Metadata is Public Data? Revisiting Smith v. Maryland
The result of Edward Snowden's leak of materials detailing data collection activities of the NSA has resulted in much uncertainty and concern for privacy. What is certain, is that the surveillance activities of the NSA are unconstitutional by the standards in which data is communicated in present day. Many have pointed to the Supreme Court case, Smith v. Maryland in creating an interpretation of the Fourth Amendment that is certainly not in line with the Founders' intentions had they knowledge of the technologies in use today.
This case holds, in a nutshell, that metadata is not entitled to a reasonable expectation of privacy. The SCOTUS decision was that a pen register, an instrument installed at a telephone exchange that records the the numbers dialed by customers, could be searched by law enforcement authorities without a warrant. This decision was made on the basis that "petitioner voluntarily conveyed numerical information to the telephone company." The numbers he dialed were not considered to have a reasonable expectation of privacy. In 1979 when the case was decided, wouldn't the American people still consider that an unreasonable invasion of privacy? Today, it is even more so. Effectively, this decision makes collection of metadata, phone records (which often include location information), URLs, and other data used for the purpose of describing the data it contains (its format, size, destination, author, etc.), legal without a court warrant.
Are the subject and "To" lines of your emails private? Are the websites you visit private? The fact that you have to provide a URL to properly retrieve the information you wish to retrieve does surrender your right to keeping that information free from government intrusion. The FBI has to have a warrant to search your browsing history on your computer, why shouldn't the FBI be required to have a warrant to search it in your ISP's routing logs?
Not only does this decision create a dangerous intrusion of privacy, it can disrupt business activities. Many APIs require a "key," like a password, to be in the URL of requests made. Should the NSA have access to your passwords?
Although we cannot affect an immediate change, you can take steps to protect yourself from undue surveillance. To protect your web browsing activities, you can use Tor, a proxy that reroutes your request through a network of computers. Information sent through the Tor Network is encrypted as to prevent snooping by intermediaries, and it is nearly impossible to determine who accessed what through the Tor Network.
Email communications can also be encrypted through a free, open-source technology known as OpenPGP. A simple Google search will reveal information that can help you to set it up. You can make calls through VoIP technologies, such as Viber, which is free on iPhone, Android, and Blackberry. Viber collects the some of the same type of call data records that telephone service providers collect, but it is much less likely that it will be collected en masse by government agencies. Their privacy policy states that they do not record calls, and it is very unlikely that it will be recorded. I am actually creating an alternative to Viber that uses public key encryption and does not keep logs, enabling no government collection of data, and complete security as to the contents of your call.
If you are concerned about your data being physically compromised, you may want to use TrueCrypt, a free piece of software that can help you create encrypted drives. You can store sensitive information inside these drives without fear of it being compromised. A warrant must be issued to search these drives, and this warrant can only be issued if incriminating evidence is believed to be on there. Additionally, you cannot be compelled to turn over the decryption keys unless there is evidence that incriminating evidence is on the encrypted drive. It is also possible to create a special encrypted drive inside the encrypted drive (please do not say driveception) that cannot be detected, even if you are forced to give over the keys for the initial encrypted drive, giving you deniability.