Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

ww3.ca2.uscourts.gov

Post reply on HN
Print view View original

71–80 of 316 posts

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#71

Post by [deleted] »

cool_dude85 wrote: post #57
axus wrote: post #45

Earlier quoted context omitted.

There's a password on my Google account, I totally expect to have privacy for anything I didn't choose to share with other people. The hash is kind of metadata recorded by Google, I feel like Google using it to keep child porn off their systems should be reasonable. Same ballpark as limiting my storage to 1GB based on file sizes. Sharing metadata without a warrant is a different question though.

As should be expected from the lawyer world, it seems like whether you have an expectation of privacy using gmail comes down to very technical word choices in the ToS, which of course neither this guy nor anyone else has ever read. Specifically, it may be legally relevant to your expectation of privacy whether Google says they "may" or "will" scan for this stuff.

[deleted]

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#72

Post by NoMoreNicksLeft »

shadowgovt wrote: post #18
rmbyrro wrote: post #8

Earlier quoted context omitted.

The harshness of sentence is not for the action of keeping the photos in itself, but the individual suffering and social damage caused by the actions that he incentivizes when he consumes such content.

It's a reasonable argument, but a concerning one because it hinges on a couple of layers of indirection between the person engaging in consuming the content and the person doing the harm / person who is harmed. That's not outside the purview of US law (especially in the world post-reinterpretation of the Commerce Clause), but it is perhaps worth observing how close to the cliff of "For the good of Society, you must b…

> The FBI says yes to both in spite of the fact that we can name no

They have two arguments for this (that I am aware of). The first argument is a practical one, that AI-generated images would be indistinguishable from the "real thing", but that the real thing still being out there would complicate their efforts to investigate and prosecute. While everyone might agree that this is pragmatic, it's not necessarily constitutionally valid. We shouldn't prohibit activities based on whether these activities make it more difficult for authorities to investigate crimes. Besides, this one's technically moot... those producing the images could do so in such a way (from a technical standpoint) that they were instantly, automatically, and indisputably provable as being AI-generated.

All images could be mandated to require embedded metadata which describes the model, seed, and so forth necessary to regenerate it. Anyone who needs to do so could push a button, the computer would attempt to regenerate the image from that seed, and the computer could even indicate that the two images matched (the person wouldn't even need to personally view the image for that to be the case). If the application indicated they did not match, then authorities could investigate it more thoroughly.

The second argument is an economic one. That is, if a person "consumes" such material, they increase economic demand for it to be created. Even in a post-AI world, some "creation" would be criminal. Thus, the consumer of such imagery does cause (indirectly) more child abuse, and the government is justified in prohibiting AI-generated material. This is a weak argument on the best of days... one of the things that law enforcement efforts excel at is just this. When there are two varieties of a behavior, one objectionable and the other not, but both similar enough that they might at a glance be mistaken for one another, is that it can greatly disincentivize one without infringing the other. Being an economic argument, one of the things that might be said is that economic actors seek to reduce their risk of doing business, and so would gravitate to creating the legal variety of material.

While their arguments are dumb, this filth's as reprehensible as anything. The only question worth asking or answering is, were (AI-generated) it legal, would it result in fewer children being harmed or not? It's commonly claimed that the easy availability of mainstream pornography has reduced the rate of rape since the mid-20th century.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#73

Post by gcbirzan »

jjk7 wrote: post #63
gcbirzan wrote: post #62

Earlier quoted context omitted.

Is it reasonable? Even if the hash was md5, given valid image files, the chances of it being an accidental collision are way lower than the chance of any other evidence given to a judge was false or misinterpreted.

Yes. How else would you prevent framing someone?

So you're saying that I craft a file that has the same hash as a CSAM one, I give it to you, you upload it to google, but it also happens to be CSAM, and I've somehow framed you?

My point is that a hash (granted, I'm assuming that we're talking about a cryptographic hash function, which is not clear) is much closer to "This is the file" than someone actually looking at it, and that it's definitely more proof of them having that sort of content than any other type of evidence.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#74

Post by bluGill »

nordsieck wrote: post #31
vlovich123 wrote: post #5

> As the district court correctly ruled in the alternative, the good faith exception to the exclusionary rule supports denial of Maher’s suppression motion because, at the time authorities opened his uploaded file, they had a good faith basis to believe that no warrant was required So this means this conviction is upheld but future convictions may be overturned if they similarly don't acquire a warrant?

> the good faith exception to the exclusionary rule supports denial of Maher’s suppression motion because, at the time authorities opened his uploaded file, they had a good faith basis to believe that no warrant was required This "good faith exception" is so absurd I struggle to believe that it's real. Ordinary citizens are expected to understand and scrupulously abide by all of the law, but it's enough for law enfor…

The courts accept good faith arguments at times. They will give reduced sentences or even none at all if they think you acted in good faith. There are enough situations where it is legal to kill someone that there are laws to make it clear that is a legal situation where one person can kill another (hopefully they never apply to you).

Note that this case is not about ignorance of the law. This is I knew the law and was trying to follow it - I just honestly thought it didn't apply because of some tricky situation that isn't 100% clear.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#75

Post by ndriscoll »

cool_dude85 wrote: post #39
gorjusborg wrote: post #24

Earlier quoted context omitted.

