A federal court in Ohio has ruled that individuals whose data was stolen by criminals in a data breach have no standing to sue the company that lost control of their data unless they can prove that the criminals actually used the data maliciously. The court reached this conclusion by relying on a Supreme Court ruling over NSA surveillance. The ruling brings into focus the potential unintended consequences of the government's legal strategy on NSA surveillance.

Its no secret that many of the NSA's surveillance programs were started long before their current legal justifications were created. In attempting to defend the legality of these programs, the NSA's defenders have articulated interpretations of the law that draw broad circles around this kind of activity, and the judiciary has upheld these broad interpretations rather that rule against the NSA.

One of the ways that the judiciary has sought to shield the NSA from legal challenges is by arguing that individual citizens do not have standing to challenge the legality of NSA programs unless they can prove that their personal data was accessed inappropriately. This court in Ohio applied that same logic to a different set of circumstances - where the data wasn't held by the NSA, but by a criminal organization. What makes sense in one context ought to apply in other contexts.

This sort of follow on consequence may occur in other ways as well. With respect to the domestic meta-data surveillance program, the NSA's defenders have argued that there are no Fourth Amendment or First Amendment implications, and that the surveillance was authorized by Section 215 of the Patriot Act. If this interpretation is true, than Section 215 of the Patriot Act also authorizes the mass collection of any other kind of business record. Furthermore, if there are absolutely no constitutional implications, than the government can authorize by statute the mass collection of business records for other purposes as well, such as everyday law enforcement. Also, state and local governments can follow suit and operate their own local mass surveillance programs that target their citizens.

The judiciary needs to pay closer attention to these issues in handing down rulings that authorize far more than they intend. For more about the Ohio ruling, click this link: