Category Archives: Privacy

Statutes, Judges, and DoJ

Posted on by
Reply

The Supreme Court last Tuesday heard a case between Microsoft and DoJ concerning whether the emails of an alleged drug dealer must be turned over to the government pursuant to a search warrant to that effect.  The catch is that the emails are stored exclusively on servers in Ireland—nominally beyond the reach of the US’ long arm of the law.

The statute in question is the Stored Communications Act, enacted 30 years ago before email and similar electronic communications were available.

Microsoft handed over some account data that was stored in the US but said it shouldn’t have to hand over the emails, which were stored on a server in Ireland.
…
The Second US Circuit Court of Appeals sided with Microsoft, ruling the 1986 law didn’t apply beyond US territory.

DoJ and the participating States’ Attorneys General argued that the appellate decision, if left intact, would hamper the government’s crime-fighting ability.  That’s likely accurate, but there are two things about that.  One is that the convenience of government is not an excuse for limiting individual liberties either directly or through the companies we own. Some of you have heard that from me before.

The other thing, though, is that extending the statute to reach beyond our borders is a political decision, not a legal one.  Only the political arms of our government—Congress and the President acting together (or with Congress overruling a veto)—can make that decision; only the political arms of our government can extend the Act or write a new one to fill the apparent gap.

There’s this bit of disingenuousity, too, from Solicitor General Noel Francisco:

Microsoft’s employees could prepare that disclosure without leaving their desks in the United States[.]

They could prepare such disclosures without leaving their desks in the US in 1986 when the Act was passed, too.  All they had to do was write letters to the managers of the overseas storage facilities.  Nothing has changed here except that email has replaced gofers and the mail room.  Nor has the status of the material stored overseas changed.

On the other hand, Microsoft and other massive tech companies also are raising red herrings.

Microsoft, Google, and other technology companies say…the case could threaten American dominance in the $250 billion cloud-computing industry, because foreign clients won’t use US firms if their data isn’t protected.

That also may be true, and it’s also not relevant.  That’s a question that’s strictly a business matter and not a legal one.  To the extent government help is useful in filling this business gap, it’s also a political question, and these businesses need to seek their recourse through those political arms of our government.

Finally, there already is an alternate route to getting the emails, as admitted by DoJ in their filings:

There is a diplomatic process, governed by legal assistance treaties, that allows the US to request that foreign law-enforcement counterparts share sought-after data, but it can be slow and ineffective, the department said.

There’s that convenience thing, again.

What does the text of the Act say? That’s what the Justices must apply, not a phantom Act that doesn’t exist but that does represent what Justices or DoJ officials might wish the Act to say.  Article I, Section 1, is quite clear about who gets to write the statutes in our system of government, and extending the reach of an existing statute is law-making that is beyond the reach of any member of the judiciary or of the DoJ.

A Thought on American Women’s Gymnastics

Posted on by
1

Unless you’ve been vacationing unplugged under a rock for the last several months, you’re aware of the atrocities committed by Larry Nassar, the ex-pseudo-doctor for the US’ women’s gymnastics team.  Now we find out that

The US Olympic Committee didn’t intervene in USA Gymnastics’ handling of sexual-abuse allegations against longtime national-team doctor Larry Nassar in 2015, even after USA Gymnastics’ then-president told two top USOC executives that an internal investigation had uncovered possible criminal behavior by the doctor against Olympic athletes.

And pursuant to a lawsuit,

the organization [USOC] said it was “first made aware of the possibility that a USA Gymnastics physician had sexually abused USA Gymnastics athletes in the summer of 2015, when we were informed by USA Gymnastics.”

Gymnastics is a physically dangerous and mentally stressful sport, as are most competitive sports.  Our women, and our girls, who participate in this game don’t need the added stress, much less the added damage, of sexual misbehaviors, sexual harassment, sexual assault inflicted on them by those placed in positions of power or authority over them—trainers, coaches, doctors, anyone.

I think it has become necessary to shut down women’s gymnastics as a formal sport in the US for a significant period of time, perhaps 2-5 years.  The time is necessary to completely revamp the sport and purge the criminals and the merely misbehaving personnel, folks like the imitation doctor Nassar, just convicted of harassments and of assaults against our girls; folks like the Karolyis, whose “training” techniques at best don’t align with American values; others who mistreat our girl and woman athletes while pretending merely to “toughen up the buttercups” or who get their jollies from molestations.

USA Gymnastics and the women’s side of the United States Olympic Committee must cease to exist.  When the time comes, replacements for USAG and that portion of USOC must be created from the ground up.  Anyone associated with USAG and USOC and anyone associated with those personnel out to and including the second degree of association must be banned from participation also.

Full stop.

One more item: the boys and men’s side of this needs a full, deep, and independent investigation, too, on general principles.  What deeply nefarious affairs are going on there that we don’t know about?  Hopefully none, but it’s time to look closely.

Warrantless Searches of Cell Phone Data

Posted on by
Reply

The Supreme Court has a case before it, Carpenter v US (it heard oral argument Wednesday), concerning the 4th Amendment and the personal data of a defendant in the form of his cell phone location data.  The data were obtained from the cell phone company by police without first getting a search warrant.  There is precedent.

