Just taking a stab here - if your and my computer are communicating via standard protocols only (smtp or http or whatever, on top of tcp), then it's possible to design surveillance software that sifts thru those data streams and only produces suitably redacted data, like just the hostname part of a URL of only addressee info from email. But there is nothing stopping me from designing some new protocol to communicate between your computer and mine - heck, I design and implement those all the time - and that means whoever is watching has to look at the entire data stream, puzzle over what bits are what, and then determine which are OK to see and which are not (via, potentially, legal proceedings each time).

If we can string a wire, then we're not limited to UDP/TCP, and our listener will have to get out his oscilloscope :-).

That said, I'm not sure traffic in an obscure protocol is different in a practical sense from traffic that is encrypted - in either case it will be costly for an observer to watch (the cost depending on the strength of encryption and obscurity of the protocol).


As for your concern about what you as an innocent person think, doesn't that same concern apply to public surveillance?


I'm still stuck on the quantitative difference. If you want to put my life under a microscope, in case 1 you wear out a lot of trench coats and shoe leather, jotting down:

11:52 Suspect entered Safeway, bought a dozen eggs and quart of milk
12:17 Suspect entered Joe's Sporting Goods, bought box of clay pigeons and 2 boxes #9 shells.
13:22 Suspect went to library, looked at the 'How To' section, then skimmed the Aug 08 'Scientific American, then checked out 'Portnoy's Complaint'

In case 2, you email my ISP and say 'send me everything you've got on pintler', and you get all the above for the last year. Even if everything but the hostname is redacted from the URLs, it's still the equivalent of putting a GPS tracker on my car (worse - on me!) - for the price of an email.

As an example, a little diligent googling will probably come up with OK's address, and then google streets will give me a picture of his house. That is so much cheaper than flying to the DC area with a camera and going to a bunch of assessor's offices that it is a real difference, IMHO. There are good things about that, and bad things about that, but it seems different enough to me that we need to go farther than just analogizing from telephones and snail mail. A modern rifle is within an order or magnitude or two of the effectiveness of a muzzle loader, but modern surveillance seems to me to be many orders of magnitude cheaper than in the past, and so maybe some things that have been limited by practicality might need to be limited by some kind of warrant requirement.

FWIW, I think I have heard of cases about whether a warrant was required for putting a GPS tracker on a car, but can't for the life of me recall what the resolution was, maybe there is already precedent.

As an aside, while we're talking about whether we're observing the temp of the inside or outside of the wall, is there any precedent on Tempest type monitoring?
3.31.2009 8:16am
pintler:

Which photons can the government look at without a warrant? And which photons need a warrant?


Xyzzy, I'm not a network guy, but I would think if I was authorized to look at the To and From of Fred's email, the place to do that would be at the endpoint, e.g. the 'RCPT' part of the smtp transaction. That may not work if Fred is running his own network.

I'm guessing, though, that the vast majority of people connect directly to an ISP, and send pretty vanilla traffic. If you encrypt or use tor or whatever, you get more privacy.

I kind of see that as an argument for high levels of privacy protections - sophisticated crooks can, with some extra effort, defeat surveillance anyway, so loose warrant requirements merely catch dumb crooks, while compromising the privacy of everyone. It could even be counterproductive, if enough people get creeped out by surveillance that encryption becomes mainstream, you won't even be able to catch the dumb crooks.
3.31.2009 8:35am
xyzzy:
Which photons can the government look at without a warrant? And which photons need a warrant?

Xyzzy, I'm not a network guy, but I would think if I was authorized to look at the To and From of Fred's email, the place to do that would be at the endpoint, e.g. the 'RCPT' part of the smtp transaction. That may not work if Fred is running his own network.

From a legal standpoint, does it matter where the warrant is executed?

If a judge orders the carrier to allow the government to tap the OC-48, is that unreasonable?
3.31.2009 8:59am
BZ (mail):
Can't get to the article to see whether this was treated: trying to understand how the content/non-content theory meshes with what I understood was the basic Katz-trio theory: Privacy protects the person, not the place? I understand that easily with inside/outside, but not really with the content/non-content theory (and the jargon here is head-hurting).

Are you arguing that the content is somehow the person, while non-content (which I loosely interpret as destination/transmittal information, but which also seems to include descriptors) is the place? So a pen register analogy is fine (destination), but wouldn't content descriptors of some type be more content than destination?
3.31.2009 9:03am
Caliban Darklock (www):
I have always been of the opinion that privacy is a polite fiction.

I am also rather of the opinion that privacy on the internet is simply fiction.

We all anticipate (or should) that our employers monitor everything we do online at work, and that our ISPs monitor everything we do online at home. This is not in any way private.

I, for one, find this to be a Good Thing. Privacy is only necessary so you can avoid public ridicule and castigation for things that you actually, in fact, do. The only reason to conceal them is so you can lie about them, if only by omission. I don't find that a compelling interest to be protected.
3.31.2009 10:43am
pintler:

Privacy is only necessary so you can avoid public ridicule and castigation for things that you actually, in fact, do. The only reason to conceal them is so you can lie about them, if only by omission. I don't find that a compelling interest to be protected.


Well I will come clean right in front of everyone - as God is my witness, on my wedding night, my wife and I made love.

Nonetheless, if I found you looking through the window, I would be upset with you. That's privacy.
3.31.2009 11:48am
einhverfr (mail) (www):

If a judge orders the carrier to allow the government to tap the OC-48, is that unreasonable?


Ok, here is what I am thinking, and I would hope Prof. Kerr would correct me to the extent it is fundamentally different than his viewpoint.

There are really three levels we have to consider here: 1) Public areas, like web pages, where police officers can visit without a warrant.

2) Private areas largely unprotected by the 4th Amendment but protected by statute. Whether they are COMPLETELY unprotected by 4A is another good question. For example, car searches are protected under 4A but not very much (i.e. police can't set up a roadblock and then search every car going down I-90, but most individual car searches are considered reasonable). Generally, statute would govern these areas. On the internet, this would include endpoint data, mined by the ISP on government order, but neither wiretaps or information pertaining to communication contents (probably no URL's SMTP subject headers, or the like). Warrants might be issued for this information based on the likelihood that the material would be pertinent to an ongoing investigation, or under the standards set forth by the Stored Communications Act.

3) Some areas would be fully protected under the 4th Amendment and these would include material related to communication content. Presumably this would include things like URLs, email subject headers, file attachment names, email bodies, etc. Warrants issued here tend to require more specificity in what officers expect to find, have exclusion rules, etc. Standards might be similar to those set in the Wiretap Act.

Does this make sense?
3.31.2009 11:57am
Brent Peterson:
xyzzy:

You are ignoring the abstraction of layers.

The engineering distinction between "header" "content" [ "trailer" ] depends on what layer of the stack you're working with. That is, it depends on your point of view. Or, in another sense, it's arbitrary.

I agree that the distinction between "header" and "content" is, in a sense, arbitrary. But aren't physical distinctions--ones that courts make in Fourth Amendment law--also, in a sense, arbitrary? I mean, how does a court distinguish between and an addressed "envelope" and a written "letter"? Both are just pieces of paper with writing on them.
3.31.2009 1:27pm
einhverfr (mail) (www):
BTW, I wonder if it would be clearer to argue degrees of 4A protection rather than black/white distinctions. I think that the 4A covers all searches and requires that they be reasonable.

Hence we might think of areas where there are strong 4A protections (say, in the home) and areas where there are weak 4A protections (students at school, car on the public highway). In these cases of weak protection, statutory controls would USUALLY be sufficient to meet Constitutional muster, regardless of what they say. Of course, searching every car travelling on a public highway, or strip-searching a 13-year-old on suspicion she might have ibuprofen might still raise Constitutional problems in these cases, but by and large, statutory controls would be sufficient.

In areas with strong protections, statutory controls would still be determinate, but courts would need to evaluate Constitutional requirements more carefully. Hence my suggestion we think of three categories:

1) Public spaces where the 4th Amendment doesn't apply at all. Example: speech event open to the public. Also, pamphlet sent 1st class mail unsealed would presumably be public.

2) Private spaces where 4th Amendment protection is weak. Example: student in a public school, car on a public highway.

3) Private spaces where 4th Amendment is strong. Examples include inside the house, sealed first-class mail, etc.

I think that the government would still be barred from data mining all internet headers and then using this in criminal investigations (and this has been the opinion of the FISC, according to the Washington Post).

However, what I see Orin arguing is something subtly different, that there is an unprotected transaction space which includes things like bank deposits, drugstore purchases, bookstore purchases, etc. which is not protected. Although there seems to be some jurisprudence indicating that this is the case, I am not sure what the result will be as government surveillance of this transactional space increases. For example, now sudafed purchases are tracked. Is there a limit to this?

Can the government pass a law stating that all purchasers of books on a certain restricted list must be reported proactively by the bookstores which sell the books? Could the government require that ALL bank transactions, not just those above $10k get reported to them? Would this be different if cash were outlawed and all legal tender was moved to an electronic and trackable means?

I am not sure that transaction space is entirely without 4A protections. It may just be that we haven't hit the point where the line regarding what is "reasonable" is drawn yet.
3.31.2009 1:29pm
pintler:

I am not sure what the result will be as government surveillance of this transactional space increases. For example, now sudafed purchases are tracked. Is there a limit to this?


I would note that any cashless purchase (and including cash transactions where you use a 'club card') is already recorded by e.g. Safeway. Any purchase made with a credit card is tracked, although unlike Safeway, my bank only knows the total, not whether I bought broccoli or ice cream. I know my bank sends me a helpful year end summary listing every purchase I made in the last year, neatly categorized. You can tell when and where I was on vacation, how the remodeling project is going, when I was downtown on jury duty, etc. It's not reading my diary, but it's close.

So I think your questions are spot on. Can the gov't, sans warrant, require Safeway to supply that information? Can it collect it routinely, and mine it at will? Can it compel businesses to maintain it even if the business, like the library, would prefer to delete it?

These things are feasible. That makes me expect that sooner or later, some future Patriot Act will try to make them compulsory. I prefer we think about the boundaries before a future gov't is trying to 'not waste a crisis'.
3.31.2009 3:11pm
Roscoe B. Means (mail):
With all due respect, I regard this as a useless exercise that began with a false assumption that there is a real difference between "the physical world" and "the internet." The internet is not a place. It's a collection of computers that have a physical presence in physical places in the physical world. Some of them are operated in such a manner that the public is free to learn their contents, and others aren't. But they are part of the physical world, not some mystical "hyperspace." I've read all the posts and most of the comments, and I still don't see a need to engage in the fantasy of treating the internet like it was some other universe when it's not. But then, I'm probably just not techno-savvy enough to envision the situations that show the need.

To me, though, the suggested distinctions make no sense. "Content" is not a parallel to "inside," because a huge amount of "content" - maybe even most of it - is created for the equivalent of billboard display without the slightest expectation of privacy. (Indeed, that's pretty much what the word "content" means in many circles.) It seems simpler and more consistent with the Fourth Amendment to ignore the desire to treat a collection of computers differently from a collection of mailboxes or cookie jars. What the public can detect by lawful means, the police are also free to detect and seize without consent from anyone. What is not publicly available requires consent or a warrant. If you happen to put information on the hard drive of a Yahoo computer, that information has no more or less protection than a letter to Yahoo's physical mailbox or a note left in Grandma's cookie jar. If the custodian consents to its disclosure, it's disclosed. If they don't consent, police can get a warrant or they can't. Any expectation of privacy that conflicts with that is just not reasonable in my view.
3.31.2009 3:12pm
OrinKerr:
Roscoe,

So what kinds of limitations does the Fourth Amendment impose on government internet surveillance? Can they monitor IP addresses? E-mails?
3.31.2009 3:28pm
einhverfr (mail) (www):
OrinKerr:

Do you see ANY 4A limits to monitoring of emails?

