Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

ww3.ca2.uscourts.gov

Post reply on HN
Print view View original

21–30 of 316 posts

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#21

Post by kulahan »

uniformlyrandom wrote: post #12

> Google’s hash match may well have established probable cause for a warrant to allow police to conduct a visual examination of the Maher file. Very reasonable. Google can flag accounts as CP, but then a judge still needs to issue a warrant for the police to actually go and look at the file. Good job court. Extra points for reasoning about hash values.

I'm trying to imagine a more "real-world" example of this to see how I feel about it. I dislike that there is yet another loophole to gain access to peoples' data for legal reasons, but this does feel like a reasonable approach and a valid goal to pursue.

I guess it's like if someone noticed you had a case shaped exactly like a machine gun, told the police, and they went to check if it was registered or not? I suppose that seems perfectly reasonable, but I'm happy to hear counter-arguments.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#22

Post by Onavo »

uniformlyrandom wrote: post #17
henryfjordan wrote: post #2

The judge doesn't really understand a hash well. They say things like "Google assigned a hash" which is not true, Google calculated the hash. Also I'm surprised the 3rd-party doctrine doesn't apply. There's the "private search doctrine" mentioned but generally you don't have an expectation of privacy for things you share with Google

Hash can be arbitrary, the only requirement is it is a deterministic one-way function.

And it should be mostly bijective under most conditions. (This is obviously impossible in practice but hashes with common collisions shouldn't be allowed as legal evidence). Also neural/visual hashes like those used by big tech makes things tricky.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#23

Post by nokcha »

curiousllama wrote: post #6
henryfjordan wrote: post #2

The judge doesn't really understand a hash well. They say things like "Google assigned a hash" which is not true, Google calculated the hash. Also I'm surprised the 3rd-party doctrine doesn't apply. There's the "private search doctrine" mentioned but generally you don't have an expectation of privacy for things you share with Google

Out of curiosity, what is false positive rate of a hash match? If the FPR is comparable to asking a human "are these the same image?", then it would seem to be equivalent to a visual search. I wonder if (or why) human verification is actually necessary here.

For non-broken cryptographic hashes (e.g., SHA-256), the false-positive rate is negligible. Indeed, cryptographic hashes were designed so that even nation-state adversaries do not have the resources to generate two inputs that hash to the same value.

See also:

https://en.wikipedia.org/wiki/Collision_resistance

https://en.wikipedia.org/wiki/Preimage_attack

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#24

Post by gorjusborg »

curiousllama wrote: post #6
henryfjordan wrote: post #2

The judge doesn't really understand a hash well. They say things like "Google assigned a hash" which is not true, Google calculated the hash. Also I'm surprised the 3rd-party doctrine doesn't apply. There's the "private search doctrine" mentioned but generally you don't have an expectation of privacy for things you share with Google

Out of curiosity, what is false positive rate of a hash match? If the FPR is comparable to asking a human "are these the same image?", then it would seem to be equivalent to a visual search. I wonder if (or why) human verification is actually necessary here.

> Out of curiosity, what is false positive rate of a hash match?

No way to know without knowledge of the 'proprietary hashing technology'. Theoretically though, a hash can have infinitely many inputs that produce the same output.

Mismatching hash values from the same hashing algorithm can prove mismatching inputs, but matching hash values don't ensure matching inputs.

> I wonder if (or why) human verification is actually necessary here

It's not about frequency, it's about criticality of getting it right. If you are going to make a negatively life-altering report on someone, you'd better make sure the accusation is legitimate.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#25

Post by kulahan »

ziml77 wrote: post #19
superkuh wrote: post #3

It's crazy that the most dangerous people one regularly encounters can do anything they want as long as they believe they can do it. The good faith exemption has to be one of the most fascist laws on the books today. > "the good faith exception to the exclusionary rule supports denial of Maher’s suppression motion because, at the time authorities opened his uploaded file, they had a good faith basis to believe that n…

Good Samaritan laws tend to function similarly

It's not exactly the same imo, since GS laws are meant to protect someone who is genuinely trying to do what a reasonable person could consider "something positive"

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#26

Post by cool_dude85 »

kulahan wrote: post #21
uniformlyrandom wrote: post #12

> Google’s hash match may well have established probable cause for a warrant to allow police to conduct a visual examination of the Maher file. Very reasonable. Google can flag accounts as CP, but then a judge still needs to issue a warrant for the police to actually go and look at the file. Good job court. Extra points for reasoning about hash values.

I'm trying to imagine a more "real-world" example of this to see how I feel about it. I dislike that there is yet another loophole to gain access to peoples' data for legal reasons, but this does feel like a reasonable approach and a valid goal to pursue. I guess it's like if someone noticed you had a case shaped exactly like a machine gun, told the police, and they went to check if it was registered or not? I suppos…

I think the real-world analogy would be to say that the case is shaped exactly like a machine gun and the hotel calls the police, who then open the case without a warrant. The "private search" doctrine allows the police to repeat a search done by a private party, but here (as in the machine gun case), the case was not actually searched by a private party.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#27

Post by toyg »

kwanbix wrote: post #11
chaps wrote: post #9

Earlier quoted context omitted.

Erm, "Assigned" in this context is not new: https://law.justia.com/cases/federal/appellate-courts/ca5/17... "More simply, a hash value is a string of characters obtained by processing the contents of a given computer file and assigning a sequence of numbers and letters that correspond to the file’s contents." From 2018 in United States v. Reddick .

The calculation is what assigns the value.

Yes, Google's calculation.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#28

Post by SixtyHurtz »

vlovich123 wrote: post #5

> As the district court correctly ruled in the alternative, the good faith exception to the exclusionary rule supports denial of Maher’s suppression motion because, at the time authorities opened his uploaded file, they had a good faith basis to believe that no warrant was required So this means this conviction is upheld but future convictions may be overturned if they similarly don't acquire a warrant?

Yep, that's basically it.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#29

Post by mcosta »

superkuh wrote: post #3

It's crazy that the most dangerous people one regularly encounters can do anything they want as long as they believe they can do it. The good faith exemption has to be one of the most fascist laws on the books today. > "the good faith exception to the exclusionary rule supports denial of Maher’s suppression motion because, at the time authorities opened his uploaded file, they had a good faith basis to believe that n…

It is not "you say you thought you could", it is "you have reasonable evidence a crime is happening".

The reasonable here is "google said it", and it was true.

If the police arrive at a house on a domestic abuse call, and hears screams for help, is breaking down the door done in good faith?

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#30

Post by ARandumGuy »

curiousllama wrote: post #6
henryfjordan wrote: post #2

The judge doesn't really understand a hash well. They say things like "Google assigned a hash" which is not true, Google calculated the hash. Also I'm surprised the 3rd-party doctrine doesn't apply. There's the "private search doctrine" mentioned but generally you don't have an expectation of privacy for things you share with Google

Out of curiosity, what is false positive rate of a hash match? If the FPR is comparable to asking a human "are these the same image?", then it would seem to be equivalent to a visual search. I wonder if (or why) human verification is actually necessary here.

Naively, 1/(2^{hash_size_in_bits}). Which is about 1 in 4 billion odds for a 32 bit hash, and gets astronomically low at higher bit counts.

Of course, that's assuming a perfect, evenly distributed hash algorithm. And that's just the odds that any given pair of images has the same hash, not the odds that a hash conflict exists somewhere on the internet.

Post reply on HN