City of Ontario v. Quon

Yesterday, the Supreme Court heard oral arguments in City of Ontario v. Quon (transcript here), a case which addressed the ability of government employers to read personal text messages sent using government pagers. The background: Jeff Quon was a SWAT Sergeant who used a department issued pager to exchange text messages with his wife and girlfriend. After Quon repeatedly exceeded the department's 25,000 character/month limit, an audit was conducted which revealed Quon's personal text messages. Quon sued, claiming that he had a reasonable expectation of privacy in his personal text messages, and that reading the messages as part of the audit was an unreasonable search. The district court disagreed, the Ninth Circuit court of appeals reversed, and the Supreme Court accepted cert.

There were a couple of factual issues in the case, such as whether the police department's policy regarding personal communications covered text messages, and whether that policy had been modified by a later staff meeting where a Lieutenant had said that he wouldn't audit the messages as long as the individual employees paid for any overages. However, as described in the Scotuswiki (which did a pretty good job of summarizing the case and arguments), at oral argument, the Supreme Court seemed to be minimizing those factual issues, and coming down pretty squarely against Sergeant Quon. The Scotuswiki cited Justice Ginsburg as indicative of the court's apparent leanings. My preference would have been Justice Scalia, for this characteristically blunt exchange

JUSTICE SCALIA: I guess we don't decide our -- our Fourth Amendment privacy cases on the basis of whether there -- there was an absolute guarantee of privacy from everybody. I think -- I think those cases say that if you think it can be made public by anybody, you don't -- you don't really have a right of privacy. So when the -- when the filthy-minded police chief listens in, it's a very bad thing, but it's not offending your right of privacy. You expected somebody else could listen in, if not him.
MR. RICHLAND [representing the City of Ontario]: I think that's correct, Justice Scalia.
JUSTICE SCALIA: I think it is.

(emphasis added)
Of course, whether you focus on Scalia, or Ginsburg, or one of the other Justices, the result looks the same - the Supreme Court is likely to decide that, at least for SWAT personnel using government issued pagers, employers are allowed to audit text messages by reading them, even if some of those text messages are personal.

Yahoo Fights for Privacy; Ultimate Result Inconclusive

Via this story from Wired.com, Yahoo has "prevailed" in its efforts to resist a court order to turn over emails based on an assertion that the emails were "relevant and material to an ongoing criminal investigation," rather than on a warrant. Technically, at least in the legal sense, Yahoo actually prevailed. Federal prosecutors, who had requested the emails as part of their investigation into a sealed criminal case, dropped their request, meaning that Yahoo prevailed on whether it would have to turn the particular requested emails over in this case. However, in a broader sense, Yahoo's "victory" is an empty one, and could arguably be treated as worse than a clear loss. The reason is that the heart of Yahoo's dispute with the prosecutors was interpretation of the stored communications act. As I mentioned previously (see here), this law has been the subject of substantial controversy, and a definitive ruling could have helped clarify the situation. As it is though, the cloud of uncertainty remains, leaving future litigants in the same situation of potentially having to defy a court order when prosecutors request emails that are arguably material, but which can't be obtained with a warrant.

Personal Emails on Company Computers

In December of 2007, Marina Stengart was employed as the Executive Director for Nursing at Loving Care Agency Inc., a company which provides home-care nursing and health services. Sadly, Ms. Stengart's relationship with Loving Care soured, and she left Loving Care and sued for, among other things, harassment based on gender, religion and national origin. However, before she left, Ms. Stengart used a laptop computer provided by the company to exchange emails with her attorney. When she left, she returned the laptop to Loving Care, and they were able to retrieve and read those emails by examining her computer's cache.

Not surprisingly, her lawyer went berserk (which, when a lawyer does it, is called applying for an order to show cause) and said that Loving Care's attorney should have treated the emails as privileged and returned them once they were discovered. Loving Care's attorney disagreed, and, on March 30, the New Jersey Supreme Court issued a comprehensive opinion (which can be found here) stating that Loving Care's attorney should have treated the emails as privileged and remanding to the trial court to determine an appropriate sanction.

Some interesting points from the opinion:

1) The Court said that Loving Care's policy regarding personal emails received on company machines was not entirely clear. However

Because of the important policy concerns underlying the attorney-client privilege, even a more clearly written company manual -- that is, a policy that banned all personal computer use and provided unambiguous notice that an employer could retrieve and read an employee's attorney-client communications, if accessed on a personal, password protected e-mail account using the company's computer system -- would not be enforceable.