Could the government ask that all to/from addresses from ALL emails sent or received within the US be forwarded to them for analysis? Or would this be the equivalent of searching every car on a public highway?
3.31.2009 4:34pm
einhverfr (mail) (www):
Sorry, that should be monitoring of non-content data from emails.
3.31.2009 4:35pm
Edmund Unneland (mail):
If I may, I would like to get back to the question of whether encryption creates a hightened expectation of privacy that Fourth Amendment jurisprudence should recognize.

The presence of a privacy hedge or fence helps delineate where the curtilage begins. Could encryption be analogized to a hedge? Do I remember correctly that the presence of a hedge or opaque fence of a certain height creates a requirement for a warrant in order to do surveilance of the property? (This may only be in California, under the state constitution.)

(On the other hand, many communities use the zoning code to limit the front fence or hedge to a height that can be easily peered over by an officer. I know of at least village in Westchester that does this.)
3.31.2009 4:38pm
Caliban Darklock (www):
@pintler: "Nonetheless, if I found you looking through the window, I would be upset with you. That's privacy."

However, if I had a right to stand where I was standing while looking through the window (i.e. I was not trespassing), that is all you could do - be upset. For example, if the window to your bedroom is directly across from my upstairs balcony, I might sit on my balcony and look through your bedroom window.

The burden lies with you, not me, to preserve your privacy. If you were unwilling to let me watch your activity in the bedroom, you would close the curtains, in much the same way you might encrypt an email message. But if you neglect to close the curtains, and I proceed to walk out on my balcony and watch, you have no real complaint - and if you don't notice I'm watching, so the first you hear about it is when your colleagues at work all seem to know about that funny thing you do with your elbow, there's no actual recourse.

In the same fashion, if you send an email which is duly recorded in the logs of some intermediate site that routed the message, and someone with the right to view those logs decides to convey your message to additional people - or even post it in public - they have that right. Likewise, if the police ask to see any message from you that such a person has, the message might be voluntarily provided.

If you didn't want the message read, you should have encrypted it, just like you should close the curtains when you don't want to be watched. You have every right to be upset about the message being read. I simply do not believe you have the right to compel people not to read it.

This is, of course, just my opinion.
3.31.2009 5:00pm
einhverfr (mail) (www):
Caliban Darklock:

I would note that my argument above had nothing to do with encryption being hard to crack, but just that it provides an opaque encapsulation, providing security at least equivalent to a paper envelope for first-class mail. I would think that ROT-13 (or even ROT-1 in the Lex Luthor hypothetical) would be sufficient for contents of an email in transit if one were to try to draw such a line. Of course this doesn't apply to public documents as in that hypothetical.

This leads to an interesting question that I am not finding an answer to in Prof. Kerr's article. Is there an equivalent to a public pamphlet in email? If I sent a public pamphlet through the mail and don;t put it in a sealed envelope, the whole thing is "outside." Is there any equivalent in internet communications?
3.31.2009 5:25pm
gattsuru (mail) (www):
As for your concern about what you as an innocent person think, doesn't that same concern apply to public surveillance?

My company actually does public surveillance. It's a whole different kettle of fish from the viewpoint of the innocent, from my understanding of modern jurisprudence regarding the right to privacy.

If my company wants me to transport secure information from point A to point B, it's really not that difficult. I put it in a locked briefcase and simply drive. Someone observing my movements can only tell that I've gone from point A to point B with a locked briefcase that may or may not contain useful information. Even if the car is stopped and searched by police officers, it's a fairly high metric to the point where searching the briefcase and reading, recording, and copying the information is anywhere near a police officer's acceptable responses.

That's not the case if we're talking the surveillance of non-content data. As a matter of course, any method for pulling (to take one of your examples) non-subject line header data must sort through the subject line. That's equivalent to having police sort through all of your luggage at any stop. The encryption is the lock on the briefcase and car or the seal on an envelope; if it's not a demarcating point it provides no protection to the contents for anyone who's innocent. It's great that it won't be admissible in court, but that won't stop economic disaster, social consequences, or political abuse.
3.31.2009 5:34pm
pintler:

However, if I had a right to stand where I was standing while looking through the window (i.e. I was not trespassing), that is all you could do - be upset.


Forgive my imprecision. I am speaking only of what a policeman can do that a member of the general public can't. I don't think suggesting the police cannot view things that any non-policeman could is an idea with much traction.

