3

I was thinking of ideas for software projects to work on, and the one I thought to try brought an interesting legal question to mind. The idea was to create a collection of tools, such as a browser, file storage, email, and other similar services via a web interface. Acting similar to a remote computer. The idea is for the platform to minimise data collected and disclosed, to provide users with desired privacy. As a privacy concerned minor, I already go to extraordinary lengths to ensure my privacy, even in situations where I may not have any legal basis (such as against legal guardians on personal devices).

If I were to run this platform, what legal requirements would I be faced with in regards to disclosing personal information, if the account owner is a minor. To be more specific, what information, if any, am I required to disclose to a parent or guardian of the account holder without the account holder's explicit permission? Legally, would I be required to disclose information such as the content of files stored on the service, the browsing history of the user, or the communications the user had with other users and the contents of the aforementioned communication. Would I be required to possibly even grant access to the minor's account at request of a parent or guardian.

An added complexity to the legal questionability of mandatory releasing of minor's data to parents or guardians, what provisions apply if I (the service provider) am unable to provide access to such data. For example, if the platform (as I intend to) stores the data in encrypted mediums, that is unrecoverable by the platform. In this case, many mandatory release of minor data, if legally required, would be invalid since I would no longer be capable of disclosure.

This is excluding cases such as those that are similar to HIPPA Privacy Rules. For example, releasing data in case of imminent threat to their person or others. This is in regard to the case of a parent or guardian contacting the platform requesting access to the account holders data for unspecified reasons. At this point, would I have to disclose anything? Do I have to keep the account? Would I (the service) legally be able to close the account, if the account holder had retroactively requested account termination in attempt of unauthorised access.

Background

Some background on why I ask. As I said I am a minor, and I've very privacy concerned. I encrypted everything I save with a very long and complex password that only I know, change constantly, and never transcribe to clear-text medium. I talk to people and read about stories, how their parents would violate basic levels of privacy that should be expected, things like reading journals. That's why I ask if there are any legal requirements that I, if I were to deploy a platform such as this, to the guardians. I don't believe they have any right whatsoever to the content stored in a platform like this, since everyone deserves the right to privacy. However, legally, I wanted to know what I would be mandated to do.

2
  • Aside: frequently changing a long and complex password probably does not increase your security - but that is an issue for the information security stack. Aug 23, 2019 at 14:36
  • Haha, yah, it was mostly just a side comment for background. It doesn't increase security on it's own, no. I do it for accidental disclosure of my password. In case somebody gained access to my password. At most I change it once a week, and least once every few months. Haha. Aug 23, 2019 at 14:39

1 Answer 1

2

What rights the guardians would have to compel disclosure will vary by jurisdiction -- in the US I believe this would be a matter of state law. But in at least some states I think the guardians could legally compel the site to disclose such data, if it were able to.

And it is very clear that law enforcement can compel such disclosure if a warrant has been issued. In some cases law enforcement may be able to compel disclosure even without a warrant, if there is good cause and exigent circumstances.

A third party who is engaged in legal action against the person who saved the information might be able to obtain a subpoena compelling the service to disclose at least some information. That would depend on the nature of the legal action, how documents stored on the service are or might be relevant, and the opinion of the judge of the case.

Of course if the information is encrypted and the service cannot recover it, it cannot be compelled to do so. It is unsettled when a party providing encryption software must comply with a demand to help breach the encryption. But then presumably the user must have the access key, and many users will not be able to retain it without writing it down, or will not choose good keys.


I encrypted everything I save with a very long and complex password that only I know, change constantly, and never transcribe to clear-text medium.

This may not actually be the best technique. Note that the strength of the encryption system is at least as important as the complexity of the password. Note that if you ever view the content, you are transcribing to clear-text, at least in memory, and the OS may write a copy to storage if virtual memory is enabled, as it normally is. Note that each time you change a password, the content must be decrypted and then re-encrypted, and there is a risk that the temporary clear-text version which will normally exist during the process may be stored without your knowledge.

6
  • Yes, this pertains to laws in the United States of America. I wasn't sure what jurisdiction would apply because of the complexities of the internet. The account owner and guardian may reside in, for example, Florida, while my server may be ran and managed from Seattle. Aug 23, 2019 at 3:52
  • For your remark of my passwords. Yes, I know. I utilise various encryption tools, using full disk encryption on TAILS via a LUKS container, and encrypt individual items within this disk using myracrypt if the file is particularly sensitive. My passwords are at minimum twenty characters of completely random characters in various cases, symbols, and numbers. TAILS doesn't use disk, except the encrypted partition, and WiFi is disabled when I'm using it. I do this on a monthly basis. Just in case somebody discovered my password somehow. Aug 23, 2019 at 3:55
  • Last comment. In regards to disclosure, as stated, I was talking in cases in which there is no criminal nor involvement from government agency. I mean if a mother emailed me saying something like "My son uses your platform to write a journal, and I want to know what it says. I demand you give me access to hit account" am I in a position where I am legally mandated to comply, or is it to my discretion. The encryption was an after-thought. The question was mostly phrased to "if I could disclose this information, do I have to?" Aug 23, 2019 at 3:58
  • @EthanManzi If your passwords are genuinely random, don't forget you would get more security from a 30-character lowercase-only password. Aug 23, 2019 at 14:39
  • 1
    @User65535 Wrong way up. 62^20 < 10^36, 26^30 > 10^42 so more than a million times better or 20 bits more security. To verify, eight bits (each either 0 or 1) has 2^8, not 8^2 possible values. Mar 3, 2022 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .