7 ms·

If the photos are hosted on Google's servers, they have every right to scan whatever they want. If you are privacy conscious, you can upload files you encrypt y

If the photos are hosted on Google's servers, they have every right to scan whatever they want. If you are privacy conscious, you can upload files you encrypt yourself at the cost of not being able to share easily. I recognize edge cases like the one in the article you linked, but I don't see an alternative. Not scanning for CSAM on your own servers isn't a realistic expectation.

GeekyBear 4y ago
> If the photos are hosted on Google's servers, they have every right to scan whatever they want. Google is trying to get people arrested because Android backed up their personal photo libraries to Google Photos. > The day after Mark’s troubles started, the same scenario was playing out in Texas. A toddler in Houston had an infection in his “intimal parts,” wrote his father in an online post that I stumbled upon while reporting out Mark’s story. At the pediatrician’s request, Cassio, who also asked to be identified only by his first name, used an Android to take photos, which were backed up automatically to Google Photos. He then sent them to his wife via Google’s chat service. https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil... > Not scanning for CSAM on your own servers isn't a realistic expectation. Google isn't just scanning for known examples of kiddie porn, they have developed an algorithm that scans for any image of naked children and, as usual, there doesn't seem to be a human in the loop when their algorithm makes a bad call.
- knaik94 4y ago
  It's Google's servers. I imagine every content hosting company has a heuristics based approach to detecting CSAM. Google has a habit of tuning moderation algorithms for false positives rather than missed positives. Not having a human in the loop is terrible and a problem frequently when it comes to getting support from Google companies. That's a separate issue from Google or Dropbox being able to scan unencrypted files for CSAM. Google's policy of automating as much as it can has tons of downsides. But it's understandable when you look at the scale Google functions. It's important to separate the policy of scanning from Google's terrible appeal process and the algorithm false positives. I would feel differently if the story was that Android scanned an outgoing SMS or a photo saved locally. I am not sure where the balance point is to identify and report CSAM while also respecting user's rights to privacy.
  - nanidin 4y ago
    I wonder how algorithms like Stable Diffusion will impact CSAM detection policies.
    - Sporktacular 4y ago
      If a child isn't exploited to make it, it's not technically CSAM. But you could maybe argue that if the ML model is based on CSAM then it's a product of it and would need to be banned.
  - GeekyBear 4y ago
    > It's Google's servers. I imagine every content hosting company has a heuristics based approach to detecting CSAM. The slippery slope claim made in the past was that they were only looking for files that match known examples of kiddie porn. For instance, this tech from Microsoft: >PhotoDNA creates a unique digital signature (known as a “hash”) of an image which is then compared against signatures (hashes) of other photos to find copies of the same image. When matched with a database containing hashes of previously identified illegal images, PhotoDNA is an incredible tool to help detect, disrupt and report the distribution of child exploitation material. https://www.microsoft.com/en-us/photodna https://www.microsoft.com/en-us/photodna Reporting parents to police because they took pictures of their child's first bath and those photos were automatically backed up to Google servers is much, much worse.
    - Eisenstein 4y ago
      Please stop using 'child's first bath' as an indicator of overreaction by the algorithm. It is not helpful to argue something which will make you look hyperbolic or histrionic once your argument is looked into. 1. The picture(s) in question mentioned above which got an account shut down and police notified was not a 'child in a bath', it was close ups of a child's genitals 2. You are probably not a parent since a child's 'first bath' is not a thing. They are bathed as infants starting immediately. If you are referring to a child's first independent bath, then no one should be taking pictures since private bathing is not something that should be intruded upon for picture taking All that said, I agree with you.
- shitlord 4y ago
  Google scans your data for anything it finds objectionable. Here's another example of Google flagging and deleting a video from a user's Drive storage: https://twitter.com/nicholasdeorio/status/1583866251339698180?t=S31wdnWV_rFQ5BdSBGMdAA&s=19 https://twitter.com/nicholasdeorio/status/158386625133969818...
  - GeekyBear 4y ago
    There are many examples of Google's automated systems making egregious mistakes while scanning user data with no human in the loop to review the decision. >Ed Francis studies the evolution of military technology over at his YouTube channel, Armoured Archives. But this week, Francis says five years’ worth of research stored on Google Drive has become inaccessible thanks to Google’s automated error. Francis says the file in question was simply a collection of data on various tanks for a coming video on how military vehicles have evolved across historical conflicts. But Google’s automated systems deemed the file a terrorist threat, resulting in a complete lockdown of his YouTube, GMail, and Google Drive accounts. https://www.vice.com/en/article/qj8yj7/google-locks-historians-account-over-terrorism-research-videos https://www.vice.com/en/article/qj8yj7/google-locks-historia... Having a shitty algorithm kill your whole Google account with no way to reach a human to fix the problem is one thing. Having a shitty algorithm report you to the police for taking pictures of your child's first bath is a bridge too far.
    - doomslice 4y ago
      I'm not defending this at all, but one of the reasons why there are no (or few) humans that can be contacted is that they* said that it was tried before and it caused a lot more issues with mistakes/takeovers due to social engineering. * Can't remember who said it but it was at a town hall this year
      - GeekyBear 4y ago
        > one of the reasons why there are no (or few) humans that can be contacted is that they* said that it was tried before This just sounds like yet another excuse for holding payroll down as much as possible. If I am a customer of Amazon, Apple, Netflix, Walmart or any number of the other companies with a similar market cap, I can get access to real live human beings who provide customer support.
jliptzin 4y ago
Maybe monitor companies should put chips inside that scan the current screen every second to check for CSAM matches or whatever else they don’t want the customer using their monitors for and diligently report violations to the police?
- magicjosh 4y ago
  Yes! The Creating Sustainable American Mployment (CSAM) Act will create thousands of new jobs too.
- nanidin 4y ago
  You’re joking but smart TV screens already do this to identify and report content back to the mothership.
beachy 4y ago
> Not scanning for CSAM on your own servers isn't a realistic expectation It is if the false positives are overwhelming, given their impact on innocent people's lives.
magicjosh 4y ago
Not scanning for CSAM on your own servers isn't a realistic expectation. What makes it not a realistic expectation? According to other references, the USA cannot compel companies to run scans on their own customers.
josefx 4y ago
> If the photos are hosted on Google's servers, they have every right to scan whatever they want. I don't get why that should be the case. When you rent an apartment the owner is generally no longer able to just walk in and do whatever he likes, including installing cameras in the shower. So I would expect that when Google tries to sign you up for its online storage (repeatedly) you should get the same protections, especially with smart phones being such an important part of modern life.
- knaik94 4y ago
  It's more about shareable media. Relative to your analogy, I feel storing files in encrypted containers is renting an apartment and feeling confident about the landlord not walking in. On the other hand, if you hang up an obscene image in your window of your apartment, I imagine it's understandable that a landlord would use a key and take it down. If hanging up obscene images becomes a pattern, I think the landlord would kick you out. From one perspective, I understand that cloud storage should include certain rights to privacy. If I buy some compute time on AWS, I manage and control all flow of data. It would be a complete violation if AWS policed the kind of content I could store. I think self-managed vs company managed is what dictates my expectations. Google photos and drive, especially since most people don't pay for it, fall into the company managed category in my opinion. In the last few years Google Drive became more strict about sharing copyright work and started flagging files, which limits the ability the "share to anyone with a link". For people who use it as a backup, the advice I started hearing was to encrypt the data before uploading. The opsec while considering nation-state level threats to privacy already recommended only using encrypted containers since the beginnings of cloud storage. The Communications Decency Act is an interesting law that dictates the liability of online content and service providers. There is an ongoing battle to increase ISP and host liability as a way for the entertainment industry to combat piracy. FOSTA-SESTA and the ruling on Backpage [1] made things more difficult for hosts like Google and changed the liability surrounding sexual solicitation. If a host like Google knows what's being hosted and does nothing, they get in trouble. They don't have the protections they did in the past. https://en.wikipedia.org/wiki/Section_230 https://en.wikipedia.org/wiki/Section_230
  - 4y ago

GeekyBear 4y ago

> If the photos are hosted on Google's servers, they have every right to scan whatever they want. Google is trying to get people arrested because Android backed up their personal photo libraries to Google Photos. > The day after Mark’s troubles started, the same scenario was playing out in Texas. A toddler in Houston had an infection in his “intimal parts,” wrote his father in an online post that I stumbled upon while reporting out Mark’s story. At the pediatrician’s request, Cassio, who also asked to be identified only by his first name, used an Android to take photos, which were backed up automatically to Google Photos. He then sent them to his wife via Google’s chat service. https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil... > Not scanning for CSAM on your own servers isn't a realistic expectation. Google isn't just scanning for known examples of kiddie porn, they have developed an algorithm that scans for any image of naked children and, as usual, there doesn't seem to be a human in the loop when their algorithm makes a bad call.

knaik94 4y ago
It's Google's servers. I imagine every content hosting company has a heuristics based approach to detecting CSAM. Google has a habit of tuning moderation algorithms for false positives rather than missed positives. Not having a human in the loop is terrible and a problem frequently when it comes to getting support from Google companies. That's a separate issue from Google or Dropbox being able to scan unencrypted files for CSAM. Google's policy of automating as much as it can has tons of downsides. But it's understandable when you look at the scale Google functions. It's important to separate the policy of scanning from Google's terrible appeal process and the algorithm false positives. I would feel differently if the story was that Android scanned an outgoing SMS or a photo saved locally. I am not sure where the balance point is to identify and report CSAM while also respecting user's rights to privacy.
- nanidin 4y ago
  I wonder how algorithms like Stable Diffusion will impact CSAM detection policies.
  - Sporktacular 4y ago
    If a child isn't exploited to make it, it's not technically CSAM. But you could maybe argue that if the ML model is based on CSAM then it's a product of it and would need to be banned.
- GeekyBear 4y ago
  > It's Google's servers. I imagine every content hosting company has a heuristics based approach to detecting CSAM. The slippery slope claim made in the past was that they were only looking for files that match known examples of kiddie porn. For instance, this tech from Microsoft: >PhotoDNA creates a unique digital signature (known as a “hash”) of an image which is then compared against signatures (hashes) of other photos to find copies of the same image. When matched with a database containing hashes of previously identified illegal images, PhotoDNA is an incredible tool to help detect, disrupt and report the distribution of child exploitation material. https://www.microsoft.com/en-us/photodna https://www.microsoft.com/en-us/photodna Reporting parents to police because they took pictures of their child's first bath and those photos were automatically backed up to Google servers is much, much worse.
  - Eisenstein 4y ago
    Please stop using 'child's first bath' as an indicator of overreaction by the algorithm. It is not helpful to argue something which will make you look hyperbolic or histrionic once your argument is looked into. 1. The picture(s) in question mentioned above which got an account shut down and police notified was not a 'child in a bath', it was close ups of a child's genitals 2. You are probably not a parent since a child's 'first bath' is not a thing. They are bathed as infants starting immediately. If you are referring to a child's first independent bath, then no one should be taking pictures since private bathing is not something that should be intruded upon for picture taking All that said, I agree with you.
shitlord 4y ago
Google scans your data for anything it finds objectionable. Here's another example of Google flagging and deleting a video from a user's Drive storage: https://twitter.com/nicholasdeorio/status/1583866251339698180?t=S31wdnWV_rFQ5BdSBGMdAA&s=19 https://twitter.com/nicholasdeorio/status/158386625133969818...
- GeekyBear 4y ago
  There are many examples of Google's automated systems making egregious mistakes while scanning user data with no human in the loop to review the decision. >Ed Francis studies the evolution of military technology over at his YouTube channel, Armoured Archives. But this week, Francis says five years’ worth of research stored on Google Drive has become inaccessible thanks to Google’s automated error. Francis says the file in question was simply a collection of data on various tanks for a coming video on how military vehicles have evolved across historical conflicts. But Google’s automated systems deemed the file a terrorist threat, resulting in a complete lockdown of his YouTube, GMail, and Google Drive accounts. https://www.vice.com/en/article/qj8yj7/google-locks-historians-account-over-terrorism-research-videos https://www.vice.com/en/article/qj8yj7/google-locks-historia... Having a shitty algorithm kill your whole Google account with no way to reach a human to fix the problem is one thing. Having a shitty algorithm report you to the police for taking pictures of your child's first bath is a bridge too far.
  - doomslice 4y ago
    I'm not defending this at all, but one of the reasons why there are no (or few) humans that can be contacted is that they* said that it was tried before and it caused a lot more issues with mistakes/takeovers due to social engineering. * Can't remember who said it but it was at a town hall this year
    - GeekyBear 4y ago
      > one of the reasons why there are no (or few) humans that can be contacted is that they* said that it was tried before This just sounds like yet another excuse for holding payroll down as much as possible. If I am a customer of Amazon, Apple, Netflix, Walmart or any number of the other companies with a similar market cap, I can get access to real live human beings who provide customer support.

jliptzin 4y ago

Maybe monitor companies should put chips inside that scan the current screen every second to check for CSAM matches or whatever else they don’t want the customer using their monitors for and diligently report violations to the police?

magicjosh 4y ago
Yes! The Creating Sustainable American Mployment (CSAM) Act will create thousands of new jobs too.
nanidin 4y ago
You’re joking but smart TV screens already do this to identify and report content back to the mothership.

beachy 4y ago

> Not scanning for CSAM on your own servers isn't a realistic expectation It is if the false positives are overwhelming, given their impact on innocent people's lives.

magicjosh 4y ago

Not scanning for CSAM on your own servers isn't a realistic expectation. What makes it not a realistic expectation? According to other references, the USA cannot compel companies to run scans on their own customers.

josefx 4y ago

> If the photos are hosted on Google's servers, they have every right to scan whatever they want. I don't get why that should be the case. When you rent an apartment the owner is generally no longer able to just walk in and do whatever he likes, including installing cameras in the shower. So I would expect that when Google tries to sign you up for its online storage (repeatedly) you should get the same protections, especially with smart phones being such an important part of modern life.

knaik94 4y ago
It's more about shareable media. Relative to your analogy, I feel storing files in encrypted containers is renting an apartment and feeling confident about the landlord not walking in. On the other hand, if you hang up an obscene image in your window of your apartment, I imagine it's understandable that a landlord would use a key and take it down. If hanging up obscene images becomes a pattern, I think the landlord would kick you out. From one perspective, I understand that cloud storage should include certain rights to privacy. If I buy some compute time on AWS, I manage and control all flow of data. It would be a complete violation if AWS policed the kind of content I could store. I think self-managed vs company managed is what dictates my expectations. Google photos and drive, especially since most people don't pay for it, fall into the company managed category in my opinion. In the last few years Google Drive became more strict about sharing copyright work and started flagging files, which limits the ability the "share to anyone with a link". For people who use it as a backup, the advice I started hearing was to encrypt the data before uploading. The opsec while considering nation-state level threats to privacy already recommended only using encrypted containers since the beginnings of cloud storage. The Communications Decency Act is an interesting law that dictates the liability of online content and service providers. There is an ongoing battle to increase ISP and host liability as a way for the entertainment industry to combat piracy. FOSTA-SESTA and the ruling on Backpage [1] made things more difficult for hosts like Google and changed the liability surrounding sexual solicitation. If a host like Google knows what's being hosted and does nothing, they get in trouble. They don't have the protections they did in the past. https://en.wikipedia.org/wiki/Section_230 https://en.wikipedia.org/wiki/Section_230
- 4y ago