Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf] • Hacker News Board

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#211

Post by SauntSolaire » Thu, Oct 31, 2024, 1:10 AM UTC

ok_computer wrote: post #133

startupsfail wrote: post #112

Earlier quoted context omitted.

Wait until Trump is in power and corporations are masterfully using these tools to “mow the grass” (if you want an existing example of this, look at Putin’s Russia, where people get jail time for any pro-Ukraine mentions on social media).

Yeah I’m paranoid like I said, but this case it seems like the hash of a file on google’s remote storage flagged as potential match that was used as justification to request a warrant. That seems common sense and did not involve employees snooping pre-warrant. The Apple CSAM hash detection process, that the launch was rolled back, concerned me namely because it was run on-device with no opt out. If this is running on…

I only worry that, in the case that renting becomes a roundabout way of granting more oversight ability to the government, then as home ownership rates decrease, government surveillance power increases.

Sure, it's facilitated through a third party (the owner), but the extrapolated pattern seems to be: "1. Only people in group B will have fewer rights, so people in group A shouldn't worry" followed closely by "2. Sorry, you've been priced out of group A."

In the case of renting, we end up in the situation where those who have enough wealth to own their own home are afforded extra privileges of privacy.

Now to bring this back to the cloud; the cynical part of me looks towards a future of cheap, cloud-only storage devices. Or an intermediate future of devices where cloud is first party and local storage is just enough of a hassle that people don't use it. And the result is that basically everyone now has the present day equivalent of local storage scanning.

If renting de-facto grants fewer rights, then in the future where "you'll own nothing and be happy", you'll also have no rights, and all the way people will say "as a renter, what did you expect?"

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#212

Post by bluGill » Thu, Oct 31, 2024, 1:20 AM UTC

BlarfMcFlarf wrote: post #162

bluGill wrote: post #81

Earlier quoted context omitted.

No this is breaking the law by saying this looked like one of the situations where I already know the law doesn't apply. If Google had looked at the actual image and said it was child porn instead of just saying it was similar to some image that is child porn this would be 100% legal as the courts have already said. That difference is subtle enough that I can see how someone would get it wrong (and in fact I would ex…

Doesn’t address the point. Does everyone get a good faith exception from laws they don’t know or misunderstand, or just the police?

when the law isn't clear and so reasonable people would understand it as you did you should get a pass.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#213

Post by bluGill » Thu, Oct 31, 2024, 1:22 AM UTC

wonnage wrote: post #104

bluGill wrote: post #66

Earlier quoted context omitted.

It seems like that is very relevant information that was not considered by the court. If this was a cryptographic hash I would say with high confidence that this is the same image and so Google examined it - there is a small chance that some unrelated file (which might not even be a picture) matches but odds are the universe will end before that happens and so the courts can consider it the same image for search purp…

That's the exact conclusion that was reached - the search required a warrant.

the court implied even a hash without collisions would not count when it should.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#214

Post by everforward » Thu, Oct 31, 2024, 1:55 AM UTC

refulgentis wrote: post #199

everforward wrote: post #194

Earlier quoted context omitted.

It would seem that the inverse would need to apply in order for the justice system to have any semblance of impartiality. That is that we now have to let both of them off the hook, since neither had been specifically informed they weren’t allowed to do the thing beforehand. That is why many people think this should be tossed out. Ignorance that an action was a crime is almost never an acceptable defense, so it should…

> we now have to let both of them off the hook, since neither had been specifically informed they weren’t allowed to do the thing beforehand. I'm not trying to be funny, or aggressive, or passive aggressive, seriously: there's two entities in the discussion, the cops, and the person with a photograph with a hash matching child porn. I'm phrasing that as passively as possible because I want to avoid the tarpit of look…

> Do you mean the hash-possessor weren't specifically informed it was illegal to possess said hash?

This is literally the doctrine behind the good faith argument and qualified immunity. If they have not been informed that this specific act, done in this specific way is not allowed then it is largely permissible.

A stupid but equivalent defense from the possessor would be “it’s in Googles possession, not mine, so I had a good faith belief that I did not possess the files”. It’s clearly wrong based on case law, but I wouldn’t expect the average person to have a great grasp of how possession works legally (nor would I claim to be an expert on it).

