The Fourth Amendment in the Bill of Rights protects against unreasonable searches and seizures and is a vital part of the United States Constitution. As data stored in the cloud continues to proliferate, the debate on how this law relates to the security of this data will become increasingly important.
Recently, a very in depth analysis on this topic was released in the 6/2009 edition of the Minnesota Law Review titled, "Defogging the Cloud: Applying Fourth Amendment Principles to Evolving Privacy Expectations in Cloud Computing." The article discusses how the fourth amendment relates to data stored in the cloud. The article was written by David Couillard, who is in his final year at Minnesota Law School.
The Law Review article was brought to my attention by James Urquhart, who writes on cloud computing for CNET.com. Urquhart breaks down the law review article and provides a clear path for how the law should treat data stored in the clouds in an article titled "Does the Fourth Amendment Cover the 'Cloud'"?
Urquhart sums up the discussion very nicely and lays a solid framework as to how this issue could be approached:
"Coulliard wraps up with a suggested framework for applying the Fourth Amendment to "the cloud" that is very much in line with my own thinking. Treat digital assets on third-party sites not as transactions (like phone numbers dialed), but in the same way you would treat physical assets kept in an apartment or storage locker:
'[T]he service provider has a copy of the keys to a user's cloud "storage unit," much like a landlord or storage locker owner has keys to a tenant's space, a bank has the keys to a safe deposit box, and a postal carrier has the keys to a mailbox. Yet that does not give law enforcement the authority to use those third parties as a means to enter a private space.
The same rationale should apply to the cloud. In some circumstances, such as search engine queries, the third party is clearly an interested party to the communication. But when content data, passwords, or URLs are maintained by a service provider in a relationship more akin to that of landlord-tenant, such as private Google accounts, any such data that the provider is not directly interested in should not be understood to be open to search via consent or a waiver of Fourth Amendment protection.'
Amen, Mr. Coulliard. Personally, I hope the courts note this framework, and begin applying it to Fourth Amendment cases arising from Internet-based computing immediately. Furthermore, I call for Congress to explicitly codify a similar framework with laws that clearly and unequivocally state the rights of users with respect to their data in the cloud."
I would recommend reading the entire Urquhart article to fully understand the implications and possible approaches to addressing the issue of cloud data and the fourth amendment.
# # #
