Saturday, August 10, 2013

We need more engineers practicing law

I learned with dismay that the Obama administration is actually on firmer legal ground than I imagined in its en-masse acquisition of phone metadata.  The government precedent is Smith v. Maryland (1979) where the Supreme Court specifically held that the warrantless installation of a pen register (a device that records what numbers are dialed on a phone line) did not violate the fourth amendment because there is no "legitimate expectation of privacy" on the numbers you dial.

But the court, like the Obama administration, was wrong.  Here's the key excerpt from the decision (at the beginning of section B in case you want to follow along):
[I]t is important to begin by specifying precisely the nature of the state activity that is challenged. The activity here took the form of installing and using a pen register. Since the pen register was installed on telephone company property at the telephone company's central offices, petitioner obviously cannot claim that his "property" was invaded or that police intruded into a "constitutionally protected area." Petitioner's claim, rather, is that, notwithstanding the absence of a trespass, the State, as did the Government in Katz, infringed a "legitimate expectation of privacy" that petitioner held. Yet a pen register differs significantly from the listening device employed in Katz, for pen registers do not acquire the contents of communications. This Court recently noted: 
"Indeed, a law enforcement official could not even determine from the use of a pen register whether a communication existed. These devices do not hear sound. They disclose only the telephone numbers that have been dialed - a means of establishing communication. Neither the purport of any communication between the caller and the recipient of the call, their identities, nor whether the call was even completed is disclosed by pen registers." United States v. New York Tel. Co., 434 U.S. 159, 167 (1977).  [All emphasis added] 
The court might be forgiven for making this mistake in 1979.  But in 2013 it should be obvious to everyone that this analysis is wrong.  Just because there is no sound doesn't mean there is no communication.  Communication just means the transmission of information from a sender to a recipient.  Whether that information is analog or digital, or whether it has anything at all to do with someone's voice, is immaterial.  When I dial my phone there is no question that I am sending information to -- and hence communicating with -- the phone company.

Now, it is still an open question whether this particular communication is subject to a reasonable expectation of privacy.  Not all communications are.  For example, if you have an old-school conversation with another human being in a public place you have no reasonable expectation of privacy because you could be overheard by anyone.  So do you have a reasonable expectation of privacy when communicating with the phone company?  I for one certainly thought so until I read Smith v. Maryland.  There is all kinds of information that I transmit to companies I do business with that I expect them to keep private.  Surely the founding fathers considered business records to be part of one's "papers and effects" regardless of whether or not they were actually kept on paper.

But leave aside the question of whether we have a constitutional right to privacy in our business dealings and ask a more fundamental question: are we even allowed to offer privacy as a contractual obligation in the U.S. any more?    Clearly if my contract with the phone company had included a clause that stipulated that they promised not to turn over my records to the government without a warrant then I would have a clear-cut reasonable expectation of privacy (because I have a reasonable expectation that the people I'm doing business with will honor their contractual obligations).  But is this even possible nowadays?

Sadly, the experiment has been done, and the answer seems to be "no".  I say "seems to be" because we don't actually know what transpired to make Lavabit shut down.  But it seems pretty clear that Ladar Levison didn't pull the plug because he got tired of running the company.

Which brings me full circle to my central complaint, which is not about surveillance, but rather about secrecy and the end-runs that are being done around the Constitution and the rule of law in the name of security.  Underlying the rule of law are some unwritten meta-rules, one of which is that you can't reasonably expect people to play by the rules if it is not possible for them to know what the rules are.  And right now it is not possible, thanks to a combination of shady deals conducted behind closed doors and a supreme court that is ignorant of technology and playing fast and loose with the meanings of English words like "communication."

No comments: