Note how your statement does not hold in the real world.

Email being transmitted by 3rd parties is not different from voice calls being transmitted by 3rd parties. Yes, you are trusting a provider, with the expectation that your provider will send the data where you've asked it to send the data, and nowhere else. This is still true whether you're talking postal service, landline voice calls, SMS, cellular voice calls, Skype, etc.

From the parent of my original comment:

Almost every SMTP server out there today requires authentication ... That is the very definition of trying to keep things private.

Do you disagree with me? Do you believe that SMTP authentication contributes to privacy and not authenticity?

If I am using them to communicate with a 3rd party, I have a reasonable expectation of privacy between myself and that 3rd party. You would most certainly need a warrant to turn around and try to get access to a message stored on their servers.

On top of that, quite a bit of email today doesn't even touch SMTP. If I'm sending an email from one GMail user to another GMail user, I'm pretty sure it is just shuffled around on Google's internal servers. And, of course, I'm connecting to Google using SSL, an encrypted connection.

How does that not scream private?

I cut out the SSL and TLS because I don't disagree; SSL and TLS certainly says "privacy". I wanted to specifically address the notion that "authentication =~ privacy"

Why can't it be both?

Why should storing something on a third party's system obviate the need for a warrant? If I rent real property and use it to store my papers, does that mean the government should be entitled to seize them without a warrant because I'm storing them on the premises of a third party? If not, what's the difference?

In other news: you can't invoke the 4th amendment if you stash boxes of weed at a friend's house and he hands them over to the government when asked.

There are privacy policies and terms of service that cover what a service provider will share with whom and under what conditions. This represents an agreement between the user and the service.

However, that is wholly different from the rights held by the government (IRS) to compel the service provider to provide information at the government's demand.

Your analogy with the "boxes of weed" are similarly misguided and completely unrelated. The more relevant analogy would be that the government forced your friend's landlord to unlock his door without a warrant, entered, discovered the boxes of weed with your name on it, then arrested you.

And, to put your analogy back into the subject e-mail context, if you e-mailed something incriminating to your friend and your friend opted to turn you in to the authorities, that is entirely different from the government gaining access to your e-mail of its own volition, and without a warrant.

Mail theft was a pretty serious crime in USA I am led to believe, regardless of whether it is sent in encrypted form or not...

To prove to yourself that SMTP is primarily concerned about authenticity over privacy, just try setting up your own mail server. Ensuring your mail is not blocked and/or marked as spam is an involved process of establishing multiple checkpoints re-confirming your identity. DKIM, SPF, domainkeys- each intended to establish that you sent this (unencrypted) message, and not someone pretending to be you.

Google won't hand you a packet capture from eth0 on smtp.gmail.com because you asked nicely. You would have to coerce an insider (or exploit your way in).

The only situation in which your statement applies is if you're abusing a position of trust as a network administrator. While it's true that this is possible, it's also possible for someone to break into your (postal) mailbox. You still have an expectation of privacy.

Of course, if you send an email to an account with the same provider, it's probably secure.

I asked once. The answer was: no, it is not waived and no warning need be attached. Applicable law revolves around intent and that is largely determined by who you choose for recipients. There is some allowance for typos and mistakes when addressing or sending. The warning is just to remind people of appropriate conduct, encourage them to report incorrectly addressed messages, and make the intent extra clear.

Absent an expectation of privacy, the government is entitled to search whatever and whenever it pleases. Are you suggesting there is court precedent establishing the government does not require a warrant to search a box being delivered by UPS?

So, again, what actual precedent exists to support rayiner's contention?

But, absent that, the government cannot simply compel UPS to hand over the package or relay its contents without a warrant. That would be a violation of the Fourth.

OTOH, if the UPS employee simply looked in the box, it wouldn't be a Fourth issue. It is only so if the employee did so at the behest of the government. In other words, you are correct: in that case the employee is acting as a government agent[1], which triggers the Fourth:

[1] http://www.fletc.gov/training/programs/legal-division/podcas...

Edit: Key clause:

Miller: Can private parties ever trigger the 4th Amendment?

Solari: Yes, as we discussed, if a private party were to be acting at the behest of the government -- if a government agent were to ask that FedEx person to open up a package and look inside, or to ask someone’s girlfriend to go through their things looking for evidence to turn over to the police, then that would be government activity. That would be the actions of a government agent because government agents can’t ask private parties to do something they themselves couldn’t do under the 4th Amendment, so in that type of instance it would be extended to that private party.

Now my next question is can someone force the third party to give up the information without a warrant? I know they most likely will just comply. However, just for completeness, can a company like FedEx say that they require a warrant before opening packages?

[1] https://ssd.eff.org/your-computer/govt/privacy

I just grepped my personal email server log to double check, here's an obfuscated entry from this morning:

> localhost postfix/smtpd[14440]: TLS connection established from mail-xxxxxxxx.google.com[xxx.xx.xxx.xxx]: TLS v1 with cipher RC4-SHA (128/128 bits)

Doesn't look like clear text to me.

Edit: A test tool... https://www.checktls.com/

However where I do disagree with rayiner is that you should be able to expect that third parties which you willingly entrust your communication to, should not be compelled to turn over that message without a warrant.

If they turn it over willingly that's caveat emptor, but email to me feels more like a hand-to-hand transfer of a postcard than dropping a postcard on a public desk (as used in a different example), and therefore you should be able expect that it's not treated as essentially public domain.

What does "should" have to do with it? A landline telephone isn't encrypted, people still expect their conversations to be private. And I don't see why email should be different -- if it came out that human Google employees have been reading your emails it would be a huge scandal.

> If they turn it over willingly that's caveat emptor

I don't know about that. Do you think it would also be reasonable without a court order for them to provide your private emails to a party other than the government, like a reporter or your company's customers or suppliers?

But I'll take it further, to the extent that a secure channel isn't possible by phone today, people shouldn't expect privacy there any more either.

Being able to keep the government from using your information is different from privacy, and that's my big point. These conversations always go the route that Big Brother knowing about something is the worst thing that can happen to you, but really it's not. How many people get fired from their jobs without one bit of government intervention based solely on their employer becoming aware of a message they sent? That's what I'm talking about, you should not expect privacy from unencrypted email. Even if your provider is awesome, the recipient and the recipient's provider might not be, and that's beyond your control in most cases.

> > If they turn it over willingly that's caveat emptor

> I don't know about that. Do you think it would also be reasonable without a court order for them to provide your private emails to a party other than the government, like a reporter or your company's customers or suppliers?

Do I think it would be reasonable? Not at all. But it's certainly not illegal, which is why I say caveat emptor. Pick your contractors carefully and vote with your wallet for the one that will guard your data.

Privacy should not (and in more enlightened countries and legal systems it does not) mean "others are not technically able to see it".

It should mean: "this piece of information should not be attempted to be seen by others without the owners implicit or explicit permission".

(And then legal formulas could be used to define "permission" (ie the recipient of an email has an implicit permission to read it)).

If we use the BS notion of privacy of the US courts, then copyright should not exist either (because, by the same logic, one can break the copyright protection easily). Even theft would be OK (hey, I can steal your stuff if you left your belongings in a public place).

So, no, whether my mails are in Google's servers or wherever else, it should be illegal to read them for any purpose I don't agree with. Much the same as if the postman delivers my email to the neighbor's box by mistake, he should not be allowed to open and read it.

And we can do that with cryptography, with even more sophistication than a simple "yes/no" formula:

https://en.wikipedia.org/wiki/Attribute_based_encryption

The problem with relying on legal formulas here is that you need to rely on many people -- hundreds, maybe even thousands -- to not break the law over a long period of time. Your email is not really "sent," it is copied from system to system, and anyone with access to those systems could potentially read it. Backup tapes may be lost or stolen. Hard drives full of email may be sold off. This is not privacy; it is trusting hundreds of strangers to keep your confidence for an indefinite period of time.

This is really at the heart of the disagreement in this thread. Maybe this is what you think it should mean. But that's not what it means Constitutionally. The Constitution doesn't talk about privacy, it talks about unreasonable search and seizure. And the precedent is that if you've voluntarily handed the information to someone else, its not unreasonable for the government to get that information from them.

Sure, but I don't care much about the constitution. I care about what's fair and right. Constitutions can be changed and amended, especially if they were written 3 centuries ago.

So WireShark is now illegal in your ideal world?

Email is computer technology and demands a technical answer: if you want something to not be eavesdropped on, encrypt it. This is why we use ssh and not telnet any more.

If if it's not your network and/or network traffic, or you don't have the network owners permission, then yes.

Why should it be legal? Because you like playing with it?

"Impossible" trumps "illegal" every time.

Because I don't want technology to rule us, I want us, humans, to rule technology. We say a lot of times that "technology is a tool". If we have to adopt ourselves and our society to it, instead of adapting it to our preferences, goals and morals, then it's not a tool, it's a ruler.

In this case, cryptography might be a solution. But it's not a perfect solution for me. For one, it's not widespread and it's confusing for most people to integrate to their mailing habits. Second it breaks lots of workflows and conveniences (e.g full text search of emails).

Second, I don't want the government, Google, or anybody else to have it be legal to look into my email if they can break the cryptography or find the key. I want it to be illegal even at that case.

Third, while cryptography might be a case were technology can solve this problem (privacy) there are other issues just piling technology cannot be used to solve them -- where legislation is needed.

Personally, I want technology to solve human problems. If technical solutions to problems exist, they should always be preferred over legal solutions. We do not need to increase the size of an already out-of-control legal code, and we do not need more laws that will be selectively enforced (as almost all laws are).

"it breaks lots of workflows and conveniences (e.g full text search of emails)."

That is not an insurmountable problem: get an email client that can do full text searches of your email by automatically decrypting it while the search is performed. If for some reason you need to export your search to some server, cryptographers have developed systems for doing that in a secure way, though their computation cost is a bit high (much more than searching the plaintext).

"I don't want the government, Google, or anybody else to have it be legal to look into my email if they can break the cryptography or find the key. I want it to be illegal even at that case."

I would be cautious about that. It is almost certainly the case that such a law would not be enforced when a government agency or large corporation are breaking it -- see e.g. the warrantless wiretapping program. More likely, such a law would be used when a whistleblower exploits a weakness in a cryptosystem to expose government wrongdoing.

Expanding the legal code is dangerous. We have so many laws that the government has lost track:

http://online.wsj.com/article/SB1000142405270230431980457638...

We have seen over and over how this vast legal code is abused to crack down on protesters and dissidents. Adding more laws to it is just asking for more trouble, and doing so when we have technical solutions is a pointless risk.

"while cryptography might be a case were technology can solve this problem (privacy) there are other issues just piling technology cannot be used to solve them -- where legislation is needed."

Sure -- but we are not talking about those problems, we are talking about a specific problems that is well studied and which has been solved for decades.

Indeed. Making something that could be made impossible (or extremely difficult) "only" illegal will tend to make people complacent. If the expectation is that bad people won't do something because it's against the law, good people may fail to ensure that they can't. And then bad people do it anyway, leading to outrage, panic and harmful reactionary legislation. Not to mention bad people getting away with doing bad things, which could all have been prevented with sound engineering.

This isn't to say that every problem can be solved with a technical solution -- but when the technical solution is extremely effective, a legal solution is surplus to requirements.

Consider, in a public restroom there is very little done to prevent people from seeing each other. However, one almost certainly has a reasonable expectation of privacy in such a situation. Hell, consider using the restroom in someone else's house. If you record videos of everyone that uses your restroom...

Really, we need encryption to be widely used, for people to learn about it in school, and for people to generally expect messages to be encrypted. We have not really won this fight until people encrypt private messages and get angry when private things are sent in the clear.

Consider, someone could have a camera mounted onto their foot or on a poll to get over the standard stall doors. Would you just claim that folks should be ok with this? Because, "hey, it was possible? Quite easily done, actually."

I am pushing this point so heavily especially because a large company is pushing cameras that are mounted on people's faces. If someone were going into a restroom taking pictures, people would feel rightfully violated. Soon, this is likely to be happening more than you'd care to consider. The ease with which it can be done is irrelevant to the legality of it.

So let's take that argument to its extreme: you are standing in an open field going to the bathroom. Do you still think you have an reasonable expectation of privacy?

The problem with your argument is that it is based on the idea that if people want privacy, they are entitled to it even if they do nothing to protect that privacy. There is nothing wrong with expecting people to be a bit proactive when it comes to their privacy -- closing doors, drawing their curtains, encrypting their email. People should not just shrug about someone filming them on the toilet, they should do something to prevent it (and if a person started to drill holes in the door, sure, prosecute them -- for destroying someone's property).

"If someone were going into a restroom taking pictures, people would feel rightfully violated"

No, if someone were going into a restroom taking pictures of other people going to the bathroom in a closed stall they would rightly feel violated. Any weaker standard is basically saying that nobody can take pictures in public, because they might accidentally catch a person peeing on a wall and thus violate their privacy.

"The ease with which it can be done is irrelevant to the legality of it."

No, it is very relevant to the legality, because when we make easy and popular things illegal we worsen an already out-of-control criminal justice system. We do not want to start arresting people just because they are using their cameras, even if their cameras are mounted on their heads, even if they wear their head-mounted cameras into bathrooms. If cameras are everywhere and used by everyone, the answer is to build bathroom stalls that go from the floor to the ceiling, not to open the door to waves of prosecution (which will almost certainly be used selectively against "undesirable" people).

The appropriate place to draw the legal line with privacy is with people taking proactive and reasonable measures to be private. Putting letters in envelopes, closing curtains, closing doors, and yes, encrypting emails. You have no expectation of privacy in public parks, nor if your door is left open, nor if your curtains are left open, so why should you expect privacy when you send unencrypted email?

As the other poster said, consider the urinal. Whether intended or not, there are about to be a lot of images of people at the urinal taken by a capture device. Should men just get used to this idea and expect these pictures online?

I roughly get and agree with what you are saying. But, consider, it is trivial to build a microphone that can pick up every word you said within your house. Do you feel that police should be able to use such a device from a van outside without a warrant? Hell, it is trivial to build a camera that can see through most clothes nowdays.

That is, the laws are there precisely to cover things which may be easy otherwise. Hell, it is trivial not to pay your taxes. Illegal. It is trivial not to honor a contract. Illegal. We don't make laws against jumping to the moon. Because... not exactly relevant from a legal perspective.

Yes, or else just walk to the stall and pee in the toilet. I see guys doing that all the time where I work -- some men want to be private about it, and urinals are not and have never been private.

"But, consider, it is trivial to build a microphone that can pick up every word you said within your house. Do you feel that police should be able to use such a device from a van outside without a warrant? Hell, it is trivial to build a camera that can see through most clothes nowdays."

I did say that closing your door should give you a reasonable expectation of privacy. I also said that things that are easy and popular should not be made illegal. If everyone walked around with a parabolic microphone or a millimeter wave scanner, we would have to adjust our laws, habits, and notions of what counts as a reasonable expectation of privacy accordingly. It is currently reasonable to expect that wearing clothes protects you from having your naked body photographed; that would have to change if it were common for people to carry cameras that could see through cotton.

However, if police wish to violate this, using relatively common and accessible tools, they have to have a warrant. Consider the phone calls you place. These are just as exposed to third parties as any email you send. Yet to intercept them police need a warrant. For others to do so is illegal.

Note, the deciding point here is not that it is hard or easy to intercept your communications. Or sit outside with a microphone. The point is that those activities require a warrant. Because they are illegal otherwise.

Why not? It's just a law away for this to happen.

We can fully well pretend that email really is private.

It doesn't matter if it is technically private (ie if someone can access it or not). What matters is for accessing it to be illegal.

If this is the criterion for success, this fight will take a very, very long time to win. It may be impossible.

How will I explain this to my grandma?

To my 10 year old cousin who is interested only in Nicki Minaj and makeup?

Except for the mail servers...

It would be as though you communicated by sending post cards, and the postal works took every post card and ran it through a copy machine, leaving them all in a neatly organized (by sender and receiver) pile somewhere.

Also, unsealing an envelope on a hot surface is trivial. Nitpicking aside, both mediums are not inherently secure.