Dealing With A Private Institution Policy To Inspect All Encryption-capable Devices Leaving The Country I am a student recently admitted to the University of Cincinnati, and I noticed something very peculiar and frightening in section 3.11 of their technology code of conduct. In light of clause 3.1, "When an Individual accesses university computing services and accepts any university issued computing accounts, they agree to comply with this and all other related policies," and pursuant to clause 3.11, "Exporting software, technical information, select research data, encryption software or technology, to a location outside of the United States in violation of international or regional export control laws, is illegal. The Export Controls Office must be consulted prior to export of any material that is in question," the policy definitely asserts with no wiggle-room that, by using the resources at the University of Cincinnati, I have to confirm all devices with encryption software with the Export Controls Office. There is no clause in section 3 which limits the applicability to the campus, so this policy should in theory apply to anywhere I am. The problem is that almost every electronic device in existence has complex encryption software. For example, any device able to access the internet has powerful decryption software in order to decrypt SSL-encrypted streams. Hence, this broad policy seems to demand that I have to check through the Export Controls Office with every personal electronic device in my suitcase before I leave the country. I understand the well-meaning original intentions of this policy and I fully intend to comply with the entire policy, but I am struggling to find a way around this unintended side-effect of the policy. What can I do to not have to submit my personal electronics from home for inspection every time I leave the country? I would imagine that, reading up on US privacy laws, the broadness of this policy makes the policy partially inapplicable because the policy is not above the law. Could the inapplicability of this policy extend so far as to void the policy (for my purposes, of course)? Thank you everyone! You are amazing!
You're completely misreading the goals and purpose of the Export Controls Office - Overview. They regulate the transfer of US regulated information and technology, commodities, and software in the interest of national security and economic growth. Transfer and export are not the same as the use of technology that personal devices contain. The simplest thing to do is simply call the Export Controls Office, and they will explain the difference, and tell what you need to do and what is not required of you when traveling. Some countries do prevent the use of some personal tech or Apps, i.e. Russia and Signal, the encrypted phone app; but that has nothing to do with UC.
Public schools are on a shorter legal leash than private schools are, because they must behave like proper governments do and respect the constitutional rights of their charges. (First Amendment rights are much broader in public schools than they are in private schools). Assuming that we're in a public school, a search of your phone is governed by a watered-down version of the 4th Amendment. They may search your phone if they have a reasonable suspicion that there is evidence of a violation of the law or a school rule, but this is passive with respect to you providing information -- if the phone is on, they can snoop around if they have a reasonable suspicion. The 5th Amendment would be relevant to passcodes: they cannot compel you to give up your passcode. If there was plainly-visible evidence of wrongful activity on the phone which they saw, and then you shut the phone down, then analogous to in re Boucher the courts could order you to reveal your password, under the "foregone conclusion" doctrine. However, it's the courts and not the schools who get to make that determination. One way the school could literally force you, bypassing the legal system, would be to physically threaten you, by beating you or threatening you with a gun or whip. Such physical coersion would be a felony, and it is almost inconceivable that they would do that. What they might maybe do is give you a non-physical ultimatum, of the type "decrypt the phone / reveal the password or we will... expel you / fine you / fail you in your English class / not let you go to any more football games / turn the phone over to the police". The question is, what would be legal versus illegal by way of consequences? I know of no constitutional right to attend football games anywhere, so they might well be able to get away with that deprivation. You might have a contractual right to attend games at a private school. With a private school, there is some contractual agreement between the school and you (least likely, assuming you're a minor) or your parents~guardians (most likely). That contract could imply certain rights, such as attending games, and might spell out a procedure for them to terminate that right. If they don't follow the process, they could be in breach of contract. Apart from contractual rights (which probably involve your parents, not you, but also would be considerable, for example the right to attend and be graded fairly in the English class), you have no protected rights. As you can see, the answer has a lot of "it depends" in it. Suppose your public school had a reasonable suspcion that you had engaged in a criminal activity, and might prove that by looking at the phone – which you shut down. They cannot use physical force against you, but they can try to persuade you, by offering you something that you want which they can legally take away – like attending a football game. If they try to deprive you of something that you have a right to, you can sue them to prevent that. However, they can also seek a court order to compel you to reveal the password, and it is certainly not illegal to inform you that if you don't unlock the phone, they will seek a court order. Whether or not the courts will grant the request is not obvious (incidentally, if the device is fingerprint-protected, you are hosed, since forcing a person to prove fingerprints is not against the 5th). If the school can be very specific about having seen criminal evidence, they have a leg to stand on, otherwise you cannot be compelled to testify against yourself (coughing up a password is a form of testifying against yourself).
