11 ms·
Man charged after media storage site Dropbox finds child porn in his account
- kyledrake 9y agoThis isn't surprising. Most service providers (including Facebook and Google) actively scan for known PhotoDNA hashes of CP provided by NCMEC and other groups, and will report if they detect and then verify any of them. I recall someone getting charged after using Gmail in a similar way. This isn't a legal mandate, they do this voluntarily. This isn't "Dropbox employees digging through everybody's files hunting for CP". It's all automated, likely triggered by uploads of certain types of files (images/videos). They almost certainly have a human verify the validity before reporting (which is probably a 100% manual process). They're required by law to report it once they have reasonable suspicion. An interesting abuse edge case here I've pondered for a while: someone hacks into your account and intentionally posts bad stuff to get you in trouble. It could be pretty difficult to prove that someone did this if the company's logs were inadequate. A similar flavor of this: someone sent Brian Krebs heroin in the mail, and then "tipped off" the police. Fortunately, it didn't work https://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces-charges-in-u-s/ https://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroi...
- pier25 9y ago> This isn't "Dropbox employees digging through everybody's files hunting for CP". It's all automated. If a script can access users' data what's the difference?
- carc 9y agoPermissions?
- danso 9y agoHow would Dropbox function if their scripts couldn't access user data?
- dorfsmay 9y agoFor the storage functionality, they could encrypt/decrypt on the frontend, and store encrypted data only.
- danso 9y agoSomeone else has pointed out that Dropbox has never promised end-to-end encryption of data, partly because it would be difficult to provide various user-friendly features. Also because it would be difficult on their end to apply the efficiency measures they have for doing diffs and file history.
- FooHentai 9y agoCan't do de-duplication if you're encrypting. No way Dropbox's storage back-end remains viable without de-dupe.
- mercer 9y agoIs that true though? I use Tarsnap and as I understand it, it does de-duplication server-side AND client-side encryption. That said, the point probably still stands that encryption is probably not feasibly with Dropbox feature set (or while maintaining a certain performance).
- cperciva 9y agoTarsnap deduplicates your data with respect to your data. It can't compare your data with everybody else's data, because your data is encrypted with keys which only you hold. Dropbox deduplicates everybody's data, so that they'll be able to take advantage when you and someone else both store the same file. (Of course, this trivially means they can recognize when someone stores a file which the FBI has previously provided to them.)
- mercer 9y agoAh, of course! Thanks for clearing that up (I was hoping you would chime in). Oh, and thanks for a product that does what I need it to do. I'd maybe have liked a bit more documentation (for example, how to speed up retrieving a backup), but other than that I'm very happy with it!
- kemitche 9y agoBarring client side encryption, Dropbox's servers are going to have your data.
- flachsechs 9y agoserious question: who is tasked with collecting and classifying these awful photos?
- kyledrake 9y agoNCMEC http://www.missingkids.com/home http://www.missingkids.com/home Probably some others but that's the main US one. IIRC, they may be given special legal status here to this effect.
- xupybd 9y agoMy Uncle had to do something similar for the NZ police. He had young children at the time, it was a distressing job for him. I don't envy anyone that has to deal with child abuse at any level but I guess someone has to do it.
- tuna-piano 9y agoThe kind of scary thing is that if someone else hacked into your account and posted bad stuff, even if you are later able to prove it wasn't you (alibi/IP address/etc), it may already be too late. Personal relationships will have severed. You will have lost your job. People may never look at you the same way. Passwords are everywhere, and most people don't use MFA. If dozens of celebrities had their iCloud accounts hacked, there's no doubt that thousands of normal people could have their dropbox accounts hacked - for the purpose of adding nefarious files, not downloading sensitive ones.
- revelation 9y agoI'm pretty sure if you asked a bunch of their customers (certainly corporate) they would find this very surprising. I mean, I just went to their "about us" page and here is what it says: We create products that are easy to use and are built on trust. When people put their files in Dropbox, they can trust they’re secure and their data is their own. Our users’ privacy has always been our first priority, and it always will be. Wholesale scanning of user data with heuristics and automatic police reports out of no legal necessity whatsoever certainly doesn't spell "privacy always our first priority" to me.
- deleted 9y ago[deleted]
- pier25 9y agoI find it surprising that Dropbox has access to its users files. I thought cloud storage companies kept everything encrypted, or at least access. My company uses Dropbox extensively for storing documents with sensitive information.
- atrus 9y agoIt's probably a safe assumption that if you can view files online, they are able to access any of the files. Although there is a database of hashes and whatnot for child porn that service providers can access, so they don't necessarily need unencrypted access to the files, since they can hash locally and send that to their servers.
