Thursday, December 8, 2016

You got no stinkin' privacy because the Courts do not understand the Internet

Good article on privacy, TOR, and the Court's ruling that using TOR does not give you a reasonable expectation of privacy (!):
First, let's discuss how the judge reasons that there's no expectation of privacy with Tor. This is a straightforward application if the Third Party Doctrine, that as soon as you give something to a third party, your privacy rights are lost. Since you give your IP address to Tor, you lose privacy rights over it. You don't have a reasonable expectation of privacy: yes, you have an expectation of privacy, but it's not a reasonable one, and thus it's not protected.

The same is true of all your other digital information. Your credit card receipts, phone metadata, email archive, and all the rest of things you want to keep private on the Internet are not (currently) covered by the Fourth Amendment.

If you are thinking this is bullcrap, then you'd be right. Everyone knows the Third Party Doctrine doesn't fit the Internet. We want these things to be private from the government, meaning, that they must get a warrant to access them. But it's going to take a clueful Supreme Court overturning past precedence or an armed revolution in order to change things.
The court ruled that since you have an IP address, Sumd00d on the 'net can get to you and so you have no reasonable expectation of privacy.  Ooooh kaaay.
As Orin Kerr's post points out:
Fourth Amendment law regulates how the government learns information, not what information it learns
In other words, it doesn't matter if the FBI is allowed to get your IP address, they still need a warrant to search your computer. If you've got public information in your house, the FBI still needs a warrant to enter your house in order to get it.
That seems right.  Your IP address must by definition be public on the 'net.  That doesn't mean that I want all my files on my computer browsable, duh.

But it gets worse - your computer is likely not connected to the Internet.  Instead, it's connected to an internal private network that is protected by a firewall (either a stinkin' big enterprise class firewall at work or your router/firewall at home).  Your private network uses a private IP address, by definition - this was defined in a technical spec (called "Request For Comment" in Internet Geek-speak) RFC 1918 "Address Allocation for Private Internets" - note to court and FBI G-Man: please pay attention to the work "Private" in that title.

But I digress.

The Court was ruling on the use of TOR, and basically said that since your computer uses IP (and responds to IP) there's no privacy.
Yes, the entry Tor node knows your IP address, but it doesn't know it belongs to you or is associated with your traffic. Yes, the exit Tor knows your traffic, but it doesn't know your IP address.

Technically, both your traffic and IP address are public (according to the Third Party Doctrine), but the private bit is the fact that the two are related. The "Tor network" isn't a single entity, but a protocol for how various different entities work together. No single entity in the Tor network sees your IP address combined with your activity or identity. Even when the FBI and NSA themselves run Tor nodes, they still can't piece it together. It is a private piece of information.
And quite frankly, one of the best arguments that the Courts won't provide oversight to Intel snooping is revealed in the fact that if things were as open and un-private as the Court said there isn't any need to attack the target computer with malware.  Of course, your data is private, and so the FBI has to pwn you, and to anyone with an expectation that the Fourth Amendment means what it says that's a search and the FBI should get a warrant.  Instead it's (legally) license to kill.

The punch line, of course, is all the lefties who didn't care about what the Federales were doing for the last 8 years will be appalled that the Trump Administration is probably going to totes keep on doing it, just to a different set up folks.  Now you know how we feel about the Second Amendment, where the argument has been "keep and bear arms" means that you can't have a firearm in your home and you certainly can't take it out with you, because reasons.

As a historical note, I posted years ago about how to hide yourself from NSA snooping.  It didn't rely on TOR, but probably won't work anyway.

If you think that I'm a bit paranoid, please keep in mind that I was trained to be that way by the finest minds in the Free World ...


Old NFO said...

Privacy today is a fallacy... There really isn't any if you're connected to the Web.

SiGraybeard said...

That's really a terrible ruling. It shows no knowledge of what's going on at all - for all the reasons you list.

On the other hand, it's interesting to see all the lefties getting their panties in a bunch over executive powers now. I suppose it's the typical, "it's OK if my guys do it, but not your guy".

Borepatch said...

SiGraybeard, I'd have a lot more respect for their positions if it didn't depend on whose ox is being gored.

Brad Richards said...

Technologically illiterate people ruling on technology issues. Like the recent ruling by the Court of Justice of the European Union that says that linking to copyrighted material can infringe copyright.

Dunno what you do about this. Courts are supposed to pass judgements on how laws are applied. What do you do when the courts have no clue? Worse, when they have no clue that they have no clue?

matism said...

What makes y'all so sure the "judges" are "technologically illiterate"?

I find the supposition that they are instead as foul and corrupt as the REST of the government to be far more likely.