This is effectively what the good faith doctrine establishes for police, even though they really ought to at least have an inkling given that the law is an integral part of their jobs. As long as they can claim to be sufficiently stupid, it is permissible. That is not extended to the defense, for whom stupidity is never a defense.

> But, no, if the cops in good faith make a mistake, there's centuries of jurisprudence behind not letting people go free for it, not novel with this case.

Acting in good faith would be getting a warrant regardless, because the issue is not that time-sensitive and there are clear ambiguities here. They acted brashly under the assumption that if they were wrong, they could claim stupidity. It encourages the police to push the boundaries of legal behavior, because they still get to keep the evidence even if they are wrong and have committed an illegal search.

It is, yet again, rules for thee but not for me. Frankly, with the asymmetry of responsibility and experience with laws, the police should need to clear a MUCH higher bar to come within throwing distance of “good faith”.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#215

Post by fngjdflmdflg » Thu, Oct 31, 2024, 2:06 AM UTC

Detrytus wrote: post #180

fngjdflmdflg wrote: post #173

>please use the original title, unless it is misleading or linkbait; don't editorialize. (@dang) On topic, I like this quote from the first page of the opinion: >A “hash” or “hash value” is “(usually) a short string of characters generated from a much larger string of data (say, an electronic image) using an algorithm—and calculated in a way that makes it highly unlikely another set of data will produce the same valu…

What's so weird about this? CS literature is not legally binding in any way. Of course a judge would rather quote a previous ruling by fellow judge than a textbook, Wikipedia, or similar sources.

From what I understand, a judge is free to decide matters of fact on his own, which could include from a textbook. Also, it is not clear that matters of fact decided by the Supreme Court are binding to lower courts. Additionally, facts and even meanings of words themselves can change, which makes previous findings of fact no longer applicable. That's actually true in this case as well. "Hash" as used in the context of images generally meant something like an MD5 hash (which itself is now more prone to collisions than before). The "hash" in the Google case appears to be a perceptual hash, which I don't think was as commonly used until recently (I could be wrong here). So whatever findings of fact were made by the Supereme Court about how reliable a hash is is not necessarily relevant to begin with. Looking at this specific case, here is the full quote from United States v. Ackerman:

>How does AOL's screening system work? It relies on hash value matching. A hash value is (usually) a short string of characters generated from a much larger string of data (say, an electronic image) using an algorithm—and calculated in a way that makes it highly unlikely another set of data will produce the same value. Some consider a hash value as a sort of digital fingerprint. See Richard P. Salgado, Fourth Amendment Search and the Power of the Hash, 119 Harv. L. Rev. F. 38, 38-40 (2005). AOL's automated filter works by identifying the hash values of images attached to emails sent through its mail servers.[0]

I don't have access to this issue of Harvard Law Review but looking at the first page, it says:

>Hash algorithms are used to confirm that when a copy of data is made, the original is unaltered and the copy is identical, bit-for-bit.[1]

This is clearly referring to a cryptographic hash like MD5, not a perceptual hash/neural hash as in Google. So the actual source here is not necessarily dealing with the same matters of fact as the source of the quote here (although there could be valid comparisons between them).

All this said, judges feel more confident in citing a Supreme Court case than a textbook because 1. it is easier to understand for them 2. the matter of fact is then already tied to a legal matter, instead of the judge having to make that leap himself and also 3. judges are more likely to read relevant case law to begin with since they will read it to find precedent in matters of law – which are binding to lower courts. This is why a "CS for Judges" could be a useful reference book.

Lastly, I should have looked a bit more closely at the quoted case. This is actually not a supreme court case at all. Gorsuch was nominated in 2017 and this case is from 2016.

[0] https://casetext.com/case/united-states-v-ackerman-12

[1] https://heinonline.org/HOL/LandingPage?handle=hein.journals/...

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#216

Post by programjames » Thu, Oct 31, 2024, 2:30 AM UTC

int_19h wrote: post #185

programjames wrote: post #157

Earlier quoted context omitted.

I think their point was they think the law should be based off of harms, not necessarily "morals" (since no one can seem to decide on those).

