1

4819-8179-2538.1
Strangers in the Sky: The Cloud, Third-Parties, and the Fourth Amendment
By Justin James
I. Introduction: Behold The Cloud
In the beginning Man created the computer.
1
And the computer was without
Ethernet, and Wi-Fi; and loneliness was upon the face of the operating systems. And
Man said (or maybe Al-Gore), Let there be Internet: and there was Internet. And Man
saw the Internet, that it was good:
2
and Man divided the Internet from the cable. And
Man called the cabled internet Ethernet, and the internet without cable Wi -Fi. And
Man said, Let us make data storage without limits: and let the people store whatever
they want, as much as they want. So Man created the Cloud. And the people could
access the Cloud anywhere. And the government saw the Cloud and behold, it was
very good. For the government now could access the thoughts of the people.
3

This paper discusses the Cloud; how the Fourth Amendment privacy
protections currently apply and will likely apply to the Cloud, including a discussion
of the third-party doctrine; and, finally other statutory protections for Cloud
Computing.

1
For creation of Man see Genesis 1:26-31.

2
Sussannah Fox, Lee Rainie, The Webat 25 in The U.S. (February 27, 2014)
http://www.pewinternet.org/2014/02/27/summary-of-findings-3/ (last accessed March 27, 2014)
(76% of internet users say the internet has been a good thing for society)

3
See Louis Columbus, PRISM Projected to Cost U.S. Cloud Computing Industry $35B, (August
8, 2013) http://www.forbes.com/sites/louiscolumbus/2013/08/08/prism-projected-to-cost-u-s-
cloud-computing-industry-35b/ (last accessed March, 25, 2014); Daniel Castro, How Much Will
Prism Cost the U.S. Cloud Computing Industry? (August 2013), http://www2.itif.org/2013-
cloud-computing-costs.pdf (last accessed 3/25/2014);


2
4819-8179-2538.1

II. The Air up There: What is Cloud Computing?
A precise definition of cloud computing is not easy to pin down.
4
This is due, at
least inpart, to the buzz around the cloud as the latest tech craze.
5
But, in its
simplest formmuch like this papercloud computing is the ability to run
applications, process scripts, and store data on a server over the internet, rather than
on a personal computer.
6
The user accesses this server via a network connection and
views the application or data on his personal computerthink of a web browser based
word processing program like Google Docs or Microsoft Office 365.
Six years ago nearly 69% of online Americans used some form of cloud
computing.
7
Last year, more than half of the U.S. businesses used cloud computing.
8


4
Geoffrey A. Fowler & Ben Worthen, The Internet Industry Is on a Cloud--Whatever That May
Mean, Wall St. J., Mar. 26, 2009, http://online.wsj.com/news/articles/SB123802623665542725,
(last accessed April 27, 2014). (While almost everybody in the tech industry seems to have a
cloud-themed project, few agree on the term's definition.)

5
Id.

6
William Jeremy Robinson, Free at What Cost?: Cloud Computing Privacy Under The Stored
Communications Act, 98 Geo. L.J. 1195, 1199. (2010).

7
John B. Horrigan, Cloud Computing Gains in Currency: Online Americans Increasingly Access
Data and Applications Stored in Cyberspace, Pew Research Center (Sept. 12, 2008),
http://www.pewinternet.org/2008/09/12/use-of-cloud-computing-applications-and-services/ (Last
visited March 18 2014). (Some 69% of online Americans use webmail services, store data
online, or use software programs such as word processing applications whose functionality is
located on the web.)

8
Reuven Cohen, The Cloud Hits Maintstream: More than Half of U.S. Businesses Now Use
Cloud Computing, (April 16, 2013), http://www.forbes.com/sites/reuvencohen/2013/04/16/the-
cloud-hits-the-mainstream-more-than-half-of-u-s-businesses-now-use-cloud-computing/, (last
accessed March 27, 2014).