Invasion of privacy and false light torts would probably not be applicable here. Very few states have adopted the false light tort because of its conflict with First Amendment principles and there was no agreement or even request to keep the text private. The copyright issue is trickier. First all, the TOS may provide that the copyright belongs to the text service provider or that there is a license. But, even in the absence of an express license, sending someone a message which is equivalent to sending them a letter, probably gives rise to an implied license that the person to whom it is sent can use the message that arises merely from the act of sending it without restriction or qualification. Implied license and fair use also heavily overlap. Publishing the text exactly as it was sent to you protects you from defamation liability because it is true. On the whole it would be extremely unlikely for there to be any legal liability for publishing a text from someone that they sent to you. Of course, one can imagine exceptions. If the person receiving the text was in an attorney-client relationship, or priest-parishioner making confession relationship, or was communicating regarding classified national security matters, or there was a non-disclosure agreement in place, among other possibilities, an evidentiary privilege and duty of confidentiality could apply and disclosing the material without the permission of the privilege holder could breach a duty of confidentiality and give rise to liability. If the picture was a nude picture of a minor, there could be a criminal and/or civil liability issue, and some states have also made posting "revenge porn" a criminal offense and/or a basis for civil liability. If the disclosure was effectively a way to facilitate insider trading that could be a problem. If the contents of the text were accurately transmitted but known to be false and were disseminated without disclosure of its falsity for the purpose of defrauding a third party, that could be a problem. But, no facts that obviously flag any exception are identified in the question. The mere fact that the posting may be embarrassing, or hurt someone's reputation, or was made without someone's express consent, in general, would not be a basis for liability.
First, when using profiling third party services (Analytics is "profiling" as defined by the GDPR), your main concern is not such a trivial thing as cookie compliance, but the security of processing I've analyzed Google's IP anonymization in some detail (as part of the DPIA I do for clients). My conclusion is that for most of the web-sites we manage, Google's IP anonymization is adequate to ensure security of processing as required by the DPIA process. However, on some sites that are likely to visited by users interested in what the GDPR calls "special categories of personal data" (Article 9), we either do not use Google Analytics, or we add additional layers of security in case the USA Government orders Google to disregard the stipulations in the DPA and hand over the data (yes, the US Government can legally do that - read the fine print in the Privacy Shield accord). As for Facebook Analytics, I think you've simply misunderstood their policy. Nowhere in that policy document does Facebook say that they "are not collecting Personal Identifiable Information". AFAIK, they collect tons of it, in all sorts of obnoxious and sneaky ways. What they actually say about PII in the context of Analytics is this: We do not share information that personally identifies you (personally identifiable information is information like name or email address that can by itself be used to contact you or identifies who you are) with advertising, measurement or analytics partners unless you give us permission. Let me remind you that one of their "analytics partners" was Cambridge Analytica, so if this promise not to share is true, it looks like a pretty new policy. OK, moving on to cookie compliance. To you (the controller), both Google and Facebook are processors. Given the history of the NSA and the methods it have used and AFAIK still use to get US-based companies to hand over the personal data about Europeans through orders issued by secret FISA courts, plus the fact that total nutcases currently are in charge in the USA, I am not going to rely on the privacy policy of any US-company for protection of personal data. So if I make use of Google Analytics (and I often do, they provide a great service), I always make sure that my users opt-in on that (hard cookie concent), even I make use of their IP anonymization feature (YMMV). As for Facebook, the fact that they promise not to share PII with third parties is irrelevant because they collect personal data. You will always need consent from your users to hand over their PII to Facebook in the first place. This is not optional. PS: If was a user, that consent would never been granted, no matter how great or valuable your site might be. If you have any sort of relationship with Facebook, I'll give you my personal data when you pry it from my cold, dead hands.