GP is saying that people who want this to be a crime are morally outraged that someone else might disagree, and so it's impossible to have a reasonable debate with them about it. They're probably correct, but it never hurts to try.

Oof, I fell victim to Poe's law

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#217

Post by dsubburam » Thu, Oct 31, 2024, 2:41 AM UTC

AcerbicZero wrote: post #135

pdonis wrote: post #110

Earlier quoted context omitted.

> a judge still needs to issue a warrant for the police to actually go and look at the file Only in the future. Maher's conviction, based on the warrantless search, still stands because the court found that the "good faith exception" applies--the court affirmed the District Court's finding that the police officers who conducted the warrantless search had a good faith belief that no warrant was required for the search…

I wonder what happened to fruit of the poisoned tree? Seems a lot more liberty oriented than "good faith exception" when police don't think they need a warrant (because police never seem to "think" they need a warrant).

The opinion says at the time the warrantless search occurred, one appellate court had already held "that no warrant was required in those circumstances" (p 42). Only a year after the search occurred, did another appellate court rule the other way.

This is the main argument that the search met the good faith exception to the exclusionary rule (i.e. the rule that says you have to exclude evidence improperly obtained). This exception is supported in the opinion (at p41) with several citations including United States v. Ganias, 824 F.3d 199, 221–22 (2d Cir. 2016)

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#218

Post by maronato » Thu, Oct 31, 2024, 3:05 AM UTC

anigbrowl wrote: post #163

Well let's look at how this actually played out. - Defendant was in fact sending CP through his gmail. - gmail correctly detects and flags it based on hash value - Google sends message to NCMEC based on hash value - NCMEC sends it to police based on hash value Now police are facing the obvious question, is this actually CP? They open the image, determine it is, then get a warrant to search his gmail account, and (lat…

As many others have said, Google isn’t using a cryptographic hash here. It’s using perceptual hashing, which isn’t collision-safe at all.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#219

Post by anigbrowl » Thu, Oct 31, 2024, 3:07 AM UTC

maronato wrote: post #218

anigbrowl wrote: post #163

Well let's look at how this actually played out. - Defendant was in fact sending CP through his gmail. - gmail correctly detects and flags it based on hash value - Google sends message to NCMEC based on hash value - NCMEC sends it to police based on hash value Now police are facing the obvious question, is this actually CP? They open the image, determine it is, then get a warrant to search his gmail account, and (lat…

As many others have said, Google isn’t using a cryptographic hash here. It’s using perceptual hashing, which isn’t collision-safe at all.

Did you read the whole thing?

and a more detailed examination of common perceptual hashing algorithms (skip to table 3 for the collision probabilities): https://ceur-ws.org/Vol-2904/81.pdf

And there was a whole lot of explanation of how probable cause works and how it's different from programmers' aspirations to perfection.

Re: Google’s TOS doesn’t eliminate a user’s Fourth Amendment rights, judge rules [pdf]

#220

Post by ok_computer » Thu, Oct 31, 2024, 3:20 AM UTC

SauntSolaire wrote: post #211

ok_computer wrote: post #133

Earlier quoted context omitted.

Yeah I’m paranoid like I said, but this case it seems like the hash of a file on google’s remote storage flagged as potential match that was used as justification to request a warrant. That seems common sense and did not involve employees snooping pre-warrant. The Apple CSAM hash detection process, that the launch was rolled back, concerned me namely because it was run on-device with no opt out. If this is running on…

I only worry that, in the case that renting becomes a roundabout way of granting more oversight ability to the government, then as home ownership rates decrease, government surveillance power increases. Sure, it's facilitated through a third party (the owner), but the extrapolated pattern seems to be: "1. Only people in group B will have fewer rights, so people in group A shouldn't worry" followed closely by "2. Sorr…

OK I agree with you about setting a precedent that future storage will be scanned by default. Additionally who will control the reference hash list?, since making one necessitates hashing that illicit material.

I only hope the court systems escalate it and manage to protect free speech or unreasonable search and seizure or self incrimination or whatever if the CSAM hash comparisons are used against political opponents or music piracy or tax evasion or whatever.

Good point.