4 ms·

> If the photos are hosted on Google's servers, they have every right to scan whatever they want. Google is trying to get people arrested because Android backe

> If the photos are hosted on Google's servers, they have every right to scan whatever they want. Google is trying to get people arrested because Android backed up their personal photo libraries to Google Photos. > The day after Mark’s troubles started, the same scenario was playing out in Texas. A toddler in Houston had an infection in his “intimal parts,” wrote his father in an online post that I stumbled upon while reporting out Mark’s story. At the pediatrician’s request, Cassio, who also asked to be identified only by his first name, used an Android to take photos, which were backed up automatically to Google Photos. He then sent them to his wife via Google’s chat service. https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil... > Not scanning for CSAM on your own servers isn't a realistic expectation. Google isn't just scanning for known examples of kiddie porn, they have developed an algorithm that scans for any image of naked children and, as usual, there doesn't seem to be a human in the loop when their algorithm makes a bad call.

knaik94 4y ago
It's Google's servers. I imagine every content hosting company has a heuristics based approach to detecting CSAM. Google has a habit of tuning moderation algorithms for false positives rather than missed positives. Not having a human in the loop is terrible and a problem frequently when it comes to getting support from Google companies. That's a separate issue from Google or Dropbox being able to scan unencrypted files for CSAM. Google's policy of automating as much as it can has tons of downsides. But it's understandable when you look at the scale Google functions. It's important to separate the policy of scanning from Google's terrible appeal process and the algorithm false positives. I would feel differently if the story was that Android scanned an outgoing SMS or a photo saved locally. I am not sure where the balance point is to identify and report CSAM while also respecting user's rights to privacy.
- nanidin 4y ago
  I wonder how algorithms like Stable Diffusion will impact CSAM detection policies.
  - Sporktacular 4y ago
    If a child isn't exploited to make it, it's not technically CSAM. But you could maybe argue that if the ML model is based on CSAM then it's a product of it and would need to be banned.
- GeekyBear 4y ago
  > It's Google's servers. I imagine every content hosting company has a heuristics based approach to detecting CSAM. The slippery slope claim made in the past was that they were only looking for files that match known examples of kiddie porn. For instance, this tech from Microsoft: >PhotoDNA creates a unique digital signature (known as a “hash”) of an image which is then compared against signatures (hashes) of other photos to find copies of the same image. When matched with a database containing hashes of previously identified illegal images, PhotoDNA is an incredible tool to help detect, disrupt and report the distribution of child exploitation material. https://www.microsoft.com/en-us/photodna https://www.microsoft.com/en-us/photodna Reporting parents to police because they took pictures of their child's first bath and those photos were automatically backed up to Google servers is much, much worse.
  - Eisenstein 4y ago
    Please stop using 'child's first bath' as an indicator of overreaction by the algorithm. It is not helpful to argue something which will make you look hyperbolic or histrionic once your argument is looked into. 1. The picture(s) in question mentioned above which got an account shut down and police notified was not a 'child in a bath', it was close ups of a child's genitals 2. You are probably not a parent since a child's 'first bath' is not a thing. They are bathed as infants starting immediately. If you are referring to a child's first independent bath, then no one should be taking pictures since private bathing is not something that should be intruded upon for picture taking All that said, I agree with you.
    - GeekyBear 4y ago
      > 1. The picture(s) in question mentioned above which got an account shut down and police notified was not a 'child in a bath', it was close ups of a child's genitals No, the example of Google calling the police on a parent given in the NYT article was because the parent sought medical assistance for their child during lockdown and the doctor requested pictures of the issue the child was having. This is no more an acceptable reason for Google to report parents to the police for child abuse than taking pictures of your child's first bath, and taking pictures of your child's milestones has long been something that people have done.
- ryanobjc 4y ago