The high court reasoned then [in ’70s cases involving business records that banks and landline phone companies maintain about customer transactions and that the Supreme Court then reasoned police could seize without warrants] that individuals had voluntarily revealed their financial transactions or numbers they dialed to a third party—the bank or phone company—and so had forfeited any privacy interest in that information.

Smith v Maryland is illustrative of that general position.

There is growing criticism of that position.

allowing authorities to compile such granular data about an individual’s life, without a judicial warrant, no longer meets society’s “reasonable expectation of privacy”—the touchstone of the Supreme Court’s approach to constitutional limits on searches and seizures.

The objectors’ heart is in the right place, but their criticism is wide of the mark.  Compiling data—seizing a person’s personal information, which most assuredly includes where he situates himself from time to time—without a court’s order never has met society’s or that individual’s “reasonable expectation of privacy.”

Consumers (the individuals, the particular members of society in question here) have a reasonable—indeed, a loud and vociferously stated—expectation of privacy concerning their personal data, and an equally loud and vociferously asserted ownership of those data held by third parties.  This is clearly demonstrated by the raucous and repeated hoo-raw raised every time a Facebook or a Twitter or a bank or a phone company gets caught using those personal data in ways to which the consumer-owner objects.

This is further and just as clearly established by the even louder hoo-raw raised every time one of those third parties is discovered to have inadequately protected those personal data entrusted to it by being hacked and those personal data stolen, and too often exposed.

The Supreme Court ruled erroneously then, and Carpenter is a good opportunity to correct that error.  The Court should have known at the time that revealing financial transactions or numbers they dialed to a third party was not at all a voluntary action.  The revealing was a mandatory condition of doing business with the bank or phone company, and there was no opportunity to go elsewhere—all the banks and phone companies required that: give up the financial data or the phone numbers, or don’t do business at all.  Take careful note: that the technology of the time—or today—means that [phone numbers] must be revealed to [phone companies] in no way makes the reveal voluntary: it’s still a wholly involuntary privacy exposure.  The data are owned in whole by the consumer; the third party is merely a caretaker, bound to protect the privacy and sanctity of these papers, and effects.

Prosecutors can indict ham sandwiches with their grand juries, and policemen can just as easily get search warrants, but do get the warrant.  Cell phone location data, financial transaction data, et al., all are part of the papers, and effects, of the individual.

Full stop.

Mobile Encryption is a Huge Problem

Posted on by
Reply

That’s the position of FBI Director Christopher Wray.

To put it mildly, this [mobile device encryption] is a huge, huge problem.  It impacts investigations across the board.

Certainly, consumer-done encryption of our communications devices can temporarily hinder investigations of the criminals who also use this encryption.  But as the FBI demonstrated regarding an encrypted cell phone involved in the San Bernardino terrorist attack, its initial claims notwithstanding, the encryption can be broken without the cooperation of the device’s owner.

Every tool can be misused.  The problem is not the misuse of the tool but government efforts to apply one-size-fits-all solutions to the misuse that end up harming all the rest of us more than the bad guys.

The FBI’s continued demand for a “government-mandated backdoor” that the government’s agents can use whenever they take a notion puts a premium on the encryption side of the question.  Think Government wouldn’t misbehave?  Ask anyone on the right about the behavior of the Obama administration.  Ask anyone on the left about the behavior of the Trump administration.

It’s always going to be an arms race between the good guys and the bad guys.  It’s a critical arms race, though, when it’s our own government that wants to pry into all of our private communications because a few of us are bad guys.

Asset Forfeiture

Posted on by
Reply

Attorney General Jeff Sessions has withdrawn President Barack Obama’s (D) blanket hold on asset seizure, but with safeguards.  I think those safeguards need improvement.

Stop sharing seized assets with local law enforcement.  Each State has its own laws regarding asset seizure by local law enforcement; these laws should be respected and not bypassed.

Also:

Sessions’ new guidelines say that state or local agencies seeking forfeiture under federal law must demonstrate probable cause within 15 days of the seizure. The sponsoring federal agency must notify the property’s owner within 45 days, so he can challenge it, including by going to court.

This is much too slow.  These agencies already have probable cause, or they couldn’t have conducted the raids and seizures in the first place.  Where a seizure is made pursuant to an unwarranted but otherwise legitimate stop or arrest, the seizure has its probable cause in the same process with which the police after the fact justify their stop/arrest.

The sponsoring agency knows at the moment of the seizure what it’s seized and what it intends to do with it; there’s no reason for a 45-day delay in notification other than to make the seizure as irrevocable as possible and, in the case of financial asset seizure, to make as great as possible the cost to the owner of his property’s recovery.

Finally, absent an actual conviction, there shouldn’t be any asset seizure outside the strictures of the already existing civil and criminal sections of the RICO statute.  That law provides sufficient grounds for seizure prior to conviction, when the seizure is made solely on the basis of an accusation.