Time
7 hours 36 minutes
Difficulty
Advanced
CEU/CPE
7

Video Description

This lesson covers the expectation of privacy which is essentially a two-step process. Also covered in this unit is: · Expectation/consent · Issues with infrastructure

Video Transcription

00:04
so to continue with their discussion of the Fourth Amendment, it's important to understand what the expectation of privacy is so with the expectation of privacy is essentially a two step process,
00:18
and the first step of that process is to have standing to claim protection. Under the Fourth Amendment,
00:24
a person must first demonstrate that they haven't expectation privacy.
00:29
And that expectation is not merely a subjective expectation,
00:34
but expectation. Society is prepared to recognize is reasonable under the circumstances. So first you have to demonstrate that you expect to have privacy, and then you have to demonstrate that is obviously a reason. So that's that two step process. So
00:51
if I'm outside in plain view of everyone,
00:54
there's trees and birds cars, buying people walking by. My expectation of privacy is obviously very low,
01:04
however, on the opposite end of the spectrum, if I'm in my own house, if I've got my door locked, if I've got my window shades down and I've taken those reasonable steps to ensure that I'm pretty much not being able to be seen or hurt,
01:23
I do have that expectation.
01:25
Privacy is this. Most people will recognize that I've taken those steps
01:30
and that I've demonstrated that that I should have that expectation of privacy because I've taken certain measures
01:38
now. That being said, the government could limit the reasonable expectation of privacy, and the Supreme Court has kind of looked at a few different cases. A ce faras the government limiting that expectation in one of those cases is Connor Connor, Be Ortega.
01:57
Now, in this case, it mainly applies to government boys, where it says that the government
02:05
or government poise might actually not have expectation to privacy in their workplaces. By virtue of working for the government, they tacitly or explicitly give up certain rights as part of your employment agreement with the government.
02:23
Now that being said,
02:24
it's not a blanket waiver for the government to go in and search through everyone's personal possessions at work or through their desk. There have been some exceptions to conserve your take as well, Whereas there was a police officer who had a locker in the locker room of
02:45
of the bathroom
02:46
police station,
02:47
and he also had his own personal walk
02:51
on the locker, and having that personal lock didn't necessarily violate department policy
02:57
on is there was no part of ceiling on having your own personal lock as well as there was a a government unblock on the locker. But having that private lock on that locker actually demonstrated that the person didn't have that expectation of privacy, and people thought that was a pretty reasonable
03:16
expectations where he met that two step process.
03:20
So, basically, you just want to be cognizant that there can be limitations to your expectation of privacy.
03:28
Also, with those limitations, there are caviar. So again,
03:32
it's very important to consult legal counsel. That being said,
03:39
if no reasonable expectation of privacy exists, obviously no warrants gonna be required against. So if I'm outside in open spaces plain view, there would be no warrant required. Thio conduct that search. But when in doubt, it's very important that you see
03:58
legal a bias because you don't want to end up violating
04:00
someone's rights.
04:04
So when we go into the exception of search warrant requirement,
04:10
one of the first things that we're gonna come across is consent,
04:14
so consent could be obtained in a variety of methods and ways. One of the first methods of consent is a user agreement, So if I'm going to use a certain space. If I'm going to use a computer,
04:30
uh, I'm going to be somewhere.
04:33
I either implicitly agreed to be there because I see a sign and I show up and I'm still there. I sign a physical agreement stating that that I do agree to have someone
04:47
search me or are subject to search.
04:50
Also, we have acceptable use policies
04:54
s o if I'm going to be using something
04:58
such as a device. I've generally signed some type of documents saying how I'm going to use the device and then I might be subject to search my important direction.
05:12
We also have security policies, conditions of employment. So obviously talked about government boys. I have a security clearance or I'm working in some type of facility on I'm coming in and out of that facility. Part of my condition of employment is that I agree to be searched
05:29
either coming in or out of a facility at random
05:32
on another type of of expectation
05:36
or exception. Thio. The expectation of privacy is going to be banners. So a lot of organizations, especially the federal government, will have a banner that pops up on your computer screen. That says that
05:50
the activities that are on our conducted on that computer are subject to search.
05:58
So those are just a few exceptions to the search warrant requirement of the ball under the consent category.
06:06
So some other considerations
06:10
that you may want to consider our issues to deal with your computer infrastructure computer network.
06:16
So a lot of organizations have gone to what they call bring your own device will be wild D
06:23
so B Y o d is great. It's pretty convenient that allows individuals to be connected at worker at home, allows them to use a single device that they paid for that they're comfortable with
06:34
might actually increase productivity.
06:38
I could work home in the office. I have access to the same data and same systems
06:45
then that it might actually make me more productive.
06:48
However, with that being said, bringing your own device is inherently insecure.
06:55
Uh, you don't have some type of managed system,
06:59
uh,
07:00
ensure that individual are updating the system is necessary, that they have antivirus installed on their computer systems
07:09
that they're not accessing Web sites. They shouldn't be that they're not uploading your data to places that you don't want to upload, uploaded, bring your own device or lying ploys to do that is actually quite dangerous.
07:24
And then the question arises.
07:26
In the event that you do suffer a data breach are that there is some incident involving that device. Do you have the legal authority to inspect your conference Kate Personally device. So that's going to go back to your policies and procedures and what type of agreements that you've Sutton
07:46
place
07:46
with your poise
07:50
but as a whole is a private entity that is not under control operated by the government.
07:58
Generally, you'll be safe most of the time to start investigating and collecting evidence, because in most cases a corporation are private. Entity is going to own all the infrastructure that they have,
08:16
and because they own that infrastructure they essentially
08:20
are. The can provide that consent to search their own stuff. So in the majority of cases where you're going to be investigating these incidents, the Fourth Amendment
08:31
search warrant certain seizure requirements more than likely will not come into play. But again, it's a very important consideration when you start bringing in that law enforcement organization and working with them to collect that data because in some point in time you may actually become agents of the government.
08:52
So again, it's important to you
08:54
seek legal counsel advice. And then also, if you work for the government, are you are a government agent than the Fourth Amendment applies to you 100% of the time. So you
09:07
obviously to follow those of search more requirements.

Up Next

Incident Response and Advanced Forensics

In this course, you will gain an introduction to Incident Response, learn how to develop three important protection plans, perform advanced forensics on the incident, deep dive into insider and malware threats, and commence incident recovery.

Instructed By

Instructor Profile Image
Max Alexander
VP, Cybersecurity Incident Response Planning at JPMorgan
Instructor