Parents who use Google Photos, be extremely careful what you upload

The problem here is that this actually was flagged to the human team and they sent it on to the police

It’s not “rapid remedy”, it’s “any remedy” in this situation. The facts are presumably known to everybody, including Google. Nothing illegal happened. And Google has said that the decision is final and can’t be appealed.

My understanding of that is that the humans were mainly verifying the fact that the photo was, in fact, a photo of a naked child (as opposed, perhaps, to a photo of something else the AI mistook for a naked child). At that point they forwarded it.

To me, that part makes sense. You have a photo of a naked kid, you hand it over to law enforcement so the people who actually determine that something illegal is going on can do their job and determine if something illegal is, in fact, going on.

The thing where it all goes pear-shaped is where the police conclude there’s no evidence of any wrongdoing, but the account remains banned with no ability to appeal.

Google’s stated reason for the ban is CSAM. For a photo to be CSAM though, there logically has to be a legal finding of fact - and that doesn’t exist because law enforcement came to the opposite conclusion.

Effectively, Google has asserted their unilateral authority to define something as CSAM, whether or not the legal system agrees.

5 Likes

They just decide with whom they do their business, that’s all!
And I fully understand that, as the customer knew the regulations (or should know them) (and even participated in the development of the software to find pictures like that!) and did not obey them.
Think about, this customer would be allowed back again, then Google has a chance that he is not doing anything like that again. But what happens, if he did it again?
They run thru the same process again? That consumes time, manpower and a lot of money for Google AND the involved authorities!
And thereafter? Do they let him back? And if not, why?
And if they let him back, how many shots should he get?

And if they, after the 3rd, 5th, 10th time just put an sign on his account, that this account just belongs to an person who don’t care for the rules, and is therefore not monitored anymore to avoid the unnecessary extra work and money, what happens if the person thereafter really uses this account for sharing criminal stuff?
What if something like that is be done by purpose (for example by someone who knows the software, and the system behind, very well) to provocate a reaction like this?

Where should be the red line?
Also compared with other things you can do, to violate their Rules?
They need to put up a large chart, where you can see, which rules you can violate how often to be “punished” with certain consequences?
Maybe they needed to implement a Point-System that is often in use, to punish traffic violations?!

How much “Hate” can you upload, to be equal with a picture of a nude child?
How much Spam can you send to be equal?
How often can you bully someone via Google, to equal that?
And so on…!

Google is a private company, who can descide to do business with whoever they want.
And if they don’t want to do so, with someone who violated their rules, and cost them money and Manpower, that is their sole descicion!

You’ve made your position pretty clear above, but you seem to keep assuming facts not in evidence. Google’s TOS bans CSAM explicitly:

CSAM stands for child sexual abuse material. It consists of any visual depiction, including but not limited to photos, videos, and computer-generated imagery, involving the use of a minor engaging in sexually explicit conduct. Our interpretation of CSAM follows the US federal definition of “child pornography.”

But the material in question isn’t CSAM, as determined by the appropriate law enforcement agencies. And if it’s not CSAM, the user didn’t violate Google’s rules. And yet Google has banned them for violating their rules regarding CSAM.

The question has to do with how Google acts when they make a mistake - no matter how well-intentioned.

And the answer is that they don’t seem to care.

Regarding costs to Google, Google has taken on these extra scanning efforts voluntarily, not because they’re required to. I would think the cost of dealing with errors made in the process would have been implicitly assumed to be part of taking on that non-required responsibility, but that’s the thing - Google won’t admit they made a mistake, despite law enforcement concluding otherwise.

Regarding “involved authorities”, as a general legal principle, I’m not aware of any first-world country that considers the cost of investigating false reports as a strike against the person who’s being accused of a crime. So I’m not quite sure where you’re going with the “and the involved authorities” part…?

I would assume he won’t do this inadvertently again, but honestly? Google took upon themselves the activity of scanning. Google’s AI ID’d the material. Google’s human reviewer decided to pass it on to law enforcement. And in the end, they made an objectively-incorrect determination - which they see no reason to correct.

If the guy had posted ACTUAL CSAM, I’d be fine with his account being suspended. But as long as Google keeps getting it wrong, I think the person should get another “shot” every time Google screws up.

There’s an interesting write-up of the legal side of this, in light of US law (which is the applicable governing law for these particular cases) here from Ben Thompson at Stratechery:

Even if you grant the arguments that this awesome exercise of surveillance is warranted, given the trade-offs in question, that makes it all the more essential that the utmost care be taken in case the process gets it wrong. Google ought to be terrified it has this power, and be on the highest alert for false positives; instead the company has gone in the opposite direction, setting itself as judge, jury, and executioner, even when the people we have collectively entrusted to lock up criminals ascertain there was no crime.

3 Likes

False. Google is a publicly traded company.

This isn’t black and white. There are such things as compassion and considering circumstances. After the person being cleared of wrongdoing his account should have been reinstated.