3
4819-8179-2538.1
And the Cloud is predicted to grow. According to a PEW Research study by 2020 the
cloud will dominate as stored data and cloud based apps continue to grow in
popularity.
9

As our online lives expand privacy concerns begin to rise.
10
After Edward
Snowdens disclosure of the NSAs spying program, American citizens and
companies, both foreign and domestic, are left wondering whether the constitution has
been violated and how the Fourth Amendments privacy rights apply to the Cloud.
11

III. Fourth Amendment Protections for the Cloud Are Still Up In the Air
Whether Fourth Amendment protections exist for the data we store in the Cloud
is not easily answered. While a privacy expectation may pass the reasonable
expectation to privacy test as set forth in United Sates v. Katz,
12
the third-party

9
Pew Research Internet Project, The Future of Apps and Web, (March 23, 2012)
http://www.pewinternet.org/2012/03/23/the-future-of-apps-and-web-2/ (last accessed march 27,
2014).

10
Lee Rainie, Sara Kiesler, Ruogu Kang, and Mary Madden, Anonymity, Privacy, and Security
Online, Pew Research Center (September 5, 2013)
http://www.pewinternet.org/2013/09/05/anonymity-privacy-and-security-online/, (86% of
internet users have taken steps online to remove or mask their digital footprints). (Last visited
March 27, 2014).

11
Chris Paoli, Shattered Trust: IT Survey Shows PRISM Allegation Have Brought Cloud Misgivings, (September, 9,
2013) http://redmondmag.com/articles/2013/10/01/shattered-trust.aspx (last accessed March 27, 2014)

12
389 U.S. 347, 361 (1967) (Harlan, J., concurring) (there is a twofold requirement, first
that a person have exhibited an actual (subjective) expectation of privacy, and
second, that the expectation be one that society is prepared to recognize as
reasonable.

4
4819-8179-2538.1
doctrine further blurs the answer.
13
And the Sixth Circuits opinion in Warshak shed
little light on the question.
14

A. Look to the Lodestar: Katz and a Reasonable Expectation in to Privacy in
the Cloud.
Analysis of the Cloud and the Fourth Amendment begins with the lodestar case
Katz v. United States.
15
In Katz, the United States Supreme Court addressed the
question of whether the defendants Fourth Amendment rights were violated when the
police used an electronic listening device to listen to Katzs phone call made from a
public telephone booth.
16, 17
Up to this point Olmstead v. United States established the
Fourth Amendment jurisprudence and held that the Fourth Amendment only applied
to searches and seizures of physical property.
18
Katz deviated from precedent,
overruled Olmstead, and held that the Fourth Amendment protects people, not
places.
19


13
See Smith v. Maryland 442 U.S. 735 (1979) (Finding privacy expectation in numbers dialed
unreasonable because the telephone company had permissible access to the information).

14
United States v. Warshak, 631 F.3d 266, 285--86 (6th Cir. 2010).
15
389 U.S. 347 (1967)
16
Id at 354.
17
A telephone booth is a small structure which houses a wired telephone. Typically a small glass
cube measuring 3 x 3 x 8, an individual could enter the telephone booth, close a folding door,
and deposit coins in order to make a phone call. The telephone booth is virtually extinct due to
the advent of the cellular phone and mobile computing.

18
Olmstead v. United States, 277 U.S. 438, 46668 (1928).
19
Katz, 389 U.S. at 351-53.

5
4819-8179-2538.1
The Court held that listening to the phone call without a warrant was indeed a
violation of the defendants Fourth Amendment rights because the evesdropping was
an invasion of the defendants expectation of privacy despite the phone booths open
location on a public street.
20
Finally, Katz established the test for determining what
privacy interests are protected in Justice Harlans concurring opinion: there is a
twofold requirement, first that a person have exhibited an actual (subjective)
expectation of privacy [closing the phone booth door], and second, that the
expectation be one that society is prepared to recognize as reasonable.
21

Katz has subsequently been referred to as the lodestar in determining whether
a particular form of government-initiated electronic surveillance is a search within
the meaning of the Fourth Amendment.
22
In short, Katz laid the foundation for
Fourth Amendment protection of electronic communications and gave the touchstone
test for nearly all modern day Fourth Amendment issues involving electronic
information.
Does data on stored on the Cloud pass the Katz test? At first blush it would
appear that the answer to this question is yes. Many individuals in our society who use
cloud services, one would have to assume,
23
have an expectation that their information