> Out of curiosity, what is false positive rate of a hash match? No way to know without knowledge of the 'proprietary hashing technology'. Theoretically though, a hash can have infinitely many inputs that produce the same output. Mismatching hash values from the same hashing algorithm can prove mismatching inputs, but matching hash values don't ensure matching inputs. > I wonder if (or why) human verification is actu…

I'd say the focus on hashing is a bit of a red herring. Most anyone would agree that the hash matching should probably form probable cause for a warrant, allowing a judge to sign off on the police searching (i.e., viewing) the image. So, if it's a collision, the cops get a warrant and open up your linux ISO or cat meme, and it's all good. Probably the ideal case is that they get a warrant to search the specific image…

If the hash algorithm were CRC8, then obviously it should not be probable cause for anything. If it were SHA-3, then it's basically proof beyond reasonable doubt of what the file is. It seems reasonable to question how collisions behave.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#76

Post by fear-anger-hate »

rmbyrro wrote: post #8
MathMonkeyMan wrote: post #4

The Fourth Amendment didn't help here, unfortunately. Or, perhaps fortunately. Still, 25 years for possessing kiddie porn, damn.

The harshness of sentence is not for the action of keeping the photos in itself, but the individual suffering and social damage caused by the actions that he incentivizes when he consumes such content.

Assuming the person is a passive consumer with no messages / money exchanged with anyone, it is very hard to prove social harm or damage. Sentences should be proportional to the crime. Treating possession of cp as equivalent of literally raping a child just seems absurd to me. IMO, just for the legal protection of the average citizen, a simple possession should never warrant jail time.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#77

Post by int_19h »

nokcha wrote: post #23
curiousllama wrote: post #6

Earlier quoted context omitted.

Out of curiosity, what is false positive rate of a hash match? If the FPR is comparable to asking a human "are these the same image?", then it would seem to be equivalent to a visual search. I wonder if (or why) human verification is actually necessary here.

For non-broken cryptographic hashes (e.g., SHA-256), the false-positive rate is negligible. Indeed, cryptographic hashes were designed so that even nation-state adversaries do not have the resources to generate two inputs that hash to the same value. See also: https://en.wikipedia.org/wiki/Collision_resistance https://en.wikipedia.org/wiki/Preimage_attack

These are not the kinds of hashes used for CSAM detection, though, because that would only work for the exact pixel-by-pixel copy - any resizing, compression etc would drastically change the hash.

Instead, systems like these use perceptual hashing, in which similar inputs produce similar hashes, so that one can test for likeness. Those have much higher collision rates, and are also much easier to deliberately generate collisions for.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#78

Post by ninalanyon »

> the private search doctrine, which authorizes a government actor to repeat a search already conducted by a private party without securing a warrant.

IANAL, etc. Does that mean that if someone breaks in to your house in search of drugs, finds and steals some, and is caught by the police and confesses all that the police can then search your house without a warrant?

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#79

Post by aiforecastthway »

jjk7 wrote: post #64
kulahan wrote: post #21

Earlier quoted context omitted.

I'm trying to imagine a more "real-world" example of this to see how I feel about it. I dislike that there is yet another loophole to gain access to peoples' data for legal reasons, but this does feel like a reasonable approach and a valid goal to pursue. I guess it's like if someone noticed you had a case shaped exactly like a machine gun, told the police, and they went to check if it was registered or not? I suppos…

It's like a digital 'smell'; Google is a drug sniffing dog.

I don't think the analogy holds for two reasons (which cut in opposite directions from the perspective of fourth amendment jurisprudence, fwiw).

First, the dragnet surveillance that Google performs is very different from the targeted surveillance that can be performed by a drug dog. Drug dogs are not used "everywhere and always"; rather, they are mostly used in situations where people have a less reasonable expectation of privacy than the expectation they have over their cloud storage accounts.

Second, the nature of the evidence is quite different. Drug-sniffing dogs are inscrutable and non-deterministic and transmit handler bias. Hashing algorithms can be interrogated and are deterministic and do not have such bias transferal issues; collisions do occur, but are rare, especially because the "search key" set is so minuscule relative to the space of possible hashes. The narrowness and precision of the hashing method preserves most of the privacy expectations that society is currently willing to recognize as objectively reasonable.

Here we get directly to the heart of the problem with the fictitious "reasonable person" used in tests like the Katz test, especially in cases where societal norms and technology co-evolve at a pace far more rapid than that of the courts.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#80

Post by NoMoreNicksLeft »

cool_dude85 wrote: post #39
gorjusborg wrote: post #24

Earlier quoted context omitted.

> Out of curiosity, what is false positive rate of a hash match? No way to know without knowledge of the 'proprietary hashing technology'. Theoretically though, a hash can have infinitely many inputs that produce the same output. Mismatching hash values from the same hashing algorithm can prove mismatching inputs, but matching hash values don't ensure matching inputs. > I wonder if (or why) human verification is actu…

I'd say the focus on hashing is a bit of a red herring. Most anyone would agree that the hash matching should probably form probable cause for a warrant, allowing a judge to sign off on the police searching (i.e., viewing) the image. So, if it's a collision, the cops get a warrant and open up your linux ISO or cat meme, and it's all good. Probably the ideal case is that they get a warrant to search the specific image…

> Most anyone would agree that the hash matching should probably form probable cause for a warrant

I disagree with this. Yes, if we were talking MD5, SHA, or some similar true hash algo, then the probability of a natural collision is small enough that I agree in principle.

But if the hash algo is of some other kind then I do not know enough about it to assert that it can justify probable cause. Anyone who agrees without knowing more about it is a fool.

Post reply on HN