full-disclosure - Re: e-mail snooping ruled permissible

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: pfcdh1 at matsu.alaska.edu (Hamby, Charles D.)
Subject: Re: e-mail snooping ruled permissible

Jason,

I definitely agree that the stipluations that both sides agree to were totally off-base, but my read of the Court's opinion is that this appears to be less a technical matter than an issue of statutory interpretation by the First Circuit.  I've read over the Summary and the analysis of the case itself and I do wonder what sort of effect it would have ultimately had if both parties had gotten the stipulations right.  Perhaps I missed something in the Court's analysis but it appears that the First Circuit relied much more on the particular language that was present in the Wiretap Act itself than the technical details of what the parties stipulated to.  For example:

  In the Analysis section it clearly says "Relying on the definition of electronic storage, the district court held that no interception can occur while the e-mails are in electronic storage and therefore, without the requisite interception, the Wiretap Act could not be violated."

Referring to 18 USC 2510(17) we see that the definition of "Electronic Storage" is:
(A) 

any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and 

(B) 

any storage of such communication by an electronic communication service for purposes of backup protection of such communication; 

The Court also notes that while the definiton of "wire communication" includes communications while in storage, the definition of "electronic communication" does not.  The Court goes on to say that when Congress does something like that it must be presumed that it was deliberate.  The Court then drives another nail in the coffin by saying that based on the statutory language "Congress did not intend for the Wiretap Act's interception provisions to apply to communication in electronic storage."

The Court does go on to note (several times), however that it appears that modern technology seems to have gutted the Wiretap Act (I'm paraphrasing here).  My personal opinion is that it appears that the Court wanted to rule the other way but was bound by statutory interpretation to rule the way they did.

In other cases I've read the Courts have been pretty strict in their interpretation of the ECPA and laws of that nature so this doesn't really surprise me.  One thing that puzzles me, however is why Interloc's mail server was considered "incidental".  I'd think that the destination mail server would be pretty non-incidental myself (otherwise how is the user going to get their mail?), but maybe that's just me....

-cdh