A decision in the US Court of Appeals, Ninth District in the case of United States V Borowy1, addresses the issue of the expectation of privacy in communications. I’m so not a lawyer, but as a security consultant I am someone with a vested interest in understanding privacy, so I find some of the language the court used to be very interesting. And when I consulted a good friend, a lawyer (who IS a lawyer), he said, “If it comes from the Ninth Circuit, it’s solid.”
Mr Charles Borowy is a child pornographer who installed the file-sharing program LimeWire on his computer. As a feature, LimeWire made his hard drive available to anyone with LimeWire. On May 3, 2007, and one such person was FBI Special Agent Byron Mitchell, who logged onto LimeWire to monitor trafficking in child pornography. According to the opinion, Agent Mitchell searched LimeWire for the term “Lolitaguy,” a term known to be associated with child pornography. After getting hits on that phrase from Borowy’s computer, using LimeWire’s “View-files-on-this-host” feature, Agent Mitchell saw about 240 files that his FBI software identified as being known child pornography.
Using that as probable cause, Agent Mitchell, still using LimeWire’s out-of-the-box functions, downloaded copies of files from Borowy’s computer, confirmed that they were child pornography and Borowy was arrested. Later it was discovered that Borowy had more than 600 images and 75 videos of child pornography.
Did the FBI violate Borowy’s privacy? Do people have a reasonable expectation of privacy on their computer when they connect it to the Internet?
I say that not only didn’t the FBI violate Borowy’s privacy, but also that Borowy was a) literally and figuratively publishing his files for the world to see and b) an idiot2.
In a passage of the decision upholding the actions of the FBI and affirming that it acted properly and not in violation of Borowy’s fourth amendment rights, the court says that the earlier decision in US v Ganoe was spot on:
“Under Katz v. United States, 389 U.S. 347 (1967), government conduct qualifies as a search only if it violates a reasonable expectation of privacy. Whether Agent Mitchell engaged in an unconstitutional search and seizure is largely controlled by United States v. Ganoe, 538 F.3d 1117, 1127 (9th Cir. 2008), cert. denied, 129 S.Ct. 2037 (2009), which held that the defendant92s expectation of privacy in his personal computer could not “survive [his] decision to install and use file-sharing software, thereby opening his computer to anyone else with the same freely available program.”(US Court of Appeals, 2010)
The last sentence of that passage is absolutely crucial in inferring the attitude of the court towards privacy in the Internet era. It says that the moment I install software that opens my computer to anyone else with the same freely available program, I give up my expectation of privacy. Later the Borowy ruling raises “Cf. California v. Ciraolo, 476 U.S. 207, 213-14 (1986) (finding the use of an aircraft to observe marijuana plants was not a Fourth Amendment search as it only revealed information accessible to any member of the public flying in the airspace).”
I would say that unencrypted Internet email will, in the next five years, be found to be analagous to the marijuana nursery, and outside the scope of fourth amendment protection or indeed any reasonable expectation of privacy. When users sign up for Gmail or Hotmail they understand (or should) that Google and Microsoft are mining the contents of their messages for a range of things, including what they say (for the purpose of placing ads within the messages, etc) and with whom they communicate (for the purpose of determining networks of people to whom they will eventually target ads, etc) and myriad other reasons. Users expect no privacy from Google or Microsoft, but they somehow cling to the concept that, once they hit, “send”, the message is protectively wrapped on the way to the intended recipient. Without getting into too many technical details, this is to say the least a charmingly naive concept. Email sent in plan text can be monitored, viewed, copied and is stored all along its multitudinous pathways from sender to recipient.
I’ll make a statement as a published and widely quoted information security person: it is a trivial matter to intercept and read unencrypted email using freely available programs. If I did so, I would expect that a court would find, as did the Ninth Circuit, that someone who sued me for doing so had given up their expectation of privacy when they decided to use software that opened their communications to anyone using freely available tools to intercept it.
Should this understanding signal a change of attitude? Bruce Schneier seems to think so – last March he wrote on his blog:
Between the NSA’s massive internet eavesdropping program and Gmail’s content-dependent advertising, does anyone actually expect their e-mail to be private? Between calls for ISPs to retain user data and companies serving content-dependent web ads, does anyone expect their web browsing to be private? Between the various computer-infecting malware, and world governments increasingly demanding to see laptop data at borders, hard drives are barely private. I certainly don’t believe that my SMSes, any of my telephone data, or anything I say on LiveJournal or Facebook – regardless of the privacy settings – is private.
I would say that with this opinion, the court is further clarifying the judicial attitude towards what is reasonable of a contemporary person to expect in the way of privacy when he lives a life enriched by Internet-based communication between computers. I don’t think that this means that the US system of government as we know it is at risk of collapse – but I do think that it further strengthens the argument that an unencrypted communication across the public Internet is analogous to a conversation on a crowded street corner. And as such, there should be no expectation of privacy.
 (United States. Court of Appeals, Ninth Circuit. 2010. [Online] United States v Charles A Borowy. [Available: here])
 Within the case, see below, Borowy claims to have tried and failed to make private his hard drive in a number of dumb ways. He tried to claim that because he tried to make it private it should have remained private. The court found that as funny as I did.