2) The fact that Ms. Stengart was technically unsophisticated and didn't know that her computer automatically cached documents contributed to her having a reasonable subjective expectation of privacy in the emails. If she had been more technically savvy, the Court may not have decided the emails were protected (though, given the policy considerations surrounding the privilege, I wouldn't bet on it).

3) Even though it wasn't searching for privileged materials, once it found that it had emails that were potentially privileged, Loving Care's law firm had a duty not to read them, and to report them to Stengart's lawyer. Because Loving Care's firm didn't do that, they could be disqualified and/or forced to pay Stengart's costs (or face whatever other sanctions the trial court deems appropriate).

An interesting case, and a result I'm sure was an unpleasant surprise to Loving Care.

via this article from Computer World.

Internet Giants’ Online Advertising Practices Challenged

Just as one might wonder whether the FTC had decided to choose its battles and allow the online behavioral marketing dog to continue its nap, the dog has been awakened with a loud boom. Targeted behavioral advertising practices have been in the crosshairs of privacy advocates for several years, and the privacy advocates have finally pulled the trigger. The Center for Digital Democracy (CDD) and two other public interest groups filed a complaint with the Federal Trade Commission last week challenging the tracking and profiling practices used by Internet companies such as Google, Yahoo and Microsoft. Specifically, the complainants ask the Internet companies to acknowledge that the software “cookies” they embed in a Web browser collects data about a person’s online movements that should be considered personally identifiable information, even though the cookies don’t have a person’s name attached to them.

The privacy groups claim they are not calling for an outright ban of behavioral advertising. Instead they seek a balance between what they term the “Wild West” of data collection in the world of online advertising, and privacy controls such as notice and consent. Specifically, CDD, U.S. PIRG and World Privacy Forum called on the FTC to investigate the internet companies using its Section 5 authority for conduct that constitutes unfair and deceptive practices, and to issue an injunction against the unfettered use of what they claim is personal information collected by the companies. A full copy of the complaint can be found here.

The use of targeted behavioral advertising has been a controversial practice for several years, with privacy advocates sounding the alarms, and advertisers pushing for self-regulation. Following the release by the FTC of the FTC Staff Report: Self Regulatory Principles for Online Behavioral Advertising in February, 2009, various industry associations released the Self-Regulatory Principles for Online Behavioral Advertising in July, 2009. In the Conclusion to its Report, the FTC stated that it would continue to evaluate the industry’s efforts at self-regulation, monitor the marketplace and conduct investigations to determine whether there have been violations of Section 5, and meet with industry representatives and consumer protection groups to keep pace with changes. There has been no official word from the FTC in response to the industry’s publication of its Self-Regulatory Principles.

One can only surmise that the consumer protection groups simply got tired of waiting. How the FTC proceeds in response to the complaint will reveal how forcefully the FTC intends to address the online behavioral marketing phenomenom going forward.

Microsoft v. Waledac

This is a site that all lawyers working in the area of computer security should be aware of and visit. It's a page which contains all the pleadings from Microsoft's current case against John Does 1-27 (aka the "Waledac" botnet). This page is important for two reasons. First, Microsoft's efforts against the botnet are on the cutting edge of legal efforts to shut down hacking operations, and so should be seen as examples of legal theories that can be used in that area. Second, it has some interesting (and probably useful) examples of rhetoric and explanations which can be used to sway a (presumably) technologically unsavvy judge to your side. For example, on pages 3-9 of the PDF of Microsoft's motion for a temporary restraining order against the botnet, there is a non-technical tutorial on what a botnet is, and how issuing the TRO would shut it down, complete with pictures. Similarly, in making the arguments in support of the TRO, Microsoft repeatedly seeks to establish the harm the botnet is causing by explaining how it harms Microsoft's customers. E.g.:

Once customers' computers are infected and become part of the botnet, they are unaware of that fact and may not have the technical resources to solve the problem, allowing their computers to be misused indefinitely. Thus, extrajudicial, technical attempts to remedy the problem alone are insufficient and the injury caused to customers continues.

While this might not be the most relevant argument legally (after all, one is generally not allowed to bring suit based on injuries to third parties) from an emotional standpoint, it almost certainly made the judge more likely to grant Microsoft's requested relief.*

In any case, there's too much there to succinctly summarize here. Further, there's no reason to want to read a summary. The information is valuable enough to be worth the time to read in the original.

*Yes, I am aware that harm to third parties can be used to establish that issuing an injunction is in the public interest. However, Microsoft invoked its customers' interests essentially everywhere, not only when arguing that the public interest would be served by granting a TRO.

Cloud Computing: Good for Privacy?

In general, cloud computing is not good for privacy. For documents stored on the cloud, not only is there the same risk of hacking that is present for all electronic documents, but there's also a risk that the cloud service provider will accidentally share your data with other clients or users who don't have your permission to see it (see, e.g., Google Privacy Blunder Shares Your Docs Without Permission). However, now, a group of technology companies is coming together to try and address some of the concerns related to cloud computing with a positive change in the law. As described in this article, the group, calling itself the Digital Due Process Initiative, is pressing for the law regarding access to electronically stored information to be clarified, and the protections for that information to be strengthened.

To my mind, this is a positive development. The law on what protections are afforded to electronic communications is not at all clear, as there is currently a split between the First Circuit's decision in U.S. v. Councilman and the Ninth Circuit's decision in Konop v. Hawaiian Airlines on the question of when (and if) the protections of the wiretap act apply to email (see here). While clarifying that (and preferably strengthening existing law) won't eliminate problems that could be caused by cloud service providers accidentally sharing data, if the coalition succeeds, it would change cloud computing from a phenomenon which is almost wholly destructive of privacy, to one which could have beneficial effects, at least in terms of lobbying and raising people's awareness of the issues.

Punishing Cybercrime

Is chasing cybercrooks worth it?

That's the headline to this article from CNN. I was a bit shocked to see it. The triggering event for that article was the arrest of three men who appear to have operated the 13 million computer "Mariposa" botnet. I would have expected that taking down such a significant* botnet would be followed by multiple rounds of self-congratulation, rather than questions about the value of the whole enterprise. However, according to the article

the whole get-the-bad-guys effort, while it makes for good drama, is a futile way to secure the Internet, some computer security experts say.

"The virus writers and the Trojan [horse] writers, they're still out there," said Tom Karygiannis, a computer scientist and senior researcher at the National Institute of Standards and Technology. "So I don't think they've deterred anyone by prosecuting these people."

...

It would be smarter, Karygiannis said, to develop new anti-virus technologies and to teach people how to protect themselves from Internet crime.

To my mind, the sentiment reflected in the above quote is simply wrong.

First, Karygiannis' proposed alternatives are, at best, highly imperfect solutions. With respect to user education, I suspect Karygiannis has underestimated how difficult user education actually is, though, given that it's common knowledge that people still fall for Nigerian email scams (see, e.g., here), I don't know why he would. Further, even if user education were perfect, it's not at all clear how it would protect against malware which spreads by exploiting vulnerabilities in legitimate software. Indeed, Mariposa itself has been observed to spread through vulnerabilities in Internet Explorer 6 (among other vectors, described here), so even the specific botnet addressed in the article provides a counterexample to the proposition that user education is some kind of panacea.
With respect to better anti-virus technologies, technical protection mechanisms are certainly helpful, but they too aren't a panacea. Better anti-virus protection is nice, but the people writing malware aren't dummies, and they constantly improve their products to address advances in security technology. A great example of how this works is Conficker, a malware program whose "unknown authors are ... believed to be tracking anti-malware efforts from network operators and law enforcement and have regularly released new variants to close the worm's own vulnerabilities" (via Wikipedia).

Second, with respect to Karygiannis' comment that "I don't think they've deterred anyone by prosecuting these people," to the extent that comment is meant literally - that cybercriminals, as a class, are immune to the deterrent effect of criminal prosecution, it seems unbelievable. That's especially true since the arrests related to the Mariposa botnet are only part of a series of well publicized law enforcement actions against cybercriminals (for example, the recommended 25 year sentence for computer hacker Albert Gonzalez, described in this article). Further, even if it were true that prosecution of cybercriminals had no deterrent effect whatsoever, it would still have the effect of preventing the particular cybercriminals who had been prosecuted from committing further crimes. This effect, referred to as incapacitation, is something that has been well studied and documented with respect to other types of crimes (e.g., here), and there is no reason why it shouldn't apply to cybercrime as well.

The bottom line is that punishment of cybercriminals is a necessary part of our collective defense against cybercrime. To simply focus on user education and technical protection mechanisms, while those are important tools, would do nothing to address the source of these crimes.

*Determining the actual size of botnets is, to put it mildly, an inexact science. For example, this article about the size of the "Kraken" botnet pointed out that the controversy regarding Kraken's size was not limited to how many machines it controlled, but also reached more basic questions, such as whether Kraken was really separate from the older "Bobax" botnet. However, regardless of how botnet size is counted, Mariposa is undeniably huge (by comparison, Kraken was estimated at 400,000 machines - several orders of magnitude smaller than Mariposa).