The digital
safe deposit box.
If a machine can work with your secrets without exposing them to its operator, what exactly have you disclosed?
CASE LAWCONFIDENTIAL COMPUTINGSAFEBOXThe cloud is a location. Disclosure is a relationship.
Suppose you rent a safe deposit box, place private instructions inside it, and retain the means to unlock it. You have entrusted the bank with physical custody. You have not thereby invited its employees to read your instructions. Now replace the box with a confidential-computing environment: an isolated machine that can execute your instructions while restricting the hosting operator’s access to their contents.
The interesting question is not simply who owns the processor. It is what the infrastructure provider actually receives, what it can access, what authority it has, and what you have authorized it to do. A rented computer can serve as your instrument without turning every private computation into someone else’s ordinary business record.
Delegating computation need not mean surrendering confidentiality. A system that enforces this distinction can strengthen the factual basis for a privacy claim—and reduce the readable information available from an intermediary.
This is a legal argument supported by analogies and existing privacy decisions. It is not a judicially recognized “Safenet exception,” and encryption does not place people or machines outside legal process.
What the third-party doctrine actually says
In United States v. Miller, 425 U.S. 435 (1976), the Supreme Court rejected a depositor’s Fourth Amendment challenge to government acquisition of bank records. The records concerned transactions exposed to the bank in its business. In Smith v. Maryland, 442 U.S. 735 (1979), it held that installing a pen register to capture dialed telephone numbers was not a Fourth Amendment search. The Court distinguished those numbers from conversation contents.
Neither decision establishes a universal rule that information loses protection whenever it touches rented hardware. They address particular records and relationships. Nor does the doctrine entitle the public to demand private information. It concerns constitutional limits on government acquisition; statutes, contracts, confidentiality duties, and other rules remain separate questions.
A pen register captures specified signaling or routing information, not communication contents. The statutory definition in 18 U.S.C. § 3127(3) expressly excludes contents. A transcript does not become metadata merely because software labels it a register.
| Question | What determines the answer? |
|---|---|
| Is government acquisition a search? | Fourth Amendment doctrine, the information, and the circumstances. |
| What process may obtain a provider’s records? | The applicable statute, record category, and constitutional requirements. |
| Can the provider produce readable contents? | Keys, access rights, system design, and actual technical capability. |
| May a bot capture a conversation? | Interception law, consent, parties, jurisdiction, and context. |
These questions interact, but an answer to one does not decide all the others.
Carpenter: third-party custody is not the end of the inquiry
In Carpenter v. United States, 585 U.S. 296 (2018), the government obtained historical cell-site location records from wireless carriers. The Court held that acquiring the records was a search and generally required a warrant supported by probable cause.
The reasoning addressed the revealing nature of the records and the practical realities of cellphone use. Detailed historical tracking differed from the limited records at issue in Smith and Miller. The Court declined to mechanically extend their reasoning to this setting.
Carpenter expressly presented its decision as narrow. It did not eliminate the third-party doctrine, decide every metadata question, or establish that all information required for modern life is protected identically. Its importance here is methodological: courts examine the relationship and the information rather than treating a provider’s possession as conclusive.
The 2026 decision: what Chatrie holds
On June 29, 2026, the Supreme Court decided Chatrie v. United States, No. 25-112. Investigators had used a geofence warrant to obtain Google Location History information connected to a credit-union robbery. The process began with location records for devices near the crime scene and narrowed toward identified users.
The Court held that police conducted a Fourth Amendment search when they acquired Chatrie’s location information from Google. Building on Carpenter, the majority rejected the argument that using Google’s Location History service necessarily surrendered the relevant privacy interest. The short period of information obtained did not remove constitutional protection.
The decision also explains why remote storage need not change a user’s understanding of information as personal. Its discussion compares Location History with private materials such as documents, photographs, emails, and calendars. That reasoning is relevant to the broader question of whether using remote infrastructure should automatically defeat privacy.
The Court left the warrant’s reasonableness—including probable cause and particularity at each stage—for the Court of Appeals. It did not invalidate every geofence warrant, decide confidential computing, or hold that autonomous software is legally an extension of its user’s computer.
The case therefore supports resistance to simplistic claims of voluntary disclosure. Extending that reasoning to encrypted agent networks requires an additional argument about their facts. Read the official opinion and Supreme Court docket, including the separate opinions, for the scope of the dispute.
