Does the Fourth Amendment cover 'the cloud'?
One of the biggest issues facing individuals and corporations choosing to adopt public cloud computing (or any Internet service, for that matter) is the relative lack of clarity with respect to legal rights over data stored online. I've reported on this early legal landscape a couple of times, looking at decisions to relax expectations of privacy for e-mail stored online and the decision to allow the FBI to confiscate servers belonging to dozens of companies from a co-location facility whose owners were suspected of fraud.
However, while I've argued before that the government has yet to apply the right metaphor to the modern world of networked applications and data, there has been little literature that has actually dissected the problem in detail. Even worse, I've seen almost no analysis of how the United States Constitution's Fourth Amendment, which guards against unreasonable searches and seizures, applies to Internet-housed data.
(Credit:
Flickr/Thorne Enterprises)
However, I just had the pleasure of reading an extremely well-written note in the June 2009 edition of the Minnesota Law Review titled "Defogging the Cloud: Applying Fourth Amendment Principles to Evolving Privacy Expectations in Cloud Computing (PDF)." Written by David A. Couillard, a student at the University of Minnesota Law School expected to graduate this year, the paper is a concise but thorough outline of where we stand with respect to the application of Fourth Amendment law to Internet computing. It finishes by introducing a highly logical framework for evaluating the application of the Fourth Amendment to cases involving cloud-based data.
According to Coulliard, we aren't very far along at all today:
Under a rubric of "reasonable expectations of privacy," the Court has since defined the contours of the Fourth Amendment's application in varying circumstances. But technology and society's expectations are evolving faster than the law. Although statutory schemes exist, some argue that these laws are outdated. Meanwhile, the Supreme Court has not even addressed the Fourth Amendment's application to e-mail, let alone the expanding uses of cloud-computing platforms. Thus, Fourth Amendment law needs a framework that will adapt more quickly in order to keep pace with evolving technology.
I stated essentially the same thing in my Cloud Computing Bill of Rights back in 2008:
In order for enough trust to be built into the online cloud economy, however, governments should endeavor to build a legal framework that respects corporate and individual privacy, and overall data security. While national security is important, governments must be careful not to create an atmosphere in which the customers and vendors of the cloud distrust their ability to securely conduct business within the jurisdiction, either directly or indirectly.
Coulliard starts his analysis with how legal precedent for telephonic communications may or may not apply to the cloud. He notes that all such law is evaluated under a "reasonable expectation of privacy" test:
The reasonable-expectation-of-privacy test arose out of Katz v. United States, where Justice Harlan, concurring, outlined a two-part requirement: (1) that the person demonstrated a subjective expectation of privacy over the object and (2) that the expectation was reasonable. This test can be applied to both tangible and intangible objects. However, when the object of a search--tangible or not--is voluntarily turned over to a third party, the Supreme Court has held that a person loses their reasonable expectation of privacy in that object.
Much of the legal confusion in cases involving any form of data or transaction on the Internet since has revolved around considering whether storing your data in a third-party data center is in fact subject to the so-called "third-party doctrine." This includes cases like Smith v. Maryland, in which the courts argued that people generally gave up an expectation of privacy with regard to their phone records simply through the act of dialing their phone--as the phone company receives and processes the phone numbers, thereby becoming a party in the transaction.
Coulliard argues, however, that while Smith v. Maryland applies to the phone numbers dialed, it does not apply to the contents of the conversation, as noted in Katz v. United States. Thus, the courts should adopt a framework in which the third-party doctrine is applied much more narrowly to online content (including cloud-based data), according to Coulliard.
Coulliard goes on to discuss legal analogies of virtual containers, encryption and password protection to briefcases, locks, and keys. The argument is complex, but it turns out that in the physical world, the combination of security and opacity of a container used to store an object both affect the "reasonable expectation of privacy" test:
Hypothetically, if a briefcase is locked with a combination lock, the government could attempt to guess the combination until the briefcase unlocked; but because the briefcase is opaque, there is still a reasonable expectation of privacy in the unlocked container. In the context of virtual containers in the cloud...encryption is not simply a virtual lock and key; it is virtual opacity.
So, if the courts were to interpret digital assets in the same way Coulliard does, you could virtually (no pun intended) assure your Fourth Amendment protections, even in the cloud, if you simply encrypted your data. Cloud vendors, are you listening?
Coulliard wraps up with a suggested framework for applying the Fourth Amendment to "the cloud" that is very much in line with my own thinking. Treat digital assets on third-party sites not as transactions (like phone numbers dialed), but in the same way you would treat physical assets kept in an apartment or storage locker:
[T]he service provider has a copy of the keys to a user's cloud "storage unit," much like a landlord or storage locker owner has keys to a tenant's space, a bank has the keys to a safe deposit box, and a postal carrier has the keys to a mailbox. Yet that does not give law enforcement the authority to use those third parties as a means to enter a private space.
The same rationale should apply to the cloud. In some circumstances, such as search engine queries, the third party is clearly an interested party to the communication. But when content data, passwords, or URLs are maintained by a service provider in a relationship more akin to that of landlord-tenant, such as private Google accounts, any such data that the provider is not directly interested in should not be understood to be open to search via consent or a waiver of Fourth Amendment protection.
Amen, Mr. Coulliard. Personally, I hope the courts note this framework, and begin applying it to Fourth Amendment cases arising from Internet-based computing immediately. Furthermore, I call for Congress to explicitly codify a similar framework with laws that clearly and unequivocally state the rights of users with respect to their data in the cloud.