- lend000 9y agoThat's the value proposition of something like Siacoin or Filecoin. If Dropbox did that, you wouldn't be able to reset your password (since they do not store your password, just a salted hash, I hope). Dropbox does plenty of interesting things with its users' files to optimize storage. I know they dedupe files, probably using a file hash. Perhaps they optimize even further.
- pier25 9y ago> If Dropbox did that, you wouldn't be able to reset your password Right, or course. I'm thick today.
- woranl 9y agoDropbox holds all the encryption keys. They do not use end to end encryption.
- Lazare 9y agoNope. Dropbox has never claimed they don't have access to your files, and you should generally assume that cloud providers are always looking through your data unless they explicitly claim otherwise (and maybe even if they do). Dropbox has been in the news for scanning user files for years (eg, [1][2][3]). Note that the third link dates back to 2011; not a new issue. If you do want to keep your data secure from the cloud provider, encrypt it yourself, or use a service that encrypts it before uploading using a key you provide (and with a client you trust not to be compromised). Spideroak makes a big play for this market[4], but I can't vouch for them. [1]: http://www.pcworld.com/article/2048680/dropbox-takes-a-peek-at-files.html http://www.pcworld.com/article/2048680/dropbox-takes-a-peek-... [2]: https://www.extremetech.com/computing/179495-how-dropbox-knows-youre-a-dirty-pirate-and-why-you-shouldnt-use-cloud-storage-to-share-copyrighted-files https://www.extremetech.com/computing/179495-how-dropbox-kno... [3]: https://readwrite.com/2011/04/20/how-to-keep-dropbox-employees/ https://readwrite.com/2011/04/20/how-to-keep-dropbox-employe... [4]: https://spideroak.com/no-knowledge/ https://spideroak.com/no-knowledge/
- quuquuquu 9y agoYikes. Ok, let's abstract the topic to debate it. Dropbox scans user accounts. It alerts the police that objectionable material appears on an account. The police attempt to associate the account with a person. Social media profiles and IP adresses turn up a name and general geographic location. Police find a person's name associated with said profiles, email, and IP. They show up at his address, and ask him, hey, are these accounts yours? "Maybe, why?" The police then execute a warrant, confiscate his phone. The phone contains an app, which is logged into an account with objectionable material on it. You are now charged with possession of child porn. Child porn is a terrible and heinous crime. Put that aside for a moment. What happens if someone illegally accessed your account and placed those images there?
- ivebeenframed 9y agoThat objection applies to almost any possible evidence gathering technique. Framing someone has always been a possibility. It's the subject of many stories, and more than a few real life cases. But we don't know or (IMO) have reason to believe it's become more common in the digital age. You need motive and ability to do it still, and those often don't come together.
- quuquuquu 9y agoThe duty of law is to prove guilt "beyond a reasonable doubt". Is it unreasonable for my account to have been hacked and used to hold illegal material? There are accounts of mine that I don't even remember existing. Multiple use multiple devices of mine from time to time. Should my dad be hauled to prison when I use his computer, and I catch a virus that stores child porn in his dropbox account from 5 years ago?
- ivebeenframed 9y ago> Is it unreasonable for my account to have been hacked and used to hold illegal material? I wouldn't necessarily say unreasonable. Incredibly unlikely, though.
- hiisukun 9y agoMost companies that host content have a "report" function. You might have once reported a post on facebook, a file link on dropbox, or an image on imgur (to take a few examples) for being bad in some way. If the reason for your report is that the content involves child abuse, then the company is generally accountable for checking it out. This means different things depending on the type of content, the country, and lots of other moving parts, but it is the "safety of the children" argument at work. In practice, often an American content host will let NCMEC know, since they compile and forward on reports to law enforcement. Sometimes content will simply be removed. Again, it depends on the details. This is indeed one of those cases where your privacy, and the rights you have over your property, are impinged upon as a regular person. The courts where I live (Australia) take this quite seriously and are aware that a balance must be struck. I get nervous and uncomfortable when the "think of the children" argument is misused during discussions involving encryption, intellectual property violations, and general freedoms - but I'm aware that on some occasions it is important. A lot of work goes into identifying and where possible rescuing the children involved in this stuff, and preventing more. That is always the focus, in my experience. A final note - the child protection industry is keen to remove the word pornography from the lexicon, and to refer to this type of material as "child abuse" or "child exploitation" material. I think it would be good to reflect that in the headline, because while most everyone knows what child porn means, calling it such mentally associates it with the pornography aspect (the end user) rather than the victim (the child).
- spork12 9y agoEasy solution to the privacy issue here - Use encfs (https://github.com/vgough/encfs https://github.com/vgough/encfs) That's how I store all of my illegal content on dropbox.
- magamind 9y agoI much prefer using the $5 wrench anyways.