  How do you take a photo on android to only store it locally? The whole photos experience on Android has been simplified to break that distinction and there is no way to even really know or realize what is happening - BY DESIGN. The real answer here is, again, Android is not privacy first by default. BTW parents taking medical pictures of their children != CSAM which is an acronym for "Child Sexual Abuse Material"... Taking care of your child's medical problem isn't "sexual abuse" despite the conflation of the two people are glossing over in this thread.
  - knaik94 4y ago
    I installed an offline gallery and disabled Google Photos. For years and years Samsung android phones didn't have the option of cloud backups. There's a very clear distinction between local and cloud, every single photo taken using any camera app is local only. Galleries, like Google Photos, and backup services like Dropbox have an explicit setting to enable cloud backup. Google Photo backup is very distinctly different from Google Drive and phone backups in general. I use FolderSync to sync it with a self hosted NextCloud instance. If I am travelling, I prefer using Syncthing, a wifi file server running off the phone, or a physical wire to transfer photos. I know exactly what pictures are sent where and backed up with what method. I am not sure why you believe Android treats photo and file management like a black box, I don't believe Apple does either. Apple iOS devices are much more difficult to manually backup as they only allow background photo sync to iCloud, if the screen is turned off syncing to a third party will most likely fail. But there is a straightforward toggle to disable Photos backup to iCloud. Android file management is superior to any other mobile OS. Android is file privacy first by design, as long as you are comfortable managing backup and syncing with self-hosted and self-managed solutions. I have gone the additional step of rooting my phone as well to get around any Android limitations on what folders certain apps have access to. No one is arguing against the last point you made. No one was conflating the two.
    - GeekyBear 4y ago
      > There's a very clear distinction between local and cloud, every single photo taken using any camera app is local only. >Android is file privacy first by design Yet we have the NYTimes article stating that the only ways Google could have access to the photos they tried to have a parent arrested for would be to scan content on the device, scan automatic backups, or spy on the text messages sent from the device. The examples in the story were parents sharing images directly with their doctor, not the with the general public.
shitlord 4y ago
Google scans your data for anything it finds objectionable. Here's another example of Google flagging and deleting a video from a user's Drive storage: https://twitter.com/nicholasdeorio/status/1583866251339698180?t=S31wdnWV_rFQ5BdSBGMdAA&s=19 https://twitter.com/nicholasdeorio/status/158386625133969818...
- GeekyBear 4y ago
  There are many examples of Google's automated systems making egregious mistakes while scanning user data with no human in the loop to review the decision. >Ed Francis studies the evolution of military technology over at his YouTube channel, Armoured Archives. But this week, Francis says five years’ worth of research stored on Google Drive has become inaccessible thanks to Google’s automated error. Francis says the file in question was simply a collection of data on various tanks for a coming video on how military vehicles have evolved across historical conflicts. But Google’s automated systems deemed the file a terrorist threat, resulting in a complete lockdown of his YouTube, GMail, and Google Drive accounts. https://www.vice.com/en/article/qj8yj7/google-locks-historians-account-over-terrorism-research-videos https://www.vice.com/en/article/qj8yj7/google-locks-historia... Having a shitty algorithm kill your whole Google account with no way to reach a human to fix the problem is one thing. Having a shitty algorithm report you to the police for taking pictures of your child's first bath is a bridge too far.
  - doomslice 4y ago
    I'm not defending this at all, but one of the reasons why there are no (or few) humans that can be contacted is that they* said that it was tried before and it caused a lot more issues with mistakes/takeovers due to social engineering. * Can't remember who said it but it was at a town hall this year
    - GeekyBear 4y ago
      > one of the reasons why there are no (or few) humans that can be contacted is that they* said that it was tried before This just sounds like yet another excuse for holding payroll down as much as possible. If I am a customer of Amazon, Apple, Netflix, Walmart or any number of the other companies with a similar market cap, I can get access to real live human beings who provide customer support.

