In this post, I am asking two questions that have been inspired by some research I have been doing into privacy concerns in the digital world. This post is partially inspired by a report from the Electronic Frontier Foundation regarding websites' policies for disclosure of private information to the government (the full text of the report is available here). Moreover, I recently finished the first draft of a paper that addresses issues of online surveillance and its Fourth Amendment implications. I hope to have finalized for the next law journal submissions cycle, but there are a couple of unanswered questions that I have not yet included in the paper that I thought I would mention here.
The first question: does the third party doctrine apply if the third party promises that information will be kept secret?
Under the third party doctrine, if somebody knowingly submits information to a third party, then the person submitting the information no longer has a reasonable expectation that the information will remain private. A typical justification for this is that the person submitting the information accepts the risk that the third party will disclose that information to the police.
I am inclined to say that the information can still be obtained by the government without a warrant, and the person who submitted that information will be barred from raising a Fourth Amendment claim by the third party doctrine. Even if you give information to a third party who promises that the information will remain secret, that third party can back out on his or her word.
My intuition here arises from the third party doctrine's origins in organized crime cases, where the Court held that statements to informants who were in defendants' homes or rooms without warrants were admissible. The defendants who made statements to the informants assumed the risk that the informants would disclose that information to the police. This held true in organized crime situations where snitching to the police would be a surefire way to get killed. It seems, in these cases, that the informant had implicitly agreed to keep silent -- with the penalty for disclosure being death.
This seems to relate to websites' claims of security in an environment of government surveillance. Several websites pride themselves in being beacons of privacy because they only allow the government to access their information with a warrant and go through other procedural steps before user information is released.
But if the government were to obtain this information without a warrant -- or to take an extreme case -- if the government were to hack into the website without the website's knowledge and collect user information directly, I am not sure if the website's users would be able to make a successful Fourth Amendment argument against this tactic. After all, the users have given their information over to a third party, who may have ended up giving away that information. Despite the website's contract not to do so, the website could choose to violate this contract. And even though the website did not voluntarily give up this information, that does not change the fact that the individuals had no expectation of privacy in that information to begin with by giving it away to the website.
While a lot of discussion about the Fourth Amendment in a digital context begin and end with the third party doctrine, I think that a dimension that has been under-addressed is the issue of standing.
This leads me to my second question: how do questions of Fourth Amendment standing apply to situations where the government obtains personal information from websites by getting this information without a warrant and without the permission of the website?
I am not particularly surprised that standing has not been discussed that much -- it is a relatively underdeveloped area of Fourth Amendment law, and it involves similar facts and considerations as the third party doctrine, so discussing both concepts might seem redundant. But I think that standing is an important consideration in the online context -- especially if people are not convinced that the third party doctrine does not allow the government to obtain information from a website without the website's knowledge or permission.
The police may violate the Fourth Amendment in collecting evidence, but they can still use that evidence to prosecute somebody whose Fourth Amendment rights were not violated. The person whose rights were not violated lacks standing to make a Fourth Amendment claim.
The typical citation for Fourth Amendment standing issues is Minnesota v. Carter, 525 U.S. 83 (1998). In this case, the police entered a house without a warrant and saw that the defendant was present and bagging drugs. The Supreme Court held that whether or not the police lawfully entered the house turned out to be an irrelevant inquiry -- because the defendant did not live at the house and because he was not an overnight guest, the police officer's entry into the house did not infringe on his Fourth Amendment interest to be free from unreasonable searches. If the entry had been an unreasonable search, the police would not have been able to use any obtained evidence against the homeowner or an overnight guest, because those people would have standing.
With Carter in mind, say defendant stored incriminating, personal documents in a friend's home. Defendant does not have any ownership interest in that house, and defendant has never stayed overnight at the house. If the police enter the friend's house without a warrant and find those documents, the police would not be able to use them to prosecute the friend, but the police would be able to use the documents against defendant. Even if the search is illegal, it only violated the Fourth Amendment interests of the friend, and not defendant.
The government can probably make a similar argument when it obtains information on users from online services like Google and Facebook. Even if the government did not ask the website's permission to obtain this information, and putting aside any government arguments from the third party doctrine, there seems to be a serious question of whether users of these websites have standing to argue that the government's information collection practices violate their Fourth Amendment rights. The government is not breaking into the users' personal computers -- rather the government is searching the servers of a separate company.
So even if users who are arguing for Fourth Amendment violations can get around the third party doctrine, they would still seem to have trouble establishing that they have standing to argue that their Fourth Amendment rights have been violated. To get past the standing concern, users would need to establish a Fourth Amendment interest in the information they share with websites. This is something that I hope to explore both in my paper and in a future post, but I felt that outlining the general issues of the third party doctrine and standing is a good place to start.