Personally, I think there’s more to the story. Google may have lost the data, or found the process of being reinstated too cumbersome. Sound far fetched? See the recent stories on Facebook having absolutely no idea where data is going…

1 Like

<puts on Political Science hat>
Actually, true. Yes, Google is publicly traded. That doesn’t change the fact that Google is a private company, in the sense that it isn’t a government entity. We can’t make First Amendment claims against Google, for instance.
</removes hat>

I’m in agreement with the rest of what you say. Google are being jerks about this.

(Edited to try putting my fake HTML tags back in after they got stripped out on the first attempt.)

4 Likes

Are you sure about this? Back in the ‘90s I was told that if I found illegal photos on any corporate computer we would have been required to notify the authorities because possession of that type of material was a crime. Google may not be required to do it, but they would almost definitely be criticized for not scanning for it once someone discovered some on one of their servers.

It’s unfortunate that the father is permanently locked out of his account. It may be that Google just doesn’t not want to keep a staff to deal with the all the jurisdictions where their 1.8 billion users reside. Especially for what appears to be a free account. Or, as @acavender so eloquently put it “Google are being jerks about this.”

In any event if he had a good backup this would have been an significant inconvenience rather than a disaster.

There were two people mentioned in the article, at least one of which was a paying user.

And I agree 100% that a good backup would have made it better - but I guess it hinges upon how you define “significant inconvenience”. His phone and email were all through Google, and all were terminated without warning. I realize that you can get a new phone number and a new email, but suddenly losing your primary email address and being unreachable via phone could cause some very severe problems.

I agree with your premise above that people should probably have their own domain-based email accounts. Good luck convincing the average person of that, of course. :slight_smile:

3 Likes

If it happened to me it would be a royal P.I.T.A. But even if I didn’t own my own domain I could have a new phone number and email account in a matter of hours.
(On second thought, shouldn’t he be able to transfer his number to a new carrier?)

And then, if I had a backup of my data, I could start notifying everyone of my new contact info.

If you own a car or a house a responsible person will purchase insurance. If you use computers and mobile devices a responsible person will back up their data.

Just realized I hadn’t commented on this part.

Google checking the data on their servers against the existing publicly-available CSAM hashes is probably (functionally) at the level of “legal requirement” now. And once they found something that they believed to be CSAM, yeah - that would trigger the legal reporting.

But that’s not what the case is here. This is Google’s AI trying to find new (i.e. not already in the database) CSAM, human reviewers making a judgement call about whether a given image is or is not CSAM (having a photo of your own child naked isn’t even close to a de facto crime - it’s about context), and then taking action against the user.

Since the AI-based scanning is voluntary on their part, and they refuse to back down on the judgement call determining the content to be CSAM (which is a legal determination - not something Google can even do), the resulting mess is on them.

This doesn’t negate the fact that having backups is good, trusting Google is a bad idea in general, etc. But It’s its own thing.

By my understanding, not if the number has been terminated and released at the previous carrier. Google’s facilities for doing so are almost certainly part of being able to access your account, which he couldn’t do.

That seems to be the consensus opinion around here. I’ve been using it since '04 and can’t recall having any problems. But I’m sure there must have been a couple of times I couldn’t connect or something.

The way I see it if Google Workspace is approved for doctors, banks, government employees, etc. my stuff should be pretty safe.

Cloud Compliance - Regulations & Certifications | Google Cloud

Yeah, I’ve had a Google account for the longest time and haven’t had any problems either. Which is why I was trying to focus on “trusting Google” rather than “using Google”. It seems to be one of those things that’s generally fine and reliable (and that’s the experience of most users at scale), until all of a sudden for some reason it isn’t. And when it goes sideways, it goes really sideways.

I remember a discussion on here a couple of years back where I was making the argument that files in Google didn’t constitute “a backup” for data retention purposes, and there was at least one ostensibly-tech-savvy person who insisted that Google was a trusted place to put stuff, because they had great backups.

Incidents like this, as you’ve pointed out with backups, illustrate the importance of not having so much implicit trust in third-party platforms. :slight_smile:

3 Likes

For my Doctor routinely the first point of contact is a web form where people detail their symptoms and can attach photos or videos. I think patients dont think and just want to get treated.

As a patient I attach photos routinely to my dermatologist and haven’t seen him face to face for years.

Some years ago my son-in-law asked me to back up his iPhone to my computer. I don’t remember exactly why, he was changing phones or something. What I hadn’t anticipated was that Google scooped up all of the photos on his phone, placing them into my Google Photos account. And there were a lot of photos, none of which were inappropriate, but I certainly wouldn’t purposely have invaded his privacy in this way.

