Why isn&#39;t FBI&#39;s access to our data against the right of privacy? In many blogs, it's said that your search history may get you in jail, like Can Your Internet Search History Get You Arrested and Internet Searches That Could Get You Arrested. Seems that FBI can have access to our online data. Why isn't FBI's access to our data against the right of privacy? What's even worse is that they may abuse their access for other conspiracy purposes. Is there a system to prevent the FBI from utilising their access for some vicious plot? To avoid technological distinctions, assume for the sake of this question that the searches take place in the US using a United States internet service provider, using a U.S.-based search engine, not using a VPN.
Firstly, because there isn't an explicit Constitutional &quot;right to privacy&quot;, per se, and even if there was (and there are arguments that several constitutional provisions amount, in aggregate, to a right to privacy), that it wouldn't be absolute, in the same way that freedom of speech and of the press are not absolutes. Indeed, the closest thing to a right to privacy, the 4th Amendment, has explicit caveats: &quot;The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.&quot; (emphasis mine). Thus reasonable searches and seizures, especially those authorized by a warrant, are constitutional. Furthermore, even in light of a constitutional right of privacy derived from this statue, depending on how the &quot;search history&quot; is compiled, the 4th Amendment might not even apply, due to the Katz doctrine, also known as the &quot;open fields&quot; doctrine. Basically, the 4th amendment (as far as searches goes) does not apply to things that are publicly observable; while this would protect a literal &quot;search history&quot; compilation (baring a reasonable search), the searches themselves are public queries, broadcasted over the internet. Anyone watching could compile them into a &quot;search history&quot; themselves.
A fundamental requirement of criminal culpability is intent. Based on the description this whole process is happening after a user has already had their phone seized. If a person was not aware of Signal's hidden files to damage the police's data forensics software, they will not have met the criminal intent requirement, either maliciously or under a criminal negligence theory. None of the prongs of CFAA are strict liability statutes (18 U.S. Code § 1030 &quot;Whoever having knowingly accessed a computer...&quot;), so that would not apply here. If we imagine a person that is aware of all the information from Signal about their app intentionally abusing Cellebrite's package and with intention to cause damage downloads Signal's malicious files to their phone, I think it's an open question whether or not they would be liable under the CFAA. Specifically, 18 U.S. Code § 1030(a)(5)(A) (emphasis mine) Whoever knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; An argument on this could go both ways. On the one hand, the owner of the phone could be found to not have substantially caused the information to be transmitted to a protected computer, as the police were the integral cause for that in executing their warrant. On the other hand, this sort of file could be considered a digital &quot;booby trap,&quot; and booby traps are illegal for essentially this reason, that they have a foreseeable effect of causing harm to people who are lawfully inside a building without the owner's permission. In this case, the owner's trap was sprung by law enforcement but still placed by the owner in order to damage them.
1a - Where is US government website where person can requesting free copy of their MIB (online or by phone). And I don't mean MIB.com. I am looking for government website that would reference something like MIB, i.e. for instance Federal Trade Commission website references annualcreditreport.com There isn't one. The right to medical information is a right you have vis-a-vis individual heath care providers and insurance companies that have your medical information. The U.S. government does not have access to this information and doesn't facilitate you getting this information, except that you could sue in federal court to get it if the person required by law to provide it to you didn't give it to you. (The fact that the U.S. government does not have access to individual health information is one of the reasons that major medical research studies that capture a sample of the entire population of a country for a given time period are often done instead in foreign countries that have comprehensive medical records databases. In the U.S., the best possible alternative is often to look at the medical records of servicemen and veterans who received government provided health care, or to create very large voluntarily long term studies of populations such as doctors and nurses.) Even in the case of credit reports, the government website merely ends up directing you to a private sector website maintained by credit reporting websites and is not a government website. 1b - Where is US government website where person can requesting free copy of their other personal records (online or by phone) You can apply to the U.S. government via one of the IRS websites to get transcript of your past tax returns for a certain number of years. You can apply to the Social Security Administration to get your earnings history for Social Security purposes and I think that can be done from their website or by telephone. There is a U.S. government website called PACER at which you can get copies of all non-sealed filings in all federal court cases, and all filings in court cases to which you are or have been a party. There is U.S. government website at which you can ascertain whether or not a building, including your home, is in a flood plain. There is a U.S. government website that allows you to locate people who are currently incarcerated in federal prison. There is a U.S. government website that allows you to review census data from time periods when almost everybody is dead. I believe that old immigration records can also be accessed in this manner. There is a phone number at the Veteran's Administration where veterans can ask about their personal veteran's benefits. I'm not sure if that have a website from which they can do so yet. Last time I checked, a long time ago, they didn't. There are several websites and phone numbers that federal employees can access to get their personnel record type information. This is absolutely not a comprehensive list. It shouldn't be hard for you to research yourself the current web address for these sites which changes fairly often anyway. You can get many other kinds of information from the U.S. government that is about you via the Freedom of Information Act (a.k.a. FOIA), but generally speaking, this information isn't available via a website or by phone. Usually, you have to request it in a written letter or application unless a new website allowing you to do this that I don't know about has been created recently.
There is no US law licensing journalists or people who report the news, or requiring such people to identify themselves by legal name. Nor can there be under the US First Amendment. There is also no law requiring a person to identify himself or herself by legal name online. Some sites, including Wikipedia, have policies against having multiple undisclosed user IDs for the same person, but that is a matter of the site's own rules, not a matter of law. Any US law mandating this would again run afoul of the First Amendment to the US Federal Constitution. This article on Anonymous Speech reviews and cites a number of US Supreme court cases on the subject of anonymity, mostly in political contexts. This article from the Electronic Frontier Foundation (EFF) discusses the same general subject. Both articles mention that The Federalist (analyzing and advocating for the then-unratified US Constitution) was originally published under the pseudonym "Publis". The EFF Article "Court Recognizes First Amendment Right to Anonymity Even After Speakers Lose Lawsuits" discusses the 6th Circuit case of Signature Management Team, LLC v. John Doe in which it was held that an anonymous blogger who lost a copyright infringement suit could nonetheless remain anonymous. This page apparently from a Harvard course, lists and briefly describes several cases on the same subject. In Doe v. Cahill, 884 A.2d 451 (Del. 2005) an elected official sued an online poster for defamation, and sought to force the ISP involved to disclose the poster's identity. The Delaware Supreme Court ruled against this, setting a standard offering greater protection for such anonymous online speech than previous cases had. This answer is very US-centric. Laws in other countries are different. The OP has not specified a country or jurisdiction.
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
Is this illegal? No, subject to some possible narrow exceptions discussed below. Do the social media companies have a duty under the First Amendment to not censor users? No. Indeed, usually, there is greater liability exposure for failing to censor content, for example, by failing to honor a "take down notice" under Title II of the Digital Millennium Copyright Act based upon an alleged copyright violation, or for failure to censor content related to potential sex trafficking. The First Amendment to the United State Constitution (which applies to state and local government via the 14th Amendment to the United States Constitution) is a limitation on the power of governmental actors only. This said, some state constitutions, such as California's, provide free speech protections not just from government action, but also in spaces that are privately owned, but are open to the public and constitute de facto public forums. The authority of California to expand its state constitutional protections to these private settings was confirmed by the U.S. Supreme Court in the case Pruneyard Shopping Center v. Robins, 447 U.S. 74 (1980). It is conceivable that these doctrines could be expanded to public Internet forums in the case of California based social media companies (e.g., Facebook has its headquarters in Menlo Park, California; so does its sister platform Instagram; LinkedIn is based in Sunnyvale, California; and Google is based in Mountain View, California). There are also laws that limit how employers can regulate employee speech in a labor relations context, although most of them don't have constitutional dimensions. It is conceivable that these doctrines could limit social media platform's authority to limit some kinds of speech by their own employees, or in situations where the social media platform looked like it was acting as a mere agent of some other employer controlled by that employer for all practical purposes. There has also been litigation related to free speech on social media regarding the rights of governmental account holders to exercise the same kinds of account management that is available to other users, implicating the First Amendment right to petition the government. The social media platform operator is not itself the primary target in these cases, but if it simply implements its terms of service neutrally with respect to all account holders, it could be facilitating a constitutional violation by its governmental account holders and could conceivably be held liable for aiding and abetting that violation of the law by a governmental account holder (in the context of a lawsuit for money damages this is a special subtype of something called a civil conspiracy).
This would be unauthorized access to a computer. The offence is found in Section 1 of the Computer Misuse Act 1990. Note that this is a criminal offence, approaching the police about it might be the best way of handling the situation (if you want to go that route, and also, I'm not a lawyer).
In general, people have less expectation of privacy in cars than in their homes. To challenge a search and/or seizure under the Fourth Amendment, a person must have standing - the right to sue (that is, you must have had a reasonable expectation of privacy in the place where the search happened; if you didn't, no standing - can't claim your privacy was violated if you had no privacy). The US Circuit Courts are split on the issue of unauthorized rental drivers and whether they have the same reasonable expectation of privacy as the authorized driver of a rental car would have. Some Circuits allow the unauthorized driver to challenge a car search if the authorized driver gave them permission. Some Circuits look only at the agreement and if the driver isn't authorized on that, they're out of luck. The 6th Circuit is more case-by-case, with a presumption that driver can't challenge the search that can be overcome based on the facts. (All this info from US v. Haywood, 324 F.3d 514) There's a current case before the Supreme Court (argued January 9, 2018), Byrd v. US, on this very issue. This SCOTUSblog page has a lot of information on the case. Edited to add: Texas is in the Fifth Circuit, which follows the rule that unauthorized drivers don't have standing to challenge a search/seizure even with the authorized driver's permission to drive the car; unauthorized drivers of rental cars don't have a reasonable expectation of privacy because they lack a possessory interest in the car and/or they're violating the rental agreement. Basically, even though it seems the cops' stop of the car would've violated the Fourth Amendment if he were the authorized driver, since this happened in Texas, he's not going to be able to challenge the stop. IMO, this is incredibly unjust especially when the cops admitted there was no probable cause, so hopefully the Supreme Court makes this rule obsolete and allows unauthorized drivers to exercise their Fourth Amendment rights. Some law review articles on the topic of unauthorized rental drivers: "Hertz and the Fourth Amendment" "Resolving a Three-Way Circuit Split"