20
Id. at 353.
21
Id. at 361 (Harlan, J., concurring).
22
Smith v. Maryland, 442 U.S. 735, 739 (1979).

23
John B. Horrigan, Cloud Computing Gains in Currency: Online Americans Increasingly
Access Data and Applications Stored in Cyberspace, Pew Research Center (Sept. 12, 2008),
http://www.pewinternet.org/2008/09/12/use-of-cloud-computing-applications-and-services/ (Last

6
4819-8179-2538.1
is private and safe. From medical records
24
to lawyers client documents
25
more and
more personally private and confidential information is being stored in the Cloud. But
the answer is not so simple. Despite the doctors and the lawyers belief in the
Clouds security many believe their information is not completely private online.
26

This calls into question whether society is willing to recognize the privacy expectation
in Cloud stored data as reasonable. And the third-party doctrine further clouds the
answer.
B. The Third Party Doctrine and How it Applies to the Cloud
The third-party doctrine states that when persons share information with third
parties there cannot be a reasonable expectation of privacy. Its origins lies with
undercover agents and government informant.
27
In Hoffa v. United States, the

visited March 18 2014). (Some 69% of online Americans use webmail services, store data
online, or use software programs such as word processing applications whose functionality is
located on the web.)

24
AT&T Corp, Medical Imaging in the Cloud (07/10/2012)
http://www.corp.att.com/healthcare/docs/medical_imaging_cloud.pdf (Executive Summary
imploring hospitals to use AT&Ts specialized Cloud service to store medical imaging). (Last
accessed 3/18/2014).

25
Natalie Kelly, Daniel J. Siegel, John W. Silmek, Moving Your Practice to the Cloud Safely
and Ethically, American Bar Association presentation, (January 14, 2013),
http://www.americanbar.org/content/dam/aba/events/cle/2013/01/moving_your_law_practice/co
urse_materials.authcheckdam.pdf, (ABA presentation instructing Lawyers on how to ethically
use the Cloud to store their work product and client documents). (Last visited March 18 2014).

26
Lee Rainie, Sara Kiesler, Ruogu Kang, and Mary Madden, Anonymity, Privacy, and Security
Online, Pew Research Center (September 5, 2013)
http://www.pewinternet.org/2013/09/05/anonymity-privacy-and-security-online/, (59% of
internet users do not believe it is possible to be completely anonymous online). (Last visited
March 18 2014).

27
Orin S. Kerr, The Case for the Third-Party Doctrine, 107 Mich. L. Rev. 561, 567 (2009).

7
4819-8179-2538.1
defendant, Jimmy Hoffa, sought to have his conviction of bribing jurors overturned
because the government used information gained by an informant who had worked his
way into Hoffas inner circle and heard Hoffa describe the bribery.
28
He lost.
29
The
Court held that Hoffas misplaced confidence ... did not implicate Fourth
Amendment rights because the Fourth Amendment does not protect a misplaced belief
that a person to whom one voluntarily confides his wrongdoing will not reveal it.
30

The third-party doctrine began to have its nascent effect on the Fourth Amendment.
The doctrine continued to develop in United States v. White.
31
In this case,
much like Hoffa, the defendant shared inculpatory information with a government
informant and that information was used to win a conviction.
32
The Court, citing
Hoffa, held that the Fourth Amendment does not protect a wrongdoers misplaced
belief that a person to whom he voluntarily confides his wrongdoing will not reveal it
and that a criminal must realize and risk that his companions may be reporting to the
police.
33
The third-party doctrine continued to devlop.
The third-party doctrine hit puberty and then adulthood in the 1970s when it
was applied to business records. First, in Couch v. United States the Internal Revenue

28
385 U.S. 293, 300 (1966).

29
Id. at 305.

30
Id. at 30203.

31
401 U.S. 745 (1971).

32
Id. at 302

33
Id.

8
4819-8179-2538.1
Service subpoenaed Couchs accountant for Couchs tax related documents.
34
The
government searched the records in the accountants possession, and built a successful
case against Couch for understating his gross income.
35
On appeal to the Supreme
Court, Couch argued that the government violated his Fourth Amendment rights when
it engaged in a warrantless search of the records given to his accountant without a
warrant.
36
The Court succinctly held that Couch had no reasonable expectation of
privacy because it was without question that much of the information in those records
would be disclosed by the accountant in the tax return.
37

Three years later the Court expanded the third-party doctrine in United States v.
Miller.
38
Here, Miller had been convicted for several federal crimes relating the
manufacturing of alcohol.
39
The government subpoenaed Millers bank for all
records of accounts for Mitch Miller and his aliases.
40
The Government then used
these records to prove, among other things, that Miller had been evading whiskey
taxes.
41
Relying on Katz, Miller argued that obtaining and using his bank records

34
Couch v. United Stated, 409 U.S. 322, 323.
35
Id. at 32425.
36
Id. at
37
Id. at 335.
38
425 U.S. 435 (1976).
39
Id. at 436.
40
Id. at 43738.
41
Id. at 436.

9
4819-8179-2538.1
without a warrant was a violation of his privacy rights under the Fourth Amendment
because the records were merely copies of personal records that were made available
to the banks for a limited purpose and in which [Miller had] a reasonable expectation
of privacy.
42
The Supreme Court rejected this argument and stated that we perceive
no legitimate expectation of privacy in [the bank records] contents because the
depositor takes the risk, in revealing his affairs to another, that the information will
be conveyed by that person to the Government.
43

Finally, Smith v. Maryland, the pen register case.
44
In this case, a person was
robbed.
45
After the robbery the victim began receiving intimidating phone calls from a
man claiming to be the robber.
46
The police asked the telephone company to install a
pen register to record the numbers dialed from the telephone of a suspects, the
petitioner Michael Smith, home.
47
The register showed that Smith was indeed calling
the victim and the police were able to obtain a search warrant based, in part, on this
evidence.
48
Smith sought to have the fruits of the pen register excluded on the basis
that he had a reasonable expectation that the numbers he was calling were private.
49


42
Id at 422.
43
Id. at 44243.
44
442 U.S. 735 (1979).
45
Id. at 737.
46
Id.
47
Id.
48
Id.

10
4819-8179-2538.1
The Court rejected this argument on the basis that even if there were a
subjective expectation to privacy, this expectation is not one that society is prepared
to recognize as reasonable.
50
One of the explanations that Court gave for society not
recognizing this expectation as reasonable was that [m]ost phone books tell
subscribers, ... , that the company can frequently help in identifying to the authorities
the origin of unwelcome and troublesome calls.
51

These three casesCouch, Miller, and Smith
52
create the foundation of the
third party doctrine and have often been cited to support the notion that the third-party
doctrine applies to a persons electronically stored information.
53
If this notion is true
then documents stored on many of the popular Clouds
54
fall squarely within the
confines of the third-party doctrine. iCloud, Google Drive, OneDrive (formerly
SkyDrive) and Dropbox all have privacy policies that allow the provider to scan the
contents of the data stored on their Cloud Services in order to gather data that could
later be used for advertising to that customer.
55
If this was the end, it would appear

49
Id. at 74143.

50
Id. at 742 citing Katz, 389 U.S. at 361.

51
Id.

52
Sounds like a red-necks trio: a couch, a beer, and a gun.

53
Guest v. Leis, 255 F.3d 325, 335 (6th Cir. 2001) (ruling that there is no Fourth Amendment
protection for subscriber informationnames addresses, birthdates, and passwordsgiven to the
third-party systems operator).
54
Such as iCloud, Google Drive, Dropbox, and Onedrive (formerly SkyDrive).


11
4819-8179-2538.1
that the answer is simple: there is no Fourth Amendment protection, or any protection
for information stored on the Cloud. But, it is never that simple.
C. Exceptions to the Third Party Doctrine and Other Things That Ruined My
Day

Leave it to lawyers to make an otherwise simple doctrine complicated to the
point of incomprehension. At its heart, the third party-doctrine is simple: if you share
information with a third party, you cannot have a reasonable expectation of privacy in
that information. But, as Justice Stewart pointed out in his dissent in Stewart v.
Maryland, if the third-party doctrine was as simple as it sounds, then Katz would be
wrong because the telephone company could have recorded the entire phone
conversations just as easily as it can record the numbers dialed.
56
And, not only did
the telephone company in Katz have the capability to listen to telephone calls, it also
had the right to listen to telephone calls in certain situations.
57
But clearly the third-

55
All of the service providers in note 54 have privacy policies which allow the company to scan
the datas content in order to craft targeted advertisements. This information may also be shared
with other advertising agencies. See Microsofts Privacy Policies (March 23, 2014),
http://privacy.microsoft.com/en-us/fullnotice.mspx#collection; Googles Privacy Policies (March
23, 2014), http://www.google.com/policies/privacy/; DropBoxs Privacy Policies (March 23,
2014), https://www.dropbox.com/privacy.

56
Smith, 442 U.S. at 747
57
See 18 U.S.C. 2511(2)(a)(i) (It shall not be unlawful under this chapter for... a provider of
wire or electronic communication service... to intercept, disclose, or use [a] communication in
the normal course of his employment while engaged in any activity which is a necessary incident
to the rendition of his service or to the protection of the rights or property of the provider of that
service ...) See also Bubis v. United States, 384 F.2d 643, 648 (9th Cir. 1967) (When a
subscriber of a telephone system uses the systems facilities in a manner which reasonably
justifies the telephone companys belief that he is violating his subscription rights, then he must
be deemed to have consented to the companys monitoring of his calls to an extent reasonably
necessary for the companys investigation.)

12
4819-8179-2538.1
party doctrine does not allow the government to listen in to the substance of our phone
calls without a warrant. This was exactly the issue in Ktaz.
58

This also is the case with rented space. We have a privacy expectation to our
hotel rooms,
59
our apartments,
60
and our workspaces
61
despite third parties having
permissible access. Hotel staff enters the locked hotel room every morning to clean.
Our landlords have access to our apartments. And maintenance and cleaning staff
come into our office. Yet, it has never been successfully argued that there is not a
reasonable expectation to privacy because a third-party has access to these spaces.
This leaves the Third-Party doctrine and the Cloud in a state of uncertainty. On the
one hand, a plain language reading of the third-party doctrine would lead one to
believe that there is no Fourth Amendment protection for Cloud computing. But on
the other hand, there are several exceptions to the third-party doctrine, and the Cloud
feels like it lies in one of those exceptions.
This feeling is legitimized in the Sixth Circuits Decision in Warshakperhaps
the most relevant decision to date. In this case, the Sixth Circuit recognized a Fourth
Amendment right to the privacy of ones emails stored with an Internet Service


58
See Katz, 389 U.S. 347

59
United States v. Allen, 106 F.3d 695, 699 (6th Cir.1997); United States v. Young, 573
F.3d 711, 717 (9th Cir. 2009); Hoffa v. United States, 385 U.S. at 301

60
Bivens v. Six Unknown Named Agents of Fed. Bureau of Narcotics, 403 U.S. 388, 390 (1971).

61
O'Connor v. Ortega, 480 U.S. 709, 737 (1987).


13
4819-8179-2538.1
Provider.
62
The defendant, Steve Warshak, was accused of mail and bank fraud for
operating a business that used an often undisclosed auto-ship program in its sale of
penis pillsspecifically Enzyte.
63

In building its case, the government obtained over 27,000 of Warshaks emails
by an administrative subpoena under the Secured Communications Act (SCA).
64

Warshak argued that the governments means to obtain the emails was an
unreasonable search under the Fourth Amendment and should therefore be
suppressed.
65
The Sixth Circuit agreed with Warshak and found that he did have a
subjective expectation of privacy and that it was one that society would recognize as
reasonable.
66
However, Warshaks conviction was not overturned because of the
governments good faith reliance on the SCA.
67
Yet, the Sixth Circuit held, to the
extent that the SCA purports to permit the government to obtain such emails
warrantlessly, the SCA is unconstitutional.
68
In short, the government could no
longer reasonably rely on the SCA to obtain emails without a warrant. The Fourth
Amendment is back!at least in regards to email and within the Sixth Circuit.