Then again, given the track record of our state and federal legislative bodies with respect to technology law, maybe not...
James Urquhart is a seasoned field technologist with almost 20 years of experience in distributed systems development and deployment, focusing on service-oriented architectures, cloud computing, and virtualization. James is currently market manager for the Data Center 3.0 strategy at Cisco Systems, though the opinions expressed here are strictly his own. He is a member of the CNET Blog Network and is not an employee of CNET. 
For example, on Facebook, a post is NOT private if the sender does not restrict who can or cannot see it. However, a post with restricted visibility is considered private.
In the cloud, if I created a document and there is some way to ensure the document remains private (encryption, access control or whatnot), the document is private.
If there is no way to ensure a document remains private (I'm not sure if Google Docs has such a method), I believe the document must be considered private.
The stem cell issue is related to Roe v. Wade and Roe v. Wade is related to the unalienable rights "Life, liberty, and the pursuit of happiness"...has not been resolved.
The automatic weapons issue and how it relates to the 2nd Amendment (and the intent of which)...has not been resolved.
Sure there *may* be related "real-life/material-world" issues but that does NOT automatically mean that even those "real-life" issues have been resolved. So, suggesting that we apply existing laws that don't effectively work for even our 200 year old issues is not reasonable.
That's like trying to hit a broken nail on the head with a broken hammer.
Re automatic weapons v. the 2nd Amendment, it is very cut and dried. The people were intended to have access to the same weapons as the military, because the people themselves were intended to be the country's defense. The only fuzzy category of weapons is of the nuclear type -- most people couldn't afford those anyway, though. Hell, I don't trust the government to have military weapons! They have a monopoly of force. Things would be much better off if the thugs in charge couldn't muscle the people around so much.
Re Roe v. Wade: the issue is if the unborn infant is a full-fledged human or not, with all the rights and privileges thereof, because if it were, terminating it is malum in se. And since there's no practical difference between a child just before and just after birth, nor is there a logical and consistent way to delineate a clear point in gestation where one's humanity begins, it must in fact be at conception. However, as a society we make trade-offs: for example, we execute criminals who are a quantifiable threat to society (for non-supporters of capital punishment, an executed life sentence is virtually the same effect). Most of us do not consider that malum in se. If there's any argument for abortion it must be a rationale for trading an infant's life for a comparable objective (such as saving the life of the mother).
First, the lawyers will never allow any law to be clear and unequivocal; there is no financial future in unambiguous law and further they have never done it before. Kudos to T Jefferson.
Second, momentum is legally now in the hands of the 'peace officers', the TSA, HSA, etc. and the traditional protectors of the people. "And for your safety, ma'am, I am handcuffing you to the car door." They operate on the 'sin first, get forgiveness later', which satisfies all kinds of people, (I'll go naked as long as I am safe. Protect the childred) except those whose lives are accidently on the allegedly criminal servers. Never take a fact laden laptop overseas, when you return you may never see it again.
That is the beauty of the "cloud." You can store your files on a server somewhere, and bring a "clean" laptop with you. Nobody can get to those files unless they know where you store them, and the authentication details.
That brings us back to the problem of this article: Does, and should, the fourth amendment cover the cloud? I'm not a lawyer, but I say it should. (To clarify: It should cover cloud services, but obviously not social media, which is a form of publishing data.)
There are very few companies that will voluntarily acknowledge a data breach should one occur. Very few places, even within the US, are required by law to notify customers their data has been compromised.
If you do store data in the cloud, I suggest you read your TOS contract thoroughly. Most likely you will find that you have little to no legal recourse if your personal data is stolen, lost, or misplaced. Until data in the cloud is as protected as a document in a safe deposit box, I am not going there.
" Very few places, even within the US, are required by law to notify customers their data has been compromised."
This isn't very accurate. Quite a few states have laws that now require full disclosure when an issue arises. many of the state that do not have a law yet are actively working on one.
in my opinion, the police should have to follow the exact same laws regarding privacy as all other citizens including criminal surveillance laws. the only exception is if there is a search warrant or if the police witness a crime in progress and follow the suspect into their house, in which case it is still limited to things within plain sight until they can get a search warrant.
i just believe that the only thing separating a cop from an average citizen is, and always should be, that if they see a crime being committed, they are legally authorized and expected to respond to it. they are like the people seated in the exit row of an airplane. nothing more.
There is nothing new in this world, all technology-related issues could be easily resolved using traditional (classical Roman) law.
First you reference 200 year-old law, implying that nothing new has changed since then.
Now you're referencing 2,000 year-old law and saying that there's nothing new since then.
Since you're being so arbitrary, why don't you up it by another couple factors of ten and say:
"Nothing has changed since the invention of the wheel!"
"Eye for eye! It was good enough for my grand-pappy!"
Once your message or e-mail has reached it's destination, all bets are off. If the receiver wants to post it publically for the whole world to see, you have no right to privacy in that case.
So Stop Complacating it!
Ken4usa
- by Ken4usa April 13, 2010 1:04 AM PDT
- Agen, If you have E-Mail, And a 3rd Party is in voled in the trans-action, you Have Not Given thim Premision to Give It Out To Aney One Elos. Therefore t do so Would be a Vialation Of The Fourth Amendment.
- Like this Reply to this comment
-
(40 Comments)Ken4usa
4,13 2010. 1:04am