Part 2 - Expectation of Privacy

Video Activity

This lesson covers the expectation of privacy which is essentially a two-step process. Also covered in this unit is: · Expectation/consent · Issues with infrastructure

Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or

Already have an account? Sign In »

Time
7 hours 56 minutes
Difficulty
Advanced
CEU/CPE
7
Video Description

This lesson covers the expectation of privacy which is essentially a two-step process. Also covered in this unit is: · Expectation/consent · Issues with infrastructure

Video Transcription
00:03
>> To continue with our discussion
00:03
>> of the Fourth Amendment,
00:03
>> it's important to understand
00:03
what the expectation of privacy is.
00:03
With the expectation of privacy,
00:03
it's essentially a two-step process.
00:03
The first step of that process is to have
00:03
standing to claim protection
00:03
>> under the Fourth Amendment,
00:03
>> a person must first
00:03
demonstrate that they have an expectation of
00:03
privacy and that that expectation is
00:03
not merely a subjective expectation,
00:03
but an expectation that society is prepared to
00:03
recognize as reasonable under the circumstances.
00:03
First, you have to demonstrate that you expect to have
00:03
privacy and then you have to
00:03
demonstrate that that is obviously reasonable.
00:03
That's that two-step process.
00:03
If I'm outside in plain view of everyone,
00:03
there's trees and birds and cars,
00:03
people walking by,
00:03
my expectation of privacy is obviously very low.
00:03
However, on the opposite end of that spectrum,
00:03
if I'm in my own house,
00:03
if I've got my door locked,
00:03
if I've got my window shades down,
00:03
and I've taken those reasonable steps to ensure
00:03
that I'm pretty much not
00:03
>> being able to be seen or heard,
00:03
>> I do have that expectation of
00:03
privacy as most people will recognize that
00:03
I've taken those steps and that
00:03
I've demonstrated that I should
00:03
have that expectation of
00:03
privacy because I've taken certain measures.
00:03
Now, that being said,
00:03
the government can limit
00:03
the reasonable expectation of
00:03
privacy and the Supreme Court
00:03
has looked at a few different cases as far
00:03
as the government limiting that expectation.
00:03
One of those cases is O'Connor v Ortega.
00:03
Now, in this case,
00:03
it mainly applies to government employees,
00:03
where it says that government employees might
00:03
actually not have an expectation
00:03
to privacy in their workplaces.
00:03
By virtue of working for the government,
00:03
they tacitly or explicitly give up
00:03
certain rights as part of
00:03
your employment agreement with the government.
00:03
Now, that being said,
00:03
it's not a blanket waiver
00:03
for the government to go in and search through
00:03
every one's personal possessions
00:03
or go through their desk.
00:03
There have been some exceptions
00:03
to O'Connor v Ortega as well,
00:03
whereas there was a police officer
00:03
who had a locker in the locker room of
00:03
the bathroom of a police station and he
00:03
also had his own personal lock on the locker.
00:03
Having that personal lock did necessarily violate
00:03
departmental policy as there was
00:03
no policy on having your own personal lock,
00:03
as well as there was
00:03
a government-owned lock on the locker.
00:03
But having that private lock on
00:03
that locker actually demonstrated that
00:03
the person did have that expectation of privacy
00:03
and people thought that was
00:03
a pretty reasonable expectation,
00:03
so he'd met that two-step process.
00:03
Basically, you just want to be cognizant that there can
00:03
be limitations to your expectation of privacy,
00:03
but also with those limitations, there are caveats.
00:03
Again, it's very important to consult legal counsel.
00:03
That being said, if
00:03
no reasonable expectation of privacy exist,
00:03
obviously no warrant is going to be required.
00:03
Again, if I'm outside in open spaces,
00:03
plain view, there would be
00:03
no warrant required to conduct that search.
00:03
But when in doubt,
00:03
it's very important that you
00:03
seek legal advice because you
00:03
don't want to end up violating someone's rights.
00:03
When we go into
00:03
the exception of the search warrant requirement,
00:03
one of the first things that we're going to
00:03
come across is consent.
00:03
Consent can be obtained in a
00:03
>> variety of methods and ways.
00:03
>> One of the first methods of
00:03
>> consent is a user agreement.
00:03
>> If I'm going to use a certain space,
00:03
if I'm going to use a computer,
00:03
if I'm going to be somewhere,
00:03
I either implicitly agree to
00:03
be there because I see a sign and I show up and
00:03
I'm still there or I sign
00:03
a physical agreement stating that I do
00:03
agree to have someone search
00:03
>> me or I'm subject to search.
00:03
>> Also, we have acceptable use policies.
00:03
So if I'm going to be using something such as a device,
00:03
I just generally sign some documents
00:03
saying how I'm going to use the device and
00:03
then I might be subject to
00:03
search at my employer's direction.
00:03
We also have security policies,
00:03
>> conditions of employment.
00:03
>> Obviously we've talked about government employees.
00:03
If I have a security clearance
00:03
or I'm working in some type of
00:03
facility and I'm coming in and out of that facility,
00:03
part of my condition of
00:03
>> employment is that I agree to be
00:03
>> searched either coming in or
00:03
>> out that facility at random.
00:03
>> Then another type of expectation or
00:03
exception to the expectation
00:03
of privacy is going to be banners.
00:03
A lot of organizations,
00:03
especially the federal government,
00:03
will have a banner that pops up
00:03
on your computer screen that says
00:03
that the activities that
00:03
are conducted on that computer are subject to search.
00:03
Those are just a few exceptions
00:03
to the search warrant requirement
00:03
that fall under the consent category.
00:03
Some other considerations that you may want to consider
00:03
are issues to deal with
00:03
your computer infrastructure and your computer network.
00:03
A lot of organizations have gone to what they
00:03
call Bring Your Own Device or BYOD.
00:03
BYOD is great, it's pretty convenient.
00:03
It allows individuals to be
00:03
>> connected at work or at home,
00:03
>> allows them to use a single device
00:03
that they've paid for and
00:03
>> that they're comfortable with,
00:03
>> it might actually increase productivity.
00:03
I could work from home I could work in the office,
00:03
I have access to the same data and the same systems,
00:03
then it might actually make me more productive.
00:03
However, with that being said,
00:03
bringing your own device is inherently insecure.
00:03
If you don't have some type of managed system
00:03
to ensure that individual updating
00:03
of the system is necessary,
00:03
that they have antivirus
00:03
installed on their computer systems,
00:03
that they're not accessing websites,
00:03
that they shouldn't be or that they are not uploading
00:03
your data to places that you don't want it uploaded,
00:03
bringing your own device or allowing employees to do
00:03
that is actually quite dangerous.
00:03
Then the question arises
00:03
that in the event that you do suffer
00:03
a data breach or that there's
00:03
some incident involving that device,
00:03
do you have the legal authority to
00:03
inspect or confiscate a personally-owned device?
00:03
That's going to go back to your policies
00:03
and procedures and
00:03
what type of agreements that you've set in
00:03
place with your employees.
00:03
But as a whole,
00:03
as a private entity that is not owned or
00:03
controlled or operated by the government, generally,
00:03
you'll be safe most of the time to start investigating
00:03
and collecting evidence because in most cases,
00:03
a corporation or a private entity is going to
00:03
own all the infrastructure that they have,
00:03
and because they own that infrastructure,
00:03
they essentially can't provide
00:03
that consent to search their own stuff.
00:03
In the majority of cases where you're
00:03
going to be investigating these incidents,
00:03
the Fourth Amendment search warrant and
00:03
seizure requirements more than
00:03
likely will not come into play.
00:03
But again, it's a very important consideration
00:03
when you start bringing in
00:03
that law enforcement organization and working with
00:03
them to collect that data
00:03
>> because at some point in time,
00:03
>> you may actually become agents of the government,
00:03
so again it's important to seek legal counsel advice.
00:03
Then if you work
00:03
for the government or you are a government agent,
00:03
then the Fourth Amendment
00:03
applies to you 100 percent of the time,
00:03
so you obviously have
00:03
to follow those search warrant requirements.
Up Next