62
Warshak, 631 F.3d 266, 28586.

63
Id. at 27881.

64
Id. at 282.

65
Id. at 281.

66
Id. at 274, 284.

67
Id. at 282.

68
Id. at 288.


14
4819-8179-2538.1
But what effect, if any, does Warshak have on Cloud computing? The Courts
reasoning perhaps shines some light on this question. The Sixth Circuit applied the
Katz test to determine that Warshaks privacy expectations in his email was
reasonable.
69
The Sixth Circuit Court applied the same reasoning that Supreme Court
used in Katz. In Katz, the Court based its decision on the vital role that the public
telephone [had] come to play in private communication.
70
The Warshak court
reasoned very similarly:
Since the advent of email, the telephone call and the letter have waned
in importance, and an explosion of Internet-based communication has
taken place. People are now able to send sensitive and intimate
information, instantaneously, to friends, family, and colleagues half a
world away. Lovers exchange sweet nothings, and businessmen swap
ambitious plans, all with the click of a mouse button.
[71]
Commerce has
also taken hold in email. Online purchases are often documented in
email accounts, and email is frequently used to remind patients and
clients of imminent appointments. In short, account is an apt word for
the conglomeration of stored messages that comprises an email account,
as provides an account of its owners life. By obtaining access to
someones email, government agents gain the ability to peer deeply into
his activities.
72


The Sixth Circuits analogy of email to the telephone is clear: it goes without
saying that like the telephone in earlier history, e-mail is an ever-increasing mode of
private communication, and protecting shared communications through this medium is

69
Warshak, 631 F.3d at 284

70
Katz, 389 U.S. at 352.

71
The reference to a mouse may already date this opinion.

72
Warshak, 631 F.3d at 284.


15
4819-8179-2538.1
as important to Fourth Amendment principles today as protecting telephone
conversation has been in the past.
73

But the analogy of a telephone, mail, or e-mail, to the Cloud is not nearly as
clean. In fact, it is hard to draw any analogy. Unlike any of the above communication
methods where the service providerthe telephone company, postal service, or
internet service provideris not the intended recipient of any communications, in the
Cloud the service provide is, in a way, the intended recipient. When you st ore
something in the Cloud, you send that data to the service provider and often, only the
service provider with the intent to access it later.
And yet hope is not lost, as the Warshak court noted: [o]ur conclusion finds
additional support in the application of Fourth Amendment doctrine to rented space.
The Sixth Circuits brief analogy of e-mail to rented space serves as a much better
analogy for the Cloud. If one imagines the Cloud as a rented storage unit or deposit
box, the renter enjoys Fourth Amendment protection of the contents in his storage unit
or safe deposit box despite the owners of the storage building or the bank vault having
access.
74

D. Is This Broad Enough For Ya?

73
Id. at 286.

74
United States v. Johnson, 584 F.3d 995, 1001 (10th Cir. 2009) (People generally have a
reasonable expectation of privacy in a storage unit, because storage units are secure areas that
command a high degree of privacy); United Sates v. First Nat. City Bank, 568 F.2d 853, 858
(2
nd
Cir. 1977) (Search of a safe deposit box is within the scope of the Fourth Amendment);


16
4819-8179-2538.1
Just because the analogy is therethe Cloud is a lot like rented spaceit does
not mean that Cloud computing has Fourth Amendment protections in all
circumstances. As the Warshak Court aptly stated:
[W]e are unwilling to hold that a subscriber agreement will never be
broad enough to snuff out a reasonable expectation of privacy. As the
panel noted in Warshak I, if the ISP expresses an intention to audit,
inspect, and monitor its subscribers emails, that might be enough to
render an expectation of privacy unreasonable.
75


And this is, perhaps, precisely the issue with Cloud Computing: is the service
providers privacy policies or other policies so broad that an expectation of privacy is
unreasonable? As mentioned, Cloud Service Providers typically have privacy policies
that allow them to scan the contents of your data.
76
Googles Google Drive Terms are
perhaps the broadest: when you upload or otherwise submit content to our Services,
you give Google (and those we work with) a worldwide license to use, host, store,
reproduce, modify, create derivative works (....) communicate, publish, publicly
perform, publicly display and distribute such content
77

It is hard to believe that this is not the type of service agreement the Warshak
Court was referring to. Google expressly states it has the right to distribute the
contents of your Google Drive. That is a broadif not obesesubscriber agreement
that leaves little for one to reasonably expect his data is private.

75
Warshak, 631 F.3d at 287.

76
See note 39, above.

77
Googles Privacy Policies (March 23, 2014), http://www.google.com/policies/privacy/
(emphasis added).


17
4819-8179-2538.1
Whats more there are no express protections that your data will be secure. And
Cloud services can be surprisingly, albeit scarily, easy to hack into.
78
If Steve
Wozniaks prophecy is correctthere are going to be a lot of horrible problems in
the next five years as a result of Cloud Computing and giving more control of our
property to Cloud Service Providers
79
then the Cloud cannot be a place that society
recognizes a privacy interest once the notoriety of hackers spreads. At such a point the
analogy of the Cloud to a rented space breaks down. A renter of a storage unit or safe
deposit box is ensured that certain safety precautions will be taken. There are walls,
locks, cameras, and guards. There is limited access. But, when there is no promise of
such precautions,
80
and it is believed that the storage is relatively unsecured, then the
Cloud becomes the equivalent to an open field and there cannot be a reasonable
expectation of privacy to items found in an open field. Therefore there cannot be a
Fourth Amendment protection for an unsecure Cloud.
81


78
Dune Lawrence, How Long Can Cloud Servers Hold Off Hackers? Not as Long as You Think,
(December 19, 2013) http://www.businessweek.com/articles/2013-12-19/how-long-can-cloud-
servers-hold-off-hackers-not-as-long-as-you-think, (CloudPassage, a cloud security company, set
up six servers loaded with various combinations of widely used programs, and had a contest for
hackers to see how long it would take. It took four hours, and the winner was a self-described
amateur, who thought it would be a fun evening to poke around).

79
Seth Feigerman, Steve Wozniak: Cloud Computing Will Cause Horrible Problems In the Next
Five Years, (Aug. 6, 2012) http://www.businessinsider.com/steve-wozniak-cloud-computing-
will-cause-horrible-problems-in-the-next-five-years-2012-8 (Last accessed March 25, 2014).

80
Not all Cloud base services are unsecure. Services such as SecureOak, Tonido and Cubby
offer services very similar to dropbox, iCloud, GoogleDrive, and OneDrive, but will encrypt the
data so that it is secure. These services do not store your encryption password so they cannot
decrypt your data.
81
Oliver v. United States, 466 U.S. 170, 179 (1984). Holding that there is no reasonable
expectation to privacy in an open field.

18
4819-8179-2538.1
And apparently such a notion is already taking hold: 59% of Americans believe
that you can never be completely private online.
82
Whats more, this study was
completed before the public was fully aware of the PRISM surveillance program.
83
As
more and more peopleboth domestic and foreignwise up to the security flaws and
open their eyes to just how unsecure their cloud documents are, at least on U.S. based
cloud servers, more and more consumers are flocking away from U.S. based Cloud
services in favor of Cloud Service Providers where there are security guarantees.
84


E. Conclusion on the Constitutional Protections Afforded to the Cloud
So, where do things correctly stand? Katz gives us the basic test: is there a
subjective expectation to privacy and is that expectation reasonable? Couch, Miller,
and Smith give us the third-party doctrine which states that if you share your
information with a third party, then you cannot have a reasonable expectation of

82
Lee Rainie, Sara Kiesler, Ruogu Kang, and Mary Madden, Anonymity, Privacy, and Security
Online, Pew Research Center (September 5, 2013)
http://www.pewinternet.org/2013/09/05/anonymity-privacy-and-security-online/, (59% of
internet users do not believe it is possible to be completely anonymous online). (Last visited
March 18 2014).

