8 ms·

Scanning in the cloud can be just as problematic. Google is not just scanning for known examples of kiddie porn, they are scanning for images of naked children

Scanning in the cloud can be just as problematic. Google is not just scanning for known examples of kiddie porn, they are scanning for images of naked children, and reporting parents to the police. for instance, they tried to get a parent arrested for using their Android phone to get medical assistance for their child during lockdown. >With help from the photos, the doctor diagnosed the issue and prescribed antibiotics, which quickly cleared it up. But the episode left Mark with a much larger problem, one that would cost him more than a decade of contacts, emails and photos, and make him the target of a police investigation. “I knew that these companies were watching and that privacy is not what we would hope it to be,” Mark said. “But I haven’t done anything wrong.” The police agreed. Google did not. https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil...

autoexec 4y ago
I wouldn't be surprised if Microsoft wasn't doing the same thing with photos viewed in their default Photo app (The names of the images viewed in that app are sent as telemetry already along with the times they were viewed and how long each image was left open). Windows defender may even be checking the files it scans for whatever content MS considers objectionable. We likely wouldn't won't know unless it becomes a news story or a whistleblower tells us.
- GeekyBear 4y ago
  > I wouldn't be surprised if Microsoft wasn't doing the same thing with photos viewed in their default Photo app Google has apparently shared their algorithm with others, but only Facebook was mentioned by name. >in 2018, Google developed an artificially intelligent tool that could recognize never-before-seen exploitative images of children. That meant finding not just known images of abused children but images of unknown victims who could potentially be rescued by the authorities. Google made its technology available to other companies, including Facebook. https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil...
- soulofmischief 4y ago
  Even if it isn't currently checking against CSAM databases, it does by default share file metadata with Microsoft.
- BuyMyBitcoins 4y ago
  I had no idea the photos app was doing this. This seems beyond excessive and I’m glad I happen to use the old photo viewer. The new one always takes a second to load the photo, and I suppose that’s because it’s doing all this other stuff in the background.
  - ls15 4y ago
    I often hear the argument that the average user does not care about privacy, but I don't think that this is true. Instead I think the average user is just not aware of the insane amount of data that is exfiltrated and what can be done with that data, because the software does not make it clear what it actually is doing.
    - BuyMyBitcoins 4y ago
      Honestly, why on Earth does Microsoft want to know the filenames of the photos being opened? And, how often each one is viewed? What possible enhancement to the app can be justified because of this information?
      - autoexec 4y ago
        Cynically, I'm sure it could be "justified" in all kinds of ways like "knowing more about the photos viewed most often with our Photos app helps us to determine what new features would best enhance the user experience. Only metadata is being collected, so no employee is ever able to view your pictures. We value your privacy blah blah blah" Even more cynically, it just gives them more data about you and your interests (with viewing frequency/duration being a measure of interest) which lets them push more narrowly targeted ads at you, which gives them more money, which lets them invest more in improving Windows as a whole or whatever else they tell themselves so they can face their own reflections.
- Eisenstein 4y ago
  I checked out this claim and and was able to find this: * https://www.reddit.com/r/Windows10/comments/8zk1yy/a_simple_analysis_of_what_local_data_the_photos/ https://www.reddit.com/r/Windows10/comments/8zk1yy/a_simple_... It stores that information in a local index, and also stores telemetry data which counts interactions with the app, but there is no evidence it is uploading indexes to MS. Do you have any evidence of this?
  - autoexec 4y ago
    I believe that info was in one of these links: https://learn.microsoft.com/en-us/windows/configure/windows-diagnostic-data https://learn.microsoft.com/en-us/windows/configure/windows-... https://learn.microsoft.com/en-us/windows/configure/basic-level-windows-diagnostic-events-and-fields https://learn.microsoft.com/en-us/windows/configure/basic-le... They both 404 now. I had saved a copy of both at the time, but those files must be on another drive. I'll keep looking though! There were several articles about it at the time https://www.extremetech.com/computing/247311-microsoft-finally-reveals-exactly-telemetry-windows-10-collects-pc https://www.extremetech.com/computing/247311-microsoft-final... https://www.ghacks.net/2017/04/06/windows-10-full-and-basic-telemetry-data-collection-information/ https://www.ghacks.net/2017/04/06/windows-10-full-and-basic-... These documents were massive and filled with lots of information buried in places that seemed odd and scattered across different sections so that you couldn't get all the information about what an app collected in one section/table of the document. Another thing I remember from those pages was that in some circumstances short clips (less than 1 minute) of the videos you played using window's default player would be sent to MS as well, but they said that would only happen in the event of crashes.
knaik94 4y ago
If the photos are hosted on Google's servers, they have every right to scan whatever they want. If you are privacy conscious, you can upload files you encrypt yourself at the cost of not being able to share easily. I recognize edge cases like the one in the article you linked, but I don't see an alternative. Not scanning for CSAM on your own servers isn't a realistic expectation.
- GeekyBear 4y ago
  > If the photos are hosted on Google's servers, they have every right to scan whatever they want. Google is trying to get people arrested because Android backed up their personal photo libraries to Google Photos. > The day after Mark’s troubles started, the same scenario was playing out in Texas. A toddler in Houston had an infection in his “intimal parts,” wrote his father in an online post that I stumbled upon while reporting out Mark’s story. At the pediatrician’s request, Cassio, who also asked to be identified only by his first name, used an Android to take photos, which were backed up automatically to Google Photos. He then sent them to his wife via Google’s chat service. https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil... > Not scanning for CSAM on your own servers isn't a realistic expectation. Google isn't just scanning for known examples of kiddie porn, they have developed an algorithm that scans for any image of naked children and, as usual, there doesn't seem to be a human in the loop when their algorithm makes a bad call.
  - knaik94 4y ago
    It's Google's servers. I imagine every content hosting company has a heuristics based approach to detecting CSAM. Google has a habit of tuning moderation algorithms for false positives rather than missed positives. Not having a human in the loop is terrible and a problem frequently when it comes to getting support from Google companies. That's a separate issue from Google or Dropbox being able to scan unencrypted files for CSAM. Google's policy of automating as much as it can has tons of downsides. But it's understandable when you look at the scale Google functions. It's important to separate the policy of scanning from Google's terrible appeal process and the algorithm false positives. I would feel differently if the story was that Android scanned an outgoing SMS or a photo saved locally. I am not sure where the balance point is to identify and report CSAM while also respecting user's rights to privacy.
9991 4y ago
If you're still using Microsoft or Google services at this point, you deserve what you get.
- deely3 4y ago
  Victim blaming is very easy, yes?
  - 9991 4y ago
    Yes, pretty easy. Keyboard-warrioring in general is. But that's not the point. Victim blaming doesn't do any good for today's victim, but maybe it will help show the next person that their fate is under their control.