As far as the idea that sending unencrypted email is tantamount to posting on a billboard, do you feel the same is true of an unencrypted first class letter? That may be read in transit, IIUC, if the sorting machine shreds the envelope, in order to try and forward it appropriately (as a sysadmin might look at email in the event of a problem), but I would be unhappy if the letter carrier, or the clerk at Mailboxes-R-Us, made a habit of opening and reading my mail. And in the 4th amendment context, IIUC, a warrant is required for the police to read my plain text snail mail.
3.31.2009 6:31pm
einhverfr (mail) (www):
pintler:

The question is whether an unencrypted email is:

1) The equivalent of a postcard or open pamphlet mailed through the USPS, first class.

2) The equivalent of a letter in a sealed envelope mailed through the USPS, first class.

3) The equivalent of an unsealed document mailed through a private currier but with some expectations that it won't be read (contractual or otherwise).

In case 1, anyone can pick up the pamphlet and read it in transit, no protections.

In case 2, a warrant is required to open the letter and read its contents.

In case 3, basic information, collected by the carrier might be subject to weak protections (it can be ordered to be handed over with a low barrier of suspicion), but wouldn't be subject to the full Constitutional protections the same way #2 might be. Other information might be subject to those requirements.

Now, I am going to note that forced decryption in Orin's framework might not trigger strong (warrant) protections under the 4th Amendment, but they might require the same sorts of protections involved in law office searches, in the sense that one might need to have a separate, uninvolved team do the initial sanitation and hand back the less protected data to the police. This might need to be done automatically if the protocol is known but non-automatically if it is not. In the latter case, I would think there would be concerns similar to law office searches where contents must be sanitized of privileged material before handed on.
3.31.2009 7:23pm
theycallmecontent:
Orin said,

Can you explain what this means? What unknown protocols? Are you making a point about deep packet inspection.


pintler gave a good answer above.

http://volokh.com/posts/1238441460.shtml#555521

It is helpful to understand the idea of layering a protocol on top of another protocol. I will try to explain a different way. Let's take a typical analog phone call. We have a protocol(s) that allow telephones to communicate and transfer information in the form of sound. Thats pretty cool, but now what? We layer another protocol on top of those protocols in the form of English, French, German, maybe even some new whistling language I invented or a machine that translates sound into digital information (a modem).

Once we add a modem into the layering of protocols, it is pretty easy to see how we can then keep moving up the protocol levels, but the other examples I listed are able to have protocols layered on top of them also.

Let's pull back for a second and take a look at an example where we are layering the English protocol on top of the protocols of the analog phone system--

1) Person A: Hello
2) Person B: Is Bob Johnson there?
3) Person A: Hold on.
4) Person C: Hello.
5) Person B: Connect your modem.
6) Person C: Hold on.
7) (Sound of modem connecting)

Since the English protocol is pretty well defined, we might say that 1,3,4,6 is transactional information, 2 is identifying information and 5 is content. While courteous telephone manners may disguise the fact, one problem is that the English protocol does not define a structure rigid enough to ascertain this information without knowing the whole transaction. Also, there is nothing preventing me from layering another protocol besides English over the analog phone protocols and unless I am using a known, unambiguous protocol, you have to look at the whole message in order to reverse engineer it.

Number 7 is there merely to ask the koan question why is 1-6 now considered exclusively content and seven is not.

Think about the practical/legal problems of imposing your distinctions on human language and the idea of layering or tunneling new protocols on top of and within language. For your proposal to be workable at all, you must either force me to follow your language conventions or know the 'real truth' of my communications before you can separate content from non content. That is a tall order in the human realm.
3.31.2009 7:43pm
einhverfr (mail) (www):
theycallmecontent:

Why would 5 be content? It is just part of the transaction state information by my view as it doesn't reveal in any way the substance of the conversation.

Consider the following:

Suppose a product of mine sends the following request
GET fun_document.html \HTTP1.1
HOST www.fundocs.com
CONTENT-ENCODING utf8


Now, in return I get soemthing like:
STATUS 200 OK
CONTENT-LENGTH 389543

followed by the content of fun_document.html

What is content and what is non-content? I would argue that all TCP and IP header information (not included in this dialog) would be non-content, as would the CONTENT-ENCODING, and the two header lines returned back.