The FBI vault raid: control of the building is not control of every box
In Snitko v. United States, 90 F.4th 1250 (9th Cir. 2024), the Ninth Circuit reviewed the FBI’s search of customer safe deposit boxes at U.S. Private Vaults. The warrant targeted the business and expressly restricted criminal searches of individual box contents. Agents nonetheless examined contents under an asserted inventory rationale.
The court rejected the inventory justification and held that the searches exceeded the warrant’s limits. It reversed and remanded for sequestration or destruction of the relevant inventory-search records. Its discussion warned against the breadth of general searches resembling historical writs of assistance.
This is a useful analogy for shared computing: authority concerning a facility or its operator does not automatically authorize unrestricted searching of every customer’s protected material. But Snitko concerned warrant scope and inventory searches. It did not create an encryption rule, decide the third-party status of cloud workloads, or categorically prohibit lawful searches of rented containers.
The analogy is about the separation between custody of infrastructure and access to its contents. Its force does not depend on imagining that a physical bank vault is impossible to open.
Safebox: making confidentiality part of the system
The Safebox architecture page describes attested compute, sandboxed workflows, policy-controlled outputs, signed audit records, and split credential handling between Requester and Executor boxes. Its public Infrastructure repository provides a verification route for the boundary layer; the page identifies the application layer as closed.
For the legal argument, the important proposition is limited operator access. The documentation describes an intended design; this article does not independently certify its implementation or deployed guarantees.
Its access to plaintext must be established separately.
Confidential-computing technologies have different guarantees. AWS Nitro Enclaves, a Nitro-based EC2 virtual machine, AMD SEV-SNP, and Intel SGX are not interchangeable descriptions. A claim about host or hypervisor access must identify the actual technology and deployment.
Attestation provides evidence about a measured environment. It does not by itself prove application correctness, eliminate vulnerabilities, or produce a secret from public measurements. Secure key release requires an actual secret source and an enforcement mechanism. A subpoena does not cause keys to vanish; the practical question is whether its recipient has access or control sufficient to comply.
Similarly, signatures establish authenticity, not confidentiality. A signed output can disclose sensitive information. Privacy depends on the program, release policy, destinations, and enforcement—not merely the presence of a signature.
When your box talks to someone else’s box
Now consider the stronger scenario: your encrypted environment communicates with another person’s encrypted environment over a distributed network. Infrastructure operators supply execution and transport while approved programs exchange only the information their policies permit. No central service necessarily receives a readable transcript.
The strongest privacy claim concerns information that remains inaccessible to those operators. The analogy is a network of protected instruments acting for their users, rather than an intermediary collecting readable information for its own purposes.
But another person’s box can still act for another person. If you authorize it to learn your address, negotiate a contract, or deliver a message, that is a meaningful disclosure to a recipient even if nobody watches the computation in real time. Its owner’s access, the permitted outputs, retention, and the program’s authority matter. Automation does not make a recipient disappear.
| Layer | What may be disclosed? | What must be examined? |
|---|---|---|
| Hosting node | Ciphertext, workload identifiers, timing | Plaintext access, attestation, keys, administrator powers |
| Network relay | Addresses, traffic volume, timing | Routing design, logs, correlation opportunities |
| Recipient’s box | Selected inputs or computed results | Who controls it and who may obtain outputs |
| External integration | API requests and authorized data | The receiving service’s visibility and retention |
A decentralized protocol may lack one central custodian. Its node operators, users, developers, governance participants, or service providers can nevertheless be identifiable legal actors. Whether any particular actor has responsive information or relevant control is a factual question. Decentralization changes the map of custody and authority; it does not erase jurisdiction.
The legal argument worth making
The argument can be stated without declaring absolute privacy. First, a person uses a remote machine as a private computational instrument. Second, enforceable technical controls prevent the hosting provider from accessing the private inputs and state. Third, the user retains meaningful authority over permitted execution and release. Fourth, the information sought is the user’s protected material rather than merely the provider’s independently generated business records.
These facts can support an expectation-of-privacy argument and a distinction between infrastructure custody and voluntary exposure. Carpenter and Chatrie help resist automatic forfeiture through technology use. Snitko illustrates why authority over shared premises does not dissolve boundaries around customers’ material.