Although the USA don't like it, there's a department called INTERPOL which is composed by about 150 countries. When a crime is committed and you need to involve another country to solve it, the sovereignty of each County prevents a police officer from one country acting upon another country. That's when the INTERPOL comes in. They usually requests the police from that country to act up. A judge from that country will grant their local police access to the data to be delivered to the country that requested it. Can the police get a search warrant for data 'in the cloud'? Yes. If the servers are located within the boundaries of your own country, it's a normal procedure. But like the above answer states, it's easier to subpoena the records than to execute a search warrant. In a subpoena, the company itself is bound to provide everything the police asks. Can the police get a search warrant for such third party systems? Yes. If there's enough probable cause, the investigation can lead to allow the police to try and discover files that are held by servers that store the cloud data. But if the servers are located outside the country and the company does not have any office opened in the country, a search warrant won't have validity in another jurisdiction and the police can't act without breaking the sovereignty principle. That's where the INTERPOL services are handy. The department is built in the principle of polices from different countries helping each other. The downside is that it's too bureaucratic and it takes a lot of time. For instance if he has a virtual machine hosted by Amazon, would they serve the warrant on Amazon, or on the suspect? Like mentioned by @Viktor, if the company has an office within the bounds of your country, it's easier to subpoena the records because that way the company will filter and provide only the data linked to the suspect being investigated. That is, the subpoena will have both the name of the company (Amazon) and the name of the Suspect, so the company can provide only the necessary files. Update If the police lack sufficient evidence for a search warrant, but an interpol country was, for some reason, willing to work with the police to collect and provide that information would they be able to use it even if they wouldn't have been able to subpoena a US country? Hypothetically speaking, I see your follow-up as a company that do have a local office and the Federal Police was turned down by a judge on a warrant/subpoena. In that case, there's no reason for another's country police to act on their own country. The suspect is a foreign suspect, the crime is a foreign crime and the police has no reason to work on it. But for the sake of argument, let's say that the local police was turned down by a judge for lack of evidence or something and the suspect has been investigated by a foreign country or whatever. If the information that the local police desires to obtain is available through the INTERPOL, it's most likely to be accepted since it's a data stored by an international police department. In your scenario, the foreign police was granted a legal right to search and collected the data for legal purpose. Maybe they can't use it in their own country, but since they followed a safe chain of custody and provided the information to the INTERPOL, that information has legal validity and it is not fruit of the poisonous tree if the chain of custody was maintained.
I'm not going to comment on the specifics of this law; rather, I think this question shows a misconception of the way the legal system works in general. Here's the question: do you actually have "legally privileged" material on your phone? If not, what's keeping you from claiming that is that it's not true, and lying to a police officer is a bad idea. And just putting a letter from your lawyer on the phone doesn't mean you've established a legal privilege--attorney-client privilege is not a magic spell, it's a reasonable system of protection that only covers certain communications. The bottom line is: the statute in general, and that clause in particular, were included in the law to protect real, important, and substantial legal right. The courts interpret the law in light of that purpose. If the police officer finds a solution that protects your rights while still carrying out the purpose of the statute, the court will be unlikely to fault him or her. In this case, if you tell the officer that there is a letter from your attorney in a particular folder, the obvious solution is for the officer not to open that folder. Problem solved. In practice, in the United States at least, these cases are dealt with routinely; computers are seized, and attorneys and judges work together to ensure that privilege is protected while still allowing reasonable access to seized materials. I would imagine the same is true in the U.K. The bottom line is: the law is not a game, and technical "gotchas" are rarely effective. Common law systems allow judges enough leeway to avoid this sort of pointless technicality.
This would probably constitute illegal wiretapping and would certainly constitute a 4th Amendment search if conducted by law enforcement. Normally, the definition of whether something is "public" for purposes of an expectation of privacy is whether it could be detected by a human being unaided by technological enhancements from a place where someone could lawfully be to make that kind of observation. Some of the relevant cases are Katz v. U.S., 389 U.S. (1967) (tape recorder outside a public telephone booth was a search violating the expectation of privacy) and U.S. v. Karo, 468 U.S. (1984) (tracking device placed in barrel by authorities violated expectation of privacy). RFID signals are not "public" even if they are not encrypted with a private code because a device, such as the ones identified in the question, is necessary to receive them. The Wiretap Act, codified by 18 U.S. Code § 2511, is a federal law aimed at protecting privacy in communications with other persons. Typically, when you think of a "wiretap," the first thing that comes to mind is someone listening to your telephone calls. But the Act protects more than that. Under the Act, it is illegal to: intentionally or purposefully intercept, disclose, or use the contents of any wire, oral, or electronic communication through the use of a "device." The Act provides criminal and civil penalties for violations, although it creates various exceptions to when interceptions and disclosures are illegal. From here. In this circumstance, despite being passive, one is intentionally intercepting the contents of electronic communications through the use of a device. The fact that there was not in all cases an intent to communicate through, for example, an RFID chip, on a specific occasion probably does not suffice to render it not a communication.
If you are charged under the laws of Estonia (or Australia or Thailand or the UK) then the laws of the USA have no relevance whatsoever. It makes no difference if you are a US citizen, if the alleged crime happened in the USA or was perpetrated against the USA. If nation X has jurisdiction then you are tried under the laws of nation X. That is what sovereignty means. As to your specific example, Facebook does business in Estonia, therefore they are subject to Estonian law, as a US corporation they are also subject to US law and the law of every other jurisdiction they operate in (see why they need big legal departments?). If a legitimate Estonian warrant was served on them to disclose metadata or anything else then they are legally obliged to do so or be in contempt of court. Oh, and by the way, the first amendment right to free speech does not give you a right to anonymous free speech.