[Dylan16807]

I think if you want to get the analogy right you need to have in-transit encryption, so employees can only see the destination of the data, but once it's stored away it should be decryptable. A key part of using the lockbox analogy to explore your rights is by having it still be physically penetrable, but never expected to be penetrated.

Let's look at Dropbox for a moment. If the system is working correctly the employees never have access to the contents of your files. The data flows past the employees in a TLS tunnel that only lets the destination server decrypt it. Employees are kept from accessing the contents via a mechanism similar in effectiveness to locks. Should this data be protected? I think it should.

Now let's move on to Email. Most of the time, with modern server configurations, it works in a very similar way. The messages are encrypted in transit, stored in plain text, and employees are kept out. Ignoring that obsolete rule about email 'abandonment' after a certain number of days, I see no reason email shouldn't need a warrant.

It comes down in part to how the data is stored in the first place. Why do you say that my email is 'unprotected'? Are there not locks on it, barriers keeping away employees in the typical case? What makes it less secure than a box with a lock that can be broken with a hammer?

[rayiner]

I think there is a big difference between a safe deposit box, where a bank employee would have to break the law and break a lock to access the contents of an account, and something like a gmail account where there are numerous employees authorized to access the contents of the accounts (see the recent story about the Google employee that stalked teenagers), and where the "bank" scans through the contents of the accounts in the regular course of business (to target ads). A bank typically has no idea what you store in a safe deposit box. Google and Facebook know exactly what you store in your accounts with them, and their business model depends on their knowing the contents of your supposedly "private" accounts.