Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

ww3.ca2.uscourts.gov

Post reply on HN
Print view View original

41–50 of 316 posts

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#41

Post by henryfjordan »

duxup wrote: post #32
henryfjordan wrote: post #2

The judge doesn't really understand a hash well. They say things like "Google assigned a hash" which is not true, Google calculated the hash. Also I'm surprised the 3rd-party doctrine doesn't apply. There's the "private search doctrine" mentioned but generally you don't have an expectation of privacy for things you share with Google

Google at some point decided how to calculate that hash and that influences what the value is right? Assigned seems appropriate in that context? Either way I think the judge's wording makes sense.

Google assigned the hashing algorithm (maybe, assuming it wasn't chosen in some law somewhere, I know this CSAM hashing is something the big tech work on together).

Once the hashing algorithm was assigned, individual values are computed or calculated.

I don't think the judge's wording is all that bad but the word "assigned" is making it sound like Google exercised some agency when really all it did was apply a pre-chosen algorithm.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#42

Post by glitcher »

superkuh wrote: post #3

It's crazy that the most dangerous people one regularly encounters can do anything they want as long as they believe they can do it. The good faith exemption has to be one of the most fascist laws on the books today. > "the good faith exception to the exclusionary rule supports denial of Maher’s suppression motion because, at the time authorities opened his uploaded file, they had a good faith basis to believe that n…

And specifically with respect to the law, breaking a law and claiming you didn't know you did anything wrong as an individual is not considered a valid defense in our justice system. This same type of standard should apply even more to trained law enforcement, not less, otherwise it becomes a double standard.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#43

Post by devmor »

vlovich123 wrote: post #5

> As the district court correctly ruled in the alternative, the good faith exception to the exclusionary rule supports denial of Maher’s suppression motion because, at the time authorities opened his uploaded file, they had a good faith basis to believe that no warrant was required So this means this conviction is upheld but future convictions may be overturned if they similarly don't acquire a warrant?

At the time, what they did was assumed to be legal because no one had ruled on it.

Now, there is prior case law declaring it illegal.

The ruling is made in such a way to say “we were allowing this, but we shouldn’t have been, so we wont allow it going forward”.

I am not a legal scholar, but that’s the best way I can explain it. The way that the judicial system applies to law is incredibly complex and inconsistent.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#44

Post by cool_dude85 »

curiousllama wrote: post #6
henryfjordan wrote: post #2

The judge doesn't really understand a hash well. They say things like "Google assigned a hash" which is not true, Google calculated the hash. Also I'm surprised the 3rd-party doctrine doesn't apply. There's the "private search doctrine" mentioned but generally you don't have an expectation of privacy for things you share with Google

Out of curiosity, what is false positive rate of a hash match? If the FPR is comparable to asking a human "are these the same image?", then it would seem to be equivalent to a visual search. I wonder if (or why) human verification is actually necessary here.

The reason human verification is necessary is that the government is relying on something called the "private search" doctrine to conduct the search without a warrant. This doctrine allows them to repeat a search already conducted by a private party (i.e., Google) without getting a warrant. Since Google didn't actually look at the file, the government is not able to look at the file without a warrant, as that search exceeds the scope of the initial search Google performed.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#45

Post by axus »

henryfjordan wrote: post #2

The judge doesn't really understand a hash well. They say things like "Google assigned a hash" which is not true, Google calculated the hash. Also I'm surprised the 3rd-party doctrine doesn't apply. There's the "private search doctrine" mentioned but generally you don't have an expectation of privacy for things you share with Google

There's a password on my Google account, I totally expect to have privacy for anything I didn't choose to share with other people.

The hash is kind of metadata recorded by Google, I feel like Google using it to keep child porn off their systems should be reasonable. Same ballpark as limiting my storage to 1GB based on file sizes. Sharing metadata without a warrant is a different question though.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#46

Post by crooked-v »

naet wrote: post #34

It seems like a large part of the ruling hinges on the fact that Google matched the image hash to a hash of a known child pornography image, but didn't require an employee to actually look at that image before reporting it to the police. If they had visually confirmed it was the image they suspected it was based on the hash then no warrant would have been required, but the judge reads that the image hash match is not…

The hashes involved in stuff like this, as with copyright auto-matching, are perceptual hashes (https://en.wikipedia.org/wiki/Perceptual_hashing), not cryptographic hashes. False matches are common enough that perceptual hashing attacks are already a thing in use to manipulate search engine results (see the example in random paper on the subject https://gangw.cs.illinois.edu/PHashing.pdf).

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#47

Post by henryfjordan »

ARandumGuy wrote: post #30
curiousllama wrote: post #6

Earlier quoted context omitted.

Out of curiosity, what is false positive rate of a hash match? If the FPR is comparable to asking a human "are these the same image?", then it would seem to be equivalent to a visual search. I wonder if (or why) human verification is actually necessary here.

Naively, 1/(2^{hash_size_in_bits}). Which is about 1 in 4 billion odds for a 32 bit hash, and gets astronomically low at higher bit counts. Of course, that's assuming a perfect, evenly distributed hash algorithm. And that's just the odds that any given pair of images has the same hash, not the odds that a hash conflict exists somewhere on the internet.

You need to know the input space as well as the output space (hash size).

If you have a 32bit hash but your input is only 16bit, you'll never have a collision (and you'll be wasting a ton of space on your hashes!).

Image files can get into the megabytes though, so unless the output hash is large the potential for collisions is probably not all that low.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#48

Post by int_19h »

bloopernova wrote: post #40
rmbyrro wrote: post #8

Earlier quoted context omitted.

The harshness of sentence is not for the action of keeping the photos in itself, but the individual suffering and social damage caused by the actions that he incentivizes when he consumes such content.

Respectfully, it's not pornography, it's child sexual abuse material. Porn of/between consenting adults is fine. CSAM and sexual abuse of minors is not pornography. EDIT: I intended to reply to the grandparent comment

Pornography is any multimedia content intended for (someone's) sexual arousal. CSAM is obviously a subset of that.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#49

Post by EVa5I7bHFq9mnYK »

curiousllama wrote: post #6
henryfjordan wrote: post #2

The judge doesn't really understand a hash well. They say things like "Google assigned a hash" which is not true, Google calculated the hash. Also I'm surprised the 3rd-party doctrine doesn't apply. There's the "private search doctrine" mentioned but generally you don't have an expectation of privacy for things you share with Google

Out of curiosity, what is false positive rate of a hash match? If the FPR is comparable to asking a human "are these the same image?", then it would seem to be equivalent to a visual search. I wonder if (or why) human verification is actually necessary here.

I doubt sha1 hashes are used for this. Those image hashes should match files regardless of orientation, cropping, resizing, re-compression, color correction etc. The collision could be far more frequent with these hashes.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#50

Post by tooltower »

naet wrote: post #34

It seems like a large part of the ruling hinges on the fact that Google matched the image hash to a hash of a known child pornography image, but didn't require an employee to actually look at that image before reporting it to the police. If they had visually confirmed it was the image they suspected it was based on the hash then no warrant would have been required, but the judge reads that the image hash match is not…

The hash functions used for these purposes are usually not cryptographic hashes. They are "perceptual hashes" that allows for approximate matches (e.g. if the image has been scaled or brightness-adjusted). https://en.wikipedia.org/wiki/Perceptual_hashing

These hashes are not collision-resistant.

Post reply on HN