Home Computers Connected to the Internet Aren't Private, Court Rules

[n2doc]

A federal judge for the Eastern District of Virginia has ruled that the user of any computer that connects to the Internet should not have an expectation of privacy because computer security is ineffectual at stopping hackers.

The June 23 ruling came in one of the many cases resulting from the FBI's infiltration of PlayPen, a hidden service on the Tor network that acted as a hub for child exploitation, and the subsequent prosecution of hundreds of individuals. To identify suspects, the FBI took control of PlayPen for two weeks and used, what it calls, a "network investigative technique," or NIT—a program that runs on a visitor's computer and identifies their Internet address.

Such mass hacking using a single warrant has riled privacy and digital-rights advocates, but Senior U.S. District Judge Henry Coke Morgan Jr. upheld the use of the warrant and even stated that the warrant is unnecessary because of the type of crime being investigated and because users should have no "objectively reasonable expectation of privacy."

Even using countermeasures, such as the Tor network, does not mean that the user should expect their location or their activities to remain private, according to the judge.

more
http://www.eweek.com/security/home-computers-connected-to-the-internet-arent-private-court-rules.html

[Faux pas]

1. ...

[tk2kewl]

3. so does this also apply to wall st, banks, corps, and government computers

let's do this...

i have nothing to hide, so let's make all the information open



either that or leave me the fuck alone

[SoLeftIAmRight]

32. wow

really crazy

[Rex]

4. That includes the judges home computer too.

So let's have a look!

[struggle4progress]

5. The FBI had actually obtained warrants in this case

so one concern is that "it was not necessary for Judge Morgan to address the issue of warrantless use of the investigatory techniques"

[whatthehey]

6. It's hard to defend pedophiles

but the trouble is the second part of the phrase...

the type of crime being investigated and because users should have no "objectively reasonable expectation of privacy."


I'm neither incorrigibly cynical nor a tin foil hatter when it comes to privacy, but who would take bets that RIAA isn't salivating at this for a start with HBO and the movie studios right behind them?

[Kablooie]

7. If law enforcement sees evidence of a crime being committed can't they enter without a warrant?

Seems this would be analogous to that.
But to infiltrate a computer where no crime is evident without a warrant should be illegal.

The judge's ruling basically is like him saying you have no expectation of privacy at home because locksmith tools can be used to break in.

[Nitram]

16. I agree. They followed users of a pedophile web site back to their home computers.

That sounds like evidence that a crime was in progress .

[Meldread]

28. Here is the legal equivalent, in my opinion.

Let's say you know there is a store (i.e. server) that is selling illegal drugs (i.e. the child porn). The FBI gets a warrant to observe the store (i.e. the server), and over the course of two weeks it secretly places GPS tracking devices on the cars of everyone who visits the store (i.e. installing malware on their computers). They watch where the tracking devices lead them and then discover their homes (i.e. uncover their IP addresses). The FBI then raids their homes (without a warrant), searches for drugs or drug paraphernalia (i.e. confiscates their electronic devices), and arrests everyone that they can press a reasonable case against.

The problem here is the fact that the FBI did not get a warrant to search the homes. They are arguing that their single warrant covered the entire thing, and the judge is agreeing. However, in order to get there legally and logically, the judge is making the argument that ANYONE connected to the internet should have no expectation of privacy.

If this is allowed to stand, this means that the government can infect everyone's computer with malware, gather whatever information they want, and then use it as they see fit--including in criminal prosecutions. They don't even need a warrant, as the judge points out, as their is no reasonable expectation of privacy in the first place.

[Kablooie]

34. Yes. Seems obvious to me that they would need a warrant to search each suspect.

Just because someone visits a place that instigated crimes doesn't automatically mean they are guilty of the crime. A suspect, yes, but a warrant would be needed to get evidence of actively engaging in crime.

This had better go to SCOTUS or the big brother state could get out of hand.

[Meldread]

35. Yes, and this is what complicates the FBI's case.

The FBI is desperately trying to argue that the program they installed was not a form of malware or hacking. Their reasoning is that all the program did was report the IP address to them based on who visited the site. It didn't search their computer files, it didn't change their security settings, or anything like that.

This should start to make clear why the FBI didn't get the additional warrants that would normally be needed. The reason being is that they had no evidence of any wrong doing aside from visiting the website. Of course, this is not good enough justification for a search warrant. It's the equivalent of saying, "Hey, I saw him visit the store (the one where drugs are sold). I don't know if he is in any way involved with criminal activity, but I'd like to search his home anyway."

Now, obviously, this person in question was involved in criminal activity, but it is not hard to see how this reasoning could not lead to a direct breach of the 4th Amendment. You basically get yourself in a position where you are arguing against warrants all together--which is exactly where the Judge found himself, declaring that there was no need for a warrant due to no reasonable expectation of privacy.

The only reasonable ruling here that protects the 4th Amendment rights of citizens is to toss out all the convictions made by the FBI in this sting due to the fact that no warrants were obtained. There is no desire to make that ruling in this case for obvious reasons, but it is the right ruling--and its the FBI's fault.

Of course, to be fair to the FBI as well here, if the FBI had installed a program on their computer that DID search their files then it would still be considered an illegal search due to no warrant obtained. The FBI knows this and that is why, once again, they find themselves in this position. Technology and the securing of data has begun to outstrip the FBI's ability to conduct what would normally be considered routine policing.

