4 ms·

I do have one question. What if it wasn't child porn? Would it be right for them to go looking through your email for evidence of tax fraud? How about smoking w

I do have one question. What if it wasn't child porn? Would it be right for them to go looking through your email for evidence of tax fraud? How about smoking weed? Where do you draw the line? The question isn't "do the ends justify the means?" the question should be "What if they're mistaken?" EDIT: While I stand by my questions I acknowledge the use of PhotoDNA as opposed to simply rifling through someone's inbox.

krapp 12y ago
Is Google legally liable if it's discovered that they're hosting emails with child porn attached? If so, then does that suggest that Google owns the email hosted on their servers, and has the right to examine them if they want?
- icebraining 12y ago
  I think Google's only liable if they know about it and didn't report. According to paragraph (f) of the 18 U.S. Code § 2258A, Protection of Privacy.— Nothing in this section shall be construed to require an electronic communication service provider or a remote computing service provider to— (1) monitor any user, subscriber, or customer of that provider; (2) monitor the content of any communication of any person described in paragraph (1); or (3) affirmatively seek facts or circumstances described in sections (a) and (b). http://www.law.cornell.edu/uscode/text/18/2258A?quicktabs_8=2#quicktabs-8 http://www.law.cornell.edu/uscode/text/18/2258A?quicktabs_8=...
lclarkmichalek 12y ago
Your question doesn't seem to be "What if they're mistaken?"; it seems you are more asking "will they stop at child porn?". Anyway, I'd agree with jfoutz, in saying that society has dealt with these problems before, and has managed to create a fairly good line as to where something must be reported, and where a person's privacy becomes more important. That's not to say they will manage to create that line again, but it's also not to say they won't. Regardless, I don't think it's an unavoidable slippery slope. As for "What if they're mistaken?", well I highly doubt anyone will be convicted off the basis of an automated image recognition tool alone. If they are mistaken from time to time, then the person will probably have a warrant (ha) issued for their email, and any investigation would follow normally. If they're mistaken very often (i.e. the PhotoDNA implementation turns out to be shit), then the police (or whoever is receiving these reports) will probably stop caring, and nothing will have changed.
- PhasmaFelis 12y ago
  > As for "What if they're mistaken?", well I highly doubt anyone will be convicted off the basis of an automated image recognition tool alone. "Convicted" isn't the fear, post-9/11. The fear is getting put on a secret government watch list and being harassed for the rest of your life with no chance to ever clear your name, or even to be told why you're being screwed.
  - lclarkmichalek 12y ago
    Isn't that mainly terrorism, not paedophilia? Anyway, at least in this case, the tip was sent to the National Center for Missing and Exploited Children, which, being a private non profit, doesn't seem too closely associated with the NSA/DHS/whatever government organisation you believe maintains these lists.
    - DanBC 12y ago
      The UK version - the Internet Watch Foundation - is also a charity but you'd be a foolish UK ISP to ignore what they say. https://www.iwf.org.uk/ https://www.iwf.org.uk/
      - lclarkmichalek 12y ago
        The UK equivalent would probably be the NSPCC. If Google had a tip of an individual person distributing these images they would not contact the IWF. That would be for a website that was distributing these images.
        DanBC 12y ago
        In the UK the IWF provide information about what to block and take reports about hosted images. CEOP are the group that Google would report people to. http://ceop.police.uk/ http://ceop.police.uk/
    - throwaway0010 12y ago
      "Isn't that mainly terrorism, not paedophilia?" It's nothing at all. Plenty of innocent people are on those lists having done nothing. That the pretext is terrorism is irrelevant.
at-fates-hands 12y ago
You mean like the football coach in Minnesota that had some videos of his kids playing after a bath in his cellphone and got arrested for child porn? http://news.yahoo.com/ex-minnesota-state-mankato-coach-returning-job-201558492--spt.html http://news.yahoo.com/ex-minnesota-state-mankato-coach-retur... I'm not sure if there is a ton of oversight for what Google does, but I agree with your point there needs to some kind of vetting to determine guilt beyond a reasonable doubt. In the case here, the man had quite a history of previous behavior that would make it a pretty clear choice as to what Google needed to do. In the case of the football coach who only had the innocent video of his kids playing, there was some obvious signs that were ignored in the process of steamrolling a mans career, his reputation and his standing in the community where he's lived his whole life.
- IanCal 12y ago
  Isn't what's happening here quite different? They'd be matching against a know list of images.
  - tptacek 12y ago
    Yes. Robust hashing wouldn't flag a parent's personal pictures of their young kids at bathtime. We aren't discussing nudity detection algorithms.
tptacek 12y ago
They can't use the same technique, or any technique with similar privacy tradeoffs, to look for tax fraud. The scheme they use here only works with documents known to authorities, whose possession is criminalized. The technique (searches for collisions in a corpus of robust hashes) can't generate new information for authorities about documents they haven't seen. And there is no case in which a person could possess those documents where the government wouldn't have a reasonable interest in knowing that; in other words, there's no valid privacy interest intrinsic in possessing one of the specific documents they're looking for. None of those conditions exists for tax fraud, or for that matter terrorism. The slippery slope you're invoking doesn't really exist.
- potatosareok 12y ago
  Searching for collisions in a corpus of robust hashes seems to me like the post office drug sniffing packages, and people seem to be ok with that. The same way the drug sniff dog won't give away anything other then drug/no drugs (is that how they work? I thought so?), this scheme shouldn't give anything away more then CP/no CP. At the same time I think that to eliminate CP entirely you need to get rid of some of the freedoms we enjoy. I'm sure you can 100% get rid of CP if you track what everyone is looking at on their computers, but is that a tradeoff you want to make? Even if the filter really only can ever report looking at CP/not looking at CP, would you be comfortable with that running on everything you own? I could be arguing to a nonsensical extreme, but the NSA tracking all data is following this to some perverted extreme - if we can track EVERYTHING that is going on, and eventually actually make actionable data out of it, we can catch all the criminals/stop crime. But I think we accept the possibility of a bit more crime in exchange for preserving some of our freedoms.
- TheOtherHobbes 12y ago
  >They can't use the same technique It's not the technique, it's the precedent. The technology is really not the point here. >None of those conditions exists for tax fraud, or for that matter terrorism. Actually they exist for both. Google is only one possible access point for monitoring. The question is whether we want Internet services of all kinds of to be part of a culture of automated state surveillance. I'd suggest there are good reasons for answering that question with a firm 'No'.
DannyBee 12y ago
FWIW: Child abuse of most forms is subject to mandatory reporting. It is highly likely this is not as voluntary as you think. Google would likely have liability if they discovered this and didn't report.
- ruloo 12y ago
  "Google would likely have liability if they discovered this and didn't report." I agree. However, they have to look for it to discover it. The provider is safe in ignorance by default. Google has chosen to pursue this activity like an investigative agency and is using a system that seeks out specific material in an automated fashion. But i agree that now the ignorance is gone they must report it. Further i think subject nature of the content is distracting to the conversation. The problem IMO is not that google reported content. Its that google is looking for it.
DannyBee 12y ago
FWIW: Child abuse of most forms is subject to mandatory reporting. It is highly likely this is not as voluntary as you think. While in the US, they are not required to scan, this is not always true in every other country.