None of these authorities alone settles that argument for Safebox. A court would need to assess the deployment, the claimant’s relationship to it, the information sought, the government’s conduct, and the applicable law. Hardware ownership is relevant context, not an all-purpose answer. Encryption supplies evidence of an effort to preserve confidentiality, not a certificate of constitutional immunity.
What legal process can still reach
The Stored Communications Act, 18 U.S.C. § 2703, distinguishes categories of contents and records and provides different forms of process. It should not be summarized as blanket permission to obtain all cloud contents by subpoena. Constitutional requirements remain relevant; statutory language alone does not resolve every acquisition.
Operators may possess account information, payment records, IP histories, ciphertext, backups, or audit information even where plaintext is unavailable. Recipients may possess readable results. Endpoints may hold keys or decrypted copies. A lawful investigation can seek those materials subject to the rules that apply.
Encryption can make compliance with a demand for readable contents technically impossible for a particular recipient. Whether a demand is legally valid is a different question. Compelled assistance, user decryption, preservation duties, and searches of endpoints raise additional issues that depend on circumstances and jurisdiction.
The Fourth Amendment primarily constrains governmental action. It is not a general-purpose prohibition on every private company’s data handling. Technical isolation and contractual commitments therefore remain valuable even where constitutional litigation is not the relevant remedy.
A separate issue: who may capture the conversation?
The discussion began with AI transcription. It is essential to keep collection authority separate from storage security. An encrypted destination does not authorize an otherwise unlawful interception.
18 U.S.C. § 2510 defines interception in terms of acquisition using a device; retaining an audio file is not the only relevant event. Under the federal private-party consent provision, § 2511(2)(d), a party’s participation or a party’s prior consent can authorize interception, subject to the provision’s criminal-or-tortious-purpose limitation. State laws can impose additional requirements.
Manual notes made from lawful unaided hearing differ from electronic capture. But “human notes are always legal” is too broad, and a microphone feeding immediate transcription does not avoid interception analysis simply because the audio is discarded. Cross-state situations require a conflicts-of-law assessment; the strictest state’s rule does not mechanically govern every call.
The provider exception in § 2511(2)(a)(i) is tied to specified service and protection functions. It does not turn every optional analytics product into ordinary network transport. Nor does the existence of that exception mean all routing and buffering would otherwise necessarily be unlawful in every setting.
For a Safebox assistant, establish a lawful basis to acquire the conversation, then apply the confidentiality boundary to processing, retention, and release. These are complementary requirements.
Turn the architectural argument into evidence
A persuasive implementation makes its boundaries inspectable. Document which principals can obtain plaintext, where keys originate, how attestation gates access, and which approved workloads can release information. Record the deployment technology, update authority, recovery mechanisms, and the external services a workflow contacts.
Map logs as carefully as message contents. A system can protect payloads while exposing a sensitive record of relationships and activity. Signed audit logs may strengthen accountability while becoming sensitive material themselves; their readers, retention, and release policy belong in the threat model.
Finally, describe the security assumptions honestly: hardware and firmware trust, approved application behavior, endpoint security, side channels, software vulnerabilities, availability, and output leakage. Attestation identifies an environment under its trust assumptions; it does not make those assumptions disappear.
“Safebox is designed to keep private computation within an attested boundary and restrict infrastructure operators’ access to plaintext. That architecture can strengthen privacy arguments and limit what intermediaries can disclose. The legal result depends on the facts and applicable law.”
The opportunity is substantial: infrastructure that can perform useful work without acquiring ordinary access to the user’s secrets. The legal case becomes stronger when the technical boundary is precise enough to prove.
Primary sources & further reading
- Miller · 1976Bank business records and the third-party doctrine.
- Smith · 1979Dialed numbers, distinguished from conversation contents.
- Carpenter · 2018Historical cell-site location information.
- Chatrie · 2026Official Supreme Court opinion on Google Location History.
- Snitko · 2024Official Ninth Circuit opinion on the private-vault searches.
- Safebox architectureProduct architecture and its stated verification model.
- Safebots InfrastructurePublic infrastructure source.
- AWS Nitro EnclavesProvider documentation for the specific enclave product.
Case discussions concern the opinions linked here. Subsequent proceedings may affect a particular case’s disposition. Architecture statements are distinguished from independent implementation verification. This article offers general legal and technical analysis, not advice for a particular recording, investigation, or dispute.