The HOST header, the GET command, and the body of the document would be content because they reveal the substance of the communication.

The above, btw, is a pretty close approximation of how a web browser works. In fact, it is about as close to HTTP standard formats as I can do off the top of my head (without looking at the RFC).
3.31.2009 7:55pm
einhverfr (mail) (www):
I see 'connect your modem' as being the same as STATUS 200 OK
3.31.2009 7:56pm
Tammy Cravit (mail):
I can't help but feel that the protocol layering issue raised by xyzzy and theycallmecontent is a bit far afield for this discussion. The reasonableness (or lack thereof) of a search does not depend, AFAIK, on the technical complexity of performing the search. The fact that I may write letters to a friend in SignWriting as opposed to English doesn't change the Fourth Amendment calculus as far as I can see, even though it's arguable that decoding a letter thusly written is more difficult for law enforcement than decoding English.

Let's suppose, for the sake of the argument, that I had a file cabinet full of SignWriting documents. The police could serve me with a search warrant seeking all documents related to my business dealings with Party X, and they'd either have to trust me to comply with the warrant or obtain an expert who could help them find the relevant documents. If they were unable to do so because they didn't have anyone available who could decode SignWriting, they might end up seizing materials beyond the scope of the warrant, in which case the materials may be deemed inadmissible later. But the fact that the process of identifying the relevant information is difficult is, in my view, an externality posed upon the parameters of the search warrant.

Likewise, suppose we decide that I need a warrant to read the contents of your e-mails. I duly obtain the warrant and my computer forensics guy downloads your Outlook .pst file and extracts 5,000 emails that he thinks fall within the parameters of the warrant. Let's further say that his attempts to decrypt my encrypted messages are only partially successful, and that as a result he obtains 200 emails that are properly outside the scope of the warrant, and that he further fails to detect 200 responsive emails in the file. I could, of course, move to suppress the 200 extra emails he got, but how does that consideration affect the requirement for a warrant itself?

It seems to me the issues of limiting the scope of the warrant a priori, actually executing the warrant and obtaining the material sought by the warrant, and determining a posteriori what items seized were actually outside the scope of the warrant are interrelated but distinct activities.

Or am I missing something?
3.31.2009 8:39pm
einhverfr (mail) (www):

The reasonableness (or lack thereof) of a search does not depend, AFAIK, on the technical complexity of performing the search.


That is true. The question regarding encryption doesn't have to be dependent on technical complexity however. The question is whether you treat all email (except that which is nominally encrypted) as open pamphlets sent in first class mail, and encrypted emails as those which are in opaque envelopes. Such a standard would depend on a "separate observation" standard. Hence a plausible argument could be made which has to do with opacity from casual observation rather than the technical complexity with breaking it (and in fact encryption might be one possible element, but not the only possibility).

An analogy would be the difference between a postcard where one can read the contents at the same time you read the address information and a letter which is contained in an opaque envelope. I think it is reasonable to suppose that such an opacity-related boundary might exist in personal communications occurring in cyberspace.

The trouble with this argument however, seems to be that none of these things go through government facilities the way mail does. Consequently it is ALL behind opaque barriers and proper subpoenas and warrants with appropriate levels of judicial oversight based on the intrusiveness of the search are thus required. Consequently, I would abandon the encryption argument as long as we agree that this transaction-space is not entirely free from the protections of the fourth amendment any more than motor vehicles travelling down the public highway are.
3.31.2009 9:08pm
theycallmecontent:
einhverfr,

You make an excellent point. One on the reasons I chose that specific wording is because it really blurs the distinction between content and transactional information.

If we replaced 'connect your modem' with 'call me back at 5:00.' Would you see it differently?

How about 'meet me at the city park by the red bench.' Still transactional and not content?

How about 'speak in Spanish'?

How do we come up with a rule to determine what is content and what is transactional or identifying information? Where does one protocol end and a new one begin? These are not easy questions.

Tammy Cravit said,

Or am I missing something?

Information that would be able to be collected without a warrant.
3.31.2009 9:09pm
pintler:
@Tammy Cravit:

It's possible we're not all having the same conversation :-).
My understanding is that we are primarily focusing on what the gov't can get without a warrant. It was posted earlier that the Post Office will, upon request, without a warrant, photocopy the exterior of all my mail and provide it to the police.

The question is how that applies to email or web traffic. 'Photocopy the exterior of all mail' is pretty easy to understand, but to us nerds, 'pull out addressee information, but not content' is kind of a thorny issue - there are a lot of protocols, and each protocol has sticky issues about what is and isn't content. For the URL:

http://some.isp.com/anthrax_cookbook.html

what is the 'address' and what is the content? Us nerds might say 'the subject sent 742 bytes to port 80 at the box called some.isp.com'. Or you can say that 'anthrax_cookbook.html' is also part of the address, which might be reasonable for a static page like that. But if I
you see the URL:

http://my.library.org/checkout.cgi?title=Das%20Kapital

you know I just checked out 'Das Kapital'. If I had requested the book via snail mail, photocopying the exterior of my letter wouldn't tell you I was a closet pinko, so that argues that everything but 'my.library.org' is content, not addressee information.

I'll stop the nerdish riff, but these cases are the simplest examples. Judges will end up, protocol by protocol, trying to decide what is and isn't 'content' (hey, I smell expert witness fees!). And it's not like you can just establish a body of law and that's it - protocols come and go all the time.
3.31.2009 9:20pm
theycallmecontent:
...but these cases are the simplest examples. Judges will end up, protocol by protocol, trying to decide what is and isn't 'content' (hey, I smell expert witness fees!).

Not only that, but wait till the courts have to deal will protocols specifically designed to exploit and workaround existing precedent. There are many thirteen year olds on /b/ that would salivate at the idea of perpetually trolling the supreme court.

ps. If you haven't seen /b/ please don't go. Seriously.
3.31.2009 9:46pm
einhverfr (mail) (www):
Theycallmecontent:

"Speak in Spanish" would be simiar to (in HTTP) headers that say: VERSION NOT SUPPORTED and list a different version as supported. I see that as transactional information exclusively.

TEMPORARILY UNAVAILABLE, TRY BACK LATER would also seem to be transactional information. Even if we were to add:

TEMPORARILY UNAVAILABLE, TRY BACK LATER EST. 1700PDST

Pintler:

There was another article that Prof. Kerr linked to above that I thought was more informative than his article. Among other things it went into more detail on the reasons for the content/noncontent distinction and the different standards of judicial review in both cases. The authors ended up concluding that URL's are generally part of content information.

The reasoning was that most URL's (at least those relating to GET requests) tend to refer to static content which is not frequently updated. This static content could be archived and so if you know the URL and you know when it was sent, you can determine the exact nature of the content retrieved. Obviously there are many cases where this wouldn't be precisely the case, but it would seem to be safe to consider URLs as a class to be part of content.

The envelope article makes a distinction between information that identifies the parties and information that identifies the contents of the communication. URLs seem to generally fall in the latter category reliably enough that I would think would be generally protected.

I am not entirely sure I agree with this line. I would be equally happy with a line that precludes police from looking beyond immediate appearances (i.e. not into encrypted or otherwise concealed contents) without a more restrictive warrant, provided that SOME form of warrant or at least limited subpoena was required to get info from the ISP.
3.31.2009 11:04pm
xyzzy:
Or am I missing something?


Yes.

Professor Kerr's article proposes making a "content" "non-content" distinction in 4A law.

Existing law alreading makes a strong distinction between wiretaps and pen-registers, (and also billing information).

Furthermore, telecom and network engineers make a distinction between header and payload. Those header vs payload distinctions have already been used in some of few court cases as ways to distinguish searches that require a warrant vs subpoeanable information.

However, from an engineering standpoint, header vs payload distinctions are not absolute.

And the courts have been getting it wrong. By mixing and matching the processes and endpoints that consume the headers.

Further —fwiw— Larry Solum advocates bring the layering principles from network engineering into internet law. Network engineers use layering because it's essential to abstract out complexity.
4.1.2009 7:36am
einhverfr (mail) (www):
xyzzy:

Existing law alreading makes a strong distinction between wiretaps and pen-registers, (and also billing information).


The envelope article that Prof. Kerr linked to discusses that in more detail. I personally think the envelope article is one more detailed and informative than this section in Prof. Kerr's article. Of course it is longer too, so this would be expected.

The idea in the envelope article is that the pen register/wiretap distinction is what is really where the non-content/content distinction is made. Furthermore, they argue that this is a functional rather than an engineering distinction. Several of the problems categorized as "hard" are looked at in that article and I think reasonable answers are arrived at (URLs and email subject lines being presumed to be content, for example).

The envelope article seems my mind to simply project the pen register/wiretap boundary onto internet communications. This is probably clearer than trying to apply mail delivery standards since it avoid the question of what the difference between an open pamphlet sent first-class mail and a sealed letter also sent first-class mail and how to apply this difference to the internet in a technology-neutral way (such an line of reasoning would seem to my mind to end up at an "opacity" line which would correspond with the use of encryption, steganography, or the like).

So the question is: Is inside/outside like it is with the mail or like the wiretap/pen register boundary? If the latter, doesn't that presuppose MORE protections for internet communications than for material delivered via the USPS?

In short, I think the envelope article is quite worth reading on this specific issue.
4.1.2009 11:57am
Tammy Cravit (mail):
@pintler:

Thanks for clarifying. To take your example, though, and riff it just a bit farther, I don't think you can draw a boundary based on the technical character of the information. Take your own example of:

http://some.isp.com/anthrax_cookbook.html

It might be tempting to say that the protocol/host part of the URL is envelope and the rest is content. But what about if the URL looked like this:

http://www.how-to-make-anthrax.com/index.html

Does the envelope/content boundary get drawn in the same place?

I'm reading the paper that Prof. Kerr linked to about the envelope/content issue presently, so I may have more to say when I'm done. But it strikes me that entangling the court into the nitty-gritty details of TCP/IP engineering for specific protocols is a road leading only to madness.

Perhaps the solution is to say, "information about who you're communicating with is 'envelope' and anything that discloses the nature or content of that communication isn't", and then leave it to the courts to untangle the specifics on a case-by-case basis using that rule of thumb.

I'll finish reading the envelope article now. :-)
4.1.2009 12:17pm
einhverfr (mail) (www):
Tammy:

Perhaps the solution is to say, "information about who you're communicating with is 'envelope' and anything that discloses the nature or content of that communication isn't", and then leave it to the courts to untangle the specifics on a case-by-case basis using that rule of thumb.


I think that is what the envelope article states.

I would be inclined to allow HOST headers as non-content data since they usually identify a web site, while URL's to be content based on that information.

Consider to/from email addresses, as courts have generally ruled that this information is not heavily protected (presumably there are still limits to what is a "reasonable" search in such cases). If you send an email to sales@how-to-make-anthrax.com that would probably be non-content.
4.1.2009 1:54pm

Post as: [Register] [Log In]

Account:
Password:
Remember info?

If you have a comment about spelling, typos, or format errors, please e-mail the poster directly rather than posting a comment.

Comment Policy: We reserve the right to edit or delete comments, and in extreme cases to ban commenters, at our discretion. Comments must be relevant and civil (and, especially, free of name-calling). We think of comment threads like dinner parties at our homes. If you make the party unpleasant for us or for others, we'd rather you went elsewhere. We're happy to see a wide range of viewpoints, but we want all of them to be expressed as politely as possible.

We realize that such a comment policy can never be evenly enforced, because we can't possibly monitor every comment equally well. Hundreds of comments are posted every day here, and we don't read them all. Those we read, we read with different degrees of attention, and in different moods. We try to be fair, but we make no promises.

And remember, it's a big Internet. If you think we were mistaken in removing your post (or, in extreme cases, in removing you) -- or if you prefer a more free-for-all approach -- there are surely plenty of ways you can still get your views out.