krapp 12y ago

Is Google legally liable if it's discovered that they're hosting emails with child porn attached? If so, then does that suggest that Google owns the email hosted on their servers, and has the right to examine them if they want?

icebraining 12y ago
I think Google's only liable if they know about it and didn't report. According to paragraph (f) of the 18 U.S. Code § 2258A, Protection of Privacy.— Nothing in this section shall be construed to require an electronic communication service provider or a remote computing service provider to— (1) monitor any user, subscriber, or customer of that provider; (2) monitor the content of any communication of any person described in paragraph (1); or (3) affirmatively seek facts or circumstances described in sections (a) and (b). http://www.law.cornell.edu/uscode/text/18/2258A?quicktabs_8=2#quicktabs-8 http://www.law.cornell.edu/uscode/text/18/2258A?quicktabs_8=...

lclarkmichalek 12y ago

Your question doesn't seem to be "What if they're mistaken?"; it seems you are more asking "will they stop at child porn?". Anyway, I'd agree with jfoutz, in saying that society has dealt with these problems before, and has managed to create a fairly good line as to where something must be reported, and where a person's privacy becomes more important. That's not to say they will manage to create that line again, but it's also not to say they won't. Regardless, I don't think it's an unavoidable slippery slope. As for "What if they're mistaken?", well I highly doubt anyone will be convicted off the basis of an automated image recognition tool alone. If they are mistaken from time to time, then the person will probably have a warrant (ha) issued for their email, and any investigation would follow normally. If they're mistaken very often (i.e. the PhotoDNA implementation turns out to be shit), then the police (or whoever is receiving these reports) will probably stop caring, and nothing will have changed.

PhasmaFelis 12y ago
> As for "What if they're mistaken?", well I highly doubt anyone will be convicted off the basis of an automated image recognition tool alone. "Convicted" isn't the fear, post-9/11. The fear is getting put on a secret government watch list and being harassed for the rest of your life with no chance to ever clear your name, or even to be told why you're being screwed.
- lclarkmichalek 12y ago
  Isn't that mainly terrorism, not paedophilia? Anyway, at least in this case, the tip was sent to the National Center for Missing and Exploited Children, which, being a private non profit, doesn't seem too closely associated with the NSA/DHS/whatever government organisation you believe maintains these lists.
  - DanBC 12y ago
    The UK version - the Internet Watch Foundation - is also a charity but you'd be a foolish UK ISP to ignore what they say. https://www.iwf.org.uk/ https://www.iwf.org.uk/
    - lclarkmichalek 12y ago
      The UK equivalent would probably be the NSPCC. If Google had a tip of an individual person distributing these images they would not contact the IWF. That would be for a website that was distributing these images.
      - DanBC 12y ago
        In the UK the IWF provide information about what to block and take reports about hosted images. CEOP are the group that Google would report people to. http://ceop.police.uk/ http://ceop.police.uk/
  - throwaway0010 12y ago
    "Isn't that mainly terrorism, not paedophilia?" It's nothing at all. Plenty of innocent people are on those lists having done nothing. That the pretext is terrorism is irrelevant.

at-fates-hands 12y ago

You mean like the football coach in Minnesota that had some videos of his kids playing after a bath in his cellphone and got arrested for child porn? http://news.yahoo.com/ex-minnesota-state-mankato-coach-returning-job-201558492--spt.html http://news.yahoo.com/ex-minnesota-state-mankato-coach-retur... I'm not sure if there is a ton of oversight for what Google does, but I agree with your point there needs to some kind of vetting to determine guilt beyond a reasonable doubt. In the case here, the man had quite a history of previous behavior that would make it a pretty clear choice as to what Google needed to do. In the case of the football coach who only had the innocent video of his kids playing, there was some obvious signs that were ignored in the process of steamrolling a mans career, his reputation and his standing in the community where he's lived his whole life.

IanCal 12y ago
Isn't what's happening here quite different? They'd be matching against a know list of images.
- tptacek 12y ago
  Yes. Robust hashing wouldn't flag a parent's personal pictures of their young kids at bathtime. We aren't discussing nudity detection algorithms.

tptacek 12y ago

They can't use the same technique, or any technique with similar privacy tradeoffs, to look for tax fraud. The scheme they use here only works with documents known to authorities, whose possession is criminalized. The technique (searches for collisions in a corpus of robust hashes) can't generate new information for authorities about documents they haven't seen. And there is no case in which a person could possess those documents where the government wouldn't have a reasonable interest in knowing that; in other words, there's no valid privacy interest intrinsic in possessing one of the specific documents they're looking for. None of those conditions exists for tax fraud, or for that matter terrorism. The slippery slope you're invoking doesn't really exist.

potatosareok 12y ago
Searching for collisions in a corpus of robust hashes seems to me like the post office drug sniffing packages, and people seem to be ok with that. The same way the drug sniff dog won't give away anything other then drug/no drugs (is that how they work? I thought so?), this scheme shouldn't give anything away more then CP/no CP. At the same time I think that to eliminate CP entirely you need to get rid of some of the freedoms we enjoy. I'm sure you can 100% get rid of CP if you track what everyone is looking at on their computers, but is that a tradeoff you want to make? Even if the filter really only can ever report looking at CP/not looking at CP, would you be comfortable with that running on everything you own? I could be arguing to a nonsensical extreme, but the NSA tracking all data is following this to some perverted extreme - if we can track EVERYTHING that is going on, and eventually actually make actionable data out of it, we can catch all the criminals/stop crime. But I think we accept the possibility of a bit more crime in exchange for preserving some of our freedoms.
TheOtherHobbes 12y ago
>They can't use the same technique It's not the technique, it's the precedent. The technology is really not the point here. >None of those conditions exists for tax fraud, or for that matter terrorism. Actually they exist for both. Google is only one possible access point for monitoring. The question is whether we want Internet services of all kinds of to be part of a culture of automated state surveillance. I'd suggest there are good reasons for answering that question with a firm 'No'.

DannyBee 12y ago

FWIW: Child abuse of most forms is subject to mandatory reporting. It is highly likely this is not as voluntary as you think. Google would likely have liability if they discovered this and didn't report.

ruloo 12y ago
"Google would likely have liability if they discovered this and didn't report." I agree. However, they have to look for it to discover it. The provider is safe in ignorance by default. Google has chosen to pursue this activity like an investigative agency and is using a system that seeks out specific material in an automated fashion. But i agree that now the ignorance is gone they must report it. Further i think subject nature of the content is distracting to the conversation. The problem IMO is not that google reported content. Its that google is looking for it.

DannyBee 12y ago

FWIW: Child abuse of most forms is subject to mandatory reporting. It is highly likely this is not as voluntary as you think. While in the US, they are not required to scan, this is not always true in every other country.