83
PRISM is a mass electronic surveillance program used by the NSA. The program is used to
collect data from several internet sources, including the contents of Cloud stored documents.

84
Daniel Castro, How Much Will Prism Cost the U.S. Cloud Computing Industry? (August
2013), http://www2.itif.org/2013-cloud-computing-costs.pdf (last accessed 3/25/2014), (On the
low end, U.S. cloud computing providers might lose $21.5 billion over the next three years. This
assumes the U.S. eventually loses about 10 percent projected market share for the domestic
market. On the high end, the U.S. cloud computing providers might lose $35.0 billion by 2016.
This assumes the U.S. eventually loses 20 percent of the foreign market ot competitors and
retains its current domestic market share.)


19
4819-8179-2538.1
privacy. But, there are exceptions to this doctrine as the Warshak Court pointed out.
And, although one cannot claim a complete analogy when comparing the Cloud with
telephone or mail, there is a closer analogy to rented space.
Yet, this analogy breaks down for two reasons: first, Cloud Service Providers
Terms of Use are often so broad that there cannot be a reasonable expectation to
privacy (Google can distribute the contents of your files to others); second, the
analogy to rented space breaks down when it comes to security because the Cloud is
relatively unsecured. And, this insecurity gnaws away at societys expectations that
their Cloud stored documents are private to a point that society is no longer willing to
recognize as reasonable the expectation that your Cloud saved documents are private.
And so, like so many other things in the law, the Fourth Amendments
application to the Cloud is unclear. As of this writing no court has addressed this
issue. But, pulling a Steve Wozniak like prophecy, this issue will likely result in a
circuit split as a result of the third-party doctrine. Admittedly this is not much of a
prophecy as it has already started to happen. The Sixth Circuit and the Fifth Circuit
have set the two paths the other Circuits will likely follow.
The Sixth Circuit and its decision in Warshak likely supports a finding that
Cloud stored documents do enjoy Fourth Amendment protections for at least some
Cloud Service ProvidersGoogle Drive and others like it with broad Terms of Use
may never enjoy Fourth Amendment Protections unless they amend their Terms of
Use. The Clouds analogy to rented space supports this notion.

20
4819-8179-2538.1
The Fifth Circuit has its decision in In re U.S. for Historical Cell Site Data and
appears that it would likely find in favor of the government and rule that there is no
Fourth Amendment protections for Cloud stored data.
85
In this case, the Court ruled
that it was not an unreasonable search for the Government to warrantlessly obtain cell
site data from cell phone service providers because it was information shared with and
collected by the provider: to the extent an individual knowingly exposes his activities
to third parties, he surrenders Fourth Amendment protections.
86
A Cloud case would
likely be decided similarly: it is information knowingly shared with and collected by a
third party.
Even in those Circuits that follow the decision in Warshack, there is still a
problem with broad Terms of Use and other security risks. As a result, companies will
likely cure their security risks and amend their Terms of Use so that society can
maintain its expectation to privacy in the Cloud.
Eventually, this issue will make it to the Supreme Court. There, hopefully, the
Justices follow Justice Sotomayors concurrence in U.S. v. Jones as it relates to the
Third-Party Doctrine and we will have yet another exception as it applies to digital
data.
87


85
In re U.S. for Historical Cell Site Data, 724 F.3d 600, 610 (5th Cir. 2013)

86
Id.

87
United States v. Jones, 132 S. Ct. 945, 957 (2012) (The Third-Party Doctrine is ill-suited to
the digital age, in which people reveal a great deal of information about themselves to third
parties in the course of carrying out mundane tasks.)


21
4819-8179-2538.1