People stored all sorts of private information with third parties in 1776. They had accountants and bookkeepers and suppliers and vendors, etc.

> Can you call AT&T and ask for someone else's records and get them?

Can you call up Ernst and Young and ask for someone else's accounting records? No, but the government can.

The test isn't "things you wish to stay private." It's "reasonable expectation of privacy." It's an objective test, not a subjective one. And I find it very difficult to understand how anyone could have a "reasonable expectation" of privacy in information generated by a third party for its own use, that's exposed to god knows how many engineers and system administrators.

But if you're going to argue that this objectively means "reasonable expectation that your privacy will be respected in this case" rather than "reasonable expectation that your privacy should be respected in this case" then you have reduced any protection to something meaningless through circular logic. By this kind of argument, anyone can violate your privacy, in any way, for any reason, and it's all OK as long as they make sure you know it's happening.

That's what the reasonable expectation of privacy test has always meant, so its not reducing it at all. Whether its meaningless or not, well, actual actions by government have been found to violate it, so its clearly not a null protection, even if it isn't what you'd prefer.

Obviously I disagree with you and rayiner over how ambiguous that phrase is, but that doesn't really matter. This entire HN discussion is about a call to change the situation, in particular, the current behaviour of the US government and the laws that the US government argues permit such behaviour. Arguing that something is OK because it's what the law currently says doesn't seem to advance that debate in any useful way.

Most of the NSA programs that have been exposed to date are not "clear" violations of the law. They are attempts to operate at the boundaries of the law as currently understood, but they seem to reflect a genuine attempt to stay within those boundaries.

Distinctions that people on Hacker News dismiss because they have a broad-based ideological opposition to surveillance, like "metadata versus data" or "U.S. persons versus foreigners" are in fact the operative markers delineating the bounds of the law.

Merely following the law doesn't turn a bad idea into a good idea, or justify a program, but it does say something about whether people are acting in good faith. What doesn't advance the debate is saying that people in the government must be acting in bad faith because they are "clearly" violating the law, when in fact you just don't understand what the law is.

I think this is where we have slightly different points of view.

In the general situation we're discussing, i.e., state surveillance, the people who make the laws and the people who should be following them are the same, or at least closely related. In that context, to demonstrate good faith, I think you need to make good laws and then follow them.

There is an interesting wrinkle in the US that we don't have here in the UK because the US Constitution is theoretically out of reach of the current government. However, as usual actions speak louder than words, and as an outsider it doesn't appear that having a written constitution is a reliable safeguard any more (on many issues, not just the surveillance one). Again, the people who might be acting unconstitutionally and the people who would judge them are cut from the same cloth.

Because of these inherent conflicts of interest, I don't think that merely following the letter of the law is sufficient to demonstrate (or, equally, demonstrate the lack of) anything very interesting.