knaik94 4y ago

It's Google's servers. I imagine every content hosting company has a heuristics based approach to detecting CSAM. Google has a habit of tuning moderation algorithms for false positives rather than missed positives. Not having a human in the loop is terrible and a problem frequently when it comes to getting support from Google companies. That's a separate issue from Google or Dropbox being able to scan unencrypted files for CSAM. Google's policy of automating as much as it can has tons of downsides. But it's understandable when you look at the scale Google functions. It's important to separate the policy of scanning from Google's terrible appeal process and the algorithm false positives. I would feel differently if the story was that Android scanned an outgoing SMS or a photo saved locally. I am not sure where the balance point is to identify and report CSAM while also respecting user's rights to privacy.

nanidin 4y ago
I wonder how algorithms like Stable Diffusion will impact CSAM detection policies.
- Sporktacular 4y ago
  If a child isn't exploited to make it, it's not technically CSAM. But you could maybe argue that if the ML model is based on CSAM then it's a product of it and would need to be banned.
GeekyBear 4y ago
> It's Google's servers. I imagine every content hosting company has a heuristics based approach to detecting CSAM. The slippery slope claim made in the past was that they were only looking for files that match known examples of kiddie porn. For instance, this tech from Microsoft: >PhotoDNA creates a unique digital signature (known as a “hash”) of an image which is then compared against signatures (hashes) of other photos to find copies of the same image. When matched with a database containing hashes of previously identified illegal images, PhotoDNA is an incredible tool to help detect, disrupt and report the distribution of child exploitation material. https://www.microsoft.com/en-us/photodna https://www.microsoft.com/en-us/photodna Reporting parents to police because they took pictures of their child's first bath and those photos were automatically backed up to Google servers is much, much worse.
- Eisenstein 4y ago
  Please stop using 'child's first bath' as an indicator of overreaction by the algorithm. It is not helpful to argue something which will make you look hyperbolic or histrionic once your argument is looked into. 1. The picture(s) in question mentioned above which got an account shut down and police notified was not a 'child in a bath', it was close ups of a child's genitals 2. You are probably not a parent since a child's 'first bath' is not a thing. They are bathed as infants starting immediately. If you are referring to a child's first independent bath, then no one should be taking pictures since private bathing is not something that should be intruded upon for picture taking All that said, I agree with you.
  - GeekyBear 4y ago
    > 1. The picture(s) in question mentioned above which got an account shut down and police notified was not a 'child in a bath', it was close ups of a child's genitals No, the example of Google calling the police on a parent given in the NYT article was because the parent sought medical assistance for their child during lockdown and the doctor requested pictures of the issue the child was having. This is no more an acceptable reason for Google to report parents to the police for child abuse than taking pictures of your child's first bath, and taking pictures of your child's milestones has long been something that people have done.
ryanobjc 4y ago
How do you take a photo on android to only store it locally? The whole photos experience on Android has been simplified to break that distinction and there is no way to even really know or realize what is happening - BY DESIGN. The real answer here is, again, Android is not privacy first by default. BTW parents taking medical pictures of their children != CSAM which is an acronym for "Child Sexual Abuse Material"... Taking care of your child's medical problem isn't "sexual abuse" despite the conflation of the two people are glossing over in this thread.
- knaik94 4y ago
  I installed an offline gallery and disabled Google Photos. For years and years Samsung android phones didn't have the option of cloud backups. There's a very clear distinction between local and cloud, every single photo taken using any camera app is local only. Galleries, like Google Photos, and backup services like Dropbox have an explicit setting to enable cloud backup. Google Photo backup is very distinctly different from Google Drive and phone backups in general. I use FolderSync to sync it with a self hosted NextCloud instance. If I am travelling, I prefer using Syncthing, a wifi file server running off the phone, or a physical wire to transfer photos. I know exactly what pictures are sent where and backed up with what method. I am not sure why you believe Android treats photo and file management like a black box, I don't believe Apple does either. Apple iOS devices are much more difficult to manually backup as they only allow background photo sync to iCloud, if the screen is turned off syncing to a third party will most likely fail. But there is a straightforward toggle to disable Photos backup to iCloud. Android file management is superior to any other mobile OS. Android is file privacy first by design, as long as you are comfortable managing backup and syncing with self-hosted and self-managed solutions. I have gone the additional step of rooting my phone as well to get around any Android limitations on what folders certain apps have access to. No one is arguing against the last point you made. No one was conflating the two.
  - GeekyBear 4y ago
    > There's a very clear distinction between local and cloud, every single photo taken using any camera app is local only. >Android is file privacy first by design Yet we have the NYTimes article stating that the only ways Google could have access to the photos they tried to have a parent arrested for would be to scan content on the device, scan automatic backups, or spy on the text messages sent from the device. The examples in the story were parents sharing images directly with their doctor, not the with the general public.

shitlord 4y ago

Google scans your data for anything it finds objectionable. Here's another example of Google flagging and deleting a video from a user's Drive storage: https://twitter.com/nicholasdeorio/status/1583866251339698180?t=S31wdnWV_rFQ5BdSBGMdAA&s=19 https://twitter.com/nicholasdeorio/status/158386625133969818...

GeekyBear 4y ago
There are many examples of Google's automated systems making egregious mistakes while scanning user data with no human in the loop to review the decision. >Ed Francis studies the evolution of military technology over at his YouTube channel, Armoured Archives. But this week, Francis says five years’ worth of research stored on Google Drive has become inaccessible thanks to Google’s automated error. Francis says the file in question was simply a collection of data on various tanks for a coming video on how military vehicles have evolved across historical conflicts. But Google’s automated systems deemed the file a terrorist threat, resulting in a complete lockdown of his YouTube, GMail, and Google Drive accounts. https://www.vice.com/en/article/qj8yj7/google-locks-historians-account-over-terrorism-research-videos https://www.vice.com/en/article/qj8yj7/google-locks-historia... Having a shitty algorithm kill your whole Google account with no way to reach a human to fix the problem is one thing. Having a shitty algorithm report you to the police for taking pictures of your child's first bath is a bridge too far.
- doomslice 4y ago
  I'm not defending this at all, but one of the reasons why there are no (or few) humans that can be contacted is that they* said that it was tried before and it caused a lot more issues with mistakes/takeovers due to social engineering. * Can't remember who said it but it was at a town hall this year
  - GeekyBear 4y ago
    > one of the reasons why there are no (or few) humans that can be contacted is that they* said that it was tried before This just sounds like yet another excuse for holding payroll down as much as possible. If I am a customer of Amazon, Apple, Netflix, Walmart or any number of the other companies with a similar market cap, I can get access to real live human beings who provide customer support.