5 ms·

Wait wait wait, so it's acceptable now that government/LEO give a list of forbidden hashes to service providers with the expectation that they filter their netw

by morsch 12y ago

Wait wait wait, so it's acceptable now that government/LEO give a list of forbidden hashes to service providers with the expectation that they filter their networks and report anybody who's a match? Because that sounds bat shit insane. Who's to say protest-plans.ppt won't be the next thing on the list? Or justin-bieber.mp3? Or cia-torture-prisons.txt? With a hash, the ISP doesn't even know what the file is about before they detect a match, and having them look closer at matches and decide whether the government needs to know is just as insane.

meowface 12y ago
>Who's to say protest-plans.ppt won't be the next thing on the list? Or justin-bieber.mp3? Or cia-torture-prisons.txt? Because possession of those files doesn't break federal law, but possession of child pornography does? And even if those things were added, obviously Google does some sort of rough verification process of the nature of the content being sent if it matches a hash. Service providers have been sharing image hashes of CP for 6+ years now. It's definitely not just Google. Your slippery slope makes no sense. This is probably the absolute least invasive thing that Google does. You are aware they show ads based on the actual text content of your emails, right?
- DanBC 12y ago
  > Because possession of those files doesn't break federal law Depends what country you're in. > Your slippery slope makes no sense. I agree. There is a very big difference between a pirated Justin Bieber MP3 file and images of children being raped.
  - deleted 12y ago
    [deleted]
- morsch 12y ago
  I have zero confidence in the LEO/domestic intelligence services caring whether protest-plans.ppt break federal law. And I don't want Google to have to implement some completely opaque "rough verification process" to determine whether the government requested trigger is valid in one case but not in another.
  - tptacek 12y ago
    I always do a sort of mental double-take when I see comments like this. If you have zero confidence in law enforcement caring about the law, then what does any of this matter? What's to discuss? The government is going to do whatever it wants, and there are no policy implications to Google's detection of child pornography. There's nowhere to go from that rhetorical position, so why even bother picking specific things in opposing comments to respond to?
    - ObviousScience 12y ago
      This is nonsense. It's perfectly consistent to think that law enforcement is willing to cheat when they can get away with it, but that other domestic forces are capable of holding them accountable for that. Further, it strawmans the position: they do think that law enforcement cares about the law, just not so much as catching lawbreakers who aren't part of the political or policing class, and is willing to cheat the law in order to "fulfill the deeper mission", or some ascribed view like that. A natural reply to thinking that law enforcement will cheat if it can is to think that other large, entrenched players must force law-enforcement to disclose its actions for review before lending their power to law enforcement goals - which is exactly the stance in insisting that Google not respond to hashed lists, and instead demand to see the files that they're supposed to be blocking. It increases the number of players necessary to cheat successfully, and hence removes some of the incentive of law enforcement to cheat.
      - tptacek 12y ago
        Your comment would be stronger without the first sentence, but glass houses, stones, &c. Since the rest of it was a good-faith response to my question: I'm not sure I understand how it's consistent to believe that law enforcement (to be precise: "LEOs and domestic intelligence") are inclined to ignore the law entirely, and believe that there's accountability. If there was accountability, they could not easily incline towards ignoring the law, because doing that would have consequences. Belief in the former condition seems to equate to disbelief of the latter. I don't think I responded to a straw man argument. I think you rehabilitated a broken argument and then supposed that I was responding to that better argument instead of the one that was actually posed.
- im3w1l 12y ago
  But it is a lot easier to abuse existing infrastructure, than to build abusive infrastructure from scratch.
- waterlesscloud 12y ago
  Transmission of classified documents to unauthorized persons does in fact break federal law. Why wouldn't that also be included, then?
  - tptacek 12y ago
    One reason is that it's extraordinarily expensive to enlist Google and Microsoft in the pursuit of government secrets compared to the alternatives. The USG (like most F-500 companies) invests a lot of money in patrolling the borders of its networks for breaches of sensitive information. For commercial entities, there's a whole class of product ("data loss prevention" systems) that do this out of the box. Since (a) the information the USG is watching for is generated from within their network borders, and (b) USG isn't comfortable sharing that information or artifacts of that information with third parties, it doesn't make a lot of sense for them to invest a huge amount of effort (both technically and legally) to come up with some cockamamie scheme to have Google look for those secrets without knowing what the secret is. Instead of engaging with the intractable problem of having Google dragnet GMail for documents Google is not allowed to read, the USG is much more likely to just subpoena the accounts of people it suspects to be trafficking in those documents.
    - waterlesscloud 12y ago
      Not that I have much faith in the idea that something being extraordinarily expensive prevents the government from pursuing a particular course, but what you say would cover most cases. But let's say instead of classified documents, we're talking about al-qaeda-training-manual.pdf. One can easily imagine such a document violating federal laws. Say there are various documents the government catches during a raid, on say Bin Laden's compound for example. Say the government would like Google to look around and see who has trafficked in these documents. They don't have to tell Google what the documents are, exactly, just provide hashes/file sizes/ etc. Why wouldn't this happen?
      - tptacek 12y ago
        I don't know. Maybe it would. And, my comfort level with that happening depends a whole lot on the circumstances.
- greggman 12y ago
  His slippery slope does make sense. Your argument seems to suggest you would think it's okay for the police to show up at your door everyday and go though your files looking for child porn as long as they promise not to care about anything else like that weed you've got or those taxes you didn't file perfectly. I'm assuming you wouldn't be happy with that . Google shouldn't be looking in my email in the first place period for anything . The end. I'll give them permission to automate scanning to place ads but that's it. Anything past that is out full stop
  - DanBC 12y ago
    > Google shouldn't be looking in my email in the fiery place period for anything . The end. I'll give them permission to automate scanning to place ads but that's it. Anything past that is out full stop All services have clauses saying what you're not allowed to do on those services; and that they monitor to ensure that you're not doing that. I'd be amazed if the user agreement you signed when you started using Google (assuming you use Google) didn't have that.
  - martey 12y ago
    > I'll give them permission to automate scanning to place ads but that's it. Anything past that is out full stop If you look at the relevant section of Google's Privacy Policy - https://www.google.com/intl/en/policies/privacy/#nosharing https://www.google.com/intl/en/policies/privacy/#nosharing - you have already given them permission to access your email to "meet any applicable law, regulation, legal process or enforceable governmental request".
  - meowface 12y ago
    You do realize that automation of scanning to place ads is FAR more invasive to your privacy than what's being described in this article? Scanning if any of the images you sent, when hashed, meet a certain hash is about as blind and automated as you can possibly get. They have no clue of what images you send or what they look like, they just know if you sent an image that is an exact match to an image of child pornography. No one is actually reading through emails and "looking" at the pictures; a program is hashing them all.
tptacek 12y ago
Well, for one thing, no law exists that would criminalize "protest-plans.ppt", and it's unlikely that any law proposed to do that would survive in court. So there's that difference.
- ObviousScience 12y ago
  Yes, the US government is full of respectable agencies like the CIA, who obviously would never do something like spy on the team investigating their likely criminal actions, and attempt to dynamically reclassify materials so as to stall out the investigation team. How could a citizen possibly think that government agencies aren't infallibly interested in the citizen's good and question secret block lists?
  - tptacek 12y ago
    The CIA doesn't have the authority to criminalize "protest-plans.ppt". They're part of the executive branch. To criminalize protest plans, Congress would need to pass a law, one that at the very least left room for executive branch rulemaking about which slide decks were or weren't criminal. And, of course, that law would not survive in court. Of course, you aren't talking about outlawing documents. You're suggesting a different case, one in which hashes of documents are used not for criminal investigations but to keep tabs on citizens. But that wasn't the case I was responding to.
- ruloo 12y ago
  We don't need the courts to make it illegal. You can damage political adversaries in court of public opinion by leaking other damaging information. protest-plans.ppt could just be a way to identify political threats in order to flag and search other traffic records. we know that the intelligence agencies spy on politicians. A dirty picture or chat affair leaked to the press destroys a user before they even get into an office of power. or detects and removes someone in position to be a whistleblower.
DanBC 12y ago
It only sounds batshit insane if you're used to oppressive misuse of law enforcement. Living in the UK it sounds reasonable to me that when a child abuser is caught with images of child sexual abuse that law enforcment: 1: tries to identify and help the victim 2: tries to identify and punish the perpetrator 3: tries to find and punish other people using these same images Whilst I disagree with drug laws I think it is sensible (within the context of thise laws) that customs officers inspect packages passing the borders to find contraband.

by morsch 12y ago

meowface 12y ago

>Who's to say protest-plans.ppt won't be the next thing on the list? Or justin-bieber.mp3? Or cia-torture-prisons.txt? Because possession of those files doesn't break federal law, but possession of child pornography does? And even if those things were added, obviously Google does some sort of rough verification process of the nature of the content being sent if it matches a hash. Service providers have been sharing image hashes of CP for 6+ years now. It's definitely not just Google. Your slippery slope makes no sense. This is probably the absolute least invasive thing that Google does. You are aware they show ads based on the actual text content of your emails, right?

DanBC 12y ago
> Because possession of those files doesn't break federal law Depends what country you're in. > Your slippery slope makes no sense. I agree. There is a very big difference between a pirated Justin Bieber MP3 file and images of children being raped.
- deleted 12y ago
  [deleted]
morsch 12y ago
I have zero confidence in the LEO/domestic intelligence services caring whether protest-plans.ppt break federal law. And I don't want Google to have to implement some completely opaque "rough verification process" to determine whether the government requested trigger is valid in one case but not in another.
- tptacek 12y ago
  I always do a sort of mental double-take when I see comments like this. If you have zero confidence in law enforcement caring about the law, then what does any of this matter? What's to discuss? The government is going to do whatever it wants, and there are no policy implications to Google's detection of child pornography. There's nowhere to go from that rhetorical position, so why even bother picking specific things in opposing comments to respond to?
  - ObviousScience 12y ago
    This is nonsense. It's perfectly consistent to think that law enforcement is willing to cheat when they can get away with it, but that other domestic forces are capable of holding them accountable for that. Further, it strawmans the position: they do think that law enforcement cares about the law, just not so much as catching lawbreakers who aren't part of the political or policing class, and is willing to cheat the law in order to "fulfill the deeper mission", or some ascribed view like that. A natural reply to thinking that law enforcement will cheat if it can is to think that other large, entrenched players must force law-enforcement to disclose its actions for review before lending their power to law enforcement goals - which is exactly the stance in insisting that Google not respond to hashed lists, and instead demand to see the files that they're supposed to be blocking. It increases the number of players necessary to cheat successfully, and hence removes some of the incentive of law enforcement to cheat.
    - tptacek 12y ago
      Your comment would be stronger without the first sentence, but glass houses, stones, &c. Since the rest of it was a good-faith response to my question: I'm not sure I understand how it's consistent to believe that law enforcement (to be precise: "LEOs and domestic intelligence") are inclined to ignore the law entirely, and believe that there's accountability. If there was accountability, they could not easily incline towards ignoring the law, because doing that would have consequences. Belief in the former condition seems to equate to disbelief of the latter. I don't think I responded to a straw man argument. I think you rehabilitated a broken argument and then supposed that I was responding to that better argument instead of the one that was actually posed.
im3w1l 12y ago
But it is a lot easier to abuse existing infrastructure, than to build abusive infrastructure from scratch.
waterlesscloud 12y ago
Transmission of classified documents to unauthorized persons does in fact break federal law. Why wouldn't that also be included, then?
- tptacek 12y ago
  One reason is that it's extraordinarily expensive to enlist Google and Microsoft in the pursuit of government secrets compared to the alternatives. The USG (like most F-500 companies) invests a lot of money in patrolling the borders of its networks for breaches of sensitive information. For commercial entities, there's a whole class of product ("data loss prevention" systems) that do this out of the box. Since (a) the information the USG is watching for is generated from within their network borders, and (b) USG isn't comfortable sharing that information or artifacts of that information with third parties, it doesn't make a lot of sense for them to invest a huge amount of effort (both technically and legally) to come up with some cockamamie scheme to have Google look for those secrets without knowing what the secret is. Instead of engaging with the intractable problem of having Google dragnet GMail for documents Google is not allowed to read, the USG is much more likely to just subpoena the accounts of people it suspects to be trafficking in those documents.
  - waterlesscloud 12y ago
    Not that I have much faith in the idea that something being extraordinarily expensive prevents the government from pursuing a particular course, but what you say would cover most cases. But let's say instead of classified documents, we're talking about al-qaeda-training-manual.pdf. One can easily imagine such a document violating federal laws. Say there are various documents the government catches during a raid, on say Bin Laden's compound for example. Say the government would like Google to look around and see who has trafficked in these documents. They don't have to tell Google what the documents are, exactly, just provide hashes/file sizes/ etc. Why wouldn't this happen?
    - tptacek 12y ago
      I don't know. Maybe it would. And, my comfort level with that happening depends a whole lot on the circumstances.
greggman 12y ago
His slippery slope does make sense. Your argument seems to suggest you would think it's okay for the police to show up at your door everyday and go though your files looking for child porn as long as they promise not to care about anything else like that weed you've got or those taxes you didn't file perfectly. I'm assuming you wouldn't be happy with that . Google shouldn't be looking in my email in the first place period for anything . The end. I'll give them permission to automate scanning to place ads but that's it. Anything past that is out full stop
- DanBC 12y ago
  > Google shouldn't be looking in my email in the fiery place period for anything . The end. I'll give them permission to automate scanning to place ads but that's it. Anything past that is out full stop All services have clauses saying what you're not allowed to do on those services; and that they monitor to ensure that you're not doing that. I'd be amazed if the user agreement you signed when you started using Google (assuming you use Google) didn't have that.
- martey 12y ago
  > I'll give them permission to automate scanning to place ads but that's it. Anything past that is out full stop If you look at the relevant section of Google's Privacy Policy - https://www.google.com/intl/en/policies/privacy/#nosharing https://www.google.com/intl/en/policies/privacy/#nosharing - you have already given them permission to access your email to "meet any applicable law, regulation, legal process or enforceable governmental request".
- meowface 12y ago
  You do realize that automation of scanning to place ads is FAR more invasive to your privacy than what's being described in this article? Scanning if any of the images you sent, when hashed, meet a certain hash is about as blind and automated as you can possibly get. They have no clue of what images you send or what they look like, they just know if you sent an image that is an exact match to an image of child pornography. No one is actually reading through emails and "looking" at the pictures; a program is hashing them all.

tptacek 12y ago

Well, for one thing, no law exists that would criminalize "protest-plans.ppt", and it's unlikely that any law proposed to do that would survive in court. So there's that difference.

ObviousScience 12y ago
Yes, the US government is full of respectable agencies like the CIA, who obviously would never do something like spy on the team investigating their likely criminal actions, and attempt to dynamically reclassify materials so as to stall out the investigation team. How could a citizen possibly think that government agencies aren't infallibly interested in the citizen's good and question secret block lists?
- tptacek 12y ago
  The CIA doesn't have the authority to criminalize "protest-plans.ppt". They're part of the executive branch. To criminalize protest plans, Congress would need to pass a law, one that at the very least left room for executive branch rulemaking about which slide decks were or weren't criminal. And, of course, that law would not survive in court. Of course, you aren't talking about outlawing documents. You're suggesting a different case, one in which hashes of documents are used not for criminal investigations but to keep tabs on citizens. But that wasn't the case I was responding to.
ruloo 12y ago
We don't need the courts to make it illegal. You can damage political adversaries in court of public opinion by leaking other damaging information. protest-plans.ppt could just be a way to identify political threats in order to flag and search other traffic records. we know that the intelligence agencies spy on politicians. A dirty picture or chat affair leaked to the press destroys a user before they even get into an office of power. or detects and removes someone in position to be a whistleblower.

DanBC 12y ago

It only sounds batshit insane if you're used to oppressive misuse of law enforcement. Living in the UK it sounds reasonable to me that when a child abuser is caught with images of child sexual abuse that law enforcment: 1: tries to identify and help the victim 2: tries to identify and punish the perpetrator 3: tries to find and punish other people using these same images Whilst I disagree with drug laws I think it is sensible (within the context of thise laws) that customs officers inspect packages passing the borders to find contraband.