INVITATION TO CYBERSECURITY 270 Satisfied that she had done all that she had been asked to do, and likely a bit more, Alice stopped there and turned over her treasure trove of data to her boss, who dutifully handed it off to the police... Because the Fourth Amendment was written in 1791, it does not explicitly address the privacy of digital information such as information on computers and smartphones, in emails, and posted on social media websites. However, the courts have found that information, even if not written on a physical object like a piece of paper, is protected, and this includes digital information. The judiciary has developed guidelines to determine when and whether the Fourth Amendment applies, the most important of which is the test of a reasonable expectation of privacy. The determination of whether a reasonable expectation of privacy exists is the crucial factor in deciding whether a citizen’s rights have been violated by a search and seizure. A two-pronged test is typically applied: Did the individual exhibit an expectation of privacy? Would society recognize that his expectation of privacy was reasonable? Some scenarios where an expectation of privacy is debatable include work email, cell phone calls, cell phone call metadata, cell phone location data, personal email written from work, personal files stored on a work computer, web browsing history, and posts to social media. In offices and at universities, digital and physical banners and labels are sometimes used to try to dispel any notion of an expectation of privacy. They typically state something like, “All uses of this system and all data may be intercepted, monitored, recorded, copied, audited, inspected, and disclosed to authorized sites and law enforcement personnel.” The third-party doctrine helps to determine if a person had a reasonable expectation of privacy. It states that when a person shares information with another party, then he surrenders his expectation of privacy concerning that information. The third party could turn it over to the government without violating any Fourth Amendment rights. The third-party doctrine applies in the digital age in a significant way because almost all information shared electronically is technically shared with a third party service provider. This is so problematic that the Electronic Communications Privacy Act (ECPA) specifically addresses the rights and responsibilities of electronic communication service providers regarding the handling of digital information (see next section for more details). In the story above, all of Charlie’s information collected by Alice was shared with the university in one form or another (i.e., the university was a third party). But that does not automatically mean that the courts would find that Charlie did not have a reasonable expectation of privacy. If we assume that there were no digital banners, labels, or notices posted around the university explicitly stating that no expectation of privacy existed and that no contract or agreement signed by Charlie included any clauses referencing the privacy of his information, then Charlie may have had a reasonable expectation of privacy.
RkJQdWJsaXNoZXIy MTM4ODY=