This reflects the issue back onto us as citizens, and we are challenged about what we value more. Do we value a society in which some criminals are able to evade the law because their crimes are entirely digital, or do we value a society in which we have a robust 4th Amendment and an actual expectation of privacy from government intrusion and illegal searches.

[Downwinder]

8. There is no expectation of privacy because the

Government can see through walls.

[Rex]

14. That is the truth.

And does all the time.

[Orrex]

9. I guess it's not breaking and entering if I can pick the door lock, either.

[Journeyman]

10. If homeowners expected security, they wouldn't connect their door to the outside world. . .

[snooper2]

12. It's more like you break into a house and sell stolen goods out of it

Can you arrest everyone showing up at the house for receiving stolen property?

[FBaggins]

11. Sigh. The ruling says no such thing

It relies on existing Supreme Court rulings. It basically rules that you don't have a reasonable expectation of privacy in your IP address because you willingly turn it over to a 3rd party (just as the phone numbers that you dial are not private because you give them to the phone company).

The defendant would still have a 4A right to privacy if there wasn't a warrant to search his PC, but his defense in this case rests on the claim that they shouldn't have been able to get that warrant because the government shouldn't have been able to capture his IP address.

It's as though they recorded a terrorist's phone conversation after obtaining a warrant to do so... but THAT warrant was only issued because they had a larger warrant to identify all calls that came to a different number... then the defendant claims that they shouldn't be able to capture his phone number with the first warrant. It isn't a ruling that all phone calls can be recorded without warrants.

The defendant clearly had an expectation of privacy - since he used a browser that was intended to hide it - but the court ruled that it was not a reasonable expectation (specifically comparing it to a pot grower who built high fences, but was spotted from the air).

I agree with the court that society would not find such actions to hide kiddy porn usage to be reasonable.

[Xipe Totec]

13. By extension, cameras and microphones on said computers... nt

[Scalded Nun]

15. What a ridiculous premise

But, based upon that, a computer/server based out of the home and connected to the Internet would have no expectation of privacy, regardless if that is one's personal computer or, say, a government one?

[0rganism]

17. by that standard, are our homes fair game because they could possibly be robbed?

if you have a driveway, do you relinquish any expectation of privacy for the house connected to it?

[MohRokTah]

18. I have security in place.

The natural progression of this ruling is that even though I have a lock on my front door I have no reasonable expectation of privacy because a lockpick can easily overcome that and a lock is ineffectual security.

[jberryhill]

27. With the slight difference that...

...you are in the habit of handing out and receiving child porn through a slot in that door.

It's not as if the search was to find evidence of a crime. There was evidence of a crime. The search was to follow where the trail of that evidence led.

[surrealAmerican]

19. Wouldn't that mean that hacking is legal?

After all, there's no expectation of privacy, right?

... or is it only the FBI who is allowed access?

Somehow, I don't think they want to open this particular can of worms.

[Odin2005]

21. This is a good example of people in power showing their technological ignorance.

[Odin2005]

20. I can't tell if this is technological illiteracy or just plain stupidity.

[Xipe Totec]

22. This has to be one of the stupidest legal arguments

Reasoning in a similar manner, one can argue that the user of any telephone that connects to the phone network should not have an expectation of privacy because telephone security is ineffectual at stopping phone taps.

Or that the occupant of any home that connects to the road network should not have an expectation of privacy because home security is ineffectual at stopping burglars.

[sarisataka]

23. What exactly

When's the FBI obtaining?

If the FBI was gaining IP addresses to identify the users, I could see that as being similar to identifying someone by their home address. I think that falls within reasonable ground.

If however they were then proceeding to hack the home computer and remotely search the drives that I think would be an invasion of privacy without a warrant.

The phrasing the court uses is ambiguous and potentially worrisome.

[Meldread]

24. Well I guess Snowden can come home now.

After all, leaks of government information happen all the time, and they are happening more frequently now than ever. By sharing its information with Edward Snowden, the government had no reasonable expectation of privacy since it was sharing the information.

You know, it's just like connecting your driveway to the street. Once you do that, your home is no longer private. You have effectively opened up your home to the entire world. Then, not only did you connect your driveway to the street, you connected your door to the outside, allowing people to get in! You even laid down a "Welcome" mat outside your front door, giving them permission!

[rug]

25. I'm painting my bathroom windows black.

[MariaThinks]

26. so i guess having a front door means there is no privacy into a house?

[0rganism]

31. if you have a door or a driveway, you knowingly and willingly risk burglars in your home

therefore you can have no expectation of privacy
hence the 4th amendment is officially null and void with respect to any dwelling into which people may enter

[uponit7771]

29. This is stupid on its face, a car can be broken into that doesn't mean that its open to the world

[AntiBank]

30. Poppy Bush appointed

[muriel_volestrangler]

33. While the reasoning might raise concern, the FBI's methods look OK to me

In other words, the agents took the extra precaution of not deploying the NIT until the user first
logged into Playpen and second entered into a section of Playpen which actually displayed child
pornography. At this point, testified SA Alfin, the user apparently downloaded child
pornography as well as the NIT to his computer. Thus, the FBI deployed the NIT in a much
narrower fashion than what the warrant authorized.

thttps://www.eff.org/files/2016/06/23/matish_suppression_edva.pdf

That seems reasonable to me - it wasn't just signing up for the website that enables you to send and receive data while thinking it's untraceable; it was looking for the child porn. At that point, I think it's reasonable to 'search' the computer, even if you don't know who it belongs to at first.

The "you don't have an expectation of hiding your IP address, even with Tor" claim looks complicated.