autoexec 4y ago

I wouldn't be surprised if Microsoft wasn't doing the same thing with photos viewed in their default Photo app (The names of the images viewed in that app are sent as telemetry already along with the times they were viewed and how long each image was left open). Windows defender may even be checking the files it scans for whatever content MS considers objectionable. We likely wouldn't won't know unless it becomes a news story or a whistleblower tells us.

GeekyBear 4y ago
> I wouldn't be surprised if Microsoft wasn't doing the same thing with photos viewed in their default Photo app Google has apparently shared their algorithm with others, but only Facebook was mentioned by name. >in 2018, Google developed an artificially intelligent tool that could recognize never-before-seen exploitative images of children. That meant finding not just known images of abused children but images of unknown victims who could potentially be rescued by the authorities. Google made its technology available to other companies, including Facebook. https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil...
soulofmischief 4y ago
Even if it isn't currently checking against CSAM databases, it does by default share file metadata with Microsoft.
BuyMyBitcoins 4y ago
I had no idea the photos app was doing this. This seems beyond excessive and I’m glad I happen to use the old photo viewer. The new one always takes a second to load the photo, and I suppose that’s because it’s doing all this other stuff in the background.
- ls15 4y ago
  I often hear the argument that the average user does not care about privacy, but I don't think that this is true. Instead I think the average user is just not aware of the insane amount of data that is exfiltrated and what can be done with that data, because the software does not make it clear what it actually is doing.
  - BuyMyBitcoins 4y ago
    Honestly, why on Earth does Microsoft want to know the filenames of the photos being opened? And, how often each one is viewed? What possible enhancement to the app can be justified because of this information?
    - autoexec 4y ago
      Cynically, I'm sure it could be "justified" in all kinds of ways like "knowing more about the photos viewed most often with our Photos app helps us to determine what new features would best enhance the user experience. Only metadata is being collected, so no employee is ever able to view your pictures. We value your privacy blah blah blah" Even more cynically, it just gives them more data about you and your interests (with viewing frequency/duration being a measure of interest) which lets them push more narrowly targeted ads at you, which gives them more money, which lets them invest more in improving Windows as a whole or whatever else they tell themselves so they can face their own reflections.
Eisenstein 4y ago
I checked out this claim and and was able to find this: * https://www.reddit.com/r/Windows10/comments/8zk1yy/a_simple_analysis_of_what_local_data_the_photos/ https://www.reddit.com/r/Windows10/comments/8zk1yy/a_simple_... It stores that information in a local index, and also stores telemetry data which counts interactions with the app, but there is no evidence it is uploading indexes to MS. Do you have any evidence of this?
- autoexec 4y ago
  I believe that info was in one of these links: https://learn.microsoft.com/en-us/windows/configure/windows-diagnostic-data https://learn.microsoft.com/en-us/windows/configure/windows-... https://learn.microsoft.com/en-us/windows/configure/basic-level-windows-diagnostic-events-and-fields https://learn.microsoft.com/en-us/windows/configure/basic-le... They both 404 now. I had saved a copy of both at the time, but those files must be on another drive. I'll keep looking though! There were several articles about it at the time https://www.extremetech.com/computing/247311-microsoft-finally-reveals-exactly-telemetry-windows-10-collects-pc https://www.extremetech.com/computing/247311-microsoft-final... https://www.ghacks.net/2017/04/06/windows-10-full-and-basic-telemetry-data-collection-information/ https://www.ghacks.net/2017/04/06/windows-10-full-and-basic-... These documents were massive and filled with lots of information buried in places that seemed odd and scattered across different sections so that you couldn't get all the information about what an app collected in one section/table of the document. Another thing I remember from those pages was that in some circumstances short clips (less than 1 minute) of the videos you played using window's default player would be sent to MS as well, but they said that would only happen in the event of crashes.

knaik94 4y ago

If the photos are hosted on Google's servers, they have every right to scan whatever they want. If you are privacy conscious, you can upload files you encrypt yourself at the cost of not being able to share easily. I recognize edge cases like the one in the article you linked, but I don't see an alternative. Not scanning for CSAM on your own servers isn't a realistic expectation.

GeekyBear 4y ago
> If the photos are hosted on Google's servers, they have every right to scan whatever they want. Google is trying to get people arrested because Android backed up their personal photo libraries to Google Photos. > The day after Mark’s troubles started, the same scenario was playing out in Texas. A toddler in Houston had an infection in his “intimal parts,” wrote his father in an online post that I stumbled upon while reporting out Mark’s story. At the pediatrician’s request, Cassio, who also asked to be identified only by his first name, used an Android to take photos, which were backed up automatically to Google Photos. He then sent them to his wife via Google’s chat service. https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil... > Not scanning for CSAM on your own servers isn't a realistic expectation. Google isn't just scanning for known examples of kiddie porn, they have developed an algorithm that scans for any image of naked children and, as usual, there doesn't seem to be a human in the loop when their algorithm makes a bad call.
- knaik94 4y ago
  It's Google's servers. I imagine every content hosting company has a heuristics based approach to detecting CSAM. Google has a habit of tuning moderation algorithms for false positives rather than missed positives. Not having a human in the loop is terrible and a problem frequently when it comes to getting support from Google companies. That's a separate issue from Google or Dropbox being able to scan unencrypted files for CSAM. Google's policy of automating as much as it can has tons of downsides. But it's understandable when you look at the scale Google functions. It's important to separate the policy of scanning from Google's terrible appeal process and the algorithm false positives. I would feel differently if the story was that Android scanned an outgoing SMS or a photo saved locally. I am not sure where the balance point is to identify and report CSAM while also respecting user's rights to privacy.

9991 4y ago

If you're still using Microsoft or Google services at this point, you deserve what you get.

deely3 4y ago
Victim blaming is very easy, yes?
- 9991 4y ago
  Yes, pretty easy. Keyboard-warrioring in general is. But that's not the point. Victim blaming doesn't do any good for today's victim, but maybe it will help show the next person that their fate is under their control.