You should have told me that 22 years ago when I got my first home personal computer. Google is a private company, but it also is a monopoly, a potentially malignant one at that. Google has it tentacles wrapped hard around me, and it is going to take me years to get free. And I’m a little bit nerdy. The average user is in a hopeless situation vs. Google and other tech monopolies. I remember back in the day thinking how cool all of this computer/tech stuff was. But today the tech monopolies have become potential monsters with censorship and disregard for their individual users.

In regard to CSAM scanning, maybe it shouldn’t be done. As horrible as child pornography is, I view the issue as similar to that of end-to end encryption of email and text messages. Though terrorists and other miscreants are going to take advantage of it, and I can see that there are two sides to the issue, maybe the privacy and rights of citizens should be a priority. Oppressive government sure would like to know what their citizens are up to.

1 Like

Google has done so, because you let them doing so!

If you had asked my at this time, I would have told you, as I told everybody else who asked me for an advise about that!

And No, Google is not a monopolist!
There are plenty of other solutions to achieve the same goals, with way less “Trading-privacy-for-service” than with Google!
Just because someone don’t want to go away from Google, does not mean he could not do so…!
Google, and similar companies, is doing what they are doing, because there are enough people out there, who let them do so!
If nobody would use their services under the current conditions, they would significantly change their behavior, but at this time, there is no need for them, to do so.

As far as I know Google Search and Google Maps have no peers.

I have been using Google Mail for many years. I now have my own domain, but changing all of the email addresses that I have with various websites is going to take a long time.

I use Google Photos as a backup. Yes, I do need to just bite the bullet, and take time to get rid of it. But I have to be very careful that I don’t loose photos.

I stopped using Google Drive some time ago, excepting for an occasional file exchange with another user.

The rest of Google I can do without.

Suggestions for alternatives would be welcome.

I hope that the other tech (nonmonoplies?) treat us better than does Google.

1 Like

IMO, that’s going to be difficult because . .

Your choices are pretty much Google Search or sites like Yahoo!, AOL, DuckDuckGo, Ecosia, MSN, Lycos, and Search.com that offer results from Bing (some also include results from a few speciality search engines).

Search Engine Market Share Worldwide | Statcounter Global Stats

Apple Maps is probably your best alternative to Google Maps but there are others such as Bing Maps and MapQuest. Apple Maps is an excellent choice if it covers the areas that you need.

1 Like

What is this “wait 4 hours” all about?

Some contentious threads get tagged with this to reduce rapid fire back and forth that sometimes occurs when folks get riled up and angry. :slightly_smiling_face:

1 Like

In light of the article linked in the first post, I’ve decided to limit my online visibility severely again. This is a long pattern with me of self-censorship of what I write on the internet, ever since I realized in the late 90’s that the very nature of how the lower OSI layers work meant that there can be no online privacy. (Packets sent over the internet include the sender’s and the destination’s IP address.)

I can be a little more lenient with forum posts; I need to communicate with my peers, but I always watch what I say when I post.

Most emails are now archived in DT, Apple Photos have been reduced to 65 from 528. Corporate sync services are treated as device data transfer services only, with contents removed to local storage as soon as practicable. EDIT: I’m using webDAV from my email provider, but at some point to be consistent, I’m going to have to self-host my own webDAV instance, which I dread doing.

Additional content added to the original post:

I guess I’m getting pessimistic the more I read cloud storage ToC’s, but it sure looks like they aren’t a safe place to store digital content, especially if you mix your created content with copies of other people’s content from the web. Why would a user store copies of other people’s content from the web? Because the web is ephemeral and content can at any time be inaccessible for whatever reason, and sometimes one may not have internet access. Bookmarks aren’t always sufficient.

Also, there is the chance that one piece of content might be deemed “inappropriate” by the owner of the cloud sync service, and they might, without redress, delete your entire account, and thence, a good chunk of your digital life. This has happened recently, and it will happen again.

I wanted to store my music into a sync service, for backup, and not sync it to a local device. The more I read, the more I learned that I just couldn’t justify doing it from a legal basis, even though I’d never share copyrighted information with anyone else. I know better. Even with an end to end encrypted zero knowledge service like MEGA, it isn’t legally possible. This may seem far-fetched and I am not a lawyer, but it feels like companies have to mandate the ability to file share, so that the authorities can prohibit cloud storage services from storing copyrighted information there. At the extreme, who in authority wants the dark web?

And then there is the fact that sync is always online and active. The sync service online recycle bin might be emptied inadvertently or might not work reliably. I had this happen to a client of mine in the past month. Any sync service should never be considered as the sole fount of one’s files, even if there is a reliably synced local copy on a device one owns themselves. The sync service can always delete files from that local copy.

I will assert that backup is offline and disconnected except at the time of backup. NAS systems, unless they can be dismounted, are still online and thus, somewhat vulnerable. (I’m going to get flamed on this last point; I know I am. Teach me on alternative ways to think about NAS systems.) I still think that even NAS systems need backups. OTOH, I’m not a data hoarder, far from it, but I have read about data hoarders and it might be very impractical to have a backup of everything.