[ISN] Sniffer dog threatens online privacy

InfoSec News isn at c4i.org
Fri Feb 11 03:37:40 EST 2005


By Mark Rasch, 
10th February 2005 

Comment - The Fourth Amendment to the US Constitution is supposed to
be the one that protects people and their "houses, places and effects"  
against "unreasonable searches". Forty-two years ago, the US Supreme
Court held that attaching a listening device to a public pay phone
violated this provision because the Constitution protects people, not
places, and because the Fourth Amendment prohibits warrantless
searches without probable cause if the target enjoys a reasonable
expectation of privacy.

Last month the US Supreme Court effectively trashed this principle in
a case that could have a profound impact on privacy rights online.

The case, decided by the court on 24 January, had nothing to do with
the Information Superhighway, but rather an ordinary interstate
highway in Illinois. Roy Caballes was pulled over by the Illinois
State Police for speeding. While one officer was writing him a ticket,
another officer in another patrol car came by with a drug sniffing

There was absolutely no reason to believe that Caballes was a drug
courier - no profile, no suspicious activity, no large amounts of
cash. The driver could have been a soccer mom with a minivan filled
with toddlers. Under established Supreme Court precedent, while the
cops could have looked in the window to see what was in "plain view",
the officers had neither probable cause nor reasonable suspicion to
search Caballes' car, trunk, or person.

Well, you know what happened next - the dog "sniff" indicated that
there might be drugs in the trunk, which established probable cause to
open the trunk, where the cops found some marijuana.

Now here is where things get dicey for the internet. In upholding the
dog's sniff-search of the trunk, the Supreme Court held that it did
not "compromise any legitimate interest in privacy". Why? Because,
according to the court, "any interest in possessing contraband cannot
be deemed 'legitimate'." The search was acceptable to the court
because it could only reveal the possession of contraband, the
concealment of which "compromises no legitimate privacy interest".

The expectation "that certain facts will not come to the attention of
the authorities" is not the same as an interest in "privacy that
society is prepared to consider reasonable," the court wrote.

In other words, the search by the dog into, effectively, the entire
contents of a closed container inside a locked trunk, without probable
cause, was "reasonable" even though the driver and society would
consider the closed container "private" because the search only
revealed criminal conduct.

The same reasoning could easily apply to an expanded use of packet
sniffers for law enforcement.

Currently, responsible law enforcement agencies limit their
warrantless internet surveillance to the "wrapper" of a message, ie,
email addresses or TCP/IP packet headers, unless they have a court
order permitting a more intrusive search. Looking at the "outside" of
the communication has been treated as similar to looking at the
outside of a vehicle - and maybe peering into the window a bit. To
peek inside the communication - read the content - required that you
first get someone in a black robe involved.

The experiences of Mr. Caballes (the soccer mom, or me or you )  
changed all that. The government is practically invited to peek inside
internet traffic and sniff out evidence of wrongdoing. As long as the
technology - like a well-trained dog - only alerts when a crime is
detected, it's now legal.

As context-based search technology improves, the government may soon
have the ability to take Carnivore one better and deploy "intelligent"  
packet search filters that will seek out only those communications
that relate to criminal activity. They may already have it.

Although these packet sniffing dogs sniff the packets of sinner and
saint alike, they only bark at the sinner's emails. Thus, according to
the new Supreme Court precedent, the sinner has no privacy rights, and
the saint's privacy has not been invaded. In fact, the saint would not
even know the search had taken place - internet surveillance is less
noticeable than a dog sniff.

I think Sun Microsystems' president Scott McNealy was only slightly
ahead of his time when he said: "You already have zero privacy, get
over it." We could pass a a constitutional amendment to protect our
privacy rights, but I thought we did that on 15 December, 1791 when
the Bill of Rights was ratified.

Hopefully, this case will be limited to a dark desert highway, and not
find its way onto the Infobahn. But somehow I doubt it.


SecurityFocus columnist Mark D. Rasch, J.D., is a former head of the
Justice Department's computer crime unit, and now serves as Senior
Vice President and Chief Security Counsel at Solutionary Inc